Intel vPro: Three Generations Of Remote Management

KVM Remote Control: Adding RealVNC Plus To The Mix

Everything we've talked about so far is pretty standard remote management fare. Most of it has been with vPro for quite a while, too. But KVM Remote Control is a more recent feature that was enabled when Intel put a graphics engine on its Clarkdale-based processors more than a year ago.

Now you can use RealVNC Viewer Plus software with the vPro platform for take complete control of a remote system, even before it loads up an operating system. RealVNC Viewer Plus gets access to a few features that are very common in the IPMI 2.0 implementations found on server boards, and in some cases this functionality is even a bit better. Through a TLS-encrypted tunnel, IT administrators can use RealVNC Viewer Plus to connect to the out-of-band (OOB) Management Engine. Simply, you get special VNC (that's virtual network computing, in case you were wondering) access to a hardware layer that sits beneath the operating system. You use it to take control of the keyboard, display, and mouse, facilitating the ability to turn the machine on and off, plus remotely mount disc images to load an operating system or install software. You don't need to run a VNC server on the host machine to make this functionality possible, either. 

Perhaps the most common reason you'd take remote control over a client machine would be to aid in troubleshooting. Without a feature like this, you'd either be called down to the user's desk (in an enterprise environment) or called across town to help diagnose, if you were getting paid for support. Organizations typically use tools like NetMeeting, VNC, and Remote Desktop Connection to keep from having to go to that trouble.

Logging onto RealVNC Viewer Plus is pretty easy. Note that TLS (transport layer security) encryption is available, in addition to a special connection mode for Intel's AMT KVM. Since that's one of the vPro platform's biggest benefits, the following screenshots are taken using that connection type.

As mentioned previously, AMT 7.0 allows KVM resolutions of up to 1920x1200.

Once connected, you'll immediately see a toolbar. The toolbar has fairly standard Connect, Save connection, and Disconnect capabilities.

Some of the more advanced features include the ability to remotely mount disc images to the attached computer. As you can see below, we're connecting to an image on a networked drive.

From the Intel AMT Windows client software, you're able to confirm that the image is mounted and a KVM session is active.

There are some major caveats to bear in mind, though. Because RealVNC Viewer Plus is being used to mount the disc image, transfer speeds can slow down substantially. When you're mounting a file from a networked location, the image has to be transferred over the network once to you, and then again to the client machine. As a side effect, if you're managing a machine attached wirelessly, the process can proceed pretty slowly. Of course, it's possible to speed the process up if you use a dedicated machine for management with commonly-used image files stored locally.

I once had a large operating system image take more than an hour to transfer using RealVNC Viewer Plus, which is substantially longer than many server-oriented tools take. I did find a solution in Intel's vPro Expert Center, loaded with resources for anyone getting started with this technology.

One example that stood out was Accelerate the Intel vPro Technology IDER Boot Process. This case study shows how to alleviate the boot performance issue caused by relatively slow RealVNC Plus load times using a custom boot image. Following this guide cut my operating system image mount times from over an hour to a few minutes.

Create a new thread in the US Reviews comments forum about this subject
This thread is closed for comments
21 comments
    Your comment
  • cngledad
    Can I suggest an article comparing different remote access tools we can use? From the freeware TeamViewer, VNC Viewer to such things like WebEx? I think that would be a very good topic.
    7
  • Anonymous
    ^^Don't forget Logmein Rescue which has vPro support.
    3
  • pro-gamer
    intel man please give me a job.
    Intels rock
    -4
  • NirXY
    Glad to see you made it to publish day, was waiting for this piece.
    Looking great !
    0
  • Anonymous
    One correction: DQ57TM *does* contain a v1.2 TPM, the same as found on DQ67SW and DQ67EP. It's required to be vPro compliant (necessary for Intel TXT).
    0
  • jhansonxi
    Nifty but I don't like the single-vendor lock-in. I can see real improvements in IT efficiency if this was combined with AoE. Would like to see SSH support, however.
    0
  • extremepcs
    Hopefully they have improved the activation mechanism. Kind of a PITA if you don't buy a certificate from a trusted CA. I used an internal cert and had to activate each machine by booting from a flash drive.
    1
  • chovav
    If my hard drive is encrypted using TrueCrypt pre-boot authentication, would I be able to fill in the password using Intels vPro?
    1
  • jowunger
    The voice of the guy in the video is bad. The guy talks like he is speedreading a book...
    0
  • cangelini
    cdw-vproOne correction: DQ57TM *does* contain a v1.2 TPM, the same as found on DQ67SW and DQ67EP. It's required to be vPro compliant (necessary for Intel TXT).


