Symantec ALTIRIS OUT OF BAND MANAGEMENT COMPONENT 7.0 SP3 MR1 Implementation Manual

Altiris™ Out of Band

Management Component

from Symantec

Implementation Guide

Version 7.0 SP3 MR1

Altiris™ Out of Band Management Component from

Symantec Implementation Guide

The software described in this book is furnished under a license agreement and may be used

only in accordance with the terms of the agreement.

Documentation version 7.0 SP3 MR1

Legal Notice

Symantec, the Symantec Logo, Altiris, and any Altiris or Symantec trademarks used in the

product are trademarks or registered trademarks of Symantec Corporation or its affiliates

in the U.S. and other countries. Other names may be trademarks of their respective owners.

The product described in this document is distributed under licenses restricting its use,

copying, distribution, and decompilation/reverse engineering. No part of this document

may be reproduced in any form by any means without prior written authorization of

Symantec Corporation and its licensors, if any.

THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS,

REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF

MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT,

ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO

BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL

OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING,

PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED

IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE.

The Licensed Software and Documentation are deemed to be commercial computer software

as defined in FAR 12.212 and subject to restricted rights as defined in FAR Section 52.227-19

"Commercial Computer Software - Restricted Rights" and DFARS 227.7202, "Rights in

Commercial Computer Software or Commercial Computer Software Documentation", as

applicable, and any successor regulations. Any use, modification, reproduction release,

performance, display or disclosure of the Licensed Software and Documentation by the U.S.

Government shall be solely in accordance with the terms of this Agreement.

Symantec Corporation

350 Ellis Street

Mountain View, CA 94043

http://www.symantec.com

Technical Support

Symantec Technical Support maintains support centers globally. Technical

Support’s primary role is to respond to specific queries about product features

and functionality. The Technical Support group also creates content for our online

Knowledge Base. The Technical Support group works collaboratively with the

other functional areas within Symantec to answer your questions in a timely

fashion. For example, the Technical Support group works with Product Engineering

and Symantec Security Response to provide alerting services and virus definition

updates.

Symantec’s support offerings include the following:

■ A range of support options that give you the flexibility to select the right

amount of service for any size organization

■ Telephone and/or Web-based support that provides rapid response and

up-to-the-minute information

■ Upgrade assurance that delivers software upgrades

■ Global support purchased on a regional business hours or 24 hours a day, 7

days a week basis

■ Premium service offerings that include Account Management Services

For information about Symantec’s support offerings, you can visit our Web site

at the following URL:

www.symantec.com/business/support/

All support services will be delivered in accordance with your support agreement

and the then-current enterprise technical support policy.

Contacting Technical Support

Customers with a current support agreement may access Technical Support

information at the following URL:

www.symantec.com/business/support/

Before contacting Technical Support, make sure you have satisfied the system

requirements that are listed in your product documentation. Also, you should be

at the computer on which the problem occurred, in case it is necessary to replicate

the problem.

When you contact Technical Support, please have the following information

available:

■ Product release level

■ Hardware information

■ Available memory, disk space, and NIC information

■ Operating system

■ Version and patch level

■ Network topology

■ Router, gateway, and IP address information

■ Problem description:

■ Error messages and log files

■ Troubleshooting that was performed before contacting Symantec

■ Recent software configuration changes and network changes

Licensing and registration

If your Symantec product requires registration or a license key, access our technical

support Web page at the following URL:

www.symantec.com/business/support/

Customer service

Customer service information is available at the following URL:

www.symantec.com/business/support/

Customer Service is available to assist with non-technical questions, such as the

following types of issues:

■ Questions regarding product licensing or serialization

■ Product registration updates, such as address or name changes

■ General product information (features, language availability, local dealers)

■ Latest information about product updates and upgrades

■ Information about upgrade assurance and support contracts

■ Information about the Symantec Buying Programs

■ Advice about Symantec's technical support options

■ Nontechnical presales questions

■ Issues that are related to CD-ROMs or manuals

Support agreement resources

If you want to contact Symantec regarding an existing support agreement, please

contact the support agreement administration team for your region as follows:

