Altiris Out of Band Management Component 7.1 SP1 from Symantec Implementation Guide

Transcription

1 Altiris Out of Band Management Component 7.1 SP1 from Symantec Implementation Guide

2 Altiris Out of Band Management Component 7.1 SP1 from Symantec Implementation Guide The software described in this book is furnished under a license agreement and may be used only in accordance with the terms of the agreement. Legal Notice Copyright 2011 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, Altiris, and any Altiris or Symantec trademarks used in the product are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. The product described in this document is distributed under licenses restricting its use, copying, distribution, and decompilation/reverse engineering. No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if any. THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. The Licensed Software and Documentation are deemed to be commercial computer software as defined in FAR and subject to restricted rights as defined in FAR Section "Commercial Computer Software - Restricted Rights" and DFARS , "Rights in Commercial Computer Software or Commercial Computer Software Documentation", as applicable, and any successor regulations. Any use, modification, reproduction release, performance, display or disclosure of the Licensed Software and Documentation by the U.S. Government shall be solely in accordance with the terms of this Agreement. Symantec Corporation 350 Ellis Street Mountain View, CA

3 Technical Support Contacting Technical Support Symantec Technical Support maintains support centers globally. Technical Support s primary role is to respond to specific queries about product features and functionality. The Technical Support group also creates content for our online Knowledge Base. The Technical Support group works collaboratively with the other functional areas within Symantec to answer your questions in a timely fashion. For example, the Technical Support group works with Product Engineering and Symantec Security Response to provide alerting services and virus definition updates. Symantec s support offerings include the following: A range of support options that give you the flexibility to select the right amount of service for any size organization Telephone and/or Web-based support that provides rapid response and up-to-the-minute information Upgrade assurance that delivers software upgrades Global support purchased on a regional business hours or 24 hours a day, 7 days a week basis Premium service offerings that include Account Management Services For information about Symantec s support offerings, you can visit our Web site at the following URL: All support services will be delivered in accordance with your support agreement and the then-current enterprise technical support policy. Customers with a current support agreement may access Technical Support information at the following URL: Before contacting Technical Support, make sure you have satisfied the system requirements that are listed in your product documentation. Also, you should be at the computer on which the problem occurred, in case it is necessary to replicate the problem. When you contact Technical Support, please have the following information available: Product release level

4 Hardware information Available memory, disk space, and NIC information Operating system Version and patch level Network topology Licensing and registration Customer service Router, gateway, and IP address information Problem description: Error messages and log files Troubleshooting that was performed before contacting Symantec Recent software configuration changes and network changes If your Symantec product requires registration or a license key, access our technical support Web page at the following URL: Customer service information is available at the following URL: Customer Service is available to assist with non-technical questions, such as the following types of issues: Questions regarding product licensing or serialization Product registration updates, such as address or name changes General product information (features, language availability, local dealers) Latest information about product updates and upgrades Information about upgrade assurance and support contracts Information about the Symantec Buying Programs Advice about Symantec's technical support options Nontechnical presales questions Issues that are related to CD-ROMs or manuals

5 Support agreement resources If you want to contact Symantec regarding an existing support agreement, please contact the support agreement administration team for your region as follows: Asia-Pacific and Japan Europe, Middle-East, and Africa North America and Latin America

6

7 Contents Technical Support... 3 Chapter 1 Chapter 2 Introducing Out of Band Management Component About Out of Band Management Component About out-of-band management About supported out-of-band management technologies Altiris products that can manage computers out of band What s new in Out of Band Management Component 7.1 SP How Out of Band Management Component works About the Symantec Management Console About Intel AMT About Intel AMT Setup and Configuration Service About Intel AMT versions and features About Intel AMT configuration modes About Intel AMT security About Intel AMT related credentials About Intel AMT wireless support About ASF About DASH Comparison of Intel AMT, ASF, and DASH What you can do with Out of Band Management Component About Intel AMT tasks About ASF tasks About DASH tasks Where to get more information Planning for Out of Band Management Component installation About environment requirements About configuring DNS About configuring DHCP About configuring SQL server About integrating with Microsoft Active Directory About installing Microsoft IIS... 35

8 8 Contents Installing and configuring CA About installing.net Framework on an OOB site server About planning OOB site servers hierarchy Configuring a firewall to allow Intel SCS and SQL server connections About ports used by Intel AMT About installing Out of Band Management Component in a lab environment About managing Intel AMT computers without the Symantec Management Agent installed Chapter 3 Installing Out of Band Management Component System requirements About Out of Band Management Component requirements About client computer software and hardware requirements Installing the Out of Band Management Component product Installing an OOB site server Upgrading the Out of Band Management Component product Uninstalling Out of Band Management Component Uninstalling the Out of Band Task Plug-in Uninstalling Out of Band Management Component from Notification Server Chapter 4 Preparing target computers for management Preparing target computers for management Installing the Symantec Management Agent Configuring the Symantec Management Agent settings for evaluation use Discovering out-of-band capable computers Installing the Out of Band Task Plug-in Chapter 5 Configuring Out of Band Management Component Integrating Intel SCS with Active Directory... 55

9 Contents 9 Chapter 6 Configuring Intel AMT computers for out-of-band management About configuring Intel AMT computers for out-of-band management About Intel AMT initialization About Intel AMT setup and configuration Prerequisites for Intel AMT configuration Configuring Intel AMT computers for out-of-band management Creating Intel AMT configuration profiles Configuring the automatic Intel AMT configuration profile assignment Initializing Intel AMT computers using the Remote Configuration feature Initializing Intel AMT computers manually Setting up and configuring initialized Intel AMT computers About resending Hello messages Resending Hello messages with the Delayed Configuration policy Resending Hello messages with the Send Intel AMT Hello Message task Configuring Intel AMT computers in small business mode Chapter 7 Configuring TLS About TLS About configuring and enabling TLS Configuring TLS Exporting the CA Root Certificate for the Altiris Real-Time System Manager software Configuring the connection profile to use TLS Configuring Intel AMT computers to use TLS Configuring TLS with mutual authentication Creating and installing a client certificate using an Enterprise CA Configuring Intel AMT computers to use TLS mutual authentication Chapter 8 Configuring ASF/DASH computers for out-of-band management Configuring ASF/DASH computers for out-of-band management Installing the Broadcom ASF management software

10 10 Contents Collecting ASF/DASH configuration and hardware inventory Configuring ASF/DASH computers for out-of-band management What to do next Chapter 9 Deploying OOB site servers About site services About OOB site servers Prerequisites for OOB site server installation Installing an OOB site server Viewing Out of Band Potential Site Servers Configuring the OOB site server installation settings Rolling out the OOB site server Upgrading the Out of Band Site Server Uninstalling an OOB site server Configuring the default OOB site server location Chapter 10 About Out of Band Management Component pages Auxiliary profiles: 802.1x Profiles page x Profiles: Add 802.1x Profile dialog box Select Certificate Generation Properties dialog box Add Certificate Generation Properties dialog box Select Certificate Template dialog box Auxiliary profiles: Management Presence Servers page Management Presence Servers: Add Management Presence Server dialog box Auxiliary profiles: Remote Access Policies page Remote Access Policies: Create Remote Policy dialog box Auxiliary Profiles: Wireless Profiles page Wireless Profiles: Add Wireless Profile dialog box Trusted Root Certificates page Trusted Root Certificates: Select a Certificate Authority dialog box Trusted Root Certificates: Import Trusted Root Certificate dialog box Configuration Profiles page Setup and configuration profile: General tab Setup and configuration profile: Network tab Setup and configuration profile: TLS tab Setup and configuration profile: ACL tab

11 Contents 11 Setup and configuration profile: Wireless Profiles tab Setup and configuration profile: Power Policy tab Setup and configuration profile: Domains tab Setup and configuration profile: Remote Access tab DNS configuration page General page Select Active Directory Organizational Unit dialog box Maintenance page Security keys page Service location page Users page Delayed Setup and Configuration page Intel AMT Computers page Profile assignments page Resource Synchronization page Assign profile dialog box Get ASF/DASH Configuration Inventory task Update ASF Configuration Settings task Update DASH Configuration Settings task OOB Site Service page Certificate Enrollment task Firewall Configuration task FQDN Synchronization task Install Intel Setup and Configuration Server task Install OOB Site Service agent task Install Out of Band Management Site Service Agent and Intel Setup and Configuration Server job Intel Setup and Configuration Server Upgrade job Intel Setup and Configuration Server Upgrade Job: internal task OOB Site Server Inventory task Send Intel AMT Hello Message task Appendix A Troubleshooting Out of Band Management Component Viewing Intel SCS logs About Intel SCS error messages About Intel AMT setup and configuration issues About Intel SCS console integration About Intel AMT filters update Troubleshooting OOB site server installation

12 12 Contents Appendix B Reference topics About passwords used with Intel AMT About populating filters How Resource Synchronization policy works Remote Configuration certificate requirements Remote Configuration certificate differences between releases Intel AMT Release Intel AMT Release Intel AMT Release Glossary Index

13 Chapter 1 Introducing Out of Band Management Component This chapter includes the following topics: About Out of Band Management Component What s new in Out of Band Management Component 7.1 SP1 How Out of Band Management Component works What you can do with Out of Band Management Component Where to get more information About Out of Band Management Component Altiris Out of Band Management Component software (formerly known as Altiris Out of Band Management Solution) lets you discover computers with ASF, DASH, and Intel AMT in your environment and configure the computers for out-of-band management. Out-of-band management is the ability to manage client computers regardless of the state of their power, operating system, or management agents. You can remotely change the power state of the computer, collect hardware inventory, and perform other management tasks that would normally require a visit to a client computer. See About out-of-band management on page 14.

