Remote PC Management with Intel's vPro

pschmid

Distinguished
Dec 7, 2005
333
0
18,780
The need for remote PC management has always been an issue that only increases with the size of your business. Intel wants vPro to be your perfect, OS-independent hardware-level management solution.
 

Ylian

Distinguished
Apr 27, 2007
13
0
18,510
I am the author of Intel AMT Command and Intel AMT Director, two of the tools mentioned in this piece. In my own labs here in Oregon, I can often get people to go WOW at my demos of Intel AMT, it's certainly fun stuff.

The piece is exactly correct that Intel AMT Commander is a developer tool. Don't try to get Intel support for it. Still, if anyone happens to own a vPro or Centrino Pro computer and just wants to play around, The tools are freely available as part of the Intel AMT DTK located here:

http://softwarecommunity.intel.com/articles/eng/1034.htm

I also have my own blog on these tools:

http://softwareblogs.intel.com/author/ylian-saint-hilaire/

I own a vPro computer at home and it's certainly cool to have a built-in web site in your computer that can be accessed even if the computer is in soft-off but I also manage to perform cool tricks. In my most famous trick, I use Intel AMT to VNC into a computer that has all it's network drivers disabled. I then use the VNC session to re-enable the network drivers and all this, using only the Ethernet port!

Ylian
 

yyrkoon

Distinguished
May 8, 2006
387
0
18,780
I am the author of Intel AMT Command and Intel AMT Director, two of the tools mentioned in this piece. In my own labs here in Oregon, I can often get people to go WOW at my demos of Intel AMT, it's certainly fun stuff.

The piece is exactly correct that Intel AMT Commander is a developer tool. Don't try to get Intel support for it. Still, if anyone happens to own a vPro or Centrino Pro computer and just wants to play around, The tools are freely available as part of the Intel AMT DTK located here:

http://softwarecommunity.intel.com/articles/eng/1034.htm

I also have my own blog on these tools:

http://softwareblogs.intel.com/author/ylian-saint-hilaire/

I own a vPro computer at home and it's certainly cool to have a built-in web site in your computer that can be accessed even if the computer is in soft-off but I also manage to perform cool tricks. In my most famous trick, I use Intel AMT to VNC into a computer that has all it's network drivers disabled. I then use the VNC session to re-enable the network drivers and all this, using only the Ethernet port!

Ylian

Ylian, first of all, this does indeed look like a very interresting set of tools. I was about to ask if the tools had an implementation in .NET (I am a hobbyist programmer, and .NET makes life much simpler ) , and low an behold .NET v2.0 is plastered all over the first paragraph on Intels AMT page ;)

Anyhow, I think some clarification is needed. In the article it says that p965 or q965 chipsets are required, then goes on to mention that said processors must have Intels version of VT enabled. Maybe I am not seeing the big picture here, but as far as I know VT (Virtualization Technology) is for something completely different, such as running HVM mode using Virtualization software (The ability to run 32 bit domains under a 64 bit Hypervisor, run a windows DomU from a *NIX Dom0, etc.). Is this 'software' in fact a Virtual Machine ?

Anyhow, not to toss the competition in any ones face here, but AMDs VT (AMD-V, Pacifica, whatever you want to call it . . .) does not require having a BIOS that supports their own implementation of VT, and I was rather hoping Intel would do the same thing. After reading that this technology requires a certain chipset, I have to assume that Intel VT will continue to nessesitate a BIOS implementation as well, which is not what I hoping for. Now, in case anyone is wondering if I watch the Virtualization scene fairly close, yes, I do . . .

Now I also understand that Intel does not officially support this software, but I think for it to be taken seriously, there should be at least a hardware list of compatable motherboards/CPUs, and perhaps a Forum for followers ( I missed it on your blog page ? ). This is not to say I am bashing you, or Intel, quite the contrary actualy, I see a lot of potential here, and forsee your employer fully embracing this technology some day.
 

Ylian

Distinguished
Apr 27, 2007
13
0
18,510
Thanks,

Your absolutely correct about VT not being required. VT and Virtual Appliance are both features of vPro, but they have little to do with Intel AMT. You can use Intel AMT with VT turned off and so, the article should really be corrected. Intel AMT does not run visualized.

