Adam checks the prerequisites for out of band management and decides to create a site system server on which he installs the out of band service point and the enrollment point. This computer has the fully qualified domain name (FQDN) of server15.testnet.treyresearch.net.

Adam also confirms that the existing DHCP and DNS configuration meets the requirements for AMT.

For more information about the prerequisites, see Prerequisites for Out of Band Management in Configuration Manager.

Adam works with his Active Directory service administrators to create the following Windows security groups:

• A group named ConfigMgr Out Band Service Points that contains server15.
  
  
• A group named ConfigMgr Primary Site Servers that contains the primary site server computer account.
  
  
• A universal security group named ConfigMgr AMT Computers that will contain the AMT computer accounts.
  
  

They then create an organization unit (OU) in the testnet.treyresearch.net domain for the published AMT-based computer accounts, and grant the newly created group ConfigMgr Primary Site Servers the following permissions to this OU: Create Computer Objects and Delete Computer Objects.

For more information about how to create groups and OUs, see the Active Directory Domain Services documentation.

Adam works with the PKI team with the following results:

• The web server certificate template is duplicated and configured for the enrollment point. It is installed and configured in IIS on server15.
  
  
• A custom template is created to request and install the AMT provisioning certificate on server15.
  
  
• The web server certificate template is duplicated and configured so that it is appropriate for out of band management.
  
  
• They identify and write down the certificate thumbprint of the root CA, which has to be manually added to the AMT firmware until they purchase a provisioning certificate from an external CA.
  
  

For guidance about how to deploy the PKI certificates required for out of band management, see the Deploying the Certificates for AMT section in the Step-by-Step Example Deployment of the PKI Certificates for Configuration Manager: Windows Server 2008 Certification Authority topic.

For more information about the certificate requirements, see PKI Certificate Requirements for Configuration Manager.

To prepare the desktop AMT-based computers that Adam will use in the initial testing, Adam checks that the AMT firmware configuration is correct and adds the certificate thumbprint of their internal root CA:

1. When the computer starts, he presses CTRL+P to configure the ME module.
   
   
2. He selects Intel (R) ME Configuration, Intel (R) ME Feature Control, Manageability Feature Selection, and then selects Intel (R) AMT. He exits and restarts the computer.
   
   
3. He runs the ME module again, selects Intel (R) AMT Configuration, Setup and Configuration, to verify that the value for the Current provision mode is PKI. The value is not PKI, so he selects TLS PKI, and sets the Remote Configuration to Enable.
   
   
4. In the TLS-PKI section, he selects Manage Certificate Hashes, presses the Insert key, and types the certificate thumbprint of his internal root CA.
   
   
5. He saves the changes, exits, and then restarts the computer.
   
   

For more information, see the Intel documentation.

Adam then configures the Configuration Manager primary site and makes the following changes:

• He installs a new site system server on server15, configures it with the intranet FQDN of server15.treyresearch.net, and then installs the out of band service point and the enrollment point. He then configures the Out of Band Management component.
  
  
• On the AMT Provisioning Certificate page for the out of band service point, he browses to the AMT provisioning certificate that he installed.
  
  
• On the Out of Band Management Component Properties dialog box, he configures the following:
  
  
  • On the General tab, he specifies the OU that he created in testnet.treyresearch.net, the universal security group that he created, browses to the AMT web server certificate template that he created earlier, and configures a strong password for the MEBx Account.
    
    
  • On the AMT Settings tab, he specifies his own account as an AMT User Account and a Windows global domain security group that contains help desk engineers who will use the out of band management console. He also selects the options Enable serial over LAN and IDE redirection, Allow ping responses, and Enable BIOS password bypass for power on and restart commands.
    
    

For more information, see the following sections in the How to Provision and Configure AMT-Based Computers in Configuration Manager topic:

• How to Install and Configure the AMT Provisioning Site Systems: New Site System Server
  
  
• Configuring the Out of Band Management Component
  
  

Adam wants to use Wake on LAN technology to install critical software updates on computers. He has tried this feature in the past and discovered that subnet-directed broadcasts consumed too much network bandwidth over the remote links and that few of their network adapters worked with unicast transmissions.

