Intel Confidential

Slide 1

Intel vPro Provisioning Process with Microsoft System Center

Configuration Manager SP1

These process flows focus on Advanced Security by enabling Kerberos

Authentication and TLS security

Intel Confidential

Slide 2

Purpose of Foils

•The following foils are intended to show the detailed flow of the Intel vPro Provisioning Process with Microsoft System Center Configuration Manager SP1– SCCM Agent Based Provisioning (PKI + FW >=3.2.1)– Bare Metal Provisioning (PKI + FW >=3.2.1)– Bare Metal Provisioning (PSK + FW <3.2.1)– Full UnProvision – Reset to Factory Default– Partial UnProvisioning

Intel Confidential

Slide 3

Agent Based Provisioning (PKI + FW >=3.2.1)

1. Based on policy, the Configuration Manager Agent will assess if the Client can be provisioned,. If it can, it will create a One Time Password and send the OTP to both the OOB Service and into the AMT Firmware

2. OOB Service Point secures connection with the AMT client through Embedded AMT Self Sign Certificate, Present Provisioning Certificate along with the OTP for initial Authentication

3. OOB Service Point sets the Remote Admin and MEBx password (if not changed)4. OOB Service Point requests a web server certificate on behalf of the AMT client5. OOB Service Point created an Object in AD for the vPro Client6. OOB Service Point pushes web server certificate to AMT client7. OOB Service Point pushes ACL, power schema, and other configuration data to AMT to finalize provision

Intel Confidential

Slide 4

Bare Metal Provisioning (PKI + FW >=3.2.1)

1. Admin imports provisioning data* for Client being provisioned into ConfigMgr 2007 SP12. vPro Client sends a PKI hello packet to provisioning server (defined firmware schedule)3. OOB Service Point secures connection with the AMT client through Embedded AMT Self Sign Certificate and

Present Provisioning Certificate for initial Authentication4. OOB Service Point sets the Remote Admin and MEBx password (if not changed)5. OOB Service Point requests a web server certificate on behalf of the AMT client6. OOB Service Point created an Object in AD for the vPro Client7. OOB Service Point pushes web server certificate to AMT client8. OOB Service Point pushes ACL, power schema, and other configuration data to AMT to finalize provision

* - the collection of client provisioning data can be automated from the vPro client to SCCM, which requires an OS to run the utility but could be done from a WinPE image

Microsoft SCCMOOB Import

Wizard

Intel Confidential

Slide 5

Bare Metal Provisioning (PSK + FW <3.2.1)

1. Admin imports provisioning data* for Client being provisioned into ConfigMgr 2007 SP12. vPro Client sends a PSK hello packet to provisioning server (defined firmware schedule)3. OOB Service Point forwards the provisioning request to the Intel WS-MAN Translator4. The Intel WS-MAN Translator passes the PSK - PID to establish the Secure Connection5. OOB Service Point sets Remote Admin and MEBx password routed through the Intel WS-MAN Translator6. OOB Service Point requests a web server certificate on behalf of the AMT client7. OOB Service Point created an Object in AD for the vPro Client8. OOB Service Point pushes web server certificate to AMT client routed through the Intel WS-MAN Translator9. OOB Service Point pushes ACL, power schema, and other configuration data to AMT to finalize provision

routed through the Intel WS-MAN Translator

* - the collection of client provisioning data can be automated from the vPro client to SCCM, which requires an OS to run the utility but could be done from a WinPE image

Microsoft SCCMOOB Import

Wizard

Intel Confidential

Slide 6

Full UnProvision – Reset to Factory Default*

1. Using TLS-secured connection and Digest Authentication, OOB SP sends a Full Unprovision command to client

2. OOB Service Point requests revocation of web server certificate of the AMT client3. OOB Service Point deletes corresponding Object in AD for the vPro Client4. Management Engine does the following:

a) resets the Remote Admin and MEBx password and deletes all ACL informationb) deletes web server certificate in MEc) deletes audit policy, and disables auditingd) deletes provisioning profile such as power schema, wireless profiles, and other configuration data in

MEe) removes HOST Name, Domain Name, Provisioning Server IP and portf) removes any customer provisioning certificate added to the MEBx

* - At conclusion of Full Unprovision, client is at Factory Default with the exception of Local Admin password for access through the MEBx

Intel Confidential

Slide 7

Partial UnProvision

1. Using TLS-secured connection and Digest authentication, OOB SP sends a Partial Unprovision command to client2. OOB Service Point DOES NOT request revocation of web server certificate of the AMT client3. OOB Service Point DOES NOT delete corresponding Object in AD for the vPro Client4. Remote Admin password is set back to default (admin)5. Management Engine DOES NOT reset the local MEBx password6. Management Engine DOES NOT delete web server certificate in ME7. Management Engine DOES NOT clear audit log, delete audit policy, or disables auditing8. Management Engine DOES NOT remove HOST Name, Domain Name, Provisioning Server IP and port9. Management Engine deletes provisioning profile such as ACLs, power schema, wireless profiles, and other

configuration data in ME

AMT Remote Admin Password: #$dR%Y>N&*AMT Remote Admin Password: admin

Intel Confidential

Slide 8