vPro Setup and Configuration for the dc7700 Business PC with Intel vPro Technology Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 AMT Setup and Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 AMT System Phases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Introduction The HP Compaq dc7700p Business PC uses Intel vPro technology to simplify PC management and reduce IT-related expenditures. Intel vPro technology is a combination of Active Management Technology (AMT) and Intel Virtualization Technology (VT), which allows for improved management of PC systems and enhanced security. This white paper assumes some basic knowledge of Intel AMT and Intel VT.
The In-Setup phase is the next stage and is where most AMT options are set. This can be a manual or automated procedure with a Setup and Configuration Server. The Operational phase is the final stage in which AMT is fully setup and configured in the system and ready for normal use. SMB Mode - AMT Setup and Configuration with MEBx SMB mode is for customers who do not have ISV management consoles, or the necessary network and security infrastructures to use encrypted Transport Layer Security (TLS).
• Greater than > • Less than < • Colon • Ampersand • Space : & BIOS Prerequisite This white paper is for use with HP Compaq dc7700p Business PCs. For best performance and to take advantage of AMT 2.1 features, insure the PCs have a BIOS revision of at least version 2.09 and a ME firmware of at least 2.1.0.1031. You must update the system BIOS and the ME firmware individually. Updating the ME firmware will clear AMT settings and the system will have to be set up and configured again.
2. Type the default password, which is admin. Passwords are case-sensitive. NOTE: You must change the default password before making changes to the MEBx options. 3. Change the MEBx password. The new password must meet the Strong Password criteria defined in the Password Guidelines Section. Type the password twice for verification. Change the password to establish AMT ownership. The system will go from Factory phase to In-Setup phase.
"Always Open" is the default and allows for as many local updates as the system BIOS allows, which is unlimited. Choosing Never Open or Restricted adds the Intel ME Firmware Local Update option, which can be set to Enable or Disable. By default it is Disabled. This option, along with the Qualifier, dictates whether ME local updates are allowed. "Never Open" ignores what is set in the system BIOS and follows the Intel ME Firmware Local Update option.
Figure 3 Intel ME Features Control Screen with AMT selected b. Skip Intel Quiet Systems Technology. Default Setting = Disabled, Recommended Setting = Disabled Intel Quiet System Technology is used for fan speed control. It is not used on the HP Compaq dc7700 systems because the HP system BIOS already implements excellent fan speed controls. c. Select Return to the previous menu. 10. Select Intel ME Power Control.
a. Select ME State upon Initial Power-On, and then select On. Default Setting = Off, Recommended Setting = On This option sets the behavior of the ME when the system comes out of a G3 state (Mechanical Off - power outage or power cord removed). If set to ON, the ME will try to automatically power up the system and obtain memory. Use this option with the ME ON Host Sleep States option. By default this option is set to OFF because of E-Star power regulatory requirements.
Systems with After Power Loss set to ON in F10 BIOS will remain ON and proceed to boot to the operating system. Systems with After Power Loss set to OFF in F10 BIOS will shut down after the ME obtains system memory. This option must be set to Always for Wake-On-ME to function. See “Appendix B: Power / Sleep / Global States Explained” on page 29 for an explanation of sleep/power states and an example reading of the ME Power State During Host Sleep State chart.
14. Select Intel AMT Configuration. Figure 5 Intel AMT Configuration screen 15. Select Host Name, and then type a host name. Default Setting = IntelAMT, Recommended Setting = User Dependent NOTES: Spaces are not accepted in the host name. Make sure there is not a duplicate host name on the network. You can use host names in place of the system’s IP for any applications requiring the IP address. 16. Select TCP/IP. a. Select Disable Network Interface, and then select N.
c. Select IP Address, and then type a static address. Default Setting = 10.0.0.2, Recommended Setting = Network Dependent Example: 192.168.0.1 Make sure all AMT systems have a unique static IP address if more than one system is on the same network. Multiple systems sharing the same static IP address can lead to network collisions, which will cause the systems to not respond correctly. d. Select Subnet Mask, and then type a subnet mask. Default Setting = 255.255.255.
18. Select Provision Model. a. Change to Intel AMT 1.0 Mode, and then select N. Default Setting = Intel AMT 2.0 Mode, Recommended Setting = Intel AMT 2.0 Mode This option is a toggle, and the next time you access it you are prompted with the opposite setting. b. Change to Small Business, and the select Y. Default Setting = Enterprise, Recommended Setting = SMB This option is a toggle, and the next time you access it you are prompted with the opposite setting.
23. Select Idle Timeout. Default Setting = 0x1, Recommended Setting = 0x1 This option sets the timeout value for Wake-On-ME. The default timeout value is 0x1 from the factory, but 0x0 if CMOS is cleared. A value of 0x0 means the Wake-On-ME feature is disabled and the ME will not go to sleep when not being used in a nonactive system. HP recommends a setting of 0x1, which allows the ME to go to sleep after 1 minute of inactivity.
Intel AMT WebGUI The Intel AMT WebGUI is a Web browser-based interface for limited remote system management. The WebGUI is often used as a test to determine if AMT Setup and Configuration was performed properly on a system. A successful remote connection between a remote system and the host system running the WebGUI indicates proper AMT Setup and Configuration on the remote system.
4. Type the user name and password. The default username is admin and the password is what you set during AMT Setup in the MEBx. Figure 7 Intel AMT WebGUI Screen 5. Review system information and/or make any necessary changes. NOTE: You can change the MEBx password for the remote system in the WebGUI. Changing the password in the WebGUI or a remote console results in two passwords. The new password, known as the “remote” MEBx password, only works remotely with the WebGUI or remote console.
Enterprise Mode Setup and Configuration Enterprise mode (for large corporate customers) requires a Setup and Configuration Server (S&CS). A S&CS runs an application over a network that performs AMT set up and configuration. The S&CS is also known as a Provisioning Server as seen in the MEBx. The act of setting up and configuring the AMT is also known as “provisioning.” An S&CS is typically provided by ISVs and is contained within the ISV management console product.
13. Select Intel AMT Configuration. The Intel AMT Configuration screen includes numerous options, which are available by scrolling down the menu. Figure 8 Intel AMT Configuration Screen Figure 9 Intel AMT Configuration Screen Continued 14. Select Host Name, and then type a host name Default Setting = IntelAMT, Recommended Setting = User Dependent Spaces are not accepted in the host name.
15. Select TCP/IP. a. Select Disabling Network Interface, and then select N. Default Setting = Network Interface Enabled, Recommended Setting = Network Interface Enabled If network is disabled, then all remote AMT capabilities are disabled and TCP/IP settings will not be necessary. This option is a toggle, and the next time you access it you are prompted with the opposite setting. b. Select DHCP Disable, and then select N.
20. Skip VLAN. Default Setting = Disabled, Recommended Setting = User Dependent This option enables or disables VLAN support. If VLAN is enabled, then the VLAN tag must be provided (1-4094). 21. Select SOL/IDE-R, and then select Y. a. A message window indicates that the system resets after configuration. b. Select Username and Password, and then select Enabled. Default Setting = Enabled, Recommended Setting = Enabled This option allows you to add users and passwords from the WebGUI.
26. Select Exit, and then select Y to exit the MEBx Setup and save settings. The system displays an Intel ME Configuration Complete message and reboots. 27. Turn off the system and remove power. The system is now in In-Setup Mode and is ready for deployment. 28. Plug the system into a power source and connect the network. Use the integrated Intel 82566DM NIC. Intel AMT does not work with any other NIC solution.
Setup and Configuration Server Preparation A Setup and Configuration Server must generate a Provisioning ID (PID) and Provisioning Passphrase (PPS) for each AMT system it will provision. PIDs are 8 characters and PPS are 32 characters. There are dashes between every set of 4 characters, so including dashes, PIDs are 9 characters and PPS are 40 characters. Once these PIDs and PPS are generated, they are added to the Setup and Configuration server’s secure PSK (Pre-Shared Key) database.
AMT Configuration must occur over a network. The network can be encrypted using Transport Layer Security Pre-Shared Key (TLS-PSK) protocol. Once the systems connect to an S&CS, Enterprise mode Configuration occurs. OEM TLS-PSK OEM TLS-PSK AMT set up and configuration occurs in two stages. The first stage is performed during OEM manufacturing and the second stage at the customer location.
Return to Default Return to Default is also know as Unprovisioning. An AMT set up and configured system can be unprovisioned using the AMT Configuration Screen and the Un-Provision option. Figure 10 Intel AMT Unprovisioning Screen 1. Select Un-Provision. a. Select Full Unprovision. Full unprovisioning is available for SMB mode provisioned systems. This option returns all AMT Configuration settings to factory defaults, and does not reset ME configuration settings or passwords.
Full Return to Factory Defaults You can return all AMT to factory default by clearing CMOS. This includes resetting the password to the default admin. However, settings in the ME, such as the ME Power Settings, are not reset. You must manually reset those settings to the default for the system to be in a true factory default state. You cannot remotely manage the system until it is set up and configured again.
7. The system BIOS displays a message that automatic setup and configuration will occur. a. The first available record in the Setup.bin is read into memory. The process: i. Validates the file header record. ii. Locates the next available record. iii. Invalidates current record so it cannot be used again. b. The process places the memory address into the MEBx parameter block. c. The process calls MEBx. 8. MEBx processes the record. 9. MEBx writes a completion message to display. 10.
Appendix A: Frequently Asked Questions Q: How can the MEBx be locally accessed? A: The MEBx can be locally accessed by pressing CTRL-P during POST. Q: Why is the CTRL-P prompt not displayed during POST? A: By default the CTRL-P prompt is hidden during POST, but it can be display if set in F10 Setup. Q: What is the default user name and password for the MEBx? A: The default username and password are both admin.
Q: Who provides Setup and Configuration Servers? A: Openview and ISVs such as Altiris provide Setup and Configuration Servers. Check with your management console supplier to see if they offer this service. Q: Can AMT be set for static address and the OS set for DHCP or vice versa? A: No. Although it can be done, this is not a supported setting by Intel and may cause unexpected system behavior. Q: What is the default port used by the Intel WebGUI? A: The Intel WebGUI listens to port 16992.
Q: Is a graphical representation of the ME and AMT available? A: Yes. Q: Is there a graphical representation of the ME in relation to the system? A: Yes.
Appendix B: Power / Sleep / Global States Explained A computer can be in one of several power states under the Advanced Configuration and Power Interface (ACPI) specification. These power states are also known as Sleep (Sx) states or Global (Gx) states. • S0 is the ON state. The computer is fully functioning. All system devices and operating system, if available, are running. S0 is also known as G0. • S3 is the Standby (Microsoft terminology) or Suspend-to-RAM state.
Appendix C: Wake-On-ME Explained Wake-On-ME is a new feature introduced in AMT 2.1. This feature allows the ME to go into a low power state when it is not used. There are four conditions that must be met for Wake-On-ME to function. • The system must have at least BIOS 2.09 and ME firmware 1031. • The system is in a sleep state: S3, S4, or S5. • ME On in Host Sleep State setting is set to Always. • Idle Timeout setting is set to a non-zero value. System BIOS 2.
