vPro Setup and Configuration for the dc7800p Business PC with Intel vPro Processor Technology

ManualsBrandsHP ManualsDesktopsHP Compaq dc7800 Small Form Factor PC

Table Of Contents

vPro Setup and Configuration for the dc7800p Business PC

with Intel vPro Processor Technology

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3

AMT Setup and Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

AMT System Phases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4

SMB Mode - AMT Setup and Configuration with MEBx . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

SMB Mode - AMT Setup and Configuration Steps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

Intel AMT WebGUI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Connecting with the Intel AMT WebGUI - SMB Example . . . . . . . . . . . . . . . . . . . . . . . . . 14

Setup and Configuration Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

Setup and Configuration Server Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

Enterprise Mode Setup and Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Enterprise Mode - AMT Setup and Configuration Steps . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Provisioning Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24

Legacy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

IT TLS-PSK . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

OEM TLS-PSK . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

USB Drive Key Set Up and Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .25

USB Drive Key Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Remote Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Remote Configuration: Bare-Metal vs. Delayed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Remote Configuration Time-outs in HP Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

Remote Configuration Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .28

MEBx and Hashes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

List of Supported CA Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

Return to Default . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .31

Full Return to Factory Defaults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .32

Appendix A: Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

Appendix B: Power / Sleep / Global States Explained . . . . . . . . . . . . . . . . . . . . . . . . . . . . .34

Appendix C: Wake-On-ME Explained . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Summary of content (34 pages)

