17
Intel® Setup and Configuration Service (Intel® SCS) Release Notes Version 7.0 Document Release Date: February 24, 2011

Intel® Setup and Configuration Service (Intel® SCS ......Intel® Setup and Configuration Service (Intel® SCS) Release Notes Version 7.0 Document Release Date: February 24, 2011

  • Upload
    others

  • View
    12

  • Download
    0

Embed Size (px)

Citation preview

Page 1: Intel® Setup and Configuration Service (Intel® SCS ......Intel® Setup and Configuration Service (Intel® SCS) Release Notes Version 7.0 Document Release Date: February 24, 2011

Intel® Setup and Configuration Service

(Intel® SCS)

Release Notes

Version 7.0

Document Release Date: February 24, 2011

Page 2: Intel® Setup and Configuration Service (Intel® SCS ......Intel® Setup and Configuration Service (Intel® SCS) Release Notes Version 7.0 Document Release Date: February 24, 2011

INFORMATION IN THIS DOCUMENT IS PROVIDED IN CONNECTION WITH INTEL PRODUCTS. NO LICENSE, EXPRESS OR IMPLIED, BY ESTOPPEL OR OTHERWISE, TO ANY INTELLECTUAL PROPERTY RIGHTS IS GRANTED BY THIS DOCUMENT. EXCEPT AS PROVIDED IN INTEL'S TERMS AND CONDITIONS OF SALE FOR SUCH PRODUCTS, INTEL ASSUMES NO LIABILITY WHATSOEVER AND INTEL DISCLAIMS ANY EXPRESS OR IMPLIED WARRANTY, RELATING TO SALE AND/OR USE OF INTEL PRODUCTS INCLUDING LIABILITY OR WARRANTIES RELATING TO FITNESS FOR A PARTICULAR PURPOSE, MERCHANTABILITY, OR INFRINGEMENT OF ANY PATENT, COPYRIGHT OR OTHER INTELLECTUAL PROPERTY RIGHT.

UNLESS OTHERWISE AGREED IN WRITING BY INTEL, THE INTEL PRODUCTS ARE NOT DESIGNED NOR INTENDED FOR ANY APPLICATION IN WHICH THE FAILURE OF THE INTEL PRODUCT COULD CREATE A SITUATION WHERE PERSONAL INJURY OR DEATH MAY OCCUR.

Intel may make changes to specifications and product descriptions at any time, without notice. Designers must not rely on the absence or characteristics of any features or instructions marked "reserved" or "undefined." Intel reserves these for future definition and shall have no responsibility whatsoever for conflicts or incompatibilities arising from future changes to them. The information here is subject to change without notice. Do not finalize a design with this information.

The products described in this document may contain design defects or errors known as errata which may cause the product to deviate from published specifications. Current characterized errata are available on request.

Contact your local Intel sales office or your distributor to obtain the latest specifications and before placing your product order.

Copies of documents which have an order number and are referenced in this document, or other Intel literature, may be obtained by calling 1-800-548-4725, or go to: http://www.intel.com/design/literature.htm.

Intel® Active Management Technology requires activation and a system with a corporate network connection, an Intel® AMT-enabled chipset, network hardware and software. For notebooks, Intel AMT may be unavailable or limited over a host OS-based VPN, when connecting wirelessly, on battery power, sleeping, hibernating or powered off. Results dependent upon hardware, setup & configuration. For more information, visit http://www.intel.com/technology/platform-technology/intel-amt.

Intel® vPro™ Technology is sophisticated and requires setup and activation. Availability of features and results will depend upon the setup and configuration of your hardware, software and IT environment. To learn more visit: http://www.intel.com/technology/vpro.

Systems using Client Initiated Remote Access require wired LAN connectivity and may not be available in public hot spots or "click to accept" locations. For more information on CIRA, visit http://software.intel.com/en-us/articles/fast-call-for-help-overview.