14 14 Introducing Out of Band Management Component About Out of Band Management Component Figure 1-1 Out of Band Management Component features About out-of-band management Remote management of client computers often requires the managed computer to be turned on with an operating system running. When a computer is turned on with a running operating system, the computer is considered in-band. Out-of-band is when a client computer is in one of the following out-of-band states: The computer is plugged in but is not actively running (off, standby, hibernating). The operating system is not loaded (software or boot failure). The software-based management agent is not available. Out-of-band management is the ability to manage computers in these states. Computers with Intel AMT, ASF, DASH, or IPMI capabilities can be managed out of band. See About Intel AMT on page 17. See About ASF on page 24. See About DASH on page 25.

15 Introducing Out of Band Management Component What s new in Out of Band Management Component 7.1 SP1 15 About supported out-of-band management technologies Out of Band Management Component supports computers with the following out-of-band management technologies: Intel Active Management Technology (Intel AMT) 2.0 and later (also known as Intel vpro and Intel Centrino Pro technology) See About Intel AMT on page 17. Broadcom ASF 2.0 and Intel ASF 2.0 See About ASF on page 24. Broadcom DASH See About DASH on page 25. Altiris products that can manage computers out of band You can manage computers out of band using the following Altiris products: Altiris Real-Time Console Infrastructure Altiris Real-Time System Manager These Altiris products let you perform the following out-of-band management tasks: Turn on, turn off, or restart computers. Configure hardware alerts and change the alerts destination address. Collect the hardware information that is stored in the NVRAM of the Intel AMT device. Boot a computer from a remote disk or an image on a server and run the operating system repair or reinstall. Start a remote control session from the Symantec Management Console and access BIOS to view and change settings (Intel AMT only). See About Out of Band Management Component on page 13. What s new in Out of Band Management Component 7.1 SP1 The SP1 release of Out of Band Management Component 7.1 includes new features. If you are migrating directly from 7.0 to 7.1 SP1, you should read the 7.1 release notes. The 7.1 release notes include information about what changed from 7.0 to 7.1. They also include changes to system requirements from 7.0, which you must

16 16 Introducing Out of Band Management Component How Out of Band Management Component works implement to use the 7.1 SP1 product effectively. The 7.1 release notes are available at the following URL: Table 1-1 Feature List of new features Description Support for new platforms. You can install Out of Band Task Agent on the computers that are running the following platforms: Windows 7 SP1 Windows Server 2008 R2 SP1 See About out-of-band management on page 14. How Out of Band Management Component works Out of Band Management Component installs Intel SCS on the Notification Server computer and integrates it into the Symantec Management Console. From the Symantec Management Console you can configure Intel SCS settings, discover Intel AMT capable computers, and configure them for out-of-band management. See About the Symantec Management Console on page 16. Also, Out of Band Management Component provides you with the tools to discover ASF and DASH capable computers and configure them for out-of-band management. You can manage configured Intel AMT, ASF, and DASH computers with Altiris solutions that support out-of-band technologies. See Altiris products that can manage computers out of band on page 15. About the Symantec Management Console The Symantec Management Console is the Web browser based administration console for working with Symantec Management Platform and solutions, including Out of Band Management Component. The console lets you perform tasks, schedule events, run reports, perform configuration, configure security, and more. You can run the console from the Notification Server computer (locally) or from a remote computer with a network connection to Notification Server. This means that you can perform administration tasks from wherever you are.

17 Introducing Out of Band Management Component How Out of Band Management Component works 17 About Intel AMT The console lets you set security that is specific to each console user. You specify which areas of the console a user has access to and the rights that a user has to perform specific actions. For example, one user can run reports while another user can only view reports that have already been run. You can start the console remotely by typing the following URL into the Internet Explorer's address bar: For more information on the console, see the Symantec Management Platform Help, which can be accessed through the console's Help menu. Intel Active Management Technology (Intel AMT) is a part of Intel vpro technology, which provides the following technology capabilities: Remote manageability Security Lets you remotely inventory, diagnose, and repair computers even those that are turned off reducing costly desk-side visits and increasing user uptime. Lets third-party security software identify more threats before they reach the operating system. You can isolate infected systems more quickly and update computers regardless of their power state. Intel AMT is a solution that is based in hardware and firmware and is connected to the system's auxiliary power plane. Despite the power state or the operating system state of the client computer, Intel AMT provides IT administrators with access to alerts, hardware inventory, power management, network filtering, and agent presence functionality. Intel AMT functionality requires the computer to be plugged into the power source and connected to the network. Intel AMT functionality does not require a software agent to be installed on the client computer. Altiris Out of Band Management Component, Altiris Real-Time Console Infrastructure, and Altiris Real-Time System Manager software support Intel AMT 2.0 and later. See About out-of-band management on page 14. See About configuring Intel AMT computers for out-of-band management on page 57. See About Intel AMT tasks on page 26.