[email protected]Asia-Pacific and Japan

[email protected]Europe, Middle-East, and Africa

[email protected]North America and Latin America

Technical Support ............................................................................................... 3

Chapter 1 Introducing Out of Band Management

Component ..................................................................... 13

About Out of Band Management Component ..................................... 13

About out-of-band management ............................................... 14

About supported out-of-band management technologies ............... 14

Altiris products that can manage computers out of band ............... 15

What’s new in Out of Band Management Component .......................... 15

How Out of Band Management Component works .............................. 15

About the Symantec Management Console .................................. 16

About Intel AMT .................................................................... 16

About Intel AMT Setup and Configuration Service ....................... 17

About Intel AMT versions and features ...................................... 17

About Intel AMT configuration modes ....................................... 18

About Intel AMT security ........................................................ 20

About Intel AMT related credentials .......................................... 22

About Intel AMT wireless support ............................................. 24

About ASF ............................................................................ 24

About DASH .......................................................................... 25

Comparison of Intel AMT, ASF, and DASH .................................. 25

What you can do with Out of Band Management Component ................ 26

About Intel AMT tasks ............................................................ 26

About ASF tasks ..................................................................... 27

About DASH tasks .................................................................. 27

Where to get more information ....................................................... 27

Chapter 2 Planning for Out of Band Management Component

installation ...................................................................... 31

About environment requirements ................................................... 32

About configuring DNS ................................................................. 33

About configuring DHCP ............................................................... 34

About configuring SQL server ........................................................ 34

About integrating with Microsoft Active Directory ............................. 35

About installing Microsoft IIS ......................................................... 36

Contents

Installing and configuring CA ......................................................... 36

About installing .NET Framework on an OOB site server ...................... 38

About planning OOB site servers hierarchy ....................................... 38

Configuring a firewall to allow Intel SCS and SQL server

connections .......................................................................... 39

About ports used by Intel AMT ....................................................... 40

About installing Out of Band Management Component in a lab

environment ......................................................................... 40

About managing Intel AMT computers without the Altiris Agent

installed ............................................................................... 41

Chapter 3 Installing Out of Band Management

Component ..................................................................... 43

System requirements .................................................................... 43

About Out of Band Management Component requirements ............ 43

About client computer software and hardware

requirements .................................................................. 44

Installing the Out of Band Management Component product ................ 45

Upgrading the Out of Band Management Component product .............. 45

Uninstalling Out of Band Management Component ............................ 45

Uninstalling the Out of Band Task Agent .................................... 46

Uninstalling Out of Band Management Component from

Notification Server ........................................................... 47

Chapter 4 Preparing target computers for management .............. 49

Preparing target computers for management .................................... 49

Discovering computers ........................................................... 51

Installing the Altiris Agent ...................................................... 51

Configuring the Altiris Agent settings for evaluation use ............... 52

Discovering out-of-band capable computers ................................ 52

Installing the Out of Band Task Agent ........................................ 53

Chapter 5 Configuring Out of Band Management

Component ..................................................................... 55

Integrating Intel SCS with Active Directory ....................................... 55

Contents8

Chapter 6 Configuring Intel AMT computers for out-of-band

management .................................................................. 57

About configuring Intel AMT computers for out-of-band

management ......................................................................... 57

About Intel AMT initialization .................................................. 58

About Intel AMT setup and configuration ................................... 59

Prerequisites for Intel AMT configuration ........................................ 61

Configuring Intel AMT computers for out-of-band management ........... 61

Creating Intel AMT configuration profiles .................................. 62

Configuring the automatic Intel AMT configuration profile

assignment ..................................................................... 64

Initializing Intel AMT computers using the Remote Configuration

feature ........................................................................... 65

Initializing Intel AMT computers manually ................................ 76

Setting up and configuring initialized Intel AMT computers .......... 82

About resending Hello messages ..................................................... 89

Resending Hello messages with the Delayed Configuration

policy ............................................................................. 89

Resending Hello messages with the Send Intel AMT Hello

Message task ................................................................... 90

Configuring Intel AMT computers in small business mode ................... 91

Chapter 7 Configuring TLS ................................................................... 95