PAGE 1
vPro Setup and Configuration for the dc7800p Business PC with Intel vPro Processor Technology Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 AMT Setup and Configuration . . . . . . . . . . . . . . . . . . . . AMT System Phases . . . . . . . . . . . . . . . . . . . . . . . . . SMB Mode - AMT Setup and Configuration with MEBx SMB Mode - AMT Setup and Configuration Steps . . . . .. .. .. .. .. .. .. .. . . . . .. .. ..
PAGE 2
Introduction The HP Compaq dc7800p Business PC uses Intel vPro processor technology* to simplify PC management and reduce IT-related expenditures. Intel vPro processor technology is a combination of Active Management Technology (AMT) and Intel Virtualization Technology (VT), which allows for improved management of PC systems and enhanced security. This white paper assumes some basic knowledge of Intel AMT and Intel VT.
PAGE 3
AMT Setup and Configuration AMT Setup involves the necessary steps to enable AMT such as setting up the system for AMT mode and enabling network connectivity. This setup is generally performed only once in the lifetime of a system. When AMT is enabled, it can be discovered by management software over a network. AMT Configuration sets up all other AMT options not covered in AMT Setup, such as enabling the system for Serial-Over-LAN (SOL) or IDE-Redirect (IDE-R).
PAGE 4
Passwords must: • Be between 8 and 32 characters long. • Contain both upper and lower case Latin characters (e.g. A, a, B, b). • Have at least one digit character (e.g. 0, 1, 2, … 9). • Have at least one 7-bit ASCII non-alphanumeric character with an ASCII value between 33d and 126d that is not part of the invalid character list below.
PAGE 5
For best performance and to take advantage of AMT 2.2 features, make sure HP Compaq dc7700p Business PCs have a BIOS revision of at least version 3.03, an ME firmware of at least version 2.2.1.1034, and a MEBx of at least version 2.1.4.000. Updating an HP Compaq dc7700p system from AMT 2.0 or 2.1 to AMT 2.2 by flashing the BIOS will install five Verisign certificates so the system can be used in Remote Configuration. Using Remote Configuration on an HP Compaq dc7700p system that has been updated to AMT 2.
PAGE 6
Change the password to establish AMT ownership. The system will go from Factory phase to In-Setup phase. The ME and AMT options within the MEBx are accessible and you can access the system using the AMT WebGUI. 4. Select the Intel ME Platform Configuration. A window displays indicating that the system resets after configuration. 5. Select Y. ME platform configuration allows IT personnel to configure ME features such as AMT/ASF selection, power options, firmware update capabilities, and so on.
PAGE 7
whether ME firmware local updates are allowed. "Never Open" ignores what is set in the system BIOS and follows the Intel ME Firmware Local Update option. "Restricted" ignores what is set in the system BIOS and allows local ME firmware updates until the ME is configured. Never Open Restricted ME Firmware Local Update Enabled Local ME firmware updates allowed. Local ME firmware updates allowed. ME Firmware Local Update Disabled Local ME firmware updates NOT allowed.
PAGE 8
9. Select Intel ME Power Control. Figure 4 Intel ME Power Control Screen a. Select Intel ME ON in Host Sleep States, and then select Desktop:ON in S0, S3, ME WoL in S3, S4-5, OFF After Power Loss. Default Setting = Desktop: ON in S0, Recommended Setting = Desktop: ON is S0, S3, ME WoL in S3, S4-5, OFF After Power Loss This option sets the ME power policy when the system is in a sleep state (Sx) and when returning from a G3 power loss.
PAGE 9
ME ON in Host Sleep State ME Behavior Option 6 ME is ON at all times S0, S3, S4, and S5. ME will not automatically initialize after recovering from a G3 power loss. Option 7 ME is ON only when the system is in S0. It will be asleep in S3 - S5 unless it is called upon. Timer for ME sleep is set by the Idle Timeout option. ME will not automatically initialize after recovering from a G3 power loss.
PAGE 10
NOTES: Spaces are not accepted in the host name. Make sure there is not a duplicate host name on the network. You can use host names in place of the system’s IP for any applications requiring the IP address. 15. Select TCP/IP. a. Select Disable Network Interface, and then select N. Default Setting = Network Interface Enabled, Recommended Setting = Network Interface Enabled If the network is disabled, then all remote AMT capabilities are disabled and TCP/IP settings are not necessary.
PAGE 11
The domain name is blank by default. If not populated, then the default domain of “Provisionserver” is used when connecting to a Setup and Configuration Server. If the name of the S&CS is not “Provisionserver” and the domain name is blank, then an alias must be set up in the DHCP server to redirect the connection for "Provisionserver" to the proper S&CS domain name. If the Domain Name field is populated, that is the domain used.
PAGE 12