Intel, the Intel logo, and Intel vPro, are trademarks of Intel Corporation in the U.S. and/or other countries.

Microsoft, Windows, and the Windows logo are trademarks, or registered trademarks of Microsoft Corporation in the U.S. and/or other countries.

* Other names and brands may be claimed as the property of others.

Copyright © 2006–2011, Intel Corporation. All rights reserved.

Page 3: Intel® Setup and Configuration Service (Intel® SCS ......Intel® Setup and Configuration Service (Intel® SCS) Release Notes Version 7.0 Document Release Date: February 24, 2011

Table of Contents

Intel® SCS Release Notes iii

Table of Contents

1 Introduction..........................................................................................11.1 Intel SCS 7.0 Components ......................................................................... 11.2 Supported Operating Systems .................................................................... 2

2 New Features of Intel SCS 7.0 ............................................................32.1 System Discovery....................................................................................... 32.2 Host Based Configuration Method............................................................. 32.3 Unified Configuration Process ................................................................... 42.4 Digest Master Password ............................................................................. 62.5 Configuration with Kerberos Admin Users ............................................... 62.6 Delta Configuration.................................................................................... 62.7 New Options to Define the FQDN Source................................................. 72.8 Support for Shared FQDN and Dynamic DNS .......................................... 72.9 Dedicated Network Settings....................................................................... 82.10 Support for Predefined Files Instead of a CA Request ............................ 82.11 Manual Configuration USB File for Multiple Systems ........................... 82.12 Other New Features.................................................................................. 8

3 Changes from Earlier Intel SCS Versions .........................................93.1 Changes to the Intel SCS Components ...................................................... 93.2 Changes to Data Storage .......................................................................... 103.3 Changes to the Intel SCS Architecture..................................................... 113.4 Other Changes .......................................................................................... 123.5 Unsupported Options from Earlier Versions of Intel SCS....................... 12

4 Known Issues ....................................................................................13

Page 4: Intel® Setup and Configuration Service (Intel® SCS ......Intel® Setup and Configuration Service (Intel® SCS) Release Notes Version 7.0 Document Release Date: February 24, 2011

1 Introduction

Intel® SCS Release Notes 1

1 Introduction

This document describes new features and changes made in version 7.0 of the Intel® Setup and Configuration Service (Intel® SCS). The Intel SCS lets you configure computers to use Intel® Active Management Technology (Intel® AMT).

1.1 Intel SCS 7.0 Components

This diagram shows the main components of Intel SCS 7.0 and how they can be used to configure Intel AMT systems.

Figure 1. Intel SCS 7.0 Components

Page 5: Intel® Setup and Configuration Service (Intel® SCS ......Intel® Setup and Configuration Service (Intel® SCS) Release Notes Version 7.0 Document Release Date: February 24, 2011

1 Introduction

Intel® SCS Release Notes 2

Intel SCS 7.0 includes these components:

• Intel AMT Configuration Utility — A GUI application, referred to as theACU Wizard. You can run the ACU Wizard on Intel AMT systems to configure them locally or send configuration requests to the RCS. You can also use the ACU Wizard to define settings to use when configuring multiple systems.

• Configuration Profiles — XML files that contain the configuration settings for the Intel AMT devices. You can create and edit profiles using the ACU Wizard.

• Configurator — A Command Line Interface (CLI) application that runs locally on the Intel AMT system. You can use the Configurator to configure the system locally or send a configuration request to the RCS.

• Remote Configuration Service (RCS) — A Windows service (RCSServer) that runs on a computer in the network. The RCS processes requests sent from the ACU Wizard or the Configurator. This is the only Intel SCS component that requires installation.

1.2 Supported Operating Systems

This table describes on which operating systems the Intel SCS components can run.

