HP dc72 - Blade Workstation Client User manual

1
vPro Setup and Configuration for the dc7700 Business PC
with Intel vPro Technology
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2
AMT Setup and Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
AMT System Phases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2
SMB Mode - AMT Setup and Configuration with MEBx . . . . . . . . . . . . . . . . . . . . . . . . . . .3
SMB Mode - AMT Setup and Configuration Steps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4
Intel AMT WebGUI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .14
Connecting with the Intel AMT WebGUI - SMB Example . . . . . . . . . . . . . . . . . . . . . . . . .14
Enterprise Mode Setup and Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .16
Enterprise Mode - AMT Setup and Configuration Steps . . . . . . . . . . . . . . . . . . . . . . . . . .16
Provisioning Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Legacy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .21
IT TLS-PSK . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
OEM TLS-PSK . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .22
Return to Default . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23
Full Return to Factory Defaults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24
USB Drive Key Set Up and Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24
USB Drive Key Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .25
Appendix A: Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Appendix B: Power / Sleep / Global States Explained . . . . . . . . . . . . . . . . . . . . . . . . . . . . .29
Appendix C: Wake-On-ME Explained . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .30

2
Introduction
The HP Compaq dc7700p Business PC uses Intel vPro technology to simplify PC management and reduce
IT-related expenditures. Intel vPro technology is a combination of Active Management Technology (AMT)
and Intel Virtualization Technology (VT), which allows for improved management of PC systems and
enhanced security. This white paper assumes some basic knowledge of Intel AMT and Intel VT.
AMT provides Out-of-Band (OOB) remote access to a system regardless of the system power state or oper-
ating system condition as long as the system is connected to a power source and a network. AMT is a
hardware and firmware platform resident solution relying upon the Management Engine (ME) within the
Intel Q965 GMCH chipset.
HP Compaq dc7700p Business PCs initially shipped with AMT 2.0. AMT 2.1 is an important update that
provides support for the Microsoft Vista operating system as well as power efficiencies. HP has updated
this white paper to include the new features of AMT 2.1.
Please refer to www.hp.com for other white papers and technical information regarding new HP Com-
paq dc7700p Business PCs and new Intel vPro technology.
AMT Setup and Configuration
AMT must be set up and configured in a system before use. AMT setup sets up the system for AMT mode
and enables network connectivity. This setup is generally performed only once in the lifetime of a system.
When AMT is enabled, it can be discovered by management software over a network.
AMT Setup can be accomplished in one of two modes:
•Small Medium Business (SMB) mode
•Enterprise mode (default)
AMT Configuration sets up all other AMT options not covered in AMT Setup, such as enabling the system
for Serial-Over-LAN (SOL) or IDE-Redirect (IDE-R). Settings modified in the configuration phase can be
changed many times over the course of a system’s life span. Changes can be made to the system locally
or through a management console.
AMT System Phases
An AMT system can be in one of three phases in regards to its current stage of AMT Setup and Configu-
ration, as follows:
•Factory
•In-Setup
•Operational
The Factory phase is the initial stage in which the system has been built from the factory and no AMT
Setup and Configuration has been done. The only way to access AMT in Factory phase is through the
MEBx. This phase will end for SMB mode systems after changing the default password. Enterprise mode
systems also require that you set the Provisioning ID (PID) and Provisioning Passphrase (PPS).

