Lenovo ThinkCentre M90p Configuration manual

ThinkCentre M90p with

Intel Active Management Technology

Configuration Guide

First Edition (January 2010)

LENOVO products, data, computer software, and services have been developed exclusively at private expense and

are sold to governmental entities as commercial items as defined by 48 C.F.R. 2.101 with limited and restricted

rights to use, reproduction and disclosure.

LIMITED AND RESTRICTED RIGHTS NOTICE: If products, data, computer software, or services are delivered

pursuant a General Services Administration ″GSA″ contract, use, reproduction, or disclosure is subject to restrictions

set forth in Contract No. GS-35F-05925.

Contents

About this document .........v

Chapter 1. Introduction to Intel vPro and

Intel AMT ..............1

Acronyms ...............1

Chapter 2. Features and benefits of Intel

AMT................3

Features and benefits ...........3

Chapter 3. Introduction to ISV

applications .............5

Chapter 4. Main features of computers

built with Intel AMT ..........7

CIRA .................7

KVM redirection .............8

Chapter 5. Intel AMT setup and

configuration on Lenovo ThinkCentre

M90p desktop computers .......9

Intel AMT configuration settings in Setup Utility . . 9

Intel MEBx setup and configuration ......10

Entering the MEBx configuration user interface 11

Intel(R) ME General Settings........11

Intel(R) AMT Configuration ........19

Intel(R) Quiet System Technology Configuration 20

Driver description ............20

MEI................20

LMS................21

SOL................21

Chapter 6. Web user interface .....23

Accessing the Web user interface .......23

Provisioning the Intel AMT computer ....23

Logging on to the client .........24

Functions in the Web user interface ......24

Appendix A. Examples of configuring

Intel AMT in manual and automatic

setup and configuration modes ....25

Configuring Intel AMT in manual setup and

configuration mode............25

Configuring Intel AMT in automatic setup and

configuration mode............25

ZTC provisioning ...........25

USB provisioning ...........26

Appendix B. Factory default settings

for the Intel MEBx ..........27

Appendix C. Notices .........29

Trademarks ..............30

iv ThinkCentre M90p with Intel AMT Configuration Guide

About this document

This document provides information about Intel

®

Active Management Technology

(Intel AMT) for Lenovo

®

ThinkCentre

®

M90p desktop computers. This document

provides step-by-step instructions on how to use Intel AMT.

This document is intended for trained IT professionals or those responsible for

configuring computers throughout their organizations. The readers should have

basic knowledge of network and computer technology, and be familiar with the

terms TCP/IP, DHCP, IDE, DNS, Subnet Mask, Default Gateway, Domain Name,

and so on.

This document provides information about the following topics:

Chapter 1, “Introduction to Intel vPro and Intel AMT,” on page 1: This chapter

provides a general introduction to Intel vPro

™

and Intel AMT.

Chapter 2, “Features and benefits of Intel AMT,” on page 3: This chapter

introduces the features and benefits of Intel AMT.

Chapter 3, “Introduction to ISV applications,” on page 5: This chapter provides a

general introduction to ISV applications.

Chapter 4, “Main features of computers built with Intel AMT,” on page 7: This

chapter introduces the main features of Intel AMT built-in computers.

Chapter 5, “Intel AMT setup and configuration on Lenovo ThinkCentre M90p

desktop computers,” on page 9: This chapter provides detailed instructions on how

to configure Intel AMT settings on Lenovo ThinkCentre M90p desktop computers.

Chapter 6, “Web user interface,” on page 23: This chapter provides instructions on

how to access the Intel AMT Web user interface.

vi ThinkCentre M90p with Intel AMT Configuration Guide

Chapter 1. Introduction to Intel vPro and Intel AMT

Intel vPro is a business computer platform that provides business computers with

enhanced remote management capabilities. For computers built with Intel vPro, IT

administrators can use a third party software to remotely collect inventory

information, diagnose problems, and provide various services regardless of the

computer power state or the operating system state. IT administrators can also

isolate and protect individual computers and the network from threats.

As a feature of Intel vPro, Intel AMT is designed to provide remote management

of computers regardless of the computer power state or the operating system state

as long as the computers are connected to an electrical outlet and a network.

Acronyms

The following table lists and explains some acronyms used in this document.

Acronym Description

ACL Access Control List

AMT Active Management Technology

ASF Alert Standard Format

CIRA Client Initiated Remote Access

DHCP Dynamic Host Configuration Protocol

DNS Domain Name Server

FQDN Fully Qualified Domain Name

FW Firmware

HECI Host Embedded Controller Interface

IDE-R Integrated Device Electronics - Redirection

IP Internet Protocol

ISV Independent Software Vendor

KVM Keyboard-Video-Mouse

LMS Local Manageability Service

ME Management Engine

MEBx Management Engine BIOS Extension

MEI Management Engine Interface

NVM Nonvolatile memory

OEM Original Equipment Manufacturer

OOB Out-of-band

PID/PPS Provisioning ID and Provisioning Pre-shared Key

PKI Public Key Infrastructure

PRTC Protected Real Time Clock

PSK Pre-shared Key

PXE Preboot Execution Environment

SHA Secure Hash Algorithm

SMB Small and Medium Businesses

SOL Serial-over-LAN

TCP Transmission Control Protocol

TLS Transport Layer Security

WOL Wake on Lan

ZTC Zero Touch Configuration

2 ThinkCentre M90p with Intel AMT Configuration Guide

Chapter 2. Features and benefits of Intel AMT

This chapter introduces the features and benefits of Intel AMT.