Table 1. Supported Operating Systems

Version ACU Wizard 1 Configurator RCS 2

Windows* XP Professional x32 (SP3) Yes Yes Yes

Windows 7 Professional x32/x64 Yes Yes Yes

Windows 7 Ultimate x64 Yes Yes Yes

Windows 7 Enterprise x32 Yes Yes Yes

Windows Vista* x32 Yes Yes No

Windows Server* 2008 x32/64 Yes3 No Yes

Windows Server 2008 R2 Yes3 No Yes

Windows Server 2003 x32/x64 (SP2) Yes3 No Yes

Windows Home Server Yes3 No Yes

1 The ACU Wizard also requires Microsoft .NET Framework version 2.0 (SP1) or higher installed on the computer.2 The RCS also requires Microsoft .NET Framework version 3.0 (SP1) or higher installed on the computer.3 You cannot use the ACU Wizard to configure Intel AMT on computers that have these operating systems. But, you can define settings to use when configuring other systems that have one of the operating systems supported by the Configurator.

* Other names and brands may be claimed as the property of others.

Page 6: Intel® Setup and Configuration Service (Intel® SCS ......Intel® Setup and Configuration Service (Intel® SCS) Release Notes Version 7.0 Document Release Date: February 24, 2011

2 New Features of Intel SCS 7.0

Intel® SCS Release Notes 3

2 New Features of Intel SCS 7.0

This section describes the new features of Intel SCS 7.0. For full information about a feature, refer to the Intel® Setup and Configuration Service User Guide.

2.1 System Discovery

The new System Discovery feature lets you get data about Intel AMT from systems in your network. This data can help organizations to decide how to configure and use Intel AMT in their network. System Discovery is included in Intel SCS 7.0 as:

• A command option in the Configurator component (SystemDiscovery)

• A standalone utility, located in the SCS_Discovery folder

The data is saved in an XML file and/or in the registry of the system. The data can then be collected using third-party hardware and software inventory applications.

The data is saved in the registry of each system at:

• 32-bit and 64-bit operating systems: HKLM\SOFTWARE\Intel\SCS7.0\System_Discovery

• In addition, on 64-bit operating systems: HKLM\SOFTWARE\Wow6432Node\Intel\SCS7.0\System_Discovery

For information about the data format, see the “System Discovery Data Format” section of the SCS_Discovery\Intel(R)_SCS_7.0_Discovery.pdf.

2.2 Host Based Configuration Method

Intel SCS 7.0 supports the new host-based configuration method included with Intel AMT 7.0. This method lets the Configurator, running locally on the Intel AMT system, configure the Intel AMT device. Configuration is done with an XML configuration profile. The Configurator and the profile can be sent to the Intel AMT systems in a deployment package and run with a script.

Note:

• The Intel SCS components can run on operating systems (listed in Table 3) installed with these languages: Czech, Danish, Dutch, English, Finnish, French, German, Greek, Hungarian, Italian, Japanese, Korean, Norwegian, Polish, Portuguese, Portuguese-Brazilian, Russian, Simplified Chinese, Spanish, Swedish, Traditional Chinese, Turkish.

• The Intel SCS does not support Non-Latin or Extended Latin characters in filenames or values in the XML files.

Page 7: Intel® Setup and Configuration Service (Intel® SCS ......Intel® Setup and Configuration Service (Intel® SCS) Release Notes Version 7.0 Document Release Date: February 24, 2011

2 New Features of Intel SCS 7.0

Intel® SCS Release Notes 4

2.3 Unified Configuration Process

Intel SCS 7.0 includes a “Unified Configuration” process. This process lets you define one deployment package to configure all Intel AMT versions in your network. The Intel SCS automatically uses the necessary configuration method for each Intel AMT device.

The Unified Configuration process uses two copies of the same XML profile:

• The first copy is created and stored in the RCS. This copy is used by the RCS to remotely configure devices that do not support host-based configuration.

• The second copy is “exported” from the RCS and must be included in the deployment package. This copy is used by the Configurator to locally configure devices that support host-based configuration. This copy also includes data (added during export) about the RCS and the required control mode for the Intel AMT device.