    Fixed, thanks!
    0
  • chovav
    Chris can you answer my question?
    0
  • pjkenned
    chovavIf my hard drive is encrypted using TrueCrypt pre-boot authentication, would I be able to fill in the password using Intels vPro?


    Generally you don't want to do this. Pre-boot authentication on encrypted drives is a security measure so that someone gaining access to a shut-down PC cannot cold boot onto the contents of the disk. For example, one shuts down a notebook that is subsequently stolen in an airport.

    In that scenario (actually fairly common) the user that now has the notebook can boot to the contents of the disk if a password was pre-filled.
    0
  • kevikom
    HP insight manager is better. Weird thing is I found out about it from a whitepaper on Dells site. I thought HP and Dell hated each other?? but we use it for PCs, servers, and it has a plugin for Vmware.... AND IT IS FREE.
    0
  • dj christian
    pjkennedFor example, one shuts down a notebook that is subsequently stolen in an airport. In that scenario (actually fairly common) the user that now has the notebook can boot to the contents of the disk if a password was pre-filled.


    So you saying that's a bad idea for the owner that he typed the pre-filled the password using vPro?
    0
  • Anonymous
    Hi, does anybody know if Intel Dq67sw motherboard Support 8Gb ddr3 Single Modules . Because Intel Technical product specification states " Support for 32GB of System Memory with four DIMMS using 4GB memory technology ".

    Are there any other Intel boards which support vPro ( VT-X , VT-D ) with 32GB for i7 2nd Generation.

    As i want to build one myself for VM.
    0
  • omerl
    pjkennedGenerally you don't want to do this. Pre-boot authentication on encrypted drives is a security measure so that someone gaining access to a shut-down PC cannot cold boot onto the contents of the disk. For example, one shuts down a notebook that is subsequently stolen in an airport. In that scenario (actually fairly common) the user that now has the notebook can boot to the contents of the disk if a password was pre-filled.

    dj christianSo you saying that's a bad idea for the owner that he typed the pre-filled the password using vPro?


    Chovav, pjkenned and dj christian - yes, you can use Intel vPro AMT to fill the Pre-Boot Authentication. You can do this either with AMT KVM (which is the simple way, but requires AMT 6 and above) or with AMT SOL (assuming TrueCrypt allows SOL.
    pjkenned - there are several scenarios which it would makes much sense to send the password for PBA remotely: 1. Support agent trying to recover a user's password. 2. Trying to boot to a computer you left in the office. The idea is not that the password is pre-filled, it is filled on real-time.
    It's actually can be a very powerful tool for the service-desk at your organization.
    0
  • omerl
    qwer5678So you saying that's a bad idea for the owner that he typed the pre-filled the password using vPro?

    I didn't really understand what you mean. If you utilize this feature correctly you can gain real value to your organization. Note my 2 suggestion of usage. If you have it kept in a DB or something similar, you must make sure this DB is encrypted and secured properly, since this is sensitive information, but you can still get it and send it to your computer using vPro encrypted over TLS/SSL channel.
    1
  • omerl
    okokpkpk - I'm saying DO NOT PRE-FILL THE PASSWORD. This is not what's vPro is all about.
    I'm saying, create a solution for your organization that allow real time password push to your clients, in case a password is forgotten. Passwords are stored securely inside the organization and are only used in case of password forgotten. Nothing else. Do no bypass the pre-boot authentication mechanism.
    0
  • masi87
    Why does noboy complain about the missing SSL for the logon page of the Web-Interface? (even thought not only logon but everything after that should also be encrypted to prevent cookie theft).
    0
  • michealPW
    I'm not sure what's more unsettling... The fact that this technology's being rolled out in so many mainstream Intel CPUs and Chipsets or the fact that I seem to be the only one that sees this as a major attack vector :|

    Good gawd what a frightening world we're marching into. Security and Privacy is becoming an unattainable dream.
    0