The following table lists the Lenovo business computers with Intel AMT installed.

Lenovo computer Intel AMT version

ThinkCentre M90p Intel AMT 6.X

ThinkCentre M58p Intel AMT 5.X

ThinkCentre M57p Intel AMT 3.X

ThinkCentre M55p Intel AMT 2.X

Features and benefits

ThinkCentre M90p computers built with Intel AMT enable IT administrators to

better discover, heal, and protect the networked computing assets.

v Discover: Intel AMT stores hardware and software information in nonvolatile

memory (NVM). With built-in manageability, Intel AMT enables IT

administrators to discover assets remotely, even when computers are turned off.

v Heal: The built-in manageability of Intel AMT provides out-of-band (OOB)

management capabilities, which enable IT administrators to remotely diagnose

computer problems and recover computers even if the operating systems are

inoperable. Proactive alerting and event logging help IT administrators detect

problems quickly to reduce computer downtime.

v Protect: The Intel AMT system defense feature enables better protection for

computers by proactively blocking incoming threats, controlling infected

computers before the computers cause problems in the network, and alerting IT

administrators when critical software agents are removed from the computers.

The following table shows the features and benefits of Intel AMT.

Table 1. Features and benefits of Intel AMT

Features Benefits

OOB system access Enables remote management of clients regardless of client power

state and operating system state

Remote

troubleshooting and

recovery

Significantly reduces IT helpdesk visits and increases IT service

efficiency

Proactive alerting Decreases computer downtime and minimizes IT service time

Remote hardware asset

tracking

Increases speed and accuracy with reduced accounting costs,

compared with manual inventory tracking

4 ThinkCentre M90p with Intel AMT Configuration Guide

Chapter 3. Introduction to ISV applications

Intel AMT is designed as a building block and not a complete solution. This

enables Original Equipment Manufacturers (OEMs) to incorporate Intel AMT into

their client and server hardware platforms. Competent and authorized third party

applications provide management and security services that take advantage of the

Intel AMT features, such as out-of-band access to asset information, event logs,

hardware and software tables, and embedded capabilities.

The following table lists the common third party Independent Software Vendor

(ISV) management applications.

Table 2. List of common third party management applications

Application ISV

Microsoft

®

System Management Server 2003 Microsoft

Microsoft System Center Configuration Manager Microsoft

LANDesk Management Suite LANDesk

Altiris Real Time System Manager Altiris

6 ThinkCentre M90p with Intel AMT Configuration Guide

Chapter 4. Main features of computers built with Intel AMT

Computers built with Intel AMT version 2.0 or later have the following features

and improvements:

v Remote power control

– Power on

– Power off

– Power reset

– Power cycle

v Asset management

– E-Asset tag

– OOB hardware inventory

v Integrated Device Electronics - Redirection (IDE-R)

– Floppy redirection

– CD redirection

v Serial-over-LAN (SOL)

– Screen redirection based on text

– Keyboard redirection

– Network redirection

v Remote restart

– Restart from a local hard disk drive

– Restart from a local CD or DVD drive

– Restart from a local Preboot Execution Environment (PXE)

v Event management

– Event alerting

– Event logging

– Audit log

v Agent presence

v System defense

v “CIRA”

v “KVM redirection” on page 8

CIRA

ThinkCentre M90p computers built with Intel AMT support the Client Initiated

Remote Access (CIRA) function. You can perform this function through ISV

applications. For more information about ISV applications, see Chapter 3,

“Introduction to ISV applications,” on page 5.

The CIRA function enables client-initiated, secure OOB communication to the

manageability console, which includes:

v User-initiated call-home feature

v Scheduled, automated call-home feature (no user input required)

v Transport Layer Security (TLS) session established through client initiation

KVM redirection

ThinkCentre M90p computers built with Intel AMT 6.X support

Keyboard-Video-Mouse (KVM) redirection over Internet Protocol (IP). As an

important new feature in Intel AMT 6.X, KVM redirection enables IT

administrators to remotely control the keyboard, video or visual display unit, and

mouse of the managed clients. KVM redirection has the following advantages:

v Work stably

v Based on hardware

Note: KVM redirection is based on hardware so that it can work correctly

regardless of the operating system state of the managed clients.

v Manage clients through management servers remotely

v Healing, installation and applications support

Notes:

1. KVM redirection in Intel AMT 6.X can be used only on computers with Intel

integrated graphics. For computers with discrete graphics cards, the

Serial-over-LAN (SOL) function can be used to support remote diagnostics and

repair.

2. The KVM user interfaces are only available on computers that support KVM

redirection. For more information about KVM user interfaces, see “KVM

Configuration” on page 20.