About TLS .................................................................................. 95

About configuring and enabling TLS ................................................ 95

Configuring TLS .......................................................................... 96

Exporting the CA Root Certificate for the Altiris Real-Time

System Manager software .................................................. 97

Configuring the connection profile to use TLS ............................. 97

Configuring Intel AMT computers to use TLS .............................. 98

Configuring TLS with mutual authentication ................................... 100

Creating and installing a client certificate using an Enterprise

CA ............................................................................... 100

Configuring Intel AMT computers to use TLS mutual

authentication ............................................................... 108

Chapter 8 Configuring ASF/DASH computers for out-of-band

management ................................................................. 111

Configuring ASF/DASH computers for out-of-band

management ....................................................................... 111

Installing the Broadcom ASF management software ................... 113

9Contents

Collecting ASF/DASH configuration and hardware

inventory ...................................................................... 113

Configuring ASF/DASH computers for out-of-band

management ................................................................. 115

What to do next ......................................................................... 115

Chapter 9 Deploying OOB site servers ............................................. 117

About site services ...................................................................... 117

About OOB site servers ................................................................ 118

Prerequisites for OOB site server installation ................................... 118

Installing an OOB site server ........................................................ 119

Viewing potential OOB site server computers ............................ 119

Configuring the OOB site server installation settings .................. 120

Rolling out the OOB site server ............................................... 120

Uninstalling an OOB site server .................................................... 121

Configuring the default OOB site server location .............................. 122

Chapter 10 About Out of Band Management Component

pages .............................................................................. 123

Auxiliary profiles: 802.1x Profiles page ........................................... 124

802.1x Profiles: Add 802.1x Profile dialog box ............................ 124

Select Certificate Generation Properties dialog box ..................... 126

Add Certificate Generation Properties dialog box ....................... 126

Select Certificate Template dialog box ...................................... 127

Auxiliary profiles: Management Presence Servers page ..................... 127

Management Presence Servers: Add Management Presence Server

dialog box ..................................................................... 127

Auxiliary profiles: Remote Access Policies page ............................... 128

Remote Access Policies: Create Remote Policy dialog box ............. 129

Auxiliary Profiles: Wireless Profiles page ........................................ 130

Wireless Profiles: Add Wireless Profile dialog box ...................... 130

Trusted Root Certificates page ...................................................... 131

Trusted Root Certificates: Select a Certificate Authority dialog

box .............................................................................. 131

Trusted Root Certificates: Import Trusted Root Certificate dialog

box .............................................................................. 131

Configuration Profiles page .......................................................... 131

Setup and configuration profile: General tab ............................. 131

Setup and configuration profile: Network tab ............................ 133

Setup and configuration profile: TLS tab .................................. 135

Setup and configuration profile: ACL tab .................................. 137

Setup and configuration profile: Wireless Profiles tab ................. 138

Contents10

Setup and configuration profile: Power Policy tab ....................... 139

Setup and configuration profile: Domains tab ............................ 140

Setup and configuration profile: Remote Access tab .................... 141

DNS configuration page ............................................................... 142

General page ............................................................................. 142

Select Active Directory Organizational Unit dialog box ................ 144

Maintenance page ...................................................................... 145

Security keys page ...................................................................... 145

Service location page .................................................................. 148

Users page ................................................................................ 148

Delayed Setup and Configuration page ........................................... 149

Intel AMT systems page ............................................................... 150

Profile assignments page ............................................................. 153

Resource Synchronization page .................................................... 154

Assign profile dialog box ........................................................ 155

Get ASF/DASH Configuration Inventory task .................................. 156

Update ASF Configuration Settings task ......................................... 156

Update DASH Configuration Settings task ...................................... 160

OOB Site Service page ................................................................. 161

Certificate Enrollment task .......................................................... 164

Firewall Configuration task .......................................................... 164

FQDN Synchronization task ......................................................... 165

Install Intel Setup and Configuration Server task ............................. 165

Install OOB Site Service agent task ................................................ 165

Install Out of Band Management Site Service Agent and Intel Setup

and Configuration Server job .................................................. 165

