Intel vpro AMT Remote Configuration using McAfee epo Deep Command

Size: px

Start display at page:

Download "Intel vpro AMT Remote Configuration using McAfee epo Deep Command"

Phyllis Small
5 years ago
Views:

1 Quick Start Guide Intel vpro AMT Remote Configuration using McAfee epo Deep Command version This guide contains the most simplest workflow to configure Intel AMT systems using remote configuration through McAfee epo Deep Command. 1

2 1 Setting up your environment 2

3 Make sure that you have specific software, hardware, and network configurations in place. This diagram illustrates the actions required to activate your Intel AMT systems and their out-of-and management. For more information aout each task, see their respective sections. 3

4 2 System requirements Systems McAfee epolicy Orchestrator (McAfee epo ) Intel AMT systems (common for oth wired and wireless environments) Requirements Version 4.6 Patch 7 or later Version 5.x See the McAfee epo documentation for system requirements. CPU: Intel vpro as listed in this link: RAM: 512 MB minimum (1 GB recommended) Hard Disk: 200 MB minimum free disk space Intel AMT version: 5.x or later For McAfee Drive Encryption integration, Intel AMT version 6.x or later is required. Contact your hardware vendor to otain the latest drivers and firmware. Graphics: Intel Integrated 3000 or higher (required for McAfee KVM Viewer connection) Network Interface Card (NIC): Onoard (Multiple NICs are not supported.) Drivers: Intel Management Engine Interface driver. Contact your hardware vendor to otain the latest drivers and firmware. Intel AMT systems in wireless environment Wireless Network Card: Onoard Driver: Intel PROSet. Otain the latest drivers for your version of operating system. Make sure that the system has these minimum supported versions of the wireless software: For Windows 7 Intel PROSet or later For Windows 8 Intel PROSet or later Intel RCS server Version 8.2 or later 3 Prerequisites for remote configuration Prepare the Intel AMT system environment to configure the systems using remote configuration. Install and setup your McAfee epo server, add systems in System Tree and deploy McAfee Agent on systems to manage them. Check in the epo Deep Command extensions and packages to McAfee epo. Deploy the epo Deep Command Discovery plug-in to all managed systems. Deploy the epo Deep Command client to Intel AMT systems. Make sure that designated ports are not locked in firewall or intrusion prevention system. 4

5 Use Dynamic Host Configuration Protocol (DHCP) to assign IP addresses to devices. Intel RCS domain name and FQDN must e resolved from the Intel AMT systems. Intel AMT systems must not e in wireless mode during the configuration process. Configure the systems in a wired environment with a profile including wireless settings. Once the configuration is complete, connect them ack to the wireless network for out-of-and management. Intel AMT systems must not e in a virtual private network (VPN) environment. Home domains of McAfee epo and Intel AMT systems differ in VPN environment. Intel AMT systems must have an onoard Network Interface Card (NIC). Multiple NICs are not supported. Make sure that the RCS Manager plug-in properties have een collected. Navigate to the system properties page of the Intel RCS server, select McAfee epo Deep Command RCS Manager Plugin in the Products ta. 4 Install the Intel RCS server Install the Intel Setup and Configuration Software (Intel SCS) on a Windows Server. See the Intel SCS User Guide at scs-user-guide.html for system requirements and further information. The Intel SCS includes the Intel Remote Configuration Service (RCS) server, which is required to perform the remote configuration. For option definitions, click? in the interface. a c d e f g h i j k In the McAfee epo console, select Menu Software Software Manager. On the Software Manager page under Product Categories, click Software Not Checked In Licensed. Select McAfee epo Deep Command 2.3 from the product list, click Download next to the Intel Setup and Configuration Software (Intel SCS), then save the file to the system. (Optional) Copy the IntelSCS_9.x.x.xx.zip to a Windows system where you want to install the Intel RCS server. You can also install the Intel RCS on the same system where McAfee epo is installed. Browse to the location where you saved the Intel Setup and Configuration Software (Intel SCS) file, then extract IntelSCS_9.x.x.xx.zip. Browse to the %Intel SCS extracted folder%\intelscs\rcs\ directory, doule-click IntelSCSInstaller.exe, then click Next on the Welcome screen. Accept the license agreement, then click Next. Select Remote Configuration Service (RCS), select Non-Dataase Mode, select Console, then click Next. Select your domain user account in the format domain\username, type your domain account password, then click Next. Select Generate storage key file, then click Next. Once the installation is complete, click Next, then click Finish. 5