Figure 2. Unified Configuration Process

Page 8: Intel® Setup and Configuration Service (Intel® SCS ......Intel® Setup and Configuration Service (Intel® SCS) Release Notes Version 7.0 Document Release Date: February 24, 2011

2 New Features of Intel SCS 7.0

Intel® SCS Release Notes 5

Table 2. Steps in the Unified Configuration Process

Step Description

A script or a batch file runs the Configurator locally on the Intel AMT system. The Configurator examines the Intel AMT device to find if it supports host-based configuration.

Note: The name of the command to run is “ConfigAMT”. You can also use the unified configuration process to do maintenance tasks using the “MaintainAMT” command.

The Configurator examines the settings in the profile sent in the deployment package.

This step occurs if the Intel AMT device supports host-based configuration and “Client Control” mode is defined in the profile.

The Configurator activates Intel AMT on the device and puts the device in Client Control mode. The Configurator uses the local profile to define the settings in the Intel AMT device. All configuration is done locally.

These steps occur if the Intel AMT device supports host-based configuration and “Admin Control” mode is defined in the profile.

The Configurator sends a request to the RCS to “Setup” the Intel AMT device. Note: The device must have a TLS-PSK key or must be configured for remote configuration with PKI.

The RCS activates Intel AMT on the device and puts the device in Admin Control mode.

The Configurator uses the local profile to define the settings in the Intel AMT device. All configuration is done locally.

These steps occur for all Intel AMT devices that do not support host-based configuration.

The Configurator sends a configuration request to the RCS.

Note: The device must have a TLS-PSK key or must be configured for remote configuration with PKI.

The RCS gets the configuration settings from the profile stored in the RCS.

The RCS uses the profile stored in the RCS to define the settings in the Intel AMT device. All configuration is done remotely.

Page 9: Intel® Setup and Configuration Service (Intel® SCS ......Intel® Setup and Configuration Service (Intel® SCS) Release Notes Version 7.0 Document Release Date: February 24, 2011

2 New Features of Intel SCS 7.0

Intel® SCS Release Notes 6

2.4 Digest Master Password

Each Intel AMT device contains a predefined administrative user named “admin”, referred to as the default admin user. Intel AMT uses the HTTP Digest authentication method to authenticate the default admin user. The default admin user:

• Has access to all the Intel AMT features and settings on the device

• Is not contained in the Access Control List with other Digest users, and cannot be deleted

Thus, for security reasons it is important how you define the password for this user (even if you do not use it). The new Digest Master Password feature of Intel SCS 7.0 is an additional method for defining the password of the default admin user.

The RCS calculates a different (unique) password for each device using a secret key (known as the “Digest Master Password”) and system-specific data from each device. The RCS does not need to save these admin passwords because they can be recalculated when necessary. After configuration, applications that need to use the default admin user must recalculate the password themselves or ask the RCS to calculate it for them.

2.5 Configuration with Kerberos Admin Users

If your network has Active Directory (AD), you can now define your own administrative user in the device that will be authenticated using Kerberos. You can then use this user instead of the default admin user.

These are the necessary steps if you want to use a Kerberos admin user:

1. Define an AD user in the Intel AMT device with the PT Administration realm.

2. Define a password for the default admin user. The application communicating with the Intel AMT device using the AD user will not use or require this password.