Intel Setup and Configuration Server Upgrade job ............................ 166

Intel Setup and Configuration Server Upgrade Job: internal task ......... 166

OOB Site Server Inventory task ..................................................... 166

Send Intel AMT Hello Message task ............................................... 166

Appendix A Troubleshooting Out of Band Management

Component ................................................................... 167

Viewing Intel SCS logs ................................................................. 167

About Intel SCS error messages ..................................................... 169

About Intel AMT setup and configuration issues .............................. 173

About Intel SCS console integration ............................................... 174

About Intel AMT filters update ..................................................... 174

Troubleshooting OOB site server installation ................................... 175

11Contents

Appendix B Reference topics ................................................................ 177

About passwords used with Intel AMT ............................................ 177

About populating filters ............................................................... 178

How Resource Synchronization policy works ................................... 181

Remote Configuration certificate requirements ................................ 182

Remote Configuration certificate – differences between releases ......... 182

Intel AMT Release 2.2 ............................................................ 183

Intel AMT Release 3.0 ............................................................ 183

Intel AMT Release 2.6 ............................................................ 183

Glossary ............................................................................................................. 185

Index ................................................................................................................... 189

Contents12

Introducing Out of Band

Management Component

This chapter includes the following topics:

■ About Out of Band Management Component

■ What’s new in Out of Band Management Component

■ How Out of Band Management Component works

■ What you can do with Out of Band Management Component

■ Where to get more information

About Out of Band Management Component

Altiris Out of Band Management Component software (formerly known as Altiris

Out of Band Management Solution) lets you discover computers with ASF, DASH,

and Intel AMT in your environment and configure the computers for out-of-band

management.

Out-of-band management is the ability to manage client computers regardless of

the state of their power, operating system, or management agents. You can

remotely change the power state of the computer, collect hardware inventory,

and perform other management tasks that would normally require a visit to a

client computer.

See “About out-of-band management” on page 14.

1

Chapter

Figure 1-1

Out of Band Management Component features

About out-of-band management

Remote management of client computers often requires the managed computer

to be turned on with an operating system running. When a computer is turned

on with a running operating system, the computer is considered in-band.

Out-of-band is when a client computer is in one of the following out-of-band states:

■ The computer is plugged in but is not actively running (off, standby,

hibernating).

■ The operating system is not loaded (software or boot failure).

■ The software-based management agent is not available.

Out-of-band management is the ability to manage computers in these states.

Computers with Intel AMT, ASF, DASH, or IPMI capabilities can be managed out

of band.

About supported out-of-band management technologies

Out of Band Management Component supports computers with the following

out-of-band management technologies:

Introducing Out of Band Management Component

About Out of Band Management Component

14

■ Intel® Active Management Technology (Intel® AMT) 2.0 and later (also known

as Intel® vPro and Intel® Centrino® Pro technology)

See “About Intel AMT” on page 16.

■ Broadcom ASF 2.0 and Intel ASF 2.0

See “About ASF” on page 24.

■ Broadcom DASH

See “About DASH” on page 25.

Altiris products that can manage computers out of band

You can manage computers out of band using the following Altiris products:

■ Altiris Real-Time Console Infrastructure

■ Altiris Real-Time System Manager

These Altiris products let you perform the following out-of-band management

tasks:

■ Turn on, turn off, or restart computers.

■ Configure hardware alerts and change the alerts’ destination address.

■ Collect the hardware information that is stored in the NVRAM of the Intel

AMT device.

■ Boot a computer from a remote disk or an image on a server and run the

operating system repair or reinstall.

■ Start a remote control session from the Symantec Management Console and

access BIOS to view and change settings (Intel AMT only).

What’s new in Out of Band Management Component

In the 7.0 SP3 release of Out of Band Management Component, the following new

features are introduced:

■ Support for Microsoft Windows 7.

You can install Out of Band Task Agent on the computers that are running

Microsoft Windows 7.

How Out of Band Management Component works

Out of Band Management Component installs Intel SCS on the Notification Server

computer and integrates it into the Symantec Management Console. From the

15Introducing Out of Band Management Component

What’s new in Out of Band Management Component

Symantec Management Console you can configure Intel SCS settings, discover

Intel AMT capable computers, and configure them for out-of-band management.

See “About the Symantec Management Console” on page 16.

Also, Out of Band Management Component provides you with the tools to discover

ASF and DASH capable computers and configure them for out-of-band

management.

You can manage configured Intel AMT, ASF, and DASH computers with Altiris

solutions that support out-of-band technologies.

See “Altiris products that can manage computers out of band” on page 15.

About the Symantec Management Console

The Symantec Management Console is the Web browser based administration

console for working with Symantec Management Platform and solutions, including

Out of Band Management Component. The console lets you perform tasks, schedule

events, run reports, perform configuration, configure security, and more. You can

run the console from the Notification Server computer (locally) or from a remote

computer with a network connection to Notification Server. This means that you

can perform administration tasks from wherever you are.

The console lets you set security that is specific to each console user. You specify

which areas of the console a user has access to and the rights that a user has to

perform specific actions. For example, one user can run reports while another

user can only view reports that have already been run.

You can start the console remotely by typing the following URL into the Internet

Explorer's address bar: http://<Notification_Server_name>/altiris/console

For more information on the console, see the Symantec Management Platform

Help, which can be accessed through the console's Help menu.

About Intel AMT

Intel Active Management Technology (Intel AMT) is a part of Intel vPro technology,

which provides the following technology capabilities:

Lets you remotely inventory, diagnose, and repair computers—even

those that are turned off —reducing costly desk-side visits and

increasing user uptime.

Remote manageability

Lets third-party security software identify more threats before

they reach the operating system. You can isolate infected systems

more quickly and update computers regardless of their power

state.

Security

Introducing Out of Band Management Component

How Out of Band Management Component works

16

Intel AMT is a solution that is based in hardware and firmware and is connected

to the system's auxiliary power plane. Despite the power state or the operating

system state of the client computer, Intel AMT provides IT administrators with

access to alerts, hardware inventory, power management, network filtering, and

agent presence functionality. Intel AMT functionality requires the computer to

be plugged into the power source and connected to the network. Intel AMT

functionality does not require a software agent to be installed on the client

computer.

Altiris Out of Band Management Component, Altiris Real-Time Console

Infrastructure, and Altiris Real-Time System Manager software support Intel

AMT 2.0 and later.

See “About configuring Intel AMT computers for out-of-band management”

on page 57.

See “About Intel AMT tasks” on page 26.

About Intel AMT Setup and Configuration Service

Intel AMT Setup and Configuration Service (Intel SCS) provides you with the tools

to set up and configure Intel AMT devices. Intel SCS is automatically installed on

the OOB site server computer (by default, the Notification Server computer).

See “About OOB site servers” on page 118.

Intel SCS installation creates a new database on the SQL server. This database

stores configuration parameters and administrative connection credentials for

each Intel AMT computer that you set up and configure with Out of Band

Management Component. Out of Band Management Component integrates Intel

SCS into the Symantec Management Platform and provides the interface for Intel

SCS in the Symantec Management Console.

About Intel AMT versions and features

Out of Band Management Component supports several versions of Intel AMT.

Table 1-1

Intel AMT versions and features

6.05.15.04.03.02.62.52.22.12.0Feature

D/NDDNDNNDDDesktop (D) or notebook (N) support

XXXXXXXXXXRemote platform (sw\hw) asset

tracking

XXXXXXXXXXRemote diagnostics and repair

17Introducing Out of Band Management Component

How Out of Band Management Component works

Table 1-1

Intel AMT versions and features (continued)

6.05.15.04.03.02.62.52.22.12.0Feature

XXXXXXXXXXAgent presence checking and alerting

XXXXXXXXXSystem isolation and recovery

XXXXXXXXXEnterprise mode with TLS\Kerberos

XXXXXXXXXUpgradeable remote firmware

XXXXXXXRemote configuration

X

1

XXXWireless support (802.11i, VPN)

XXXXXXX802.1x native support

XXXXCIRA (Client Initiated Remote Access)

XXFull compliance to the DASH 1.0

standard

XKVM over IP

1

Notebook computers only

About Intel AMT configuration modes

You can configure Intel AMT computers for out-of-band management in one of

the two modes:

■ Small business mode

See “About Intel AMT small business mode” on page 18.

