HP Dc72 - Blade Workstation Client Manuel utilisateur

vPro Setup and Configuration for the dc7700 Business PC

with Intel vPro Technology

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2

AMT Setup and Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

AMT System Phases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2

SMB Mode - AMT Setup and Configuration with MEBx . . . . . . . . . . . . . . . . . . . . . . . . . . .3

SMB Mode - AMT Setup and Configuration Steps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4

Intel AMT WebGUI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .14

Connecting with the Intel AMT WebGUI - SMB Example . . . . . . . . . . . . . . . . . . . . . . . . .14

Enterprise Mode Setup and Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .16

Enterprise Mode - AMT Setup and Configuration Steps . . . . . . . . . . . . . . . . . . . . . . . . . .16

Provisioning Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Legacy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .21

IT TLS-PSK . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

OEM TLS-PSK . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .22

Return to Default . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23

Full Return to Factory Defaults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24

USB Drive Key Set Up and Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24

USB Drive Key Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .25

Appendix A: Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Appendix B: Power / Sleep / Global States Explained . . . . . . . . . . . . . . . . . . . . . . . . . . . . .29

Appendix C: Wake-On-ME Explained . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .30

Introduction

The HP Compaq dc7700p Business PC uses Intel vPro technology to simplify PC management and reduce

IT-related expenditures. Intel vPro technology is a combination of Active Management Technology (AMT)

and Intel Virtualization Technology (VT), which allows for improved management of PC systems and

enhanced security. This white paper assumes some basic knowledge of Intel AMT and Intel VT.

AMT provides Out-of-Band (OOB) remote access to a system regardless of the system power state or oper-

ating system condition as long as the system is connected to a power source and a network. AMT is a

hardware and firmware platform resident solution relying upon the Management Engine (ME) within the

Intel Q965 GMCH chipset.

HP Compaq dc7700p Business PCs initially shipped with AMT 2.0. AMT 2.1 is an important update that

provides support for the Microsoft Vista operating system as well as power efficiencies. HP has updated

this white paper to include the new features of AMT 2.1.

Please refer to www.hp.com for other white papers and technical information regarding new HP Com-

paq dc7700p Business PCs and new Intel vPro technology.

AMT Setup and Configuration

AMT must be set up and configured in a system before use. AMT setup sets up the system for AMT mode

and enables network connectivity. This setup is generally performed only once in the lifetime of a system.

When AMT is enabled, it can be discovered by management software over a network.

AMT Setup can be accomplished in one of two modes:

•Small Medium Business (SMB) mode

•Enterprise mode (default)

AMT Configuration sets up all other AMT options not covered in AMT Setup, such as enabling the system

for Serial-Over-LAN (SOL) or IDE-Redirect (IDE-R). Settings modified in the configuration phase can be

changed many times over the course of a system’s life span. Changes can be made to the system locally

or through a management console.

AMT System Phases

An AMT system can be in one of three phases in regards to its current stage of AMT Setup and Configu-

ration, as follows:

•Factory

•In-Setup

•Operational

The Factory phase is the initial stage in which the system has been built from the factory and no AMT

Setup and Configuration has been done. The only way to access AMT in Factory phase is through the

MEBx. This phase will end for SMB mode systems after changing the default password. Enterprise mode

systems also require that you set the Provisioning ID (PID) and Provisioning Passphrase (PPS).

The In-Setup phase is the next stage and is where most AMT options are set. This can be a manual or

automated procedure with a Setup and Configuration Server.

The Operational phase is the final stage in which AMT is fully setup and configured in the system and

ready for normal use.

SMB Mode - AMT Setup and Configuration with MEBx

SMB mode is for customers who do not have ISV management consoles, or the necessary network and

security infrastructures to use encrypted Transport Layer Security (TLS). SMB mode AMT set up and config-

uration is a manual process done through the Intel ME BIOS Extension (MEBx).

SMB mode is the easiest to implement since it does not require much infrastructure, but is the least secure

since all network traffic is not encrypted. HP recommends using this process only in a closed network.

NOTE: The MEBx is an option ROM module that is provided to HP by Intel to be included in the HP sys-

tem BIOS. The MEBx is not HP-specific and contains options that are not used by HP. If an option is not

used by HP, ignore it and do not modify from its default state.

Password Guidelines

MEBx passwords must meet minimum criteria. These restrictions are enforced by the MEBx to reduce vul-

nerability of passwords to a dictionary attack.

Passwords must:

•Be between 8 and 32 characters long.