3. Run the Configurator/RCS using the credentials of the user defined in step 1.

2.6 Delta Configuration

Intel SCS can now configure Intel AMT settings without deleting or changing Intel AMT settings defined by a third-party application. This is done using the Profile Scope window of the Configuration Profile Wizard. Only settings defined in the Profile Scope window will be changed on the systems during configuration. All other settings will stay in their current condition on the systems. Thus you can use a profile:

• To configure systems without making changes to Intel AMT settings configured using third-party applications

• To make changes to specific Intel AMT settings on configured systems

Page 10: Intel® Setup and Configuration Service (Intel® SCS ......Intel® Setup and Configuration Service (Intel® SCS) Release Notes Version 7.0 Document Release Date: February 24, 2011

2 New Features of Intel SCS 7.0

Intel® SCS Release Notes 7

2.7 New Options to Define the FQDN Source

Intel SCS includes new options for defining how the FQDN (hostname.suffix) for the Intel AMT device is constructed:

• Primary DNS FQDN — The hostname part of the FQDN is the hostname from the host operating system. The suffix is the “Primary DNS Suffix” from the host operating system. This is the default setting, and is correct for most network environments.

• On-board LAN connection-specific DNS FQDN — The hostname part of the FQDN is the hostname from the host operating system. The suffix is the “Connection-specific DNS Suffix” of the onboard wired LAN interface.

• Host Name — Takes the host name from the operating system. The suffix is blank.

• Active Directory FQDN — The hostname part of the FQDN is the hostname from the host operating system. The suffix is the AD domain of which the host operating system is a member.

• DNS Look Up FQDN — Takes the name returned by an “nslookup” on the IP address of the onboard wired LAN interface.

• File — See “Dedicated Network Settings” on page 8.

2.8 Support for Shared FQDN and Dynamic DNS

Intel SCS 7.0 includes support for these features that are available from Intel AMT 6.0 and higher:

• Shared FQDN — This setting can change the behavior of the Intel AMT device when using option 81 of the DHCP server to update DNS:

• When this setting is true, the Intel AMT device will send broadcast queries only when the operating system is not running. This is the default behavior of all Intel AMT versions that do not support the Shared FQDN setting.

• When this setting is false, the device will always send its own broadcast queries, even when the operating system is running.

• Intel AMT Dynamic DNS Update (DDNS Update) Client — When enabled, this client can periodically update the DNS with the FQDN and IP address configured in the Intel AMT device. Intel AMT will send DDNS Updates based on the policy configured in the DHCP server returned in the DHCP option 81 flags. Before Intel AMT 6.0, Intel AMT was only capable of using the DHCP option 81 to request that the DHCP server update the DNS on its behalf.

Note: The System Discovery feature (see “System Discovery” on page 3) gets data about the host network configuration. This data can help you decide which FQDN option is correct for your network.

Page 11: Intel® Setup and Configuration Service (Intel® SCS ......Intel® Setup and Configuration Service (Intel® SCS) Release Notes Version 7.0 Document Release Date: February 24, 2011

2 New Features of Intel SCS 7.0

Intel® SCS Release Notes 8

2.9 Dedicated Network Settings

You can now set a specific IP and/or FQDN in the Intel AMT device. When you use the ACU Wizard to configure a single system you can set these values “on the fly” during configuration. For multiple systems this option is defined in the configuration profile, or the /NetworkSettingsFile flag of the Configurator CLI. You must create a separate file for each Intel AMT device and make sure that the Configurator can access the file when configuring the system. For information about the required XML format, see the NetworkSettings.xml example file located in the sample_files folder.

2.10 Support for Predefined Files Instead of a CA Request

Usually, during configuration of Intel AMT features defined to use certificate-based authentication, the Intel SCS requests the certificate from a CA. To do this, the Intel SCS component (Configurator, RCS, or ACU Wizard) configuring the Intel AMT device must have access to the CA during configuration. However, in some network environments the CA cannot be accessed from all computers.

The new host-based configuration method included with Intel SCS 7.0 supplies a solution to this problem. When defining certificate-based authentication, you can now use predefined certificate and private key files (used for the encryption).

2.11 Manual Configuration USB File for Multiple Systems

The ACU Wizard component has a new option to create a USB key for manual configuration of multiple systems. This option can be used to configure systems that have Intel AMT 6.0 and higher. When prepared for systems that have Intel AMT 7.0 and higher, the data in the USB key is “scrambled” so it cannot easily be read.