d. Select IDE Redirection, and then select Enabled. Default Setting = Enabled, Recommended Setting = Enabled This option enables/disables IDE Redirection (IDE-R) functionality. 20. Select Secure Firmware Update, and then select Enabled. Default Setting = Enabled, Recommended Setting = Enabled This option enables/disables the ability to remotely update the ME firmware. 21. Skip Set PRTC. Default Setting = None, Recommended Setting = Current Date and Time This option sets the PRTC (Protected Real Time Clock).
PAGE 13
The AMT WebGUI is accessible from the following Web Browsers: • Microsoft Internet Explorer 6 SP1 or newer • Netscape Navigator 7.1 or newer • Mozilla Firefox 1.0 or newer • Mozilla 1.7 or newer Limited remote system management includes: • Hardware inventory • Event logging • Remote system reset • Changing of network settings • Addition of new users and passwords • Updating ME firmware WebGUI support is enabled by default for SMB Setup and Configured systems.
PAGE 14
4. Type the user name and password. The default username is admin and the password is what you set during AMT Setup in the MEBx. Figure 6 Intel AMT WebGUI Screen 5. Review system information and/or make any necessary changes. NOTE: You can change the MEBx password for the remote system in the WebGUI. Changing the password in the WebGUI or a remote console results in two passwords. The new password, known as the “remote” MEBx password, only works remotely with the WebGUI or remote console.
PAGE 15
Setup and Configuration Server A Setup and Configuration Server (SCS) is an application that executes over a network performing AMT Setup and Configuration. It is required for Enterprise mode setup and configuration. In a PSK Setup and Configuration, both the AMT client system and the SCS must share a set of Provisioning ID (PID) and Provisioning Passphrase (PPS). This pair forms a Pre-Shared Key (PSK). PIDs are 8 characters and PPS are 32 characters.
PAGE 16
Enterprise Mode Setup and Configuration Enterprise mode is for large corporate customers. An SCS is required for Enterprise mode Setup and Configuration. The SCS is also known as a Provisioning Server as seen in the MEBx. Enterprise Mode - AMT Setup and Configuration Steps The AMT Setup portion for Enterprise mode is the same as SMB mode. Repeat Steps 1 through 15 to perform AMT Setup. This will take the system from Factory Mode to In Setup Mode.
PAGE 17
12. Select Intel AMT Configuration. The Intel AMT Configuration screen includes numerous options, which are available by scrolling down the menu. Figure 7 Intel AMT Configuration Screen Figure 8 Intel AMT Configuration Screen Continued 13. Select Host Name, and then type a host name Default Setting = HPSystem, Recommended Setting = User Dependent Spaces are not accepted in the host name.
PAGE 18
14. Select TCP/IP. a. Select Disabling Network Interface, and then select N. Default Setting = Network Interface Enabled, Recommended Setting = Network Interface Enabled If network is disabled, then all remote AMT capabilities are disabled and TCP/IP settings will not be necessary. This option is a toggle, and the next time you access it you are prompted with the opposite setting. b. Select DHCP Disable, and then select N.
PAGE 19
This option shows the current provisioning TLS mode. The three options are: None, PKI, and PSK. This option is only for display, no changes can be made here. b. Select Provisioning Record. Default Setting = Not Present This option shows provision record data of the system.
PAGE 20
d. Select TLS PSK. Figure 10 Intel TLS PSK Configuration Screen i. Select Set PID and PPS. This option is for Provisioning ID (PID) and Provisioning Passphrase (PPS) entry. PIDs are 8 characters and PPS are 32 characters. There are dashes between every set of four characters so counting dashes, PIDs are 9 characters and PPS are 40 characters. They must be generated by an SCS. The Admin Password, PID, and PPS can be pre-populated by HP during manufacturing. Go to the OEM TLS-PSK section for details. ii.
PAGE 21
19. Select SOL/IDE-R, and then select Y. a. A message window indicates that the system resets after configuration. b. Select Username and Password, and then select Enabled. Default Setting = Enabled, Recommended Setting = Enabled This option allows you to add users and passwords from the WebGUI. If the option is disabled, then only the administrator has MEBx remote access. c. Select Serial Over LAN, and then select Enabled. Default Setting = Enabled, Recommended Setting = Enabled d.
PAGE 22
26. Plug the system into a power source and connect the network. Use the integrated Intel 82566DM NIC. Intel AMT does not work with any other NIC solution. When power is reapplied to the system, the system immediately looks for a Setup and Configuration Server. If the system finds this server, the AMT system will send a “Hello” message to the server. DHCP and DNS must be available for the Setup and Configuration Server search to automatically succeed.
PAGE 23
Provisioning Methods There are three methods of provisioning a system with Enterprise mode: • Legacy • IT TLS-PSK • OEM TLS-PSK Legacy If you want TLS, execute legacy method of AMT set up and configuration on an isolated network separate from the corporate network. An S&CS server requires a secondary network connection to Certification Authority for TLS configuration. Customers perform legacy AMT set up and configuration. The customer initially receives systems in the Factory phase with AMT disabled.