•Contain both upper and lower case Latin characters (e.g. A, a, B, b).

•Have at least one digit character (e.g. 0, 1, 2, … 9).

•Have at least one 7-bit ASCII non-alphanumeric character with an ASCII value between 33d and

126d that is not part of the invalid character list below.

Examples of valid characters include:

• Exclamation !

• At @

•Number #

•Dollar $

•Percent %

•Caret ^

•Asterisk *

The underscore '_' is considered alpha-numeric.

The following characters are not allowed:

• Quotation mark "

• Apostrophe '

•Comma ,

• Greater than >

• Less than <

• Colon :

• Ampersand &

• Space

BIOS Prerequisite

This white paper is for use with HP Compaq dc7700p Business PCs. For best performance and to take

advantage of AMT 2.1 features, insure the PCs have a BIOS revision of at least version 2.09 and a ME

firmware of at least 2.1.0.1031.

You must update the system BIOS and the ME firmware individually. Updating the ME firmware will clear

AMT settings and the system will have to be set up and configured again.

For information about upgrading an HP dc7700p Business PC from AMT 2.0 to AMT 2.1, see the HP

Compaq Business PC with vPro Technology AMT 2.1 Firmware Update white paper, which includes

detailed instructions about how to update the system BIOS and ME firmware. This white paper is avail-

able at www.hp.com.

SMB Mode - AMT Setup and Configuration Steps

When going through the options in the MEBx for the first time (Factory phase), the default settings are in

place. This white paper details HP-recommended settings for options, some of which may be the same as

the default selection. Even though the default setting is set and used for certain options, it is good practice

to double-check important options.

1. Press Ctrl-P during POST to enter Manageability Engine BIOS Extension (MEBx) Setup. You can dis-

play this option only during POST if set in F10-Setup.

Figure 1 Intel MEBx Password Screen

2. Type the default password, which is admin. Passwords are case-sensitive.

NOTE: You must change the default password before making changes to the MEBx options.

3. Change the MEBx password. The new password must meet the Strong Password criteria defined in

the Password Guidelines Section. Type the password twice for verification.

Change the password to establish AMT ownership. The system will go from Factory phase to In-Setup

phase. The ME and AMT options within the MEBx are accessible and you can access the system

using the AMT WebGUI.

4. Select the Intel ME Platform Configuration. A window displays indicating that the system resets after

configuration.

5. Select Y. ME platform configuration allows IT personnel to configure ME features such as AMT/ASF

selection, power options, firmware update capabilities, and so on.

Figure 2 Intel ME Platform Configuration screen

6. Select Intel ME State Control, and then select Enabled.

Default Setting = Enabled, Recommended Setting = Enabled

This option enables or disables the ME and is used for diagnostic purposes. If there is a problem that

affects the ME, it can be removed from the system to eliminate it from the suspect list until root cause

is found.

Note that if the ME is disabled, then all AMT and ASF functions are also disabled. The system will not

be remotely manageable.

7. Select Intel ME Firmware Local Update Qualifier, and then select Always Open.

Default Setting = Always Open, Recommended Setting = Always Open

This option sets the policy on allowing the MEBx to be updated locally. By default, the system BIOS

allows for an unlimited number of local ME firmware updates. However, the administrator can modify

the local update setting with this ME firmware Local Update Qualifier.

"Always Open" is the default and allows for as many local updates as the system BIOS allows, which

is unlimited.

Choosing Never Open or Restricted adds the Intel ME Firmware Local Update option, which can

be set to Enable or Disable. By default it is Disabled. This option, along with the Qualifier, dictates

whether ME local updates are allowed. "Never Open" ignores what is set in the system BIOS and

follows the Intel ME Firmware Local Update option.

"Restricted" ignores what is set in the system BIOS and allows local ME firmware updates until the ME

is configured.

8. Skip LAN Controller.

Default Setting = Enabled, Recommended Setting = Enabled

This option enables or disables the Intel 82566DM NIC. If you need to disable the NIC, the ME

management mode must be set to None before the MEBx allows you to proceed. This ensures that

the ME is not in the middle of a transaction when the NIC is disabled. Disabling the NIC will cause

the system to lose all remote management capabilities. There is no F10 Setup option to disable the

NIC in the HP Compaq dc7700p Business PC. This is a departure from previous HP Compaq systems

such as the dc7600.

Note that the HP Compaq dc7700 Business PC with ASF does have the NIC disable option in F10

and not in the MEBx.

