Setting up and configuring Intel AMT in HP Business Notebooks, Desktops, and Workstations - Technical white paper

Setting up and configuring Intel AMT
Before it can be used, Intel AMT must be setup and configured, which involves the following activities:
• Setup – Generally performed once in the lifetime of a system, Intel AMT setup involves the steps necessary to enable Intel
AMT, such as setting up the system and enabling network connectivity. After Intel AMT has been enabled, it can be
discovered by management software over a network.
• Configuration – After setting up Intel AMT, you can now configure a range of options that may be changed many times
over the system’s lifecycle, such as enabling the system for Serial-Over-LAN (SOL) or IDE-Redirect (IDE-R). Changes can
be made to the system locally or through a remote console.
Setup and configuration phases
The setup and configuration process involves the following phases:
• Factory
In Factory phase, the system is initially as received from the factory; no Intel AMT setup and configuration has been
performed. In this phase, you can only access Intel AMT locally, through the Intel Management Engine BIOS Extension
(MEBx).
3
Factory phase ends when the following occurs:
– Manual mode – You have changed the default password.
– Enterprise mode – You have changed the default password and set the Provisioning ID (PID) and Provisioning
Passphrase (PPS).
• In-Setup
The In-Setup phase is used to set most Intel AMT options,
4
either manually or automatically, using an SCS.
• Operational
The Operational phase is the final phase. Intel AMT has been fully setup and configured, making the system ready for
normal use.
Manual mode setup and configuration
The Manual mode for Intel AMT setup and configuration is intended for customers that do not have an SCS or the necessary
network and security infrastructures to use encrypted Transport Layer Security (TLS). Here, setup and configuration is
performed manually through the MEBx.
Because less infrastructure is required, Manual mode is easier to implement than Enterprise mode; however, Manual mode
is less secure because network traffic is unencrypted.
Note
HP recommends performing a Manual mode setup and configuration in a closed network.
The remainder of this section provides prerequisites and guidelines for Manual mode setup and configuration.
Note
The MEBx is not HP-specific and contains options that are not used by HP. Do not change unused options from their default
state.
3
The MEBx is an optional ROM module that is provided by Intel to HP for inclusion in the HP system BIOS.
4
This process is also known as provisioning.
4