How to Self-Provision over WLAN with Intel(R) vPro(TM) Technology

How to Self-Provision over WLAN with
Intel® vPro™ Technology
June 2013
Omer Livne, Intel IT

2
Legal Notices
Copyright © 2013 Intel Corporation. All rights reserved.
This presentation is for informational purposes only. INTEL MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY.
Intel and the Intel logo are trademarks of Intel Corporation in the U.S. and/or other countries.
* Other names and brands may be claimed as the property of others.

3
Introduction
Intel IT supports a worldwide computing
environment that includes more than
100,000 PCs across 63 countries. More
than 80 percent of the devices are
mobile PCs that connect wirelessly to
our network.
Managing and securing these
environments is a key IT priority.
Intel IT has deployed Intel® vPro™
technology across our enterprise in
order to help maintain, manage, and
protect these PCs.
80% MOBILE DEVICES
CONNECTED WIRELESSLY TO OUR NETWORK
Intel IT supports
>100,000 PCs

4
Background
To activate the Intel® Active Management Technology (Intel® AMT) feature of Intel®
vPro™ Technology, we provision the PCs using Intel® Setup and Configuration
Software (Intel® SCS).
Provisioning is required to be able to take advantage of the capabilities within Intel
AMT. When employees are issued a new or replacement PC, the PC is provisioned
by technicians in our IT service centers.
Employees that participate
in our Bring Your Own
(BYO) PC program might
also bring in a PC that is
un-provisioned.
Typically provisioning is
handled automatically in
the course of installing
and configuring the OS
build.
On occasion, a PC may
need to have the
provisioning reinstalled
after delivery to the
employee.

The Challenge
We needed an easy way for technicians to
provision Ultrabooks™ devices that do not
have wired Ethernet ports.
We wanted to create a simple and efficient
way for employees to be able to self-
provision their PCs, without having to take
the PC to an IT Service Center.
Intel IT created a tool that allows our
technicians and employees to self-provision
systems over the WLAN.
Employees can now use this tool to self-
provision their PC, regardless of whether it’s a
corporate-issued PC or a Bring-Your-Own PC.
6 Copyright © 2013 Intel Corporation. All rights reserved.

Why This Is Important
Once the user’s PC is provisioned, our IT Service
Center staff can help manage and troubleshoot
issues on the PC.
This allows them to provide the same level of
service regardless of whether it is a WLAN-only
corporate-owned device or an employee’s Bring-
Your-Own (BYO) PC.
As employees bring in more WLAN-only BYO
devices, such as Ultrabook™ devices and
Windows*-based tablets with Intel® Architecture,
we expect to see more employees utilizing this
tool and subsequently requiring less support
from our IT Service Center.

Host-Based
Configuration
on Demand
8

How It Works
Host-Based Configuration on Demand
(HBCoD) is a tool that utilizes the host-based
configuration ability in Intel® Setup and
Configuration Software, which is provided by
the Intel® Active Management Technology
Configuration Utility (ACU).
The tool is available through our intranet
software library and is available to all
employees.
When run, the tool copies the necessary files to
the employee’s PC and executes a batch file
that performs several functions before running
ACUConfig.exe to provision the client.

10
The Technical Details
HBCoD self-provisioning process consists of
four major steps:
1. HBCoD copies the necessary files to
the local hard drive into c:temp
2. HBCoD launches a batch file with the
necessary instructions
3. The batch file sets the value for
variables used in the commands
4. The commands use the variables to
perform two configurations of the
system with logging and error checking

11
Step 1:
Copy the necessary file to the local hard drive
In our case, we have chosen to copy the necessary files to c:temp, but any
location will work. The files that need to be copied are:
• ACU.dll
• ACUConfig.exe
• ConfigureNowHBC.bat
• Initial HBC.xml
This can be done using a batch file called HBCoD.BAT, which is written as such:
: HBCOD stands for Host-Based Configuration on Demand
: This batch file copies the SCS configurator files to the local machine into the
: C:tempACU_Configurator folder
: And triggers configuration by running ConfigureNow.bat that contains the configuration
commands
@echo off
xcopy %~dp0.. "c:tempACU_Configurator" /e /i /h /d /y
c:
cd tempACU_Configurator
Start ConfigureNowHBC.bat

12
Step 2:
Launch a batch file with the necessary instructions
The last line of the HBCoD.BAT file
Start ConfigureNowHBC.bat
executes another batch file named
ConfigureNowHBC.BAT.
This batch file is used to perform steps 3 and 4.