9. Select Intel ME Features Control.

a. Select Manageability Feature Selection.

Default Setting = Intel AMT, Recommended Setting = Intel AMT

This option sets the platform management mode: None, Intel AMT, or ASF.

By default, HP Compaq dc7700p Business PCs are set to Intel AMT, and ASF is an available

option. HP Compaq dc7700 Business PCs are locked to ASF and cannot be changed to AMT.

The None option is also available to HP Compaq dc7700 Business PCs.

Note that setting the None option will disable all remote management capabilities.

i. Select Intel AMT.

ii. Select Return to previous menu.

Never Open Restricted

ME Firmware Local Update

Enabled

Local ME firmware updates

allowed.

Local ME firmware updates allowed.

ME Firmware Local Update

Disabled

Local ME firmware updates

NOT allowed.

Local ME firmware updates allowed

only until the ME is configured.

Figure 3 Intel ME Features Control Screen with AMT selected

b. Skip Intel Quiet Systems Technology.

Default Setting = Disabled, Recommended Setting = Disabled

Intel Quiet System Technology is used for fan speed control. It is not used on the HP Compaq

dc7700 systems because the HP system BIOS already implements excellent fan speed controls.

c. Select Return to the previous menu.

10. Select Intel ME Power Control.

Figure 4 Intel ME Power Control Screen

a. Select ME State upon Initial Power-On, and then select On.

Default Setting = Off, Recommended Setting = On

This option sets the behavior of the ME when the system comes out of a G3 state (Mechanical Off

- power outage or power cord removed). If set to ON, the ME will try to automatically power up

the system and obtain memory. Use this option with the ME ON Host Sleep States option.

By default this option is set to OFF because of E-Star power regulatory requirements. HP

recommends setting this option to ON to allow the ME to re-initialize after G3 exit.

If this option is left in the OFF state, then remote management capabilities are lost after G3 exit

and remain lost until the system has entered the S0 (System On) state.

Table 1: System Behavior after G3 Exit

b. Select ME ON in Host Sleep States, and then select Always.

Default Setting = Never, Recommended Setting = Always

This option sets the ME power policy when the system is in a sleep state (Sx).

Table 2: ME Power State During Host Sleep State

If the settings for steps 10a and 10b are ON and ALWAYS, the ME will automatically wake the

system and obtain system memory after a G3 exit. Steps 10a and 10b work in combination

because 10b dictates if the ME is active during S5, which could be the state of the system after

G3 exit. If the ME is not active in S5, then it will not try to re-initialize itself after G3 exit.

ME State upon Initial Power-ON ME ON in Host Sleep State Host Behavior

On Always System will wake after G3 exit

On Never, S3, S3+S4 System will not wake after G3

exit

Off Always, Never, S3, S3+S4 System will not wake after G3

exit

ME ON in Host Sleep State Host Power State ME Power State

Always S0 M0

Always S3, S4, S5 M1

Never S0 M0

Never S3, S4, S5 Moff

Standby (S3) S0 M0

Standby (S3) S3 M1

Standby (S3) S4, S5 Moff

Standby (S3) + Hibernate (S4) S0 M0

Standby (S3) + Hibernate (S4) S3, S4 M1

Standby (S3) + Hibernate (S4) S5 Moff

Systems with After Power Loss set to ON in F10 BIOS will remain ON and proceed to boot

to the operating system. Systems with After Power Loss set to OFF in F10 BIOS will shut down

after the ME obtains system memory.

This option must be set to Always for Wake-On-ME to function.

See “Appendix B: Power / Sleep / Global States Explained” on page 29 for an explanation of

sleep/power states and an example reading of the ME Power State During Host Sleep State

chart.

See “Appendix C: Wake-On-ME Explained” on page 30 for an explanation of Wake-On-ME.

c. Skip LAN Power Well.

Default Setting = WOL_EN Pin, Recommended Setting = WOL_EN Pin

This option defines which power well is connected to the NIC. This option in the HP Compaq

dc7700 Business PC is defined by hardware routing and is not subject to firmware or software

change.

d. Skip ME Visual LED Indicator.

Default Setting = Off, Recommended Setting = Off

This option enables or disables the LED indicator on a system board to indicate an active ME.

The purpose of this option is to warn that the ME and memory subsystem is powered and you

must remove AC power before removing DIMMs. The HP Compaq dc7700p does not implement

the ME LED. There is a separate Vaux LED located next to the DIMM slots that also indicates a

powered system board.

e. Select Return to previous menu.