3
The In-Setup phase is the next stage and is where most AMT options are set. This can be a manual or
automated procedure with a Setup and Configuration Server.
The Operational phase is the final stage in which AMT is fully setup and configured in the system and
ready for normal use.
SMB Mode - AMT Setup and Configuration with MEBx
SMB mode is for customers who do not have ISV management consoles, or the necessary network and
security infrastructures to use encrypted Transport Layer Security (TLS). SMB mode AMT set up and config-
uration is a manual process done through the Intel ME BIOS Extension (MEBx).
SMB mode is the easiest to implement since it does not require much infrastructure, but is the least secure
since all network traffic is not encrypted. HP recommends using this process only in a closed network.
NOTE: The MEBx is an option ROM module that is provided to HP by Intel to be included in the HP sys-
tem BIOS. The MEBx is not HP-specific and contains options that are not used by HP. If an option is not
used by HP, ignore it and do not modify from its default state.
Password Guidelines
MEBx passwords must meet minimum criteria. These restrictions are enforced by the MEBx to reduce vul-
nerability of passwords to a dictionary attack.
Passwords must:
•Be between 8 and 32 characters long.
•Contain both upper and lower case Latin characters (e.g. A, a, B, b).
•Have at least one digit character (e.g. 0, 1, 2, … 9).
•Have at least one 7-bit ASCII non-alphanumeric character with an ASCII value between 33d and
126d that is not part of the invalid character list below.
Examples of valid characters include:
• Exclamation !
• At @
•Number #
•Dollar $
•Percent %
•Caret ^
•Asterisk *
The underscore '_' is considered alpha-numeric.
The following characters are not allowed:
• Quotation mark "
• Apostrophe '
•Comma ,

4
• Greater than >
• Less than <
• Colon :
• Ampersand &
• Space
BIOS Prerequisite
This white paper is for use with HP Compaq dc7700p Business PCs. For best performance and to take
advantage of AMT 2.1 features, insure the PCs have a BIOS revision of at least version 2.09 and a ME
firmware of at least 2.1.0.1031.
You must update the system BIOS and the ME firmware individually. Updating the ME firmware will clear
AMT settings and the system will have to be set up and configured again.
For information about upgrading an HP dc7700p Business PC from AMT 2.0 to AMT 2.1, see the HP
Compaq Business PC with vPro Technology AMT 2.1 Firmware Update white paper, which includes
detailed instructions about how to update the system BIOS and ME firmware. This white paper is avail-
able at www.hp.com.
SMB Mode - AMT Setup and Configuration Steps
When going through the options in the MEBx for the first time (Factory phase), the default settings are in
place. This white paper details HP-recommended settings for options, some of which may be the same as
the default selection. Even though the default setting is set and used for certain options, it is good practice
to double-check important options.
1. Press Ctrl-P during POST to enter Manageability Engine BIOS Extension (MEBx) Setup. You can dis-
play this option only during POST if set in F10-Setup.
Figure 1 Intel MEBx Password Screen

5
2. Type the default password, which is admin. Passwords are case-sensitive.
NOTE: You must change the default password before making changes to the MEBx options.
3. Change the MEBx password. The new password must meet the Strong Password criteria defined in
the Password Guidelines Section. Type the password twice for verification.
Change the password to establish AMT ownership. The system will go from Factory phase to In-Setup
phase. The ME and AMT options within the MEBx are accessible and you can access the system
using the AMT WebGUI.
4. Select the Intel ME Platform Configuration. A window displays indicating that the system resets after
configuration.
5. Select Y. ME platform configuration allows IT personnel to configure ME features such as AMT/ASF
selection, power options, firmware update capabilities, and so on.
Figure 2 Intel ME Platform Configuration screen
6. Select Intel ME State Control, and then select Enabled.
Default Setting = Enabled, Recommended Setting = Enabled
This option enables or disables the ME and is used for diagnostic purposes. If there is a problem that
affects the ME, it can be removed from the system to eliminate it from the suspect list until root cause
is found.
Note that if the ME is disabled, then all AMT and ASF functions are also disabled. The system will not
be remotely manageable.
7. Select Intel ME Firmware Local Update Qualifier, and then select Always Open.
Default Setting = Always Open, Recommended Setting = Always Open
This option sets the policy on allowing the MEBx to be updated locally. By default, the system BIOS
allows for an unlimited number of local ME firmware updates. However, the administrator can modify
the local update setting with this ME firmware Local Update Qualifier.