6 5 Import the configuration certificate to the RCS server Use the Intel RCS Utility to import a third-party configuration certificate prepared in.pfx format. This task includes steps to use a third-party certificate to facilitate Remote Configuration. If you want to use self-signed certificates, see DOC For option definitions, click? in the interface. a Select a supported vendor. For the list of supported vendors, see remote-support/intel-vpro-certificates.html. Generate a Certificate Signing Request (CSR) and purchase the appropriate SSL certificate from the vendor. Prepare the configuration certificate in.pfx format. See the selected Vendor's documentation for instructions on how purchase and prepare the certificates. c In the Intel RCS server, open command prompt and change directory to the Intel RCS Utility location. (%Intel SCS extracted files%\intelscs\utils) d Run the following command to import the certificate RCSUtils.exe /Certificate Add <certificate location>\<certificate_name>.pfx <password> Replace <certificate location> with the exact location where password is stored, replace <certificate_name> with the name of the certificate (vprodemo.pfx), and replace <password> with the actual password for the certificate. The RCSUtils.exe must e run in the same user context where the Intel RCS Service is running. On completion, the command screen displays the status as Success. 6 Deploy the RCS Manager plug-in Deploy the RCS Manager plug-in to the Intel RCS server. a In the McAfee epo console, go to System Tree, then select the target server hosting Intel RCS. c d e f Click the Assigned Client Tasks ta, then click Actions New Client Task Assignment. Select McAfee Agent under Product, and Product Deployment under Task Type, then click Create New Task. Type a name for the task and any notes, then select Target Platforms, as needed. In Products and components, select McAfee epo Deep Command RCS Manager xxx, select Install as the action, select the language, then click Save. Select the task from the list, then click Next. 6

7 g h Schedule the task to run immediately or as needed, then click Next. Review the summary of the task, then click Save. The task is added to the list of client tasks for the selected Intel RCS server, and is executed at the next agent-server communication. If the Intel RCS server is usy, there might e a delay in processing the WMI call. Wait for the next agent-server communication for the RCS Manager information to e updated in the McAfee epo console. 7 Create a configuration profile policy Create a configuration profile in the McAfee epo with default settings, then push it to the Intel RCS server. Configuration profiles provide settings that are required to configure the Intel AMT systems. This task includes steps to use the default remote configuration profile availale in McAfee epo. However, for advanced settings such as wireless support, create a profile in a managed Intel RCS server, then create a configuration policy using the profile. For instructions on creating a profile using Intel RCS console, see the Intel Setup and Configuration Software (Intel SCS) User Guide. The steps 7, 8, and 9 are optional steps. Skip them to use the default settings and most simplified workflow. For option definitions, click? in the interface. a c d In the McAfee epo console, navigate to Policy Catalog, select epo Deep Command Profile Manager as the product and Configuration Profile as the category, then click New Policy. Type a name for the configuration policy and any notes, then click OK. Type a description for the profile. Select the default profile template Remote configuration with TLS. e Type the Intel MEBX password, then retype it to confirm. 7

8 The Intel MEBX password: Must e 8 32 characters in length. Must contain a numeric character. Must contain a comination of lowercase and uppercase Latin alphaets. Must contain a non-alphanumeric character. Must not contain these symols. Underscore (_) Forward slash (/) Less than (<) Doule quotes (") Greater than (>) Comma (,) Colon (:) Ampersand (&) Select Show Password to see the password as you type. Password confirmation is not required with this option. f From Intel AMT Digest admin user password, select Use generated random password to use a randomly generated digest password or select Set password, type a digest password, then retype it to confirm. The Intel AMT Digest admin password: Must e 8 32 characters in length. Must contain a numeric character. Must contain a comination of lowercase and uppercase Latin alphaets. Must contain a non-alphanumeric character. Can contain alphanumeric characters. Underscore (_) is considered an alphanumeric character. Must not contain these symols. Colon (:) Doule quotes (") Comma (,) Select Show Password to see the password as you type. Password confirmation is not required with this option. g h (Optional) Select Integrate with Active Directory, then rowse to select the Active Directory Organization Units. (Optional) In AMT User accounts and rights, add digest or Kereros users, then select the required access right for them (AMT Administrator, AMT Help Desk, AMT Remote Power Control). 8

i (Optional) In the Advanced ta, complete these Remote configuration options. Remote management Select whether to enale the we interface for Intel AMT management.

IP address Select how the IP address is determined: DHCP from the DHCP server. Static the same IP address as the host.