■ Enterprise mode.

See “About Intel AMT enterprise mode” on page 19.

See “Comparison of Intel AMT small business and enterprise mode” on page 19.

About Intel AMT small business mode

Intel AMT small business configuration mode is easy to set up and is recommended

when you have a few Intel AMT computers. You can also use this mode if your

enterprise does not have DHCP or DNS services available or if using these services

is not allowed for security or other reasons.

This mode does not support Transport Layer Security (TLS), so communications

between computers are not encrypted. This mode works well in the environments

that do not have a security infrastructure. Because small business mode is designed

Introducing Out of Band Management Component

How Out of Band Management Component works

18

for small environments, this mode does not support communications across

subnets. If your environment incorporates subnets, use enterprise mode.

See “About TLS” on page 95.

See “About Intel AMT enterprise mode” on page 19.

If you are new to Intel AMT and want to evaluate the technology, you can configure

a few computers in small business mode. Small business mode lets you get things

set up and running more quickly. Setting up an Intel AMT computer in small

business mode is a manual process that is performed though the Intel AMT capable

computer’s BIOS. Out of Band Management Component is not involved in the

configuration process. After setup, the computer is ready to be managed out of

band.

See “Configuring Intel AMT computers in small business mode” on page 91.

About Intel AMT enterprise mode

Intel AMT enterprise configuration mode is designed to serve the needs of large

enterprises. When this mode is supported with the proper network infrastructure

services, it can provide automated (one-touch or remote) configuration for Intel

AMT devices. This mode also supports the configuration of wireless features on

the Intel AMT device and integration with Microsoft Active Directory.

This mode supports multiple security options: an Intel AMT access control list,

and the option to encrypt communications through the use of Transport Layer

Security (TLS).

See “About TLS” on page 95.

Use Out of Band Management Component to control the process of enterprise

mode Intel AMT configuration from the Symantec Management Console.

See “About configuring Intel AMT computers for out-of-band management”

on page 57.

Comparison of Intel AMT small business and enterprise mode

Intel AMT small business configuration mode is easy to set up and is recommended

when you have a few Intel AMT computers. Intel AMT enterprise configuration

mode is designed to serve the needs of large enterprises and is more secure.

See “About Intel AMT small business mode” on page 18.

See “About Intel AMT enterprise mode” on page 19.

19Introducing Out of Band Management Component

How Out of Band Management Component works

Table 1-2

Differences between Intel AMT small business and enterprise modes

Enterprise modeSmall-business modeFeature

Required and provided

through Intel SCS, which is

installed with the solution

Not neededSetup and configuration

application (Out of Band

Management Component)

Can be pre-set up from the

factory, implemented

through a USB key, or

manually through the MEBx

Must be set up through the

MEBx on the computer

Setup and configuration

Intel AMT 2.2, 2.6, 3.0, 4.0,

and 5.0 support zero-touch

remote configuration method

Not supportedRemote setup and

configuration

TLS encryption through use

of Microsoft certification

authority

Not supportedEncrypted communications

SupportedNot supportedMicrosoft Active Directory

integration

SupportedNot supportedWireless management

support

SupportedNot supportedNetwork subnet support

SupportedNot supportedAccess control list for

accessing Intel AMT

Centrally managed

passwords through the

management console

Must manually change

passwords on the computer

Intel AMT password support

About Intel AMT security

One of the key benefits of Intel AMT over other out-of-band technologies, such

as Wake on LAN, is the security features.

Introducing Out of Band Management Component

How Out of Band Management Component works

20

Page is loading ...

Symantec ALTIRIS OUT OF BAND MANAGEMENT COMPONENT 7.0 SP3 MR1 Implementation Manual

This manual is also suitable for

Symantec ALTIRIS OUT OF BAND MANAGEMENT COMPONENT 7.0 SP3 MR1 Implementation Manual

Related papers

Other documents