Intel AMT runs on it's own little processor on the computer's north-bridge. We call is the "Management Engine", it does require that RAM be installed in the first bank and steals a little RAM away from the OS. Otherwise, in theory it could run without a processor being installed. Intel AMT is software running on the Management Engine that is located in the firmware along with the BIOS. We also put hardware network filters in the NIC to steal TCP ports 16992 to 16994 and route them to Intel AMT. As a result, connections to these ports on Intel AMT computers will never be seen by the OS.

It's too bad the article does not talk about the technical details of Intel AMT. Many enthusiasts would really have a great time learning about the details.

As for the list of supported motherboards, my tools should support all motherboards that support Intel AMT. At which point, it's like any other feature on motherboards, you have to look for it. For system integrators, the vPro sticker required Intel AMT to be present.

Yes, the Intel AMT DTK is all built in C#, I also have some source code available for people to play around with and built there own tools & applications. As for my employer, it fully supports Intel AMT but it may take a few more months for them to come around to support my tool set.

Ylian
 

glockman

Distinguished
Aug 22, 2006
120
0
18,680
I have been aware of VPro for a while now and when I saw this article I was hoping I'd see in the review some of the tools you can use to manage the PC, I was surprised that only the Intel developer centric tools were the only ones mentioned.

I am a network administrator and I have to say this is OK technology but it isn't that important in real life day to day admin work. The last company I worked for used lots of Dell and I took the time to set up their tool set which if memory serves was called OpenManage. I casually used it from time to time but would not consider it indispensible and really wouldn't consider anything like that or VPro to be a make or break feature for me. Even in the server world I tend to not use this kind of stuff - I can use VNC or Remote Desktop or a variety of IP KVM's like Raritan or ATEN to accomplish many remote tasks - if something is really screwed it usually requires a visit to the box anyway! I have several HP servers that have what I think they call ILO in them and it does much of this kind of junk... I have never bothered to use it.
 

Ylian

Distinguished
Apr 27, 2007
13
0
18,510
I think you are right on, if all of this management technology is going to be complicated to setup and run, why bother. I would agree with you that some of the software I have seen, including Intel's own Setup and Configuration Server (SCS) is very difficult to setup and use. You need training on it and lots of patience.

Hopefully Intel AMT Commander and Intel AMT Director will show how it's possible to build click & run software that makes use of Intel AMT without brain surgery. You probably are a great candidate for usage studies at Intel, we could learn lots from people that use this stuff. What hardware and software features would it take for it to be really useful for you? As developers, we may sometimes just build this stuff and lose track of the real users.

Ylian
Blog: http://softwareblogs.intel.com/author/ylian-saint-hilaire/
Software Download: http://softwarecommunity.intel.com/articles/eng/1034.htm
 

yyrkoon

Distinguished
May 8, 2006
387
0
18,780
Yes, the Intel AMT DTK is all built in C#, I also have some source code available for people to play around with and built there own tools & applications.

Sounds great, unfortunately for me however, both of my latest systems are based on 'the competitions' platform, I have been wanting to move to C2D though . . .

Other problems abound as well, such as: so far, only non enthusiast boards/ systems support AMT, and since I am first a gamer/enthusiast (gaming is why I first got serious into computer years ago), this is a big minus for AMT. Also, knowing what parts you need for doing exactly whatever it is you want to do, seeems to be daunting( keep in mind I know PC hardware very well, as well as most interresting technology ).

Now, that being said, the following is not meant to hurt feelings, but if it boiled down to buying hardware just for AMT, I personally would never do this. However, if in the future, the technology becomes more standarized, and more common, I would give it some serious consideration. MSI does make some very decent Intel based motherboards, so the one reviewed, I would have zero problems buying, if it were more reliable concerning AMT, and offered a bit more jazz in the enthusiast arena (but it is very similar to the motherboard I have in my most current system, minus very good overclocking features; stability I can not speak of, since I do not have one of these MSI boards . . .).

So . . . for now, I am stuck without AMT with my current platform, but after watching a couple of videos last night on AMT, my curiosity is deffinately peaked. The ability to boot from a remote image file ( without using PXE?! ) is enough to keep even the most nerdy of us busy for a long, long time to come.
 

yyrkoon

Distinguished
May 8, 2006
387
0
18,780
What hardware and software features would it take for it to be really useful for you? As developers, we may sometimes just build this stuff and lose track of the real users.