6
"Always Open" is the default and allows for as many local updates as the system BIOS allows, which
is unlimited.
Choosing Never Open or Restricted adds the Intel ME Firmware Local Update option, which can
be set to Enable or Disable. By default it is Disabled. This option, along with the Qualifier, dictates
whether ME local updates are allowed. "Never Open" ignores what is set in the system BIOS and
follows the Intel ME Firmware Local Update option.
"Restricted" ignores what is set in the system BIOS and allows local ME firmware updates until the ME
is configured.
8. Skip LAN Controller.
Default Setting = Enabled, Recommended Setting = Enabled
This option enables or disables the Intel 82566DM NIC. If you need to disable the NIC, the ME
management mode must be set to None before the MEBx allows you to proceed. This ensures that
the ME is not in the middle of a transaction when the NIC is disabled. Disabling the NIC will cause
the system to lose all remote management capabilities. There is no F10 Setup option to disable the
NIC in the HP Compaq dc7700p Business PC. This is a departure from previous HP Compaq systems
such as the dc7600.
Note that the HP Compaq dc7700 Business PC with ASF does have the NIC disable option in F10
and not in the MEBx.
9. Select Intel ME Features Control.
a. Select Manageability Feature Selection.
Default Setting = Intel AMT, Recommended Setting = Intel AMT
This option sets the platform management mode: None, Intel AMT, or ASF.
By default, HP Compaq dc7700p Business PCs are set to Intel AMT, and ASF is an available
option. HP Compaq dc7700 Business PCs are locked to ASF and cannot be changed to AMT.
The None option is also available to HP Compaq dc7700 Business PCs.
Note that setting the None option will disable all remote management capabilities.
i. Select Intel AMT.
ii. Select Return to previous menu.
Never Open Restricted
ME Firmware Local Update
Enabled
Local ME firmware updates
allowed.
Local ME firmware updates allowed.
ME Firmware Local Update
Disabled
Local ME firmware updates
NOT allowed.
Local ME firmware updates allowed
only until the ME is configured.

7
Figure 3 Intel ME Features Control Screen with AMT selected
b. Skip Intel Quiet Systems Technology.
Default Setting = Disabled, Recommended Setting = Disabled
Intel Quiet System Technology is used for fan speed control. It is not used on the HP Compaq
dc7700 systems because the HP system BIOS already implements excellent fan speed controls.
c. Select Return to the previous menu.
10. Select Intel ME Power Control.
Figure 4 Intel ME Power Control Screen

8
a. Select ME State upon Initial Power-On, and then select On.
Default Setting = Off, Recommended Setting = On
This option sets the behavior of the ME when the system comes out of a G3 state (Mechanical Off
- power outage or power cord removed). If set to ON, the ME will try to automatically power up
the system and obtain memory. Use this option with the ME ON Host Sleep States option.
By default this option is set to OFF because of E-Star power regulatory requirements. HP
recommends setting this option to ON to allow the ME to re-initialize after G3 exit.
If this option is left in the OFF state, then remote management capabilities are lost after G3 exit
and remain lost until the system has entered the S0 (System On) state.
Table 1: System Behavior after G3 Exit
b. Select ME ON in Host Sleep States, and then select Always.
Default Setting = Never, Recommended Setting = Always
This option sets the ME power policy when the system is in a sleep state (Sx).
Table 2: ME Power State During Host Sleep State
If the settings for steps 10a and 10b are ON and ALWAYS, the ME will automatically wake the
system and obtain system memory after a G3 exit. Steps 10a and 10b work in combination
because 10b dictates if the ME is active during S5, which could be the state of the system after
G3 exit. If the ME is not active in S5, then it will not try to re-initialize itself after G3 exit.
ME State upon Initial Power-ON ME ON in Host Sleep State Host Behavior
On Always System will wake after G3 exit
On Never, S3, S3+S4 System will not wake after G3
exit
Off Always, Never, S3, S3+S4 System will not wake after G3
exit
ME ON in Host Sleep State Host Power State ME Power State
Always S0 M0
Always S3, S4, S5 M1
Never S0 M0
Never S3, S4, S5 Moff
Standby (S3) S0 M0
Standby (S3) S3 M1
Standby (S3) S4, S5 Moff
Standby (S3) + Hibernate (S4) S0 M0
Standby (S3) + Hibernate (S4) S3, S4 M1
Standby (S3) + Hibernate (S4) S5 Moff

9
Systems with After Power Loss set to ON in F10 BIOS will remain ON and proceed to boot
to the operating system. Systems with After Power Loss set to OFF in F10 BIOS will shut down
after the ME obtains system memory.
This option must be set to Always for Wake-On-ME to function.
See “Appendix B: Power / Sleep / Global States Explained” on page 29 for an explanation of
sleep/power states and an example reading of the ME Power State During Host Sleep State
chart.
See “Appendix C: Wake-On-ME Explained” on page 30 for an explanation of Wake-On-ME.
c. Skip LAN Power Well.
Default Setting = WOL_EN Pin, Recommended Setting = WOL_EN Pin
This option defines which power well is connected to the NIC. This option in the HP Compaq
dc7700 Business PC is defined by hardware routing and is not subject to firmware or software
change.
d. Skip ME Visual LED Indicator.
Default Setting = Off, Recommended Setting = Off
This option enables or disables the LED indicator on a system board to indicate an active ME.
The purpose of this option is to warn that the ME and memory subsystem is powered and you
must remove AC power before removing DIMMs. The HP Compaq dc7700p does not implement
the ME LED. There is a separate Vaux LED located next to the DIMM slots that also indicates a
powered system board.
e. Select Return to previous menu.
11. Return to previous menu to exit the MEBx Setup and save AMT configuration. The system will display
an Intel ME Configuration Complete message and reboot.
After the ME Configuration is complete, you can configure the AMT on the next boot.
12. Press Ctrl-P during POST to enter MEBx Setup again.
13. Type the MEBx password.

10
14. Select Intel AMT Configuration.
Figure 5 Intel AMT Configuration screen
15. Select Host Name, and then type a host name.
Default Setting = IntelAMT, Recommended Setting = User Dependent
NOTES: Spaces are not accepted in the host name. Make sure there is not a duplicate host name on the
network. You can use host names in place of the system’s IP for any applications requiring the IP address.
16. Select TCP/IP.
a. Select Disable Network Interface, and then select N.
Default Setting = Network Interface Enabled, Recommended Setting = Network Interface
Enabled
If the network is disabled, then all remote AMT capabilities are disabled and TCP/IP settings are
not necessary.
This option is a toggle, and the next time you access it you are prompted with the opposite
setting.
b. Select DHCP Disable, and then select Y.
Default Setting = DHCP Enabled, Recommended Setting = User Dependent
You can use DHCP if it is available. If you use DHCP, then steps 16c through 16g are not
necessary. Otherwise, the system administrator will have to configure TCP/IP settings.
For the purpose of this white paper, DHCP is disabled so steps 16c through 16g can be
illustrated. Step h will appear for both DHCP and Static configurations.

11
c. Select IP Address, and then type a static address.
Default Setting = 10.0.0.2, Recommended Setting = Network Dependent
Example: 192.168.0.1
Make sure all AMT systems have a unique static IP address if more than one system is on the
same network. Multiple systems sharing the same static IP address can lead to network collisions,
which will cause the systems to not respond correctly.
d. Select Subnet Mask, and then type a subnet mask.
Default Setting = 255.255.255.0, Recommended Setting = Network Dependent
Example: 255.255.255.0
e. Select Default Gateway Address, and then accept the default and press Enter.
Default Setting = 0.0.0.0, Recommended Setting = Network Dependent,
Leave as 0.0.0.0 if this option is not needed.
f. Select Preferred DNS Address, and then accept the default value and press Enter.
Default Setting = 0.0.0.0, Recommended Setting = Network Dependent
Leave as 0.0.0.0 if this option is not needed.
g. Select Alternate DNS Address, and then accept the default value and press Enter.
Default Setting = 0.0.0.0, Recommended Setting = Network Dependent
Leave as 0.0.0.0 if this option is not needed.
h.Select Domain Name, and then type a domain name
Default Setting = none, Recommended Setting = Network Dependent
The domain name is blank by default. If not populated, then the default domain of
“Provisionserver” is used when connecting to a Setup and Configuration Server.
If the name of the S&CS is not “Provisionserver” and the domain name is blank, then an alias
must be set up in the DHCP server to redirect the connection for "Provisionserver" to the proper
S&CS domain name.
If the Domain Name field is populated, that is the domain used. However, if there is no
response after four DNS queries to the named domain, then that domain name is no longer used
and the default “Provisionserver” is used.
17. Skip Provisioning Server.
Default Setting = 0.0.0.0, Recommended Setting = Network Dependent
This option is used in Enterprise mode when an Intel AMT Setup and Configuration (Provisioning)
server is available. This option disappears once SMB mode is set in step 18.