18 18 Introducing Out of Band Management Component How Out of Band Management Component works About Intel AMT Setup and Configuration Service Intel AMT Setup and Configuration Service (Intel SCS) provides you with the tools to set up and configure Intel AMT devices. Intel SCS is automatically installed on the OOB site server computer (by default, the Notification Server computer). See About OOB site servers on page 120. Intel SCS installation creates a new database on the SQL server. This database stores configuration parameters and administrative connection credentials for each Intel AMT computer that you set up and configure with Out of Band Management Component. Out of Band Management Component integrates Intel SCS into the Symantec Management Platform and provides the interface for Intel SCS in the Symantec Management Console. About Intel AMT versions and features Out of Band Management Component supports several versions of Intel AMT. Table 1-2 Intel AMT versions and features Feature Desktop (D) or notebook (N) support D D N N D N D D D/N Remote platform (sw\hw) asset tracking X X X X X X X X X X Remote diagnostics and repair X X X X X X X X X X Agent presence checking and alerting X X X X X X X X X X System isolation and recovery X X X X X X X X X Enterprise mode with TLS\Kerberos X X X X X X X X X Upgradeable remote firmware X X X X X X X X X Remote configuration X X X X X X X Wireless support (802.11i, VPN) X X X X x native support X X X X X X X CIRA (Client Initiated Remote Access) X X X X Full compliance to the DASH 1.0 standard X X KVM over IP X

19 Introducing Out of Band Management Component How Out of Band Management Component works 19 See How Out of Band Management Component works on page Notebook computers only About Intel AMT configuration modes You can configure Intel AMT computers for out-of-band management in one of the two modes: Small business mode See About Intel AMT small business mode on page 19. Enterprise mode. See About Intel AMT enterprise mode on page 19. See Comparison of Intel AMT small business and enterprise mode on page 20. About Intel AMT small business mode Intel AMT small business configuration mode is easy to set up and is recommended when you have a few Intel AMT computers. You can also use this mode if your enterprise does not have DHCP or DNS services available or if using these services is not allowed for security or other reasons. This mode does not support Transport Layer Security (TLS), so communications between computers are not encrypted. This mode works well in the environments that do not have a security infrastructure. Because small business mode is designed for small environments, this mode does not support communications across subnets. If your environment incorporates subnets, use enterprise mode. See About TLS on page 95. See About Intel AMT enterprise mode on page 19. If you are new to Intel AMT and want to evaluate the technology, you can configure a few computers in small business mode. Small business mode lets you get things set up and running more quickly. Setting up an Intel AMT computer in small business mode is a manual process that is performed though the Intel AMT capable computer s BIOS. Out of Band Management Component is not involved in the configuration process. After setup, the computer is ready to be managed out of band. See Configuring Intel AMT computers in small business mode on page 91. About Intel AMT enterprise mode Intel AMT enterprise configuration mode is designed to serve the needs of large enterprises. When this mode is supported with the proper network infrastructure services, it can provide automated (one-touch or remote) configuration for Intel

20 20 Introducing Out of Band Management Component How Out of Band Management Component works AMT devices. This mode also supports the configuration of wireless features on the Intel AMT device and integration with Microsoft Active Directory. This mode supports multiple security options: an Intel AMT access control list, and the option to encrypt communications through the use of Transport Layer Security (TLS). See About TLS on page 95. Use Out of Band Management Component to control the process of enterprise mode Intel AMT configuration from the Symantec Management Console. See About configuring Intel AMT computers for out-of-band management on page 57. Comparison of Intel AMT small business and enterprise mode Intel AMT small business configuration mode is easy to set up and is recommended when you have a few Intel AMT computers. Intel AMT enterprise configuration mode is designed to serve the needs of large enterprises and is more secure. See About Intel AMT small business mode on page 19. See About Intel AMT enterprise mode on page 19. Table 1-3 Differences between Intel AMT small business and enterprise modes Feature Setup and configuration application (Out of Band Management Component) Setup and configuration Remote setup and configuration Encrypted communications Microsoft Active Directory integration Small-business mode Not needed Must be set up through the MEBx on the computer Not supported Not supported Not supported Enterprise mode Required and provided through Intel SCS, which is installed with the solution Can be pre-set up from the factory, implemented through a USB key, or manually through the MEBx Intel AMT 2.2, 2.6, 3.0, 4.0, and 5.0 support zero-touch remote configuration method TLS encryption through use of Microsoft certification authority Supported

