* Other names and brands may be claimed as the property of others. Slide 1 Intel ® vPro™ Provisioning Process with Microsoft* System Center Configuration.

* Other names and brands may be claimed as the property of others.

Slide 1

Intel® vPro™ Provisioning Process with Microsoft* System

Center Configuration Manager SP1

These process flows focus on Advanced Security by enabling Kerberos

Authentication and TLS security

* Other names and brands may be claimed as the property of others.

Slide 2

Purpose of Foils

•The following foils are intended to show the detailed flow of the Intel® vPro™ Provisioning Process with Microsoft* System Center Configuration Manager SP1– SCCM Agent Based Provisioning (PKI + FW >=3.2.1)– Bare Metal Provisioning (PKI + FW >=3.2.1)– Bare Metal Provisioning (PSK + FW <3.2.1)– Full UnProvision – Reset to Factory Default– Partial UnProvisioning

* Other names and brands may be claimed as the property of others.

Slide 3

Agent Based Provisioning (PKI + FW >=3.2.1)

1. Based on policy, the Configuration Manager Agent will assess if the client can be provisioned. If it can, it will create a One Time Password (OTP) and send the OTP to both the OOB Service and into the Intel® AMT Firmware

2. OOB Service Point secures connection with the Intel AMT client through Embedded AMT Self Sign Certificate, Present Provisioning Certificate along with the OTP for initial authentication

3. OOB Service Point sets the Remote Admin and MEBx password (if not changed)4. OOB Service Point requests a web server certificate on behalf of the Intel AMT client5. OOB Service Point created an Object in AD for the vPro client6. OOB Service Point pushes web server certificate to Intel AMT client7. OOB Service Point pushes ACL, power schema, and other configuration data to Intel AMT to finalize provision

* Other names and brands may be claimed as the property of others.

Slide 4

Bare Metal Provisioning (PKI + FW >=3.2.1)

1. Admin imports provisioning data** for client being provisioned into ConfigMgr 2007 SP12. vPro client sends a PKI hello packet to provisioning server (defined firmware schedule)3. OOB Service Point secures connection with the Intel AMT client through Embedded AMT Self Sign Certificate

and Present Provisioning Certificate for initial authentication4. OOB Service Point sets the Remote Admin and MEBx password (if not changed)5. OOB Service Point requests a web server certificate on behalf of the AMT client6. OOB Service Point created an Object in AD for the vPro Client7. OOB Service Point pushes web server certificate to AMT client8. OOB Service Point pushes ACL, power schema, and other configuration data to AMT to finalize provision

** - the collection of client provisioning data can be automated from the vPro client to SCCM, which requires an OS to run the utility but could be done from a WinPE image

Microsoft SCCMOOB Import

Wizard

* Other names and brands may be claimed as the property of others.

Slide 5

Bare Metal Provisioning (PSK + FW <3.2.1)

1. Admin imports provisioning data** for client being provisioned into ConfigMgr 2007 SP12. vPro client sends a PSK hello packet to provisioning server (defined firmware schedule)3. OOB Service Point forwards the provisioning request to the Intel WS-MAN Translator4. The Intel WS-MAN Translator passes the PSK - PID to establish the secure connection5. OOB Service Point sets Remote Admin and MEBx password routed through the Intel WS-MAN Translator6. OOB Service Point requests a web server certificate on behalf of the AMT client7. OOB Service Point created an Object in AD for the vPro client8. OOB Service Point pushes web server certificate to AMT client routed through the Intel WS-MAN Translator9. OOB Service Point pushes ACL, power schema, and other configuration data to Intel AMT to finalize provision

routed through the Intel WS-MAN Translator

** - The collection of client provisioning data can be automated from the vPro client to SCCM, which requires an OS to run the utility but could be done from a WinPE image

Microsoft SCCMOOB Import

Wizard

* Other names and brands may be claimed as the property of others.

Slide 6

Full UnProvisioning – Reset to Factory Default**

1. Using TLS-secured connection and Digest Authentication, OOB SP sends a Full Unprovision command to client

2. OOB Service Point requests revocation of web server certificate of the Intel AMT client3. OOB Service Point deletes corresponding Object in AD for the vPro client4. Intel® Management Engine does the following:

a) resets the Remote Admin and MEBx password and deletes all ACL informationb) deletes web server certificate in the Management Enginec) clears audit log, deletes audit policy, and disables auditingd) deletes provisioning profile such as power schema, wireless profiles, and other configuration data in

MEe) removes HOST Name, Domain Name, Provisioning Server IP and port

** - At conclusion of Full Unprovision, client is at Factory Default with the exception of Local Admin password for access through the MEBx

* Other names and brands may be claimed as the property of others.

Slide 7

Partial UnProvisioning

1. Using TLS-secured connection and Digest authentication, OOB SP sends a Partial Unprovision command to client2. OOB Service Point DOES NOT request revocation of web server certificate of the Intel AMT client3. OOB Service Point DOES NOT delete corresponding Object in AD for the vPro client4. Intel Management Engine DOES NOT reset the Remote Admin and MEBx password and deletes all ACL

information5. Intel Management Engine DOES NOT delete web server certificate in the Intel ME6. Intel Management Engine DOES NOT clear audit log, delete audit policy, or disables auditing7. Intel Management Engine DOES NOT remove HOST Name, Domain Name, Provisioning Server IP and port8. Intel Management Engine deletes provisioning profile such as power schema, wireless profiles, and other

configuration data in Intel ME

* Other names and brands may be claimed as the property of others.

Slide 8