Well, this comment was not directed at me, but I'll give you some food for thought. Also, keep in mind I am not a system administrator in any sort of data center, etc.

1) The ability to hard power on a machine remotely (unless I'm mistaken, I think this is already covered). Remote desktop is fun, and handy, but it will not do this ;)

2) The ability to send remote debugging messeges (Said machine BSoD's, or Locked up in *NIX? Email me a messege giving me a memory dump, and/or other usefull info)

3) The ability to lock out all remote communications (aimed at AMT), except for a given range, or single address (is this covered already?) Something similar to ALLOW/DENY lists in *NIX would work well I think.

I will have to read up on vPro/AMT, and see what all is possible, and perhaps I will come up with some more ideas
 

Ylian

Distinguished
Apr 27, 2007
13
0
18,510
Thanks for the comments.

1. is covered by Intel AMT. It's probably the easiest yet, most used Intel AMT feature. Secure power up, power down, soft and hard reset.

2. Intel AMT can send out SNMP Traps alerts for all kinds of things... reboots, case intrusion, etc. You just have to subscribe to get them. There is also a feature to monitor running applications and send a message back if the application stops (or computer freezes). It's called the watchdog feature.

3. At Intel, we prefered locking out people based on TLS certificate rather than IP address range, it's a lot more secure. You can also create a few accouts in Intel AMT with restricted privilages (say, a monitoring only account).

One thing I keep in mind with all this is that, even with an impressive set of feature, if the software is difficult to use, it's no good. This reminds me, I think it's annoying that Intel AMT can't remotely read fan speeds. Something that big servers can do. Otherwise, Intel AMT can generally do more than most management solutions.

By the way, we have a idea contest going on for Intel AMT on the Intel web site: http://softwarecommunity.intel.com/contests/Idea/default.aspx. If you have a good idea around Intel AMT and using it for something cool, it's probably one of the easiest contest to win ever.

Ylian
 

Ylian

Distinguished
Apr 27, 2007
13
0
18,510
Just noticed that you posted two mails. On the first one regarding gamer/enthusiast and Intel AMT, it's a great comment. Generally, Intel like others have "extreme edition" gear with no compromises. I think it would be great to have Intel AMT in such boards, especially since it's probably there anyway and "fused off" depending on the chipset you get.

I have an Intel "BadAxe" board as my main dev machine and it's exactly the type of board you would expect a gamer to use... except that it's the older Intel AMT 1.0 that was short lived and I don't recommend you get anything less than Intel AMT 2.0, which is the current version. Centrino Pro laptops will have AMT 2.5, but it's the same as 2.0 with wireless added. I think BadAxe II is coming out at some point, but I don't know any specs.

In any case, I should hope our high-end Intel chip sets will have Intel AMT support, it would certainty be really cool.

Ylian
 

yyrkoon

Distinguished
May 8, 2006
387
0
18,780
wow i dont get why you got voted 1 star on this new thread
who gave pschmid a 1 star vote and why?

Probably because the article had a bit is mis-information in it, but who knows for sure. Most of the article as far as I can tell was correct, but the part concerning VT being for vPro/AMT is incorrect as far as I know.

Anyhow, most of the people this article would interrest, would probably know this already.
 

yyrkoon

Distinguished
May 8, 2006
387
0
18,780
One thing I keep in mind with all this is that, even with an impressive set of feature, if the software is difficult to use, it's no good. This reminds me, I think it's annoying that Intel AMT can't remotely read fan speeds. Something that big servers can do. Otherwise, Intel AMT can generally do more than most management solutions.

The contest looks good, but unfortunately is too far along to partiipate, and get a fair shake at the grand prize. Its all good though . . .

As far as remote fan speed readings, it would not be that hard to implement a .NET WMI performance counter service(I have actually done this myself for fun), then it is up to the actual motherboard, and if it has well implemented fan sensors or not.

My experiences on SNMP have left a bad taste in my mouth concerning the technology. From what I have experienced, not everything, supports everything, but if an AMT based motherboard handles all the appropriate 'subscriptions', this would probably be a moot point. The other aspect I do not like about SNMP, is the administration software availible ( free software that is ), it is seemingly bloated, and requires other software to work. I think it would be awesome if someone made a standalone implementation, that did not require you the user to use other OSS software.