12
18. Select Provision Model.
a. Change to Intel AMT 1.0 Mode, and then select N.
Default Setting = Intel AMT 2.0 Mode, Recommended Setting = Intel AMT 2.0 Mode
This option is a toggle, and the next time you access it you are prompted with the opposite
setting.
b. Change to Small Business, and the select Y.
Default Setting = Enterprise, Recommended Setting = SMB
This option is a toggle, and the next time you access it you are prompted with the opposite
setting.
Notice that the Provisioning Server, Set PID and PPS, and Set PRTC options are no longer
available once the system is in Small Business mode. These options are used in Enterprise Mode.
c. Select Return to previous menu.
19. Skip Un-Provision. This option returns the system to factory defaults. See “Return to Default” on
page 23 for more information about unprovisioning.
20. Skip VLAN.
Default Setting = Disabled, Recommended Setting = User Dependent
This option enables or disables VLAN support. If VLAN is enabled, then you must provide the VLAN
tag (label) (1-4094).
VLAN support is not necessary for AMT or Virtual Appliances. If enabled, it allows the grouping of
systems from different networks into one virtual network.
21. Select SOL/IDE-R.
a. Select Yin the message window.
b. Select Username and Password, and then select Enabled.
Default Setting = Enabled, Recommended Setting = Enabled
This option allows users and passwords to be added from the WebGUI. If the option is disabled,
then only the administrator has MEBx remote access.
c. Select Serial Over LAN, and then select Enabled.
Default Setting = Enabled, Recommended Setting = Enabled
This option enables/disables Serial Over LAN (SOL) functionality.
d. Select IDE Redirection, and then select Enabled.
Default Setting = Enabled, Recommended Setting = Enabled
This option enables/disables IDE Redirection (IDE-R) functionality.
22. Select Remote Firmware Update, and then select Enabled.
Default Setting = Enabled, Recommended Setting = Enabled
This option enables/disables the ability to remotely update the ME firmware.

13
23. Select Idle Timeout.
Default Setting = 0x1, Recommended Setting = 0x1
This option sets the timeout value for Wake-On-ME.
The default timeout value is 0x1 from the factory, but 0x0 if CMOS is cleared. A value of 0x0 means
the Wake-On-ME feature is disabled and the ME will not go to sleep when not being used in a non-
active system. HP recommends a setting of 0x1, which allows the ME to go to sleep after 1 minute of
inactivity.
The timeout value can be set in both decimal and hexadecimal notation and is in units of minutes. It
must be set to a non-zero value for the ME to take advantage of Wake-On-ME. Hexadecimal settings
are preceded by a “0x”, so one minute is “0x1”.
This value is not used when the system is in an active state - S0.
This value is used only if the ME On in Host Sleep State setting is set to Always. See “Appendix C:
Wake-On-ME Explained” on page 30 for an explanation of Wake-On-ME.
24. Select Return to previous menu.
25. Select Exit, and then select Yto exit the MEBx Setup and save settings.
The system displays an Intel ME Configuration Complete message, and then the system reboots.
After the system reboots, it changes from In-Setup phase to Operational phase, and AMT is fully
operational. Once in Operational phase, you can remotely manage the system through the Intel AMT
WebGui or ISV remote console and you can provide the system to the end-user for regular use.
After an AMT system is configured, it displays its status and shows that the AMT tables are valid on
every boot.
Figure 6 Intel AMT Enabled and Configured - ME configuration complete