PAGE 24
Alternatively, the customer can provide HP with their own Administrator password, PID, and PPS to use for the order, which HP will use to bring the systems into the In-Setup phase. In the second stage, the customer receives the In-Setup systems and the PID, PPS, and password information. The PID, PPS, and password information is integrated into the customer S&CS. The In-Setup systems are then connected to the network and powered on. Enterprise Mode - AMT Configuration occurs.
PAGE 25
7. The system BIOS displays a message that automatic setup and configuration will occur. a. The first available record in the Setup.bin is read into memory. The process: i. Validates the file header record. ii. Locates the next available record. iii. Invalidates current record so it cannot be used again. b. The process places the memory address into the MEBx parameter block. c. The process calls MEBx. 8. MEBx processes the record. 9. MEBx writes a completion message to display. 10.
PAGE 26
RCFG relies on several new AMT features: • Embedded Hash Root Certificates • Self Signed Certificate • One-Time Password • Timed network access One or more hash root certificates are embedded into the AMT firmware. These certificates are integrated into the Hello messages sent by the AMT system to the SCS. The SCS must have compatible certificates to authenticate the AMT system. A self signed certificate can be generated to create a secure connection between the AMT system and the SCS.
PAGE 27
Remote Configuration Time-outs in HP Systems The HP Compaq dc7800p Business PCs are AMT 3.0 compliant. They are shipped out of the factory in Bare-Metal mode with the ME set to broadcast Hello messages for 255 hours when the ME is active and the system is connected to a network. The HP Compaq dc7700p Business PCs that are AMT 2.2 compliant will be shipped out of the factory in Delayed mode. When initiated by a remote console, Hello messages are broadcast for 6 hours.
PAGE 28
4. Select TLS PKI. Figure 11 Intel Remote Configuration Screen 1. Select Remote Configuration Enable/Disable. Default Setting = Enabled, Recommended Setting = Enabled This option enables or disables remote configuration. 2. Skip Manage Certificate Hashes. This option shows the hashes in the system, including the name of the hash and whether it is active. If no hashes are in the system, then an option to add one is available. If hashes are available, then an option to delete one or more is available.
PAGE 29
List of Supported CA Certificates The following list provides supported Certificate Authorities and certificates. Not all certificates are populated in certain configurations.
PAGE 30
Return to Default Return to Default is also know as Unprovisioning. An AMT Setup and Configured system can be unprovisioned. It is done through the AMT Configuration Screen and the Un-Provision option. Figure 12 Intel AMT Unprovisioning Screen Depending on how the system was previously provisioned, one or both unprovisioning options may appear. 1. Select Un-Provision, and then select the appropriate unprovision mode. After about one minute, an unprovisioning message displays.
PAGE 31
Full Return to Factory Defaults All AMT settings can be returned to the factory default by clearing CMOS. This includes resetting the password to the default “admin”. However, setting in the ME such as the ME Power Settings will not be reset. Those settings must be manually reset to the default for the system to be in a true factory default state. The system will need to be set up and configured again before remote management is possible. Any nondefault certificate hashes will have to be re-applied.
PAGE 32
Q: Why does a new password set with the WebGUI cannot be used locally in the MEBx? A: A password set with the WebGUI is a remote password and will only work when accessing the MEBx remotely. It does not work with the MEBx locally. The local password must be used to locally access the MEBx. Q: Is TLS required? A: No. TLS is optional. Q: If TLS is not used, then what is used? A: HTTP Digest will be used for mutual authentication if TLS is not used.
PAGE 33
Appendix B: Power / Sleep / Global States Explained A computer can be in one of several power states under the Advanced Configuration and Power Interface (ACPI) specification. These power states are also known as Sleep (Sx) states or Global (Gx) states. • S0 is the ON state. The computer is fully functioning. All system devices and operating system, if available, are running. S0 is also known as G0. • S3 is the Standby (Microsoft terminology) or Suspend-to-RAM state.
PAGE 34
Appendix C: Wake-On-ME Explained Wake-On-ME, also known as ME WoL, is a feature that allows the ME to go into a low power state when it is not used. There are three conditions that must be met for Wake-On-ME to function. • The system is in a sleep state: S3, S4, or S5. • ME On in Host Sleep State setting is set to allow ME WoL. • Idle Timeout setting is set to a non-zero value. The system must be in a sleep state (S3, S4, or S5) for Wake-On-ME to function.