21 Introducing Out of Band Management Component How Out of Band Management Component works 21 Table 1-3 Differences between Intel AMT small business and enterprise modes (continued) Feature Wireless management support Network subnet support Access control list for accessing Intel AMT Intel AMT password support Small-business mode Not supported Not supported Not supported Must manually change passwords on the computer Enterprise mode Supported Supported Supported Centrally managed passwords through the management console About Intel AMT security One of the key benefits of Intel AMT over other out-of-band technologies, such as Wake on LAN, is the security features. Table 1-4 Feature Intel AMT credentials Intel AMT security features Description The user name and the password that you use to connect to the Intel AMT device remotely. These credentials should not be confused with the MEBx credentials, which by default share the same user name and password as the remote access Intel AMT credentials. See About Intel AMT related credentials on page 22. Access Control List (Enterprise mode only) The Intel AMT access control list (ACL) manages who has access to which capabilities within Intel AMT. An ACL entry has a user ID and a list of realms to which a user has access. This access is required to use the functionality that is associated with a realm. PID-PPS security key pair (Enterprise mode only) Two kinds of ACL entries exist: Kerberos and Digest. The main difference between them is that Kerberos entries have an Active Directory SID to identify a user or group of users. Digest entries have a user name and password for user identification. When Microsoft Active Directory is used, user identities are imported from Active Directory; otherwise, user identities are added manually. A pair of keys that are used to ensure a secure connection when the configuration server configures an Intel AMT device. After a device is configured, these keys are no longer used and are deleted from the Intel SCS database.

22 22 Introducing Out of Band Management Component How Out of Band Management Component works Table 1-4 Feature TLS encryption (Enterprise mode only) Intel AMT security features (continued) Description TLS lets you encrypt communications between the configuration server and the Intel AMT device after the device has been configured. The encryption can be one direction (from the Intel AMT device to the configuration server) or both directions (mutual authentication). If you want to use TLS, you must use Intel AMT in enterprise mode and have access to Microsoft certification authority. See About TLS on page 95. Figure 1-2 Out of Band Management Component modes and security About Intel AMT related credentials The Intel AMT administrative credentials and MEBx admin credentials often get confused as the same credentials, but they are different and have different purposes. By default, the administrator account for both credentials is admin and the password is admin. The MEBx credentials control local access to the MEBx on the computer and some Intel AMT settings. The Intel AMT administrative

23 Introducing Out of Band Management Component How Out of Band Management Component works 23 credentials control remote access to the Intel AMT settings (for example, when you run an out-of-band task from the Symantec Management Console, or access the Intel AMT Web UI). When you access the MEBx for the first time, you must supply the default administrator credentials, and then you are prompted to change the password. This change modifies not only the MEBx admin account password but also the Intel AMT administrative account password. Later, when you set up and configure Intel AMT computers, you change the Intel AMT administrator password again and make it different from the MEBx one. Table 1-5 Credentials MEBx Out of Band Management Component credentials Description Used to locally access the MEBx. The default administrator account and password are admin. During the Intel AMT initialization process, the default password is changed to a user-specified password (as defined in the configuration profile). See Creating Intel AMT configuration profiles on page 62. Intel AMT Used in the remote management of Intel AMT. The default administrator account and password are admin. During the Intel AMT setup and configuration process, the default password is changed to a user-specified or randomly generated password (as defined in the configuration profile). See Creating Intel AMT configuration profiles on page 62. Altiris solutions use these credentials to perform remote management tasks. Intel SCS Users Used to access Intel SCS that is running on the OOB site server computer (by default, the Notification Server computer). At the time of Out of Band Management Component installation, all users in the Symantec Administrators group are added to the list of the Intel SCS users. See Users page on page 152. Access control list (Enterprise mode only) A list of users that can remotely access Intel AMT settings and the rights that they have. Intel AMT devices are configured with this list during the setup and the configuration process (as defined in the configuration profile). See Creating Intel AMT configuration profiles on page 62.