2.12 Other New Features

• You can now define which interfaces (operating system/BIOS) are available to the user in the Fast Call for Help feature (Intel AMT 4.0 and higher).

• Support for the redirection and user consent settings in manual configuration.

• The certificate enrollment flow does not expose the private key to software (Intel AMT 7.0 only).

• Support for shared static IPv4 address synchronization (Intel AMT 7.0 only).

• The exe and dll files of the Intel SCS components are now digitally signed. (By default, Configurator CLI commands authenticate the signature of the ACU.dll.)

• Most Intel AMT features can now be configured in a peer-to-peer network (Workgroup).

Page 12: Intel® Setup and Configuration Service (Intel® SCS ......Intel® Setup and Configuration Service (Intel® SCS) Release Notes Version 7.0 Document Release Date: February 24, 2011

3 Changes from Earlier Intel SCS Versions

Intel® SCS Release Notes 9

3 Changes from Earlier Intel SCS Versions

This section describes the main changes made to Intel SCS 7.0 from earlier versions of the Intel SCS.

3.1 Changes to the Intel SCS Components

Intel SCS 7.0 includes new components and changes to how the components work together to configure Intel AMT. These are the main changes made to the components of previous versions of the Intel SCS:

• Service — In Intel SCS 5.x and 6.0, the Service was the main component and was necessary for most of the configuration methods. In Intel SCS 7.0, the Service (named RCS) is not necessary for systems that support the host-based configuration method.

• Intel® vPro™ Technology Activator Utility — This component has been replaced by the Configurator. The Configurator is now the main component of Intel SCS 7.0.

• Database — See “Changes to Data Storage” on page 10.

• Console — In Intel SCS 7.0, a “Console” is not necessary. This table shows how the tasks that were done from the Console are now done in Intel SCS 7.0:

Table 3. Console Tasks and Intel SCS 7.0

Task in the Console Intel SCS 7.0

Define profiles Configuration profiles are now XML files. You can create profiles using the ACU Wizard.

Define TLS-PSK keys TLS-PSK keys are now created by the Configurator on the Intel AMT system and then sent to the RCS.

Operations on Intel AMT systems

All configuration requests to the RCS are sent from the Intel AMT system using the Configurator.

Define maintenance policies

The RCS does not include maintenance policies (see “Changes to the Intel SCS Architecture” on page 11)

Define users and roles Users and roles are not used in Intel SCS 7.0. However, applications and users must have the necessary permissions on the Intel AMT system and/or the RCS.

View logs Logs of events and operations done by the RCS are now kept in a log file in the RCSConfServer folder. Each time the log file (RCSLog.log) becomes too large, or the RCS is restarted, the file content is moved to a new file with this format: RCSLog.logYYYY-MM-DD-HH-MI-SS.log.

Page 13: Intel® Setup and Configuration Service (Intel® SCS ......Intel® Setup and Configuration Service (Intel® SCS) Release Notes Version 7.0 Document Release Date: February 24, 2011

3 Changes from Earlier Intel SCS Versions

Intel® SCS Release Notes 10

3.2 Changes to Data Storage

In Intel SCS 5.x and 6.0, data was kept in a central SQL database that was used by the Service and Console components. Intel SCS 7.0 does not use an SQL database or require one to be installed. The data used by the RCS component of Intel SCS 7.0 is kept in these files:

• Profile.xml — The configuration profiles

• PSKsStorage.dat — TLS-PSK keys (for the One Touch Configuration method)

• DMP.dat — Digest Master Passwords. This file only exists if at some time the RCS was set to use the Digest Master Password option.

• scsadmin.dat — Contains a record for each system configured using Intel SCS5.x and the password of its default Digest admin user. This file only exists if the admin passwords were migrated from Intel SCS 5.x.

