Intel vPro In 2012, Small Business Advantage, And Anti-Theft Tech.

Features
By Patrick Kennedy
published

One year ago, we took a look at three generations of Intel's vPro, charting how its features evolved. Now, we have a new version to explore. Additionally, we're putting Anti-Theft technology to the test, along with the new Small Business Advantage suite.

Hands-On With vPro For 2012

Probably the two biggest feature changes in this generation of vPro happen to the display pipeline.

First, the Ivy Bridge architecture adds support for a third display output. Intel now gives vPro the ability to allow that trio of screens to be accessed through the remote management interface. Second, the company adds support for monitors in portrait mode (instead of the standard landscape orientation), even if only one of the three screens is set up that way. Around the offices where I consult, there really are a notable number of users who rotate their screens into portrait mode for working in Word or on certain websites. Likewise, I increasingly see more multi-monitor arrays, particularly as 1920x1080 panels come down in price. Adding support for these additional video modes makes troubleshooting less cumbersome for IT professionals.

In Intel vPro: Three Generations Of Remote Management, we looked at the interaction between vPro and Active Management Technology. This time around, we went so far as to perform a remote BIOS update on our DQ77MK. To accomplish this, we logged into Windows through RealVNC's VNC Viewer Plus.

As you can see, the picture quality is very good. KVM Remote Control supports resolutions as high as 1920x1200 with 16-bit color, so you don't get the graininess you'd expect from some software-based remote management solutions.

From the Windows desktop, I was able to browse to Intel's support site remotely and download the updated BIOS package I needed. Double-clicking the installation unpacks a number of files and reboots the machine. Because KVM Remote works out-of-band, even when I'm looking at a command prompt (out of Windows), the remote display is still very much accessible.

Generally, if we were using an RDP or traditional VNC solution, it'd be very difficult to monitor a process like this remotely. Instead, we're even able to hop in the client system's BIOS and make changes.

You can see that accessing the DQ77MK's UEFI comes complete with mouse support, making navigation even easier. It's as if we're sitting right in front of the machine.

The board's firmware features several security settings that warrant attention, either upon initial setup or shortly thereafter. Use those options to help lock down sensitive components and help prevent unauthorized changes that could either bring an important system down or lead to compromised data.

Beyond jumping onto a remote client through VNC Viewer Plus, Intel also offers a Web-based GUI to control the features of Active Management Technology. This generation, AMT gets incremented to version 8.0, though most features appear similar for the most part.

Logging in to the interface is pretty easy once you enable remote log-in. With the Web service running, navigate to the client machine's IP address on port 16992.

From there, you have access to the features we introduced in last year's exploration of vPro. One that we really like, and want to mention again, is the ability to specify a boot device when the remote system restarts.

This option lets an administrator remotely boot to a recovery image directly from the Web-based interface, saving time/cost on a desk-side visit.

Patrick Kennedy
7 Comments Comment from the forums
  • bit_user
    Toms, you really need to blow the lid off the incredibly dangerous security flaws in vPro that can enable undetectable and irremovable rootkits. semiaccurate.com did some reporting on this. Please alert the mainstream. The exploit was already demonstrated some time ago.

    Thanks.
    Reply
  • bit_user
    I don't know if it's allowed, but here's the link:

    http://semiaccurate.com/2012/05/15/intel-small-business-advantage-is-a-security-nightmare/

    Maybe the editors will read it before they remove this post. It's not a terribly well-written article. That's where you can help, Tom's.
    Reply
  • freggo
    Why not integrate a GPS receiver into the motherboard and than have an option to define 'allowed' active areas for the system. For desktops that should be no problem as they do not get moved much.

    For laptops you may have to take a bit more time defining your typical usage area of course; you could even let the laptop track your typical usage location patterns so it can make recommendations for the best setup.

    If the systems is outside the area either request a special password or some other form of identification to unlock the machine either for one time or for inclusions of the current location into the allowed area.

    Damn, I should get that patented :-)

    Reply
  • bigdragon
    I have a hard time reading this lengthy article after all the trouble I've had with Intel's DBS1200KP and DBS1200KPR. Intel keeps promoting virtualization, but they failed to implement VT-d on that product even though there's no reason for it not to be supported.
    Reply
  • StitchExperiment626
    Backup is my complaint! Doing a full backup every night there isn't enough time.
    Reply
  • jkflipflop98
    Keep in mind, all the garbage you read on that site is by Charlie Demerjian. . . who honestly doesn't know much about anything.
    Reply
  • labtech drew
    Having owned an MSP (Managed Service Provider), with hundreds of customers, and thousands of machines under management, vPro add's enormous cost savings when implemented.

    Customer has a blue screen? No problem, you can KVM right in and see the issue.

    Workstation hung after remotely applying patches - calling the user and saying "Can you go over and hold the power button for me?" is no longer necessary. Simply shutdown the machine via vPro and power it back on. Even remotely re-imagine a machine from backup is possible.

    However, my favorite use case is the instant back to work use case. End user hard drive fails - obviously a truck roll is needed, but the most important thing is to get the user productive again. Leverage vPro's ability to redirect IDE (IDEr) to a network Live Linux CD at least gets the user in to Web Outlook, if not 100% back in business.

    How about power savings? Schedule machines to auto shutdown at night, and for your patch window, use vPro to power up the workstations, apply the patches, power down (from windows) and if a machine hangs on shutdown use the vPro power off command. Allows for nightly maintenance and keeps costs savings maximized.

    Rolling out vPro can be a bit of work using native tools, but there are solutions available (shameless plug) like LabTech Software (http://www.labtechsoftware.com) which can remotely provision and manage vPro along with any other IT management function you can think of.

    -Drew

    Full disclosure: Having ran an MSP and worked with many enterprises, out of band management tools were critical in every mature organization I worked with. As a co-founder of LabTech Software, I have engaged Intel and we are working closely to build out solutions that vPro truly solves for.
    Reply