Do not get me wrong, I do like OSS somewhat, but when you are forced to use 2-3 different softwares, plus Cygwin if you are using Windows, this only leads to possible instabilities, and a less secure machine. Anyhow, I think I have beat this horse a little too much . . .
 

yyrkoon

Distinguished
May 8, 2006
387
0
18,780
Ylian, heh, I am seeing huge potential for 'remote PC repair here', as in: someone calls me, tells me their computer has a problem, I connect to it remotely, have it boot say a WinXP CD (yeah, a fast broadband connection would be needed, and I could boot the CD into repair mode, fix the problem, and they would hopefully have a working system again after I am done.

There is however, a caveat here: you guys havent implemented a payment plan 'service' for systems repair shops !!! LOL, yeah, I know . . . was fun to dream about it for a second ;)
 

Ylian

Distinguished
Apr 27, 2007
13
0
18,510
Hi there,

First off, it's me being "blond" and incorrectly voting on the first messages. I was new to the forum and so, voted "good" instead of "best". Some of you guys should vote to offset my mistake, I don't think I can change my votes.

I do want to clarify that Intel AMT does not use SNMP at all, it uses Web Services with SOAP/WSDL calls to port 16992 (or 16993 when TLS is used). The same web server that handles the Intel AMT web pages also handles the web services calls. The only part of SNMP we use is to carry network alerts, but the subscription to these alerts is done using web services. So all in all, it works pretty well and TLS security can be used, which is very solid. Traps are UDP based and Intel AMT will repeat each trap 3 times.

You can port map ports 16992 to 16994 on a router to your Intel AMT computer and manage it from the Internet using the web page or Intel AMT Commander. This is useful for me because my Media Center PC sometimes locks-up and needs a good remote reset. I have also tried remote reboot (we call it IDE redirect) of a WinPE image over my DSL (768 kb/sec down, 128 up) and it was painfully slow, about 40 minutes before the boot locked up. This story is posted on my blog. Redirecting IDE calls over the Internet is rather ineffective, but I do agree that there is lots of great potential here for remote management and repair of computers over the Internet.

Payment plans for repair shops? I would not be unhappy if Intel made the most remotely repairable PC's on the market. Intel AMT is a great way to do this.

By the way, keep the questions coming. I will do my best to answer.

Ylian
Blog: http://softwareblogs.intel.com/author/ylian-saint-hilaire/
Software Download: http://softwarecommunity.intel.com/articles/eng/1034.htm
 

yyrkoon

Distinguished
May 8, 2006
387
0
18,780
Payment plans for repair shops? I would not be unhappy if Intel made the most remotely repairable PC's on the market. Intel AMT is a great way to do this.

Yes, in other words, how would a repair tech charge a customer, and both sides feeling safe doing so on a first time basis ?

On one hand, you have the customer feeling unsafe, because they might have to give CC info out first, and the repair tech would then charge a minimum fee, after which the tech might refund some of the charges to reflect the time spent actually repairing the PC.

On the other hand, the tech lets the 'charge' float, until he/she is done, then billing the customer after repairs are complete, not knowing if the customer will make good on the bill or not.

Anyhow, it was kind of a joke, with a little dreaming on my behalf, in that you could implement some form of a billing system in the NVRAM ;)

I have however given some serious thought, as to how system integrators could make the most of this, in more than one aspect, not just the OS/Software repair level. IE, small PC shops could tout having systems that are as reliable as possible, but if problems do arise, can be fixed in a hurry, remotely, possibly for free within the warranty time, or a fee after words. Large businesses, such as Dell, or HP may be able to do so as well, however, being in the business myself, I know how 'good' teir 2 support through OEMs can be . . . I honestly do not think they could afford the proper technitians for such a venture, and would probably have to find a contractor, who would in turn contact someone like us here (much like how things are done now, but without the driving costs/charges).

So, when all is said and done, hourly rates would be the same (or maybe prices would have to be jacked up a tad to make sure the technitians had the proper internet connection), but driving costs/charges would be eliminated, not to mention the 'green' factor as well.