13
Steps 3 and 4:
Set Variable values and execute commands with
logging and error checking
At a high-level, this batch file performs the following functions:
1. Checks for and creates (if necessary) C:IntelAMTlogs directory
2. Sets the MyServer variable to the FQDN of the appropriate provisioning server
3. Sets the MyProfile variable to the Remote Configuration Service (RCS) profile to be used
by the provisioning server
4. Sets the MyConfigFile variable to the XML file that contains the provisioning profile,
Initial HBC.xml
5. Performs an initial configuration over the WLAN using a temporary profile to enable
wireless Intel® Active Management Technology using the ConfigAMT switch for
ACUConfig.exe
6. Performs a final RCS configuration that properly configures the client using the
ConfigViaRCSOnly switch for ACUConfig.exe
7. Performs error checking

14
Steps 3 and 4:
Set Variable values and execute commands with
logging and error checking
The primary functions are 5 and 6.
5. Performs an initial configuration over the WLAN using a temporary profile to
enable wireless Intel® Active Management Technology using the ConfigAMT
switch for ACUConfig.exe
Note that in function 5, the client is provisioned with an initial configuration using a
digest password and another password used to encrypt the XML file, both of which
are in this case, P@ssw0rd.
Use the ACUWizard.exe to create the Initial HBC.XML file and refer to the Intel®
Setup and Configuration Software Deployment Guide for more information.

15
HBC.XML Configuration
Below is an example of how the initial HBC.XML file is configured:

16
Remote Configuration Service Server Configuration
In function 6 (below) the system is configured again from the RCS server during
which the digest password is either removed or replaced, depending on the
configuration of the provisioning profile “MyProfile” on the RCS provisioning server
“MyServer”.
If detailed logging and error checking are not required, the batch file can be
simplified considerably by editing the file to perform only functions 5 and 6
without the use of variables.

17
Contents of ConfigureNowHBC.bat:
cd..
Color FC
echo ************************************************************
echo This action takes about 2-5 minutes.
echo It may take longer depending on bandwidth
echo and distance from the configuration server.
echo !!!Very important: You have to be connected via Wireless LAN!!!
echo If you haven't already done so,
echo DISCONNECT LAN and CONNECT to WLAN now
echo and wait until you get an IP address
echo ************************************************************
PAUSE
Color f
If exist %SystemDrive%IntelAMTlogs goto Cont
MD %SystemDrive %IntelAMTlogs
:Cont
SET APPNAME=AMTHBCOD
SET MyServer="[FQDN of your provisioning server]"
SET MyProfile="[name of desired RCS profile]"
SET MyConfigFile="Initial HBC.xml"
:DecryptionPassword in command below matches the password used in SCS to encrypt the XML file
Call ACUConfig.exe /verbose /output console /output file %SystemDrive %IntelAMTlogsHBOCLog.txt
ConfigAMT %MyConfigFile% /DecryptionPassword P@ssw0rd
IF NOT ERRORLEVEL 0 GOTO ERROR
Call ACUConfig.exe /verbose /output console /output file %SystemDrive %IntelAMTlogsRCSLog.txt
ConfigViaRCSOnly %MyServer% %MyProfile%
SET INSTALLATIONERRORLEVEL=%ERRORLEVEL%
ECHO %DATE%:%TIME% - %APPNAME% ConfigViaRCSOnly returned: [%INSTALLATIONERRORLEVEL%]
The sample text for the
ConfigureNowHBC.bat file
is located here.