24 24 Introducing Out of Band Management Component How Out of Band Management Component works Table 1-5 Credentials Out of Band Management Component credentials (continued) Description Symantec Management Console Used to access the Symantec Management Console. Users can have rights to access specific data and perform certain management tasks. For more information, see the Symantec Management Platform Help. PID-PPS security key pair (Enterprise mode only) A pair of security keys that are used to ensure secure communications between the configuration server and the Intel AMT computer. After a computer is configured, these keys are no longer used. These keys are generated and entered into the Intel AMT device during the initialization process. See About Intel AMT initialization on page 58. About Intel AMT wireless support (Intel AMT 2.5, 2.6, 4.0, 6.0 and later) Out of Band Management Component lets you configure wireless features of Intel AMT through wireless profiles. A wireless profile defines how the system connects to the wireless access point when the operating system is not loaded. Different wireless profiles can be created and used to support different access points. See About Intel AMT on page 17. Through wireless profiles you can configure the following features: Key management - Wi-Fi Protected Access (WPA). Robust Secure Network (RSN) key management schemes are supported. Encryption algorithm - Temporal Key Integrity Protocol (TKIP) and Counter Mode CBC Mac Protocol (CCMP) are supported. Authentication - A pass phrase or 802.1x profile can be used to ensure that only authorized users can establish a connection with the Intel AMT device. About ASF ASF (Alert Standard Format) is an industry standards-based technology that lets IT administrators manage computers regardless of the operating system state. ASF performs completely out of band and only relies on the operating system to configure the solution.

25 Introducing Out of Band Management Component How Out of Band Management Component works 25 ASF provides alerting and power management functionality as long as the computer is plugged in with Ethernet connection. ASF functionality is accomplished through hardware on the network card or system board, a software agent on the client computer, and management software on the server. Altiris Out of Band Management Component, Altiris Real-Time Console Infrastructure, and Altiris Real-Time System Manager software support ASF 2.0. See About ASF tasks on page 27. About DASH DASH (Desktop and Mobile Architecture for System Hardware) is a Web services-based management technology that enables IT professionals to remotely manage desktop and mobile computers from anywhere in the world. The technology lets administrators securely turn the power on/off, query system inventory, and push firmware updates among other things, regardless of the state of the remote computer. Altiris Out of Band Management Component, Altiris Real-Time Console Infrastructure, and Altiris Real-Time System Manager software support Broadcom and Intel implementations of DASH. See Configuring ASF/DASH computers for out-of-band management on page 113. See About DASH tasks on page 27. Comparison of Intel AMT, ASF, and DASH Out of Band Management Component supports Intel AMT, ASF, and DASH out-of-band management technologies. See About Intel AMT on page 17. See About ASF on page 24. See About DASH on page 25. Table 1-6 Intel AMT, ASF, and DASH comparison Feature Intel AMT ASF DASH Network support Supports the networks that include subnets. Does not support subnets. Supports the networks that include subnets.

26 26 Introducing Out of Band Management Component What you can do with Out of Band Management Component Table 1-6 Intel AMT, ASF, and DASH comparison (continued) Feature Intel AMT ASF DASH Security Supports the user name and password authentication, an access control list, and TLS encryption (Enterprise mode only) of communications. Supports the Operator and Administrator Authentication Keys authentication for performing remote power management commands. Supports the user name and password authentication, encrypted communications using certificates. Standards Non-standards based. Based on an open standard that is developed through DMTF. Based on an open standard that is developed through DMTF. Intended use Small to large environments with multiple options for security. Small to medium size environments. Small to large environments with multiple options for security. What you can do with Out of Band Management Component About Intel AMT tasks Out of Band Management Component helps you configure Intel AMT, ASF, or DASH devices on the computers that support these technologies, so these computers can be managed out of band. See About Intel AMT tasks on page 26. See About ASF tasks on page 27. See About DASH tasks on page 27. Out of Band Management Component lets you perform the following Intel AMT tasks: Discover Intel AMT capable computers. Set up and configure computers with Intel AMT so that they can be managed out-of-band by other Altiris solutions. Define service configuration parameters for Intel SCS.

27 Introducing Out of Band Management Component What you can do with Out of Band Management Component 27 About ASF tasks About DASH tasks Create the profiles that define the setup and the configuration parameters for Intel AMT, including wireless parameters. Manage the list of valid PID-PPS keys that match what is to be installed on the Intel AMT computers that await initialization. Remotely set the host name, either detected automatically or entered manually, for an Intel AMT network interface. View and manage the entries that identify each Intel AMT computer that is configured or not configured. Remotely reset or re-configure Intel AMT computers, synchronize clocks, change power-saving policies, and so on. Control the list of users that have access to the Intel SCS console and to the Intel AMT devices and the permissions they have. See About configuring Intel AMT computers for out-of-band management on page 57. Out of Band Management Component lets you perform the following ASF tasks: Discover ASF-capable computers. Install the ASF management agent on the computers. Collect ASF configuration inventory. Configure the default connection, security, and remote power control settings on client computers with ASF. Configure the ASF alerts that can help you be more proactive in responding to memory faults, temperature issues, hard drive warnings, chassis intrusion, and so forth. These alerts help you fix issues before they become destructive. See About ASF on page 24. Out of Band Management Component lets you perform the following DASH tasks: Discover DASH-capable computers. Install the DASH management agent on the computers. Collect DASH configuration inventory. Configure connection and security settings on client computers with DASH. See Configuring ASF/DASH computers for out-of-band management on page 113.