As an example, we often get Virus/malfunctioning OS calls, our rates are $50/hour, minimum charge is 30 minutes time ($25), and driving time (local) is another minimum 30 minutes. That would be $50 just for us to show up, and say something like 'yeah, it is definately broken . . .'. Half that cost would be eliminated if AMT were up to the task right_now, and in most machines. Now imagine the calls we get similar to this, but are infact 2 hours away, thats $100 just to show up . . .

That being said, we are very fair with our customers, in how we charge them for actual time spent working on a PC (IE, if MSUpdates are downloading, the PC is being 'fixed', but the technitian may be doing something else), so we do not charge for the full time the PC has been in our shop, and on the bench, but we will charge full time spent on a house call. Which gives me another idea, how about a watchdog feature, that keeps track of remote interrection done by the user ? Something along the line of, start times/end times, and idle times after a minute or so. This would be really handy to help determine how long one actually spent on a machine. For more suggestions, please insert another $25 usd ;) Kidding . . .
 

Ylian

Distinguished
Apr 27, 2007
13
0
18,510
I certainly have lots to talk about on this topic, for sure, I am not the "strategy" guy at Intel. But you make a few interesting points.

One interesting idea about Intel AMT is the "active" part. Usually service people assume everything is ok if you hear nothing from the computer (Passive management). With Intel AMT, if you hear nothing, something must be wrong (Active management). This "active" monitoring can be very interesting to IT service business that can point out a report of your computer's run time, sleep time, etc. I also think it's great for power savings since you know in what Sx state each computer is in.

You mention the problem of having a services broker between customers that need help and technical experts. I think that's an excellent business opportunity in itself. If you where to start such a service, you would probably start off with a software only solution and add Intel AMT in when it's available. The services broker problem is not Intel AMT specific, but once solved, Intel AMT can add to your software agent and make the computer reparable in more situations.

I know some customers want to human factor and so, I think it's still important to not completely replace that service when requested. But with Intel AMT, you may get a chance to fix more problems entirely remotely or have a better idea of what is wrong before showing up. Again, I think software agents are the starting point, and Intel AMT a great addition when the agent can't run correctly or can't communicate.

I don't know the services business for computer repair very much, I do it for friends, but have little idea on the business of it all. I sometimes wonder if Intel AMT would be better for contacting official support (Dell, HP, etc), or other service shops, or allow technical expert friends better access, or allow the PC owner itself to remotely manage it's home PC from a distance. There are different models here, I wish I had numbers on how important users find these 4 models relative to each other.

Ylian
Blog: http://softwareblogs.intel.com/author/ylian-saint-hilaire/
Software Download: http://softwarecommunity.intel.com/articles/eng/1034.htm
 

yyrkoon

Distinguished
May 8, 2006
387
0
18,780
well in your case you mention the customer should already have all of the updates before seeking help

if not then charge them to download them it totally right if they cant figure this out

It is a courtesy we often provide for our customers. If you think about it, and you are busy enough, there is no point in billing someone for something that is automated. Unless, perhaps, you are thinking of the electricity being used, but we think of this as part of the service rates . . .

Ylian, yeah, the more I was thinking, as I was writting, I was saying to myself: 'this sounds more like a software solution vs a hardware solution . . .' , but I was thinking as I was writting, so I just left it in the post.

As for how the repair business works, it pretty much works as I explained, OEMs contact contractors, and contractors contact a shop such as our, that are in the local area. The main problem here, is often times, contractors think they deserve more money than they should get, for sitting on their fat behinds, and doing nothing, that we sometimes refuse to service a call (IE, they tell us a job 2-3 hours away pays $50, and dont even stop to think of the 4-6 hours driving time involved, who in their right mind would accept that? ). Anyhow, all that is pretty much for a different forum ;)
 

Ylian

Distinguished
Apr 27, 2007
13
0
18,510
I think remote repair is a big industry and lots of money to be made if you can do it quickly and in a friendly way. Intel AMT could help in some situations, but in general you should really use software first. I am sure others are more knowledgeable of that industry.

By the way, I just released the Intel AMT DTK v0.29 internally at Intel last night, and it should be on the Intel web site today in the next few days. One of the cool new features is USB Flash key support in Intel AMT Director. You save a file to a USB Storage Key, connect it to an Intel AMT computer and turn on the computer. On boot, Intel AMT will grab security settings from the key and connect to Intel AMT Director securely to get setup correctly. I tried it for the first time a few days ago... things you did not know your BIOS could do.

