Request customized firmware before you purchase Intel AMT-based computers.

Computers that can be managed out of band have BIOS extensions that can set customized values to significantly increase security when these computers are on your network. Check which BIOS extension settings are available from your computer manufacturer, and specify your values. For more information, see Determine Whether to Use a Customized Firmware Image From Your Computer Manufacturer.

If your AMT-based computers do not have the firmware values that you want to use, you might be able to manually specify them. For more information about manually configuring the BIOS extensions, see the Intel documentation or the documentation from your computer manufacturer. For additional information, see Intel vPro Expert Center: Microsoft vPro Manageability. Customize the following options to increase your security:

• Replace all certificate thumbprints of external certification authorities (CAs) with the certificate thumbprint of your own internal CA. This prevents rogue provisioning servers from attempting to provision your AMT-based computers, and you do not have to purchase provisioning certificates from external CAs.
  
  
• Use a custom password for the MEBx Account so that the default value of admin is not used. Then specify this password with an AMT Provisioning and Discovery Account in Configuration Manager. This prevents rogue provisioning servers from attempting to provision your AMT-based computers with the known default password.
  
  

Control the request and installation of the provisioning certificate.

Request the provisioning certificate directly from the provisioning server by using the computer security context so that the certificate is installed directly into the local computer store. If you must request the certificate from another computer, you have to export the private key, and then use additional security controls when you transfer and import the certificate into a certificate store.

Ensure that you request a new provisioning certificate before the existing certificate expires.

An expired AMT provisioning certificate results in a provisioning failure. If you are using an external CA for your provisioning certificate, allow for additional time to complete the renewal process and reconfigure the out of band management point.

Use a dedicated certificate template for provisioning AMT-based computers.

If you are use an Enterprise version of Windows Server for your enterprise CA, create a new certificate template by duplicating the default Web Server certificate template, ensure that only the security group that you specify in the out of band management component properties has Read and Enroll permissions, and do not add additional capabilities to the default of server authentication.

A dedicated certificate template allows you to better manage and control access to help prevent elevation of privileges. If you have a Standard version of Windows Server for your enterprise CA, you cannot create a duplicate certificate template. In this scenario, you must add Read and Enroll permissions to the security group that you specify in the out of band management component properties and remove any permission that you do not require.

Use AMT power on commands instead of wake-up packets.

Although both solutions support waking up computers for software installation, AMT power on commands are more secure than transmitting wake-up packets because they provide authentication and encryption by using standard industry security protocols. By using AMT power on commands with out of band management, this solution can also integrate with an existing public key infrastructure (PKI) deployment, and the security controls can be managed independently from the product. For more information, see “Planning How to Wake Up Clients” in Planning for Client Communication in Configuration Manager.

Disable AMT in the firmware if the computer is not supported for out of band management.

Even when AMT-based computers have a supported version of AMT, there are some scenarios that out of band management does not support. These scenarios include workgroup computers, computers that have a different namespace, and computers that have a disjoint namespace.

To ensure that these AMT-based computers are not published to Active Directory Domain Services and do not have a PKI certificate requested for them, disable AMT in the firmware. AMT provisioning in Configuration Manager creates domain credentials for the accounts published to Active Directory Domain Services, which risks the elevation of privileges when the computers are not part of your Active Directory forest.

Use a dedicated OU to publish AMT-based computer accounts.

Do not use an existing container or organizational unit (OU) to publish the Active Directory accounts that are created during AMT provisioning. A separate OU lets you manage and control these accounts better and helps ensure that site servers and these accounts are not granted more permissions than they require.

Allow the site server computer accounts Write permission to the OU, the Domain Computers group, and the Domain Guests group in each domain that contains AMT-based computers.

In addition to allowing the site server computer accounts Create all child objects and Delete all child objects permissions for the OU and apply to This object only, allow the following permissions for the site server computer accounts:

• For the OU: Write all properties permission and apply to This object and all descendant objects.
  
  
• For the Domain Computers group: Write all properties permission and apply to This object only.
  
  
• For the Domain Guest group: Write all properties permissions and apply to This object only.
  
  

Use a dedicated collection for AMT provisioning.

Do not use an existing collection that contains more computers than you want to provision for AMT. Instead, create a query-based collection by using the AMT status of Not Provisioned.

For more information about the AMT Status and how to construct a query for Not Provisioned, see About the AMT Status and Out of Band Management in Configuration Manager.

Retrieve and store image files securely when you boot from alternative media to use the IDE redirection function.

When you boot from alternative media to use the IDE redirection function, whenever possible, store the image files locally on the computer running the out of band management console. If you must store them on the network, ensure that connections to retrieve the files over the network use SMB signing to help prevent the files being tampered with during the network transfer. In both scenarios, secure the stored files to help prevent unauthorized access, for example, by using NTFS permissions and the encrypted file system.

Retrieve and store AMT audit log files securely.

If you save AMT audit log files, whenever possible, store the files locally on the computer that is running the out of band management console. If you must store them on the network, ensure that connections to retrieve the files over the network use SMB signing to help prevent the files being tampered with during the network transfer. In both scenarios, secure the stored files to help prevent unauthorized access, for example, by using NTFS permissions and the encrypted file system.

Minimize the number of AMT Provisioning and Discovery Accounts.

Although you can specify multiple AMT Provisioning and Discovery Accounts so that Configuration Manager can discover computers that have AMT management controllers and provision them for out of band management, do not specify accounts that are not currently required and delete accounts that are no longer required. Specify only the accounts that you require to help ensure that these accounts are not granted more permissions than they require and to reduce unnecessary network traffic and processing. For more information about the AMT Provisioning and Discovery Account, see Configuring the Out of Band Management Component.

For service continuity, specify a user account as the AMT Provisioning Removal Account and ensure that this user account is also specified as an AMT User Account.

The AMT Provisioning Removal Account helps ensure service continuity if you must restore the Configuration Manager site. After you restore the site, request and configure a new AMT provisioning certificate, use the AMT Provisioning and Removal Account to remove provisioning information from AMT-based computers, and then reprovision the computers.

You might also be able to use this account if an AMT-based computer was reassigned from another site and the provisioning information was not removed.

For more information about how to remove AMT provisioning information, see How to Remove AMT Information.

Use a single certificate template for client authentication certificates whenever practical.

Although you can specify different certificate templates for each of the wireless profiles, use a single certificate template unless you have a business requirement for different settings to be used for different wireless networks, specify only client authentication capability, and dedicate this certificate template for use with Configuration Manager out of band management. For example, if one wireless network required a higher key size or shorter validity period than another, you would have to create a separate certificate template. A single certificate template lets you control its use more easily and guards against elevation of privileges.

Ensure that only authorized administrative users perform AMT auditing actions and manage the AMT audit logs as required.

Depending on the AMT version, Configuration Manager might stop writing new entries to the AMT audit log when it is nearly full or might overwrite old entries. To ensure that new entries are logged and old entries are not overwritten, periodically clear the audit log if required, and save the auditing entries. For more information about how to manage the audit log and monitor auditing activities, see How to Manage the Audit Log for AMT-Based Computers in Configuration Manager.

Use the principle of least privileges and role-based administration to grant administrative users permissions to manage AMT-based computers out of band.

Use the Remote Tools Operator security role to grant administrative users the Control AMT permission, which allows them to view and manage computers by using the out of band management console, and initiate power control actions from the Configuration Manager console.

For more information about the security permissions that you might require to manage AMT-based computers, see “Configuration Manager Dependencies” in Prerequisites for Out of Band Management in Configuration Manager.