In previous versions of the Intel SCS, the SQL database also included:

• Passwords for Intel AMT “admin” users

• Configuration requests

• Information about the Intel AMT systems

• Logs

• Users

Because of changes to the Intel SCS 7.0 components and their roles, Intel SCS 7.0 does not keep this data.

In organizations where Intel SCS 5.x is operating, some of the data must be moved to files that the Intel SCS 7.0 can use. Intel SCS 7.0 includes a migration utility that can do this task. For more information, see the Intel(R)_SCS_5.x_Migration.pdf in the Migration_Utilities folder.

Note: The migration utility included in this version of Intel SCS does not support Intel SCS 6.0.

Page 14: Intel® Setup and Configuration Service (Intel® SCS ......Intel® Setup and Configuration Service (Intel® SCS) Release Notes Version 7.0 Document Release Date: February 24, 2011

3 Changes from Earlier Intel SCS Versions

Intel® SCS Release Notes 11

3.3 Changes to the Intel SCS Architecture

These changes were made to the Intel SCS architecture:

• Intel SCS 7.0 does not use the Microsoft Internet Information Services (IIS) or require it to be installed.

• In Intel SCS 5.x, communication with the Service was done by sending XML format messages using the Simple Object Access Protocol (SOAP). In Intel SCS 7.0, the API used to communicate with the Service (RCS component) uses Windows Management Instrumentation (WMI).

• In Intel SCS 5.x, all requests from applications to the Service were first sent to an SQL database. The Service then used a “queuing mechanism” to process the requests. In Intel SCS 7.0, this mechanism was removed. All requests to the Service are now sent directly to the Service (RCS).

• In Intel SCS 7.0, the Service can process a maximum of 200 requests at the same time (200 concurrent threads). This number might be less when using a CA or Active Directory. If a request cannot be processed (because all threads are being used), the Service returns a “Server too busy” error (0x80041045). It is now the responsibility of the person/application that sends a request to the Service to make sure the request was processed.

• In Intel SCS 5.x and 6.0, “maintenance policies” were defined in the Console and the Service processed them on the systems automatically. In Intel SCS 7.0, it is now the responsibility of the person/application that manages the systems to schedule and send maintenance requests to the systems. You can do this using the Configurator CLI commands (MaintainAMT or MaintainViaRCSOnly).

Note: The RCS was tested on an Intel® CoreTM I3 multi processor computer with 4 GB of RAM. Using this hardware configuration, the RCS successfully configured 1000 systems with a full configuration profile in less than an hour. During the tests, the RCS (RCSServer.exe) used between 1 GB and 2 GB of RAM.

Page 15: Intel® Setup and Configuration Service (Intel® SCS ......Intel® Setup and Configuration Service (Intel® SCS) Release Notes Version 7.0 Document Release Date: February 24, 2011

3 Changes from Earlier Intel SCS Versions

Intel® SCS Release Notes 12

3.4 Other Changes

• Scripts — Intel SCS 7.0 continues to support remote configuration using scripts and “Hello” messages. If you use this method, you will need to change the script that you use. For more information, and a sample script, refer to the Remote Configuration Using Scripts section of the Intel® Setup and Configuration Service User Guide.

• AD Integration — Integration with Active Directory is now defined at the profile level (not in the Service Settings). For Intel SCS 5.x, this change is automatically made by the migration utility.

• One Time Password — This option is only used with the Remote Configuration (PKI) method. If selected, the RCS will start configuration only after the Intel AMT device authenticates itself to the RCS with the OTP created by the Configurator. For increased security, in Intel SCS 7.0 this option is now used by default. If you do not want to use it, you must change the default RCS settings.

3.5 Unsupported Options from Earlier Versions of Intel SCS

• Pending Requests — Certification Authorities include settings that define how they handle certificate requests. Intel SCS 7.0 does not support pending certificate requests. If during configuration the CA puts the certificate into the “Pending Requests” state, the Intel SCS returns an error (#35). Thus, you must make sure that the CA and the templates used by the Intel SCS are not defined to put certificate requests into a pending state.