8 ThinkCentre M90p with Intel AMT Configuration Guide

Chapter 5. Intel AMT setup and configuration on Lenovo

ThinkCentre M90p desktop computers

The Intel Management Engine (ME) is an isolated and protected computing

resource that runs on an Intel AMT computer. The Intel Management Engine BIOS

Extension (MEBx) provides a user interface to change or configure settings that

control the operation of the Intel Management Engine (ME).

All changes to the ME platform configuration settings are not cached in the MEBx,

but committed to the ME nonvolatile memory until you exit the MEBx. If the Intel

MEBx crashes in the process of the configuration, the changes that you have made

will not be saved.

Note: To perform the CIRA function, configure your computer in the MEBx for

manual setup and configuration mode or automatic setup and configuration

mode, and then use the CIRA function through ISV applications. You do not

need to do any additional setup and configuration in the MEBx.

Intel AMT configuration settings in Setup Utility

The Setup Utility program enables you to view and change the Intel AMT related

configuration settings for your computer.

To view or change the Intel AMT configuration settings, do the following:

1. Repeatedly press and release the F1 key when turning on the computer. When

you hear multiple beeps or see a logo screen, release the F1 key. The Setup

Utility program starts.

2. From the Setup Utility program main menu, select Advanced → Intel(R) AMT.

The following window will be displayed.

In the window, you can view the following Intel AMT configuration settings:

Option Default setting Description

Intel(R) AMT Control Enabled Used to enable or disable the Intel AMT

interface.

Intel(R) AMT Reset Disabled Used to enable or disable the Intel AMT reset

function.

Press <Ctrl-P> to Enter

MEBx

Enabled Used to enable or disable the entrance of the

MEBx setup configuration menu.

For more information, see the instructions and the help messages on the screen.

Intel MEBx setup and configuration

This section provides instructions on how to set up and configure Intel AMT for

your computer.

Figure 1. Intel AMT configuration settings in Setup Utility

10 ThinkCentre M90p with Intel AMT Configuration Guide

Entering the MEBx configuration user interface

Repeatedly press and release Ctrl+P when turning on the computer. When you see

the Intel Management Engine BIOS Extension window, release the Ctrl and P keys.

Press 1 to enter the Intel MEBx MAIN MENU window (Figure 2). You will be

prompted to enter the Intel ME password. Type the Intel ME default password

admin and then you will be promoted to type a new password. To set a new Intel

ME password, see “Change ME Password” on page 12.

Intel(R) ME General Settings

Select Intel(R) ME General Settings in the Intel MEBx MAIN MENU window and

press Enter. The INTEL(R) ME PLATFORM CONFIGURATION window opens

(Figure 3). This window enables you to configure the general settings of the Intel

ME, such as ME state, ME password, power control, and so on.

Figure 2. Intel MEBx MAIN MENU window

Figure 3. INTEL(R) ME PLATFORM CONFIGURATION window

Chapter 5. Intel AMT setup and configuration on Lenovo ThinkCentre M90p desktop computers 11

The following options are listed in the INTEL(R) ME PLATFORM

CONFIGURATION window:

Intel(R) ME State Control

The Intel(R) ME State Control option allows you to enable the Intel ME on the

platform or disable the Intel ME for debugging purposes.

Note: The DISABLED option allows you to disable the Intel ME for debugging

purposes. The DISABLED option is used to stop the Intel ME code from

executing at the early stage of the Intel ME boot process so that the system

has no traffic originating from the Intel ME on any of the buses. Disabling

the Intel ME enables an IT technician to debug a system problem without

any interference from the Intel ME.

Change ME Password

The Change ME Password option enables you to change the Intel ME password.

To change the Intel ME password, select Change ME Password and press Enter.

Type your new password and press Enter. When prompted to confirm the new

password, type your new password again.

Password considerations: For security reasons, it is recommended to use a strong

password that cannot be easily compromised. To set a strong password, use the

following guidelines:

v Have eight to 32 characters in length

v Contain at least one alphabetic character, one numeric character, and one symbol

(!@#$%^&*andsoon)

v Contain at least one upper case letter and one lower case letter

v You can also use the space bar and underscore (_).

Password Policy

The Password Policy option specifies when you can change the MEBx password

through the network interface.

Select Password Policy and press Enter, the following three options will be

displayed.

Option Description

DEFAULT

PASSWORD ONLY

This option enables you to change the MEBx password when the

MEBx password has not been modified.

DURING SETUP

AND

CONFIGURATION

This option enables you to change the MEBx password during the

setup and configuration. You cannot modify the MEBx password

after the setup and configuration process is completed.

ANYTIME This option enables you to change the MEBx password anytime.

Network Setup

The Network Setup menu enables you to configure network settings. Select

Network Setup and press Enter. The INTEL(R) NETWORK SETUP window opens.

The following options will be displayed:

v “Intel(R) ME Network Name Settings” on page 13

v “TCP/IP Settings” on page 13

12 ThinkCentre M90p with Intel AMT Configuration Guide

Page is loading ...

Lenovo ThinkCentre M90p Configuration manual

Lenovo ThinkCentre M90p Configuration manual

Related papers

Other documents