background image

Intel® vPro™ and Intel® Centrino® Pro Processor Technology Quick Start Guide 

15 

 

 

A Kill All NICs policy which will stop all network traffic except for LANDesk management, Intel 
AMT, DNS, and DHCP traffic, thus isolating the client system from the network except for system 
management functions. 

 

NoteIn LANDesk 8.8 there is no GUI to create or modify System Defense filters or policies. Currently 
all modifications have to be made to the XML pages used for System Defense.
   

 

Once SD triggers an alert, the alert is displayed in the LSM log.  LANDesk and Intel AMT limit network 
access by replacing the current client policy with the Kill All NICs policy when SD is triggered.  The client 
machine is also placed in the Remediation queue, which can be found in Configure | System Defense 
| Remediation
.  Once the machine is remediated, the Kill All NICs policy is removed and the previous 
policy is re-applied.  The administrator must manually perform the actual remediation of removing the 
virus or spyware, or fixing whatever caused the SD to be triggered.  

 

 

Содержание Centrino Pro

Страница 1: ...Technology Intel Core 2 Processor with vPro Technology Intel vPro and Intel Centrino Pro Processor Technology Quick Start Guide Based on Intel Active Management Technology and LANDesk Management Suit...

Страница 2: ...onsole 11 Step 6 Test Intel vPro Client Functionality 11 Step 7 Post Configuration 13 Section 3 Deploying Intel vPro Using Enterprise Standard and Advanced Mode Provisioning 16 Process Flowchart 16 In...

Страница 3: ...e overall deployment process lists high level steps including decisions to be made which are explained in more detail in subsequent sections Deciding Which Provisioning Mode To Use Provides the necess...

Страница 4: ...vPro clients Configure Intel vPro components Intel ME and Intel AMT in Intel Management Engine BIOS Extension Intel MEBx on Intel vPro clients Discover Intel vPro clients in your management console T...

Страница 5: ...n provisioning modes is how the client system receives its configuration information In Enterprise mode you can use manual one touch or remote configuration options or have your OEM pre provision the...

Страница 6: ...tart Guide 6 Section 2 Deploying Intel vPro Using SMB Basic Mode Provisioning Process Flowchart The following picture shows the overall process flow for provisioning Intel vPro client systems in SMB m...

Страница 7: ...er Ports 16992 and 16994 to open for Intel AMT management traffic Step 2 Verify Intel vPro Client Windows Drivers The following Intel AMT drivers which are digitally signed by Intel and compatible wit...

Страница 8: ...ess functionality of systems based on Intel Centrino 2 with vPro technology Step 3a Set Password 1 In the LANDesk Configure Services tool enter a strong password on the Intel vPro Configuration tab 2...

Страница 9: ...232030 swLang 13 taskId 135 swEnv OID 1093 Lenovo http www 307 ibm com pc support site wss MIGR 67881 html Dell http support dell com support downloads driverslist aspx c us l en s gen ServiceTag Sy s...

Страница 10: ...he Intel MEBx whether you choose static IP or DHCP within SMB mode It is not necessary to enter the Domain name into the Intel MEBx for SMB mode Step 4e Set Additional Intel MEBx Parameters There are...

Страница 11: ...ist was already displayed when you moved the Intel vPro machines 5 Right click an Intel vPro machine to see all the Intel AMT selections available Discovery With the LANDesk Agent Installed on the Cli...

Страница 12: ...t console system login as an administrator with user rights 2 Open a web browser and enter the IP address and assigned port number 16992 in the browser address bar example http 192 168 0 1 16992 The f...

Страница 13: ...client agents must be installed on the client PC in order to use AP AP is automatically configured when the LANDesk client agents are installed However you can perform additional configuration in the...

Страница 14: ...esk Out of Band Monitor AMTMON Features LANDesk 8 8 has the ability to disable the network on the client at the OS level This is not done through the System Defense feature but rather through LANDesk...

Страница 15: ...e made to the XML pages used for System Defense Once SD triggers an alert the alert is displayed in the LSM log LANDesk and Intel AMT limit network access by replacing the current client policy with t...

Страница 16: ...ploying Intel vPro Using Enterprise Standard and Advanced Mode Provisioning Process Flowchart The following picture shows the overall process flow for provisioning Intel vPro client systems in Enterpr...

Страница 17: ...s fully loaded Ready for remote management SETUP SETUP Pre Pre Provisioning Provisioning CONFIGURATION CONFIGURATION Provisioning Provisioning Factory State An Intel vPro machine comes from the OEM in...

Страница 18: ...l ME also uses the DHCP server to help dynamically update the DNS server with its network address information The DHCP server must support Option 81 to register network address information into the DN...

Страница 19: ...ed in Enterprise mode to listen for Hello packets This port is configurable in the LDMS console To change the port number on the LANDesk core server do the following 1 Go to the following registry key...