14
Intel AMT WebGUI
The Intel AMT WebGUI is a Web browser-based interface for limited remote system management.
The WebGUI is often used as a test to determine if AMT Setup and Configuration was performed prop-
erly on a system. A successful remote connection between a remote system and the host system running
the WebGUI indicates proper AMT Setup and Configuration on the remote system.
The AMT WebGUI is accessible from the following Web Browsers:
•Microsoft Internet Explorer 6 SP1 or newer
•Netscape Navigator 7.1 or newer
•Mozilla Firefox 1.0 or newer
•Mozilla 1.7 or newer
Limited remote system management includes:
•Hardware inventory
•Event logging
•Remote system reset
•Changing of network settings
•Addition of new users and passwords
•Updating ME firmware
WebGUI support is enabled by default for SMB Setup and Configured systems. WebGUI support for
Enterprise Setup and Configured systems is determined by the Setup and Configuration Server.
Connecting with the Intel AMT WebGUI - SMB Example
1. Power on an AMT system that has completed AMT Setup and Configuration.
2. Execute a Web browser from a separate system - a Management computer on the same subnet as the
AMT computer.
3. Connect to the IP address specified in the MEBx and port of the AMT system.
a. By default, the port is 16992.
b. If DHCP was used, then use the Fully Qualified Domain Name (FQDN) for the ME. The FQDN is
the combination of the hostname and domain.
Example A: http://192.168.0.1:16992
Example B: http://intelamt.intel.com:16992
The Management computer makes a TCP connection to the AMT system and accesses the top level
AMT-embedded Web page within the Management Engine of the AMT system.

15
4. Type the user name and password. The default username is admin and the password is what you set
during AMT Setup in the MEBx.
Figure 7 Intel AMT WebGUI Screen
5. Review system information and/or make any necessary changes.
NOTE: You can change the MEBx password for the remote system in the WebGUI.
Changing the password in the WebGUI or a remote console results in two passwords. The new
password, known as the “remote” MEBx password, only works remotely with the WebGUI or
remote console. The local MEBx password used to locally access the MEBx is not changed. The
user has to remember both local and remote MEBx passwords to access the system MEBx locally
and remotely.
When the MEBx password is initially set in AMT Setup, the password serves as both the local and
remote password. If the remote password is changed, then the passwords are out of sync.
The remote MEBx password must follow the criteria defined in the Password Guideline section for
a strong password.
6. Select Exit.

16
Enterprise Mode Setup and Configuration
Enterprise mode (for large corporate customers) requires a Setup and Configuration Server (S&CS). A
S&CS runs an application over a network that performs AMT set up and configuration. The S&CS is also
known as a Provisioning Server as seen in the MEBx. The act of setting up and configuring the AMT is
also known as “provisioning.” An S&CS is typically provided by ISVs and is contained within the ISV man-
agement console product. Consult with your management console suppler for more information.
Enterprise Mode - AMT Setup and Configuration Steps
The AMT Setup portion for Enterprise mode is the same as SMB mode. Repeat Steps 1 through 15 to per-
form AMT Setup. This will take the system from Factory Mode to In Setup Mode.
Refer to “SMB Mode - AMT Setup and Configuration with MEBx” on page 3 for examples of MEBx menus
and full text. The following are quick steps for AMT Setup:
1. Access the MEBx by pressing Ctrl-P during POST.
2. Type the default password, which is admin.
3. Change the MEBx password, following strong password guidelines.
4. Select Intel ME Platform Configuration.
5. In Intel ME State Control, select Enabled.
6. In Intel ME Firmware Local Update Qualifier, select Always Open.
7. Skip LAN Controller.
8. Select Intel ME Features Control.
a. In Manageability Features Selection, select Intel AMT.
b. Skip Intel Quiet Systems Technology.
9. Select Intel ME Power Control.
a. Select ME State upon Initial Power-On, and then select On.
b. Select ME ON in Host Sleep States, and then select Always.
c. Skip LAN Power Well.
d. Skip ME Visual LED indicator.
10. Select Exit and save. The system displays the Intel ME Configuration Complete message, and then
reboots.
After the system reboots, starting with Step 11 you will set some of the options differently than SMB
mode.
11. Press Ctrl-P during POST to enter MEBx Setup again.
12. Type the MEBx password.