28 28 Introducing Out of Band Management Component Where to get more information Where to get more information Use the following documentation resources to learn about and use this product. Document Release Notes Table 1-7 Description Information about new features and important issues. Documentation resources Location The Product Support page, which is available at the following URL: When you open your product's support page, look for the Documentation link on the right side of the page. Implementation Guide Information about how to install, configure, and implement this product. The Product Support page, which is available at the following URL: When you open your product s support page, look for the Documentation link on the right side of the page. User Guide Information about how to use this product, including detailed technical information and instructions for performing common tasks. The Documentation Library, which is available in the Symantec Management Console on the Help menu. The ProductSupport page, which is available at the following URL: When you open your product s support page, look for the Documentation link on the right side of the page. Help Information about how to use this product, including detailed technical information and instructions for performing common tasks. Help is available at the solution level and at the suite level. The Documentation Library, which is available in the Symantec Management Console on the Help menu. Context-sensitive help is available for most screens in the Symantec Management Console. You can open context-sensitive help in the following ways: The F1 key when the page is active. The Context command, which is available in the Symantec Management Console on the Help menu. This information is available in HTML help format. In addition to the product documentation, you can use the following resources to learn about Symantec products.

29 Introducing Out of Band Management Component Where to get more information 29 Resource SymWISE Support Knowledgebase Symantec Connect Table 1-8 Description Articles, incidents, and issues about Symantec products. An online resource that contains forums, articles, blogs, downloads, events, videos, groups, and ideas for users of Symantec products. Symantec product information resources Location

30 30 Introducing Out of Band Management Component Where to get more information

31 Chapter 2 Planning for Out of Band Management Component installation This chapter includes the following topics: About environment requirements About configuring DNS About configuring DHCP About configuring SQL server About integrating with Microsoft Active Directory About installing Microsoft IIS Installing and configuring CA About installing.net Framework on an OOB site server About planning OOB site servers hierarchy Configuring a firewall to allow Intel SCS and SQL server connections About ports used by Intel AMT About installing Out of Band Management Component in a lab environment About managing Intel AMT computers without the Symantec Management Agent installed

32 32 Planning for Out of Band Management Component installation About environment requirements About environment requirements The environment requirements for Out of Band Management Component are as follows: Before you install Out of Band Management Component, you must configure the SQL server that you want Intel SCS to use in mixed authentication mode (Windows Authentication and SQL Server Authentication). See About configuring SQL server on page 34. You must configure DNS to resolve the ProvisionServer host name to the computer with OOB site server installed (by default, the Notification Server computer). You can do this before or after you install Out of Band Management Component. See About configuring DNS on page 33. See About OOB site servers on page 120. Installing Out of Band Management Component and Out of Band site server in this environment lets you perform the following actions: Configure ASF- and DASH-capable computers for out-of-band management. Manually set up and configure Intel AMT-capable computers for out-of-band management without the use of Intel AMT security features. However, if you plan to use more Intel AMT features (for example, TLS, Remote Configuration, Kerberos users, 802.1x profiles), more conditions must be met. You can prepare the environment before or after you install Out of Band Management Component. Table 2-1 Out of Band Management Component environment requirements for Intel AMT features Prerequisites Simple enterprise mode Intel AMT setup and configuration Kerberos users TLS TLS with mutual authentication, 802.1x profiles Remote Configuration Windows 2003 SP2 or later Required Required Required Required Required Active Directory Optional Required Optional Required Required Stand-alone certification authority Optional Optional Required Not supported Not supported

33 Planning for Out of Band Management Component installation About configuring DNS 33 Table 2-1 Out of Band Management Component environment requirements for Intel AMT features (continued) Prerequisites Simple enterprise mode Intel AMT setup and configuration Kerberos users TLS TLS with mutual authentication, 802.1x profiles Remote Configuration Enterprise certification authority Optional Optional Optional (supported only where Active Directory is present) Required Required DHCP server (with option 15 support) Optional Optional Optional Optional Required See About integrating with Microsoft Active Directory on page 35. See Installing and configuring CA on page 36. See About configuring DHCP on page 34. About configuring DNS The OOB site server computer (by default, the Notification Server computer) must be registered in the DNS as ProvisionServer. Intel AMT computers send their Hello packets to this host name. If the OOB site server computer already has a name, other than ProvisionServer, add a CNAME (canonical name) record to the DNS. To do this with a Microsoft DNS server, open the MMC DNS branch, open the Forward Lookup Zones branch, right-click the entry for the Notification Server computer, and click New Alias. Then type ProvisionServer as the alias name. You must create a ProvisionServer entry for each DNS domain. If you plan on installing multiple OOB site servers to different subnets or geographic locations, be sure that you configure DNS so that Intel AMT computers at each location contact their OOB site server computer. See About OOB site servers on page 120. After you install Out of Band Management Component, you can test if ProvisionServer resolves to the actual OOB site server computer. See DNS configuration page on page 146.