11. Return to previous menu to exit the MEBx Setup and save AMT configuration. The system will display

an Intel ME Configuration Complete message and reboot.

After the ME Configuration is complete, you can configure the AMT on the next boot.

12. Press Ctrl-P during POST to enter MEBx Setup again.

13. Type the MEBx password.

14. Select Intel AMT Configuration.

Figure 5 Intel AMT Configuration screen

15. Select Host Name, and then type a host name.

Default Setting = IntelAMT, Recommended Setting = User Dependent

NOTES: Spaces are not accepted in the host name. Make sure there is not a duplicate host name on the

network. You can use host names in place of the system’s IP for any applications requiring the IP address.

16. Select TCP/IP.

a. Select Disable Network Interface, and then select N.

Default Setting = Network Interface Enabled, Recommended Setting = Network Interface

Enabled

If the network is disabled, then all remote AMT capabilities are disabled and TCP/IP settings are

not necessary.

This option is a toggle, and the next time you access it you are prompted with the opposite

setting.

b. Select DHCP Disable, and then select Y.

Default Setting = DHCP Enabled, Recommended Setting = User Dependent

You can use DHCP if it is available. If you use DHCP, then steps 16c through 16g are not

necessary. Otherwise, the system administrator will have to configure TCP/IP settings.

For the purpose of this white paper, DHCP is disabled so steps 16c through 16g can be

illustrated. Step h will appear for both DHCP and Static configurations.

Autres manuels pour dc72 - Blade Workstation Client

Ce manuel convient aux modèles suivants

Table des matières

Autres manuels HP Ordinateur de bureau

HP Rp5700 - Point of Sale System Manuel utilisateur

HP Omni Pro 110 Instructions d'installation

HP 450 NG Manuel utilisateur

HP ZX2000 Manuel d'utilisation et d'entretien

HP ProDesk 400 G4 Instructions d'installation

HP Xw8400 - Workstation - 4 GB RAM Guide de référence

HP Workstation xw6000 Instructions d'installation et d'entretien

HP Pro 3005 MT Manuel utilisateur

HP blackbird 002 Manuel utilisateur

HP Presario SR1200 - Desktop PC Manuel utilisateur

HP Pavilion t267k Manuel utilisateur

HP Pavilion a250 Mode d’emploi

HP Compaq d240 MT Manuel

HP P6230F Pavilion PC Manuel utilisateur

HP Compaq dc5750 SFF Manuel d'utilisation et d'entretien

HP Pavilion t348 Manuel utilisateur

HP Compaq dx2100 MT Series Manuel d'utilisation et d'entretien

HP ENVY 23-d000 Manuel utilisateur

HP Xw4400 - Workstation - 2 GB RAM Guide de référence rapide

HP m9660f - Pavilion - Elite Fiche technique

HP TouchSmart IQ820 Manuel utilisateur

HP PAVILION DV8 Manuel

HP Media Center m7000 - Desktop PC Fiche technique

HP Brio 7100 Instructions de montage

Manuels Ordinateur de bureau populaires d'autres marques

Asus

Asus E210 Series Manuel utilisateur

Dell

Dell Inspiron 600m Manuel utilisateur

Dell

Dell Inspiron 3662 Manuel utilisateur

TotalFlow

TotalFlow uFLO Manuel utilisateur

Logitech

Logitech MK320 Manuel utilisateur

Dell

Dell XPS 730 H2C Manuel utilisateur

Sony

Sony Vaio Series Manuel utilisateur

Sony

Sony VGC-LT32E - Vaio All-in-one Desktop Computer Manuel utilisateur

Alto

Alto MD 250 Manuel utilisateur

Lenovo

Lenovo ThinkCentre Edge 72 Manuel

Lenovo

Lenovo ThinkStation D20 Manuel

Arbor Technology

Arbor Technology FPC-7800 Series Manuel utilisateur

Sony

Sony VAIO VGX-TP1 Series Manuel utilisateur

Asus

Asus Eee Box B204 Manuel utilisateur

Dell

Dell Optiplex 9010 All In One Manuel utilisateur

Everex

Everex eXplora Manuel utilisateur

Lenovo

Lenovo ThinkCentre M75e Manuel utilisateur

Dell

Dell Alienware Area-51 R4 Manuel utilisateur

HP dc72 - Blade Workstation Client Manuel utilisateur

Manuels Ordinateur de bureau populaires d'autres marques