9 i (Optional) In the Advanced ta, complete these Remote configuration options. Remote management Select whether to enale the we interface for Intel AMT management. Intel Fast Call for Help Select when a user can initiate a call for help: OS initiated from the operating system. BIOS initiated from the BIOS. IP address Select how the IP address is determined: DHCP from the DHCP server. Static the same IP address as the host. FQDN Select the source for the host name suffix: Primary DNS from the Primary DNS Suffix of the host operating system. Active directory name from the Active Directory domain where the host operating system is a memer. j Save the policy. k From the System Tree, select the Intel RCS server, click Actions Agent Set Policies & Inheritance, select epo Deep Command Profile Manager as the product, select Configuration Profile as the category, select the configuration profile policy, select Break Inheritance, then save the policy assignment. The profile created in McAfee epo appears in the Intel AMT configuration policies and is prefixed with epo_. 8 Configure Intel AMT systems using the remote configuration policy Create and enforce a remote configuration policy and select the Intel RCS server and configuration profile to e used. Intel RCS system uses Windows Management Instrumentation (WMI) to perform remote configuration. There might e a delay in remote configuration if the numer of WMI requests on the system exceeds the maximum numer of requests that can e processed at a time. For option definitions, click? in the interface. a c d In the McAfee epo console, navigate to Policy Catalog, select the epo Deep Command as the product and AMT Configuration Policies as the category, then click New Policy. Type a name for the configuration policy and any notes, then click OK. Select Allow epo to enforce these settings, then select Remote configure to enale Admin Control Mode, select the Intel RCS server and the profile to e used for the configuration. Save the policy. 9

10 e From the System Tree, assign the policy to the required systems or group. 1) Systems Click Actions Agent Set Policies & Inheritance, select epo Deep Command 2.3 as the product, select AMT Configuration Policies as the category, select the changed configuration policy, select Break Inheritance, then save the policy assignment. 2) Group Select the group, select epo Deep Command 2.3 as the product, click Edit Assignment next to AMT Configuration Policies, select the changed configuration policy under Assigned policy, then save the policy assignment. f Enforce the policy using one of these methods: Wait for the next agent-server communication or send a wake-up call. From the Intel AMT systems, click McAfee Agent Status Monitor, then click Collect and Send Properties, Check New Policies, and Enforce Policies. Click Actions AMT Actions Enforce AMT Firmware Configuration Policy. On successful policy enforcement, the selected Intel AMT systems are configured for use. To verify, navigate to the System Properties page, click the Deep Command ta, and make sure that the Configuration State is Post Configuration. 9 Enale Intel AMT features Enforce the AMT Feature Enalement policy to Intel AMT systems. For option definitions, click? in the interface. a Log on to the McAfee epo console, navigate to the System Tree. Filter systems ased on AMT tag criteria. a Click Custom, select Add, then select Tags from Managed Systems group. c Select comparison as Has Tag and value as AMT, then click Update Filter. Select the tag from Custom, rename it to AMT, if needed, then select it to filter. c d Select all systems that are filter according to the AMT tag, then select Actions AMT Actions AMT Feature Enalement. Verify the policy enforcement: 1) View the policy enforcement status in the Server Task Log. 2) Navigate to the System Tree, select an Intel AMT system, click Actions AMT Actions, and make sure that out-of-and AMT actions are not grayed out. The AMT Feature Enalement policy enales the KVM feature for you. Use the credentials for Intel AMT actions in Server Settings to connect to a system from the McAfee KVM Viewer software. Navigate to the Server Settings, select Intel AMT credentials, click Edit, then see the user name and password for Credentials for Intel AMT actions. See the epo Deep Command product guide for more details aout McAfee KVM Viewer. 10 Test your connection to an Intel AMT system Perform some actions on your Intel AMT systems to test whether they can e connected. 10

11 For option definitions, click? in the interface. a In the McAfee epo console, select Menu Systems System Tree. Select a system that you recently configured, then click Actions AMT Actions, then select one of these actions: 1) Power On Turns on the Intel AMT system. See Turn on your systems in Managing your Intel AMT systems. 2) Boot/Reoot with Actions Provides options to oot the Intel AMT system. Select Boot/Reoot from Image (IDE-R). See Boot or reoot using IDE-Redirection in Managing your Intel AMT systems. 11 Additional information For advanced configuration, see these documents or links. Deep Command product guide: page=content&id=pd25910 Deep Command known issues: page=content&id=kb84158 Deep Command quick start guide: /03/20/deep-command-quick-start-guide-updated-for-21 Deep Command demos on YouTue.com: Deep Command demos on Intel.com: enterprise-security/core-vpro-mcafee-epo-deep-command-video.html. 11

12 Copyright 2015 McAfee, Inc. Intel and the Intel logo are trademarks/registered trademarks of Intel Corporation. McAfee and the McAfee logo are trademarks/ registered trademarks of McAfee, Inc. Other names and rands may e claimed as the property of others

McAfee epo Deep Command

Quick Start Guide McAfee epo Deep Command version 2.4.1 This Quick Start Guide provides high level instructions for setting up McAfee epo Deep Command 2.4.1. For detailed instructions, refer to the McAfee