34 34 Planning for Out of Band Management Component installation About configuring DHCP About configuring DHCP The Dynamic Host Configuration Protocol (DHCP) is an Internet protocol for automating the configuration of computers that use TCP/IP. The DHCP can be used for the following purposes: To automatically assign IP addresses. To deliver TCP/IP stack configuration parameters such as the subnet mask and default router. To provide other configuration information such as the addresses for printer, time and news servers. The DHCP server dynamically provides an IP address to Intel AMT devices. You must configure your DHCP server to support Option 15 and be able to return the local domain suffix. About configuring SQL server Intel SCS requires Microsoft SQL Server Microsoft SQL Server must be configured in mixed authentication mode (Windows Authentication and SQL Server Authentication). Out of Band Management Component uses two SQL databases: Notification Server's database (Symantec_CMDB) and Intel SCS (Symantec_CMDB_IntelAMT). If you want to install multiple OOB site servers to different subnets or geographic locations, ensure that the SQL server is accessible from all these locations. All OOB site servers must use the same SQL server and the same database. See About planning OOB site servers hierarchy on page 38. You must configure the firewall on the SQL server computer to allow connections to the SQL server. See Configuring a firewall to allow Intel SCS and SQL server connections on page 39. You can install SQL server on the Notification Server computer. however, if you plan to use several other Altiris solutions or Altiris solutions that are database intensive, consider using a two-server configuration. One computer for Notification Server and one for SQL server.

35 Planning for Out of Band Management Component installation About integrating with Microsoft Active Directory 35 Table 2-2 Factor SQL server installation guidelines One-server configuration Two-server configuration Maximum number of computers to manage Update times for solutions and Notification Server processes Number of the solutions that run along with Out of Band Management Component Number of active console users 2000 Moderate Several Moderate Many 15 About integrating with Microsoft Active Directory Intel SCS uses Active Directory (AD) for Kerberos authentication using Intel AMT objects. You must integrate Out of Band Management Component with AD if you want to add Kerberos users to the Intel AMT Access Control List. Kerberos users are users in the form of DOMAIN\username. Integration with AD is also required when you want to use 802.1x authentication. The Intel AMT data that is stored in AD is used in certificate requests for that Intel AMT computer. When AD integration is enabled, during setup and configuration of an Intel AMT device, Intel SCS creates a directory entry that is based on the Intel-Management-Engine class. This directory entry contains the following data: An AD object that represents the Intel AMT device. An attribute for connecting the AD computer object to the Intel AMT object. To integrate Intel SCS with AD, the OOB site server computer (by default, the Notification Server computer) must be a member of a domain. See Integrating Intel SCS with Active Directory on page 55. About installing Microsoft IIS Notification Server, Intel SCS software, and Microsoft certification authority (if used) all require Microsoft Internet Information Services (IIS) version 6.

36 36 Planning for Out of Band Management Component installation Installing and configuring CA Microsoft IIS is a prerequisite for Notification Server installation, and it is already installed on the Notification Server computer. For default Out of Band Management Component installation, no additional steps need to be performed on IIS. You must install Microsoft IIS on the computer (other than the Notification Server computer) that you want to use for the following purposes: As an OOB site server See About OOB site servers on page 120. As a computer that hosts Microsoft certification authority See Installing and configuring CA on page 36. Note: To enable Web enrollment for certificates, install IIS before installing the certification authority. Installing and configuring CA To use certain Intel AMT features, you must install and configure the certification authority (CA). Table 2-3 Intel AMT features and the CA they require Intel AMT feature TLS CA to install If you do not have Active Directory, install a Stand-alone CA. If you have Active Directory, you can install either a Stand-alone or an Enterprise CA. TLS with Mutual Authentication Remote Configuration Install an Enterprise CA. Install an Enterprise CA. Install a Stand-alone CA on the same computer where the OOB site server computer (by default, the Notification Server computer) is installed. If you use a Stand-alone CA, there can be only one Intel SCS instance in the environment. Install an Enterprise CA on Microsoft Windows Server 2003 Enterprise Edition with Service Pack 1 or later. The Enterprise CA host must be a member of an Active Directory domain. It can be the same host as the domain controller. The user who performs the installation must be a member of the domain and have sufficient administration privileges. For example, the user must be a member of the Domain Admins group.