• Order of Common Names (CNs) — The format of the first CN in the Subject Name of generated certificates is no longer defined in “Service Settings”. Instead, you can define the CNs in the profile. The order of CNs cannot be defined. To put a specific CN first in the Subject Name field, use the “User-defined CNs” option and select only one CN.

• Intel SCS 7.0 does not support these options that were available in Intel SCS 5.x:

• FQDN Validation — This option was located in the configuration profile Domains window. When selected the Intel SCS would not configure an Intel AMT system unless it had an FQDN that matched a Domain that was marked as “permitted for configuration”. In version 7.0 of the Intel SCS, you must ensure that you enter the correct home domains in the Home Domains window.

• Use VLAN — This option was located in the configuration profile Advanced profile settings window. In version 7.0 of the Intel SCS, Virtual LANs are not supported.

• Encryption Mode Options — To improve and simplify the setup and configuration process, the encryption mode options have been removed from the advanced profile settings. If your environment includes crypto disabled computers, create a configuration profile (without TLS) specifically for them.

Page 16: Intel® Setup and Configuration Service (Intel® SCS ......Intel® Setup and Configuration Service (Intel® SCS) Release Notes Version 7.0 Document Release Date: February 24, 2011

4 Known Issues

Intel® SCS Release Notes 13

4 Known Issues

This table describes known issues with version 7.0 of the Intel SCS.

Table 4. Known Issues

Internal Tracking Number

Description Impact / Solution

2841869 If several PSKs exist in the RCS database with the same PID, but only one of them has the correct password in the newMebxPassword field, the configuration might fail.

This might occur only on systems that have Intel AMT 2.1/2.5. To solve this problem, put the correct password in the admin password field of the configuration profile and send the configuration request again.

2841868 When configuration fails because the “Delta” profile does not contain the admin password, the Intel SCS returns an incorrect error.

“Delta” profiles can only be used to reconfigure configured systems.

2841855 System Discovery returns an incorrect return code (0) when it fails to complete DNS lookup.

The log record shows the correct error message details immediately after the incorrect error code.

2841844 Installation of the RCS creates an additional empty registry key “HKLM\SOFTWARE\Intel\Intel(R) Setup and Configuration Service\7.0.0”.

This registry key is not used by the RCS component, but is necessary for the InstallShield* Wizard.

2841697 The RCS log records do not include a unique identifier for the Intel AMT system (such as UUID).

It is not easy to know for which system the record was created.

2841687 If the RCS crashes, some systems fail configuration with an incorrect message: “The SSL handshake failed due to incorrect PSK settings”.

Send the configuration request to the RCS again.

2841600 The MoveToACM command is not supported if the RCS is installed on a computer running Windows Server 2003 or Windows XP Professional.

Install the RCS on one of the other operating systems that can run the RCS (see Table 1).

Page 17: Intel® Setup and Configuration Service (Intel® SCS ......Intel® Setup and Configuration Service (Intel® SCS) Release Notes Version 7.0 Document Release Date: February 24, 2011

4 Known Issues

Intel® SCS Release Notes 14

2841362 When creating a USB key for multiple systems, the password in the Old MEBx Password field is shown on the screen.

Although the old password will be changed during configuration, make sure that only approved personnel can see this old password.

2840561 The Intel SCS does not block Non-Latin and Extended Latin characters in file names or values in the xml files.

The Intel AMT device does not support Non-Latin or Extended Latin characters in ACL Digest user names or WiFi profile names. The Configurator will complete the configuration but without configuring these settings.

2840551 After starting the RCS, the first WMI call sometimes fails with an exception.

Ignore the first WMI call.

2840547 When configuring a system with a USB key, the ACU Wizard shows KVM options for some systems that do not support the feature.

The KVM setting is ignored and the system is configured correctly.

Table 4. Known Issues (Continued)

Internal Tracking Number

Description Impact / Solution