Integration of Intel AMT settings in the management console

The complexity of Intel Active Management Technology (Intel AMT) configuration profiles depends on the components involved. When integrating Intel AMT into the management console, you first need to determine which components the console should support.

You can explore the various configuration options in the ACU wizard. This program is part of the downloadable Intel Setup and Configuration Software (Intel SCS) . For more information about the options available, see the Intel SCS documentation that is included with the Intel SCS download package.

Integrating host-based configuration into the console

Most often, when integrating into the console, a host-based configuration is used . This method uses the host OS (Windows * 7 or later) and the script to perform the configuration.

This article shows how the ACU wizard creates a sample configuration profile. The profile provides the required XML code, so the console can create and encrypt the configuration for deployment on Intel AMT devices.

Note. If the console creates an XML profile file, you must encrypt this file using SCSEncryption.exe before deploying it to an Intel AMT device. If you do not use encryption, the file will be sent to the client in plain text, while all passwords in the profile.xml file will be vulnerable.

To automate the configuration process, you need to create a profile.xml file and a script that performs the configuration. Here are the basic steps.

1. Copy the Configurator folder and the profile.xml file from the SCS download folder to a location accessible by the Intel AMT client (to a local folder, to a network folder, to a USB flash drive, etc.).
   
   
2. Open a command prompt with administrator privileges, go to the acuconfig folder and run the following command: acuconfig.exe configamt / decryptionpassword <password>.
   
   
3. The setting is considered successful when the program with code 0 exits.

Host-based configuration, as described above, has one major drawback: you cannot configure an Intel AMT device in administrator control mode. By slightly changing the configuration profile, you can organize the firmware access to the installation and configuration server, to the preparation certificate. For more information about administrator management mode and client management mode, see Installing and Configuring Intel vPro Integration .

Using the ACU Wizard

The ACU Wizard supports several methods for configuring Intel AMT devices. As part of this article, we need only one way to get our sample XML file. To create the profile.xml file using the ACU wizard, follow these steps:

1. Create a profile. To do this, open the ACU wizard and select Create Settings to configure Multiple Systems .
2. The Intel AMT Configuration Utility: Profile Designer window opens.
3. Click the green plus.
4. When the configuration profiles wizard opens, click Next .
5. When the advanced settings wizard for the configuration profiles wizard opens, click Next .
6. The system settings window of the configuration profiles wizard opens.
   
   
   1. Enter the RFB password if encryption is enabled (optional).
      
      
      1. RFB is a remote framebuffer protocol, also called RFB5900. If you enable the RFB password, you can use the standard VNC viewer using port 5900 instead of the VNC viewer designed for Intel AMT, which also uses port 16994 or 16995.
         
         
   2. Enter the password in the use the following password for all systems field .
   3. To change the network settings, press the Set ... button .
      
      1. If DHCP is enabled on the host OS, no changes are required. Pay attention to the changes that are necessary if the OS uses a static IP address.
         
         
      2. Click the Cancel button .
   4. Click the Next button .
      
      
7. The "Configuration Profiles - Done" wizard opens.
   
   
   1. Enter the desired profile name, for example “profile”.
   2. Encrypt the XML file by adding and confirming the password.
   3. Click the Finish button .
      
      
      
      
8. The Intel AMT Configuration Utility: Profile Designer window opens.
   
   1. Pay attention to the profile path shown on the screen.
      
      1. It should look something like this: <username> \ documents \ SCS_Profile.
   2. Close the ACU wizard.

Note. For detailed instructions on using the ACU wizard, see the documentation in the downloadable Intel SCS .

Using Profile.xml

So, we have an encrypted profile.xml file . Now you need to decrypt this file to reveal the settings using the SCSEncryption.exe program , which is part of the Intel SCS download package. After decryption, you can open the file in the XML viewer and see the XML tags.

Decryption syntax:

> SCSEncryption.exe Decrypt <input file name> <password> / Output <output file name>

Note. If you need to enable additional features in your profile or explore other Intel AMT features, you can do this in step 5 above. For example, one of the common and recommended features is setting up a wireless network.

Control mode selection

During the setup process, the Intel AMT device will be put into one of two modes: client management mode or administrator management mode. The main difference is that in client management mode , user consent is required for redirection operations, and in administrator management mode it is not needed.

User Consent

The user consent feature provides an additional layer of security for remote users. A user consent code is required if there is a need to redirect or manage a remote client. For example, access through a remote KVM switch or executing an IDEr command is considered a redirection operation, and receiving a power state or rebooting is not considered such an operation.

Additional Resources

• Learn more about administrator management mode and client management mode.
• Download Intel SCS.
• Intel AMT Implementation and Reference Guide.
• PowerShell Intel AMT Module.
• Download the Intel AMT SDK.
• Install and configure Intel vPro integration.

Conclusion

When managing devices that support Intel AMT, one of the most important tasks is configuration. The setup process is quite simple when using ACUconfig.exe , but the process of creating a profile requires more detailed consideration.

Using ACUWizard.exe, you can create a sample profile.xml file that demonstrates the ability to create dynamic console profiles, so there is no need to use any specific static profile. This gives us the ability to manage Intel AMT devices more broadly, customize user consent, wireless profiles, Active Directory ACLs, etc.