Ylian
Blog: http://softwareblogs.intel.com/author/ylian-saint-hilaire/
Software Download: http://softwarecommunity.intel.com/articles/eng/1034.htm
 

yyrkoon

Distinguished
May 8, 2006
387
0
18,780
Well, the thing is, when doing virus repair, you do not want to boot the infected OS. The main reason why, is you do not want any active 'virii' running while you are cleaning the system, and you want the infected HDD unmounted. The other reason is much simpler, the machine would stand a good chance of being dog slow (90% + CPU usage).

As for fixing a broken OS, this should be obvious why you would need to boot to a remote disk ;)
 

Madnik

Distinguished
May 9, 2007
1
0
18,510
Hi there,
I'm not new in the subject but I'm trying to improve my knowledge. I have some years of working exerience in computers and support departments. Remote support was always a tuff issue due to windows, firewalls and other variations and versions. I 've done a research on the subject for my master thesis and I test a lot of softwares and different machines. I like those which allow you to remotely install the control software since most customers have know idea on how to give you access or do the client installation. I had difficult time to find publications on the subject. I came across only with magazine articles and white papers.
Anyway, if Intel's idea became a standard, will be more that just great.

8O
 

Merlot_pv

Distinguished
Sep 6, 2006
10
0
18,510
Putting together a small rack which had no space for monitor and keyboard, I bit the bullet and went with HP's ILO, so I was interested in what other solutions are out there. ILO is a great solution - but not without its problems. The critical one is that ILO itself has needed rebooting which needs to be done through the OS or directly at the console. I wonder if Intel AMT has this 'managing the manager issue'.

I think it will be a while before Intel AMT or tools like ILO become more than a corporate site management tool. For one, in a domestic remote repair scenario if the computer is behind a typical router/firewall/dhcp then the AMT solution would need to actively apply a PnP hole in the firewall and 'phone home', unless the remote manager can also manage the router.

Also, my experience with installing an OS with ILO across a WAN with a 10MB link was not that enjoyable. The image in my head of sitting on a beach installing Windows 2003 x64 on the remote site, doesn't match the reality of the tedium of doing it that way. In practice it's much like the bad old days of installing via half a dozen disks, and if the link fails - you're back to square one. Virtual drives across the WAN are not the most reliable or speedy things. In reality the least you need to do is load your OS to a reliable network share first, and then do a network install from the target computer.

Anyway - for all that, I really like the idea of these tools being on regular desktop machines if you need them, but I agree with the OP that management software needs to cut the bloat and configuration tedium that seems to have accumulated over the years (and I'm talking specifically about HP here).
 

yyrkoon

Distinguished
May 8, 2006
387
0
18,780
I think it will be a while before Intel AMT or tools like ILO become more than a corporate site management tool. For one, in a domestic remote repair scenario if the computer is behind a typical router/firewall/dhcp then the AMT solution would need to actively apply a PnP hole in the firewall and 'phone home', unless the remote manager can also manage the router.

Also, my experience with installing an OS with ILO across a WAN with a 10MB link was not that enjoyable. The image in my head of sitting on a beach installing Windows 2003 x64 on the remote site, doesn't match the reality of the tedium of doing it that way. In practice it's much like the bad old days of installing via half a dozen disks, and if the link fails - you're back to square one. Virtual drives across the WAN are not the most reliable or speedy things. In reality the least you need to do is load your OS to a reliable network share first, and then do a network install from the target computer.

1) This is true, however, after a one time onsite service call, this problem would be solved.

2) The bootable 'repair' OS wouldnt have to be remote, it could even be on a seperate hidden partition, or even better, on a service CD/DVD, or even a readonly USB keychain given to the customer, and stored in a safe place. There are lots of ways around the whole remote boot 'issue', but one thing for certain: over time, internet connections will be much, much better than they are now, and should be more than sufficient. Maybe not tommorrow, maybe not even this century, but it will come to pass. Anyhow, with a little imagination, there is a lot of potential here.
 

Ylian

Distinguished
Apr 27, 2007
13
0
18,510