He enables Wake on LAN and decides to keep the default option of Use power on commands if the computer supports this technology; otherwise, use wake-up packets.

For more information, see the Configuring the Site to Send Power-On Commands for Scheduled Wake-Up Activities step in the How to Provision and Configure AMT-Based Computers in Configuration Manager topic.

Adam adds the AMT Status column to the Configuration Manager console and creates a new collection that contains just five AMT-based computers as his initial pilot. These computers are for testing only and contain different supported versions of AMT. He configures this collection for AMT provisioning.

For more information, see the Displaying the AMT Status and Enabling AMT provisioning step in the How to Provision and Configure AMT-Based Computers in Configuration Manager topic.

Adam monitors the AMT provisioning process.

For more information, see the Monitoring AMT Provisioning step in the How to Provision and Configure AMT-Based Computers in Configuration Manager topic.

Adam checks the prerequisites for out of band management again, to see whether there are any additional changes that he has to make. He notes the following:

• There are ports requirements that he must relate to the firewall administrator so that help desk engineers can connect to AMT-based computers in remote sites that are protected by the internal company firewall.
  
  
• Some help desk computers still run Windows XP, and so he must check these computers for their version of Windows Remote Management (WinRM) and update the version if necessary.
  
  
• He must add help desk engineers to an appropriate security role to run the out of band management console.
  
  

For more information, see Prerequisites for Out of Band Management in Configuration Manager.

Adam configures the properties of the out of band service point, browses to the newly purchased AMT provisioning certificate, and saves the changes.

For more information, see the Configuring the Enrollment Point and Out of Band Service Point for AMT Provisioning step in the How to Provision and Configure AMT-Based Computers in Configuration Manager topic.

Adam creates new collections to gradually roll out AMT provisioning for workstation computers. Over a period of four weeks, he enables these collections for AMT provisioning and monitors progress.

For more information, see the Displaying the AMT Status and Enabling AMT provisioning step in the How to Provision and Configure AMT-Based Computers in Configuration Manager topic.

Adam checks the wireless support prerequisites for out of band management and confirms that the versions of AMT on the laptops supports wireless profiles. He notes the wireless configuration settings that are required by the Network Policy Server as WPA2 security, AES encryption, and EAP-TLS authentication.

For more information about the prerequisites, see Prerequisites for Out of Band Management in Configuration Manager.

Adam works with the PKI team to create an additional certificate template that the AMT-based computers use to authenticate with the Network Policy Server.

For more information about creating the client certificate template, see “Creating and Issuing the Client Authentication Certificates for 802.1X AMT-Based Computers” in the Deploying the Certificates for AMT section of the Step-by-Step Example Deployment of the PKI Certificates for Configuration Manager: Windows Server 2008 Certification Authority topic.

For more information about the certificate requirements, see PKI Certificate Requirements for Configuration Manager.

Adam configures the Out of Band Management Component Properties: 802.1X and Wireless tab:

• He creates a wireless profile that contains the wireless network name, the security type of WPA2-Enterprise, and the encryption method of AES. He then selects the trusted root certificate for the Network Policy Server, and the client certificate template that was created earlier.
  
  

For more information, see steps 26 through 39 in the Configuring the Out of Band Management Component section in the How to Provision and Configure AMT-Based Computers in Configuration Manager topic.

Adam creates a new collection for laptops that can support AMT. On the Out of Band Management tab, he selects Enable provisioning for AMT-based computers.

Adam then monitors the provisioning status for these laptops, and uses the log file Amtopmgr.log, to verify that the wireless profile is successfully configured for these AMT-based computers.

Tip
If these laptops are already provisioned for AMT without the wireless profile, Adam runs the Update Provisioning Data in Management Controller Memory command for the wireless settings to be applied. For more information, see the How to Update Computers for New AMT Settings section in the How to Manage AMT Provisioning Information in Configuration Manager topic.

For more information about monitoring AMT provisioning, see the Monitoring AMT Provisioning step in the How to Provision and Configure AMT-Based Computers in Configuration Manager topic.