18
Contents of ConfigureNowHBC.bat:
:-----------------------------
IF "%ERRORLEVEL%" == "0" Goto ENDGood
:ERROR
Color FC
echo *************************************
echo Please check the error message above.
echo *************************************
GOTO EndErr
:EndErr
Color FC
SET INSTALLATIONERRORLEVEL=%ERRORLEVEL%
ECHO %DATE%:%TIME% - %APPNAME% installation returned: [%INSTALLATIONERRORLEVEL%]
echo This program will now exit
PAUSE
EXIT /b 1
:ENDGood
Color A
echo *************************************
echo Congrats! You are now AMT configured
echo *************************************
echo
echo *************************************
echo This program will now exit
echo *************************************
PAUSE
EXIT 0
The sample text for the
ConfigureNowHBC.bat file
is located here.

19
Learn More
Intel® Setup and Configuration Software (Intel® SCS)
Intel® Setup and Configuration Software (Intel® SCS) allows you to discover, set up and configure, and
maintain a secure connection to every managed device on your network. Using Intel SCS is an easy
process for unlocking the features and the value of systems with Intel® processors with Intel® vPro™
technology. Download the free software or view the training wizard online.
Intel® vPro™ Technology: Proven Value in Four Use Cases
To increase our ability to maintain, manage, and protect PCs while decreasing management costs, in
2011 Intel IT completed deployment of Intel® vPro™ technology across the entire enterprise. We have
evaluated the business value of four use cases based on Intel vPro technology that have been
deployed at Intel.
• An enterprise-scale solution for remote management of self-encrypting drives
• Remote passphrase reset
• Keyboard-Video-Mouse (KVM) remote control
• ISO mounts
In each case, we found that Intel vPro technology reduces management costs and decreases
downtime, resulting in greater employee productivity.

20
Learn More
Managing Intel® Solid-State Drives Using Intel® vPro™ Technology
Intel IT has conducted a successful pilot project of our hardware-based whole-disk encryption (WDE)
solution to replace our current software-based WDE solution on systems with self-encrypting drives.
Compared to software-based WDE, our new hardware-based WDE solution improves user experience,
increases encryption compliance, and reduces support issues. This new solution is based on two
Intel® technologies: self-encrypting Intel® Solid-State Drives and Intel® Active Management
Technology, part of Intel® vPro™ technology.
Configuration Tips for Managing Mobile PCs with Intel® vPro™ Technology
To improve our ability to use certain remote management features of Intel® Active Management
Technology (Intel® AMT) a component of Intel® vPro™ technology, Intel IT worked with Intel’s
software development team to develop ways to enhance Intel® Setup and Configuration Software
(Intel® SCS), a tool used with Intel AMT. By combining the updated version that resulted, Intel SCS 7,
with our existing client management console, we created a highly available, agile configuration and
maintenance environment for our mobile systems. This solution improves our ability to configure and
maintain mobile PCs on demand with Intel AMT and keep them configured throughout their on-the-
go life cycles for our customers.

Discover Intel IT’s strategies and initiatives that are accelerating Intel’s growth
and delivering business value.
IT Annual Performance Report
2012 Initiatives and 2013 Priorities
www.intel.com/go/ITAnnualReport

Learn more about Intel IT’s initiatives at www.intel.com/IT
Sharing Intel IT Best
Practices with the World
Assessment Tools
CIO and IT PerspectiveIT Papers
IT-to-IT Community

How to Self-Provision over WLAN with Intel(R) vPro(TM) Technology

How to Self-Provision over WLAN with Intel(R) vPro(TM) Technology

More Related Content

What's hot (19)

Viewers also liked (20)

Similar to How to Self-Provision over WLAN with Intel(R) vPro(TM) Technology (20)

More from IT@Intel (13)

Recently uploaded (20)

How to Self-Provision over WLAN with Intel(R) vPro(TM) Technology