Страница 20: ...the driver will cause a pop up to occur to confirm that Intel AMT is running The pop up can be disabled As the Intel AMT firmware is updated this driver is most likely to require a coordinated update...

Страница 21: ...re server is used to issue the certificates to the proper trusted devices within the network Under the Discovery Provisioning portion of the dialog box you ll find two options related to encryption Pr...

Страница 22: ...sioning server Once a matching root certificate is present on the provisioning server the Intel vPro clients will automatically authenticate themselves with the provisioning server at power on and wil...

Страница 23: ...in the Intel MEBx directly on the individual client Intel vPro parameters set in the management console are applied to all Intel vPro machines being provisioned Step 4B OEM Pre configuration Factory...

Страница 24: ...used again unless an Intel vPro machine is re provisioned Whereas the other TLS keys are used for all communications from the management console to the Intel vPro machine Step 4C 1 Confirm Latest BIO...

Страница 25: ...ferred restart the system and let it boot to Windows The Intel vPro client will automatically authenticate itself with the provisioning server and provisioning will occur 4 Repeat for each Intel vPro...

Страница 26: ...rocess This uses Transport Layer Security TLS Pre shared Key PSK for authentication To manually update the Intel vPro clients with new Intel MEBx passwords and valid PID PPS security keys do the follo...

Страница 27: ...3 Move the Intel vPro machines to your management database by right clicking one of the devices and selecting Move to Inventory Database Repeat for each Intel vPro machine 4 Click the All Devices list...

Страница 28: ...er information on testing these features refer to the following whitepaper Integrating Intel vPro Technology with LANDesk Management Products http download intel com business vpro pdfs landesk_whitepa...

Страница 29: ...ue screened at a remote site using the new Intel AMT features now available in your management console Using Agent Presence AP Agent Presence AP monitors for the existence of agents The LANDesk client...

Страница 30: ...Intel AMT and sent to the LANDesk core server The core server will then issue a System Defense policy to the client that will stop all network traffic except for LANDesk management traffic Intel AMT t...

Страница 31: ...policies Currently all modifications have to be made to the XML pages used for System Defense Once SD triggers an alert the alert is displayed in the LSM log LANDesk and Intel AMT limit network access...

Страница 32: ...is coming from the device s DHCP address Next the hostname will likely be the hostname that is registered in DNS for this client If the hostname is blank in the Management Engine or a different hostna...

Страница 33: ...ocess between the Intel AMT client your Domain services provision server and LDMS In the examples below you can see exactly what is happening between the Client in the provisioning process with RCT an...

Страница 34: ...1 IP Address 192 168 0 100 Thu 28 Feb 2008 113501 user cert 1 exists Thu 28 Feb 2008 113503 soap_ssl_client_context return 0 Thu 28 Feb 2008 113503 Action getCoreVersion Thu 28 Feb 2008 113506 GetCore...

Страница 35: ...s and certificate Thu 28 Feb 2008 113509 SetTLSKeyAndCertificate passed Thu 28 Feb 2008 113509 Action EnumerateTrustedRootCertificates Thu 28 Feb 2008 113509 EnumerateTrustedRootCertificates passed Th...

Страница 36: ...1 26 29 user cert 1 exists Thu 06 Mar 2008 11 26 31 soap_ssl_client_context return 0 Thu 06 Mar 2008 11 26 31 Action getCoreVersion Thu 06 Mar 2008 11 26 34 GetCoreVersion passed Thu 06 Mar 2008 11 26...

Страница 37: ...te Disabled Enable it now Thu 06 Mar 2008 11 26 35 SetRedirectionListenerState passed Thu 06 Mar 2008 11 26 35 Action setActivePowerPackage Thu 06 Mar 2008 11 26 35 EnumeratePowerPackages passed Thu 0...

Страница 38: ...008 11 26 37 SetHighAccuracyTimeSynch passed Thu 06 Mar 2008 11 26 37 Action EnumerateTrustedRootCertificates Thu 06 Mar 2008 11 26 37 EnumerateTrustedRootCertificates passed Thu 06 Mar 2008 11 26 37...

Страница 39: ...Pro Processor Technology Intel processor technology that provides a higher level of security and management to desktop computers ISV Independent Software Vendor LMS Local Management Service driver Pro...

Страница 40: ...Intel vPro and Intel Centrino Pro Processor Technology Quick Start Guide...

Страница 41: ...IN CONNECTION WITH INTEL PRODUCTS NO LICENSE EXPRESS OR IMPLIED BY ESTOPPEL OR OTHERWISE TO ANY INTELLECTUAL PROPERTY RIGHTS IS GRANTED BY THIS DOCUMENT EXCEPT AS PROVIDED IN INTEL S TERMS AND CONDIT...

Отзывы: