Sign in with
Sign up | Sign in

Intel Active Management Technology (AMT)

Intel vPro: Three Generations Of Remote Management
By

Active Management Technology is one of the most interesting pieces of Intel's vPro platform. In post-vPro 1.0 versions, the AMT engine operated from a motherboard-based processor that did its job somewhat independent of the host. By separating the management functionality, Intel made available many of the administration tasks, even when the machine was powered down and prior to the operating system booting up. If you're already familiar with technologies like IPMI 2.0 for servers, the AMT concept should sound pretty familiar.

Key AMT features include the ability to:

  • remotely turn on, off, or power cycle the machine
  • remotely mount an image to load on the machine
  • remotely access hardware asset information
  • provide serial-over-LAN (SoL) console redirection
  • provide out-of-band alerts to administrators
  • provide a secure TLS tunnel between the administrator and the vPro PC


Combined, these features are designed to give the IT administrator a management layer that sits below and functions independent of the operating system (although Intel does offer tools to integrate AMT into operating systems like Windows 7).

Intel added KVM Remote Control in AMT 6.0 to give IT administrators complete access to the keyboard, video, and mouse of a target client. You're able to take control of a properly configured workstation, from distance, and diagnose it without even needing an operating system installed. Although AMT 6.0 launched with fairly limited KVM resolutions, AMT 6.1 (exposed on the DQ57TM) added accommodations for more detailed resolution settings, making management easier. It bears note that on many IPMI 2.0-based KVM-over-IP solutions found on server motherboards, you're often limited to something like 800x600, constraining the view of a client machine. That's not really a problem for servers (many of which operate headlessly anyway). In a desktop environment, though, it's far less convenient. Currently, AMT 7.0 supports resolutions of up to 1920x1200.

One feature we weren't able to test (which is unfortunate, given the amount of attention Intel devotes to it) was Anti-Theft (AT) technology. Intel has had the ability to send a vPro-enabled PC a "poison pill" to brick it, should someone steal the machine. Really, this is most useful for mobile systems, and less so on the desktop.

In AMT 7.0, Intel makes it possible to use a 3G cellular signal to send that remote kill command, greatly improving your chances of deactivating a stolen computer before it gives up any sensitive information. Administrators can use similar technology to reactivate the computer once it is recovered.

Display all 21 comments.
  • 7 Hide
    cngledad , September 27, 2011 6:37 AM
    Can I suggest an article comparing different remote access tools we can use? From the freeware TeamViewer, VNC Viewer to such things like WebEx? I think that would be a very good topic.
  • 3 Hide
    Anonymous , September 27, 2011 11:43 AM
    ^^Don't forget Logmein Rescue which has vPro support.
  • -4 Hide
    pro-gamer , September 27, 2011 1:17 PM
    intel man please give me a job.
    Intels rock
  • 0 Hide
    NirXY , September 27, 2011 8:53 PM
    Glad to see you made it to publish day, was waiting for this piece.
    Looking great !
  • 0 Hide
    Anonymous , September 27, 2011 10:28 PM
    One correction: DQ57TM *does* contain a v1.2 TPM, the same as found on DQ67SW and DQ67EP. It's required to be vPro compliant (necessary for Intel TXT).
  • 0 Hide
    jhansonxi , September 27, 2011 10:44 PM
    Nifty but I don't like the single-vendor lock-in. I can see real improvements in IT efficiency if this was combined with AoE. Would like to see SSH support, however.
  • 1 Hide
    extremepcs , September 28, 2011 9:09 AM
    Hopefully they have improved the activation mechanism. Kind of a PITA if you don't buy a certificate from a trusted CA. I used an internal cert and had to activate each machine by booting from a flash drive.
  • 1 Hide
    chovav , September 28, 2011 9:20 AM
    If my hard drive is encrypted using TrueCrypt pre-boot authentication, would I be able to fill in the password using Intels vPro?
  • 0 Hide
    jowunger , September 28, 2011 1:29 PM
    The voice of the guy in the video is bad. The guy talks like he is speedreading a book...
  • 0 Hide
    cangelini , September 28, 2011 6:02 PM
    cdw-vproOne correction: DQ57TM *does* contain a v1.2 TPM, the same as found on DQ67SW and DQ67EP. It's required to be vPro compliant (necessary for Intel TXT).


    Fixed, thanks!
  • 0 Hide
    chovav , September 29, 2011 2:10 PM
    Chris can you answer my question?
  • 0 Hide
    pjkenned , September 30, 2011 3:44 PM
    chovavIf my hard drive is encrypted using TrueCrypt pre-boot authentication, would I be able to fill in the password using Intels vPro?


    Generally you don't want to do this. Pre-boot authentication on encrypted drives is a security measure so that someone gaining access to a shut-down PC cannot cold boot onto the contents of the disk. For example, one shuts down a notebook that is subsequently stolen in an airport.

    In that scenario (actually fairly common) the user that now has the notebook can boot to the contents of the disk if a password was pre-filled.
  • 0 Hide
    kevikom , October 10, 2011 11:13 AM
    HP insight manager is better. Weird thing is I found out about it from a whitepaper on Dells site. I thought HP and Dell hated each other?? but we use it for PCs, servers, and it has a plugin for Vmware.... AND IT IS FREE.
  • 0 Hide
    dj christian , November 11, 2011 4:56 AM
    pjkennedFor example, one shuts down a notebook that is subsequently stolen in an airport. In that scenario (actually fairly common) the user that now has the notebook can boot to the contents of the disk if a password was pre-filled.


    So you saying that's a bad idea for the owner that he typed the pre-filled the password using vPro?

  • 0 Hide
    Anonymous , January 2, 2012 8:10 AM
    Hi, does anybody know if Intel Dq67sw motherboard Support 8Gb ddr3 Single Modules . Because Intel Technical product specification states " Support for 32GB of System Memory with four DIMMS using 4GB memory technology ".

    Are there any other Intel boards which support vPro ( VT-X , VT-D ) with 32GB for i7 2nd Generation.

    As i want to build one myself for VM.
  • 0 Hide
    omerl , January 29, 2012 7:49 PM
    pjkennedGenerally you don't want to do this. Pre-boot authentication on encrypted drives is a security measure so that someone gaining access to a shut-down PC cannot cold boot onto the contents of the disk. For example, one shuts down a notebook that is subsequently stolen in an airport. In that scenario (actually fairly common) the user that now has the notebook can boot to the contents of the disk if a password was pre-filled.

    dj christianSo you saying that's a bad idea for the owner that he typed the pre-filled the password using vPro?


    Chovav, pjkenned and dj christian - yes, you can use Intel vPro AMT to fill the Pre-Boot Authentication. You can do this either with AMT KVM (which is the simple way, but requires AMT 6 and above) or with AMT SOL (assuming TrueCrypt allows SOL.
    pjkenned - there are several scenarios which it would makes much sense to send the password for PBA remotely: 1. Support agent trying to recover a user's password. 2. Trying to boot to a computer you left in the office. The idea is not that the password is pre-filled, it is filled on real-time.
    It's actually can be a very powerful tool for the service-desk at your organization.

  • 1 Hide
    omerl , February 14, 2012 8:18 AM
    qwer5678So you saying that's a bad idea for the owner that he typed the pre-filled the password using vPro?

    I didn't really understand what you mean. If you utilize this feature correctly you can gain real value to your organization. Note my 2 suggestion of usage. If you have it kept in a DB or something similar, you must make sure this DB is encrypted and secured properly, since this is sensitive information, but you can still get it and send it to your computer using vPro encrypted over TLS/SSL channel.
  • 0 Hide
    omerl , March 21, 2012 12:37 PM
    okokpkpk - I'm saying DO NOT PRE-FILL THE PASSWORD. This is not what's vPro is all about.
    I'm saying, create a solution for your organization that allow real time password push to your clients, in case a password is forgotten. Passwords are stored securely inside the organization and are only used in case of password forgotten. Nothing else. Do no bypass the pre-boot authentication mechanism.
  • 0 Hide
    masi87 , August 10, 2012 6:19 PM
    Why does noboy complain about the missing SSL for the logon page of the Web-Interface? (even thought not only logon but everything after that should also be encrypted to prevent cookie theft).
  • 0 Hide
    michealPW , August 11, 2012 7:09 PM
    I'm not sure what's more unsettling... The fact that this technology's being rolled out in so many mainstream Intel CPUs and Chipsets or the fact that I seem to be the only one that sees this as a major attack vector :|

    Good gawd what a frightening world we're marching into. Security and Privacy is becoming an unattainable dream.
Display more comments
React To This Article