17
13. Select Intel AMT Configuration. The Intel AMT Configuration screen includes numerous options,
which are available by scrolling down the menu.
Figure 8 Intel AMT Configuration Screen
Figure 9 Intel AMT Configuration Screen Continued
14. Select Host Name, and then type a host name
Default Setting = IntelAMT, Recommended Setting = User Dependent
Spaces are not accepted in the host name.

18
15. Select TCP/IP.
a. Select Disabling Network Interface, and then select N.
Default Setting = Network Interface Enabled, Recommended Setting = Network Interface
Enabled
If network is disabled, then all remote AMT capabilities are disabled and TCP/IP settings will not
be necessary. This option is a toggle, and the next time you access it you are prompted with the
opposite setting.
b. Select DHCP Disable, and then select N.
Default Setting = DHCP Enabled, Recommended Setting = User Dependent
For the purpose of this white paper, DHCP is enabled.
16. Select Provisioning Server.
a. Type the Provisioning Server IP.
Default Setting = 0.0.0.0, Recommended Setting = Network Dependent
b. Type the Port.
Default Setting = 9971, Recommended Setting = S&CS Dependent
This option is used in Enterprise mode when an Intel AMT Setup and Configuration (Provisioning)
Server is available. It points to the IP address of the S&CS.
If the IP and port are left as the default, the ME looks for ProvisionServer on DNS at port
9971.
Some ISV’s may require additional settings, such as the SC&S port number and SC&S IP
address. Contact your Management Console ISV for more details.
17. Select Provision Model.
a. Change to Intel AMT 1.0 Mode, and then select N.
Default Setting = Intel AMT 2.0 Mode, Recommended Setting = Intel AMT 2.0 Mode
b. Change to Small Business, and then select N.
Default Setting = Enterprise, Recommended Setting = Enterprise
c. Select Return to previous menu.
18. Select Set PID and PPS.
Default Setting = None, Recommended Setting = System Dependent
This option is for Provisioning ID (PID) and Provisioning Passphrase (PPS) entry. PIDs are 8 characters
and PPS are 32 characters. There are dashes between every set of 4 characters, so including dashes,
PIDs are 9 characters and PPS are 40 characters. An S&CS must generate these entries.
The Admin Password, PID, and PPS can be pre-populated by HP during manufacturing. See the OEM
TLS-PSK section for details.
19. Skip Un-Provision. This option returns the system to factory defaults. See the Return to Default sec-
tion for more information about unprovisioning.

19
20. Skip VLAN.
Default Setting = Disabled, Recommended Setting = User Dependent
This option enables or disables VLAN support. If VLAN is enabled, then the VLAN tag must be
provided (1-4094).
21. Select SOL/IDE-R, and then select Y.
a. A message window indicates that the system resets after configuration.
b. Select Username and Password, and then select Enabled.
Default Setting = Enabled, Recommended Setting = Enabled
This option allows you to add users and passwords from the WebGUI. If the option is disabled,
then only the administrator has MEBx remote access.
c. Select Serial Over LAN, and then select Enabled.
Default Setting = Enabled, Recommended Setting = Enabled
d. Select IDE Redirection, and then select Enabled.
Default Setting = Enabled, Recommended Setting = Enabled
22. Select Remote Firmware Update, and then select Enabled.
Default Setting = Enabled, Recommended Setting = Enabled
This option enables or disables the ability to remotely update the ME firmware.
23. Skip Set PRTC.
Default Setting = None, Recommended Setting = Current Date and Time
This option sets the PRTC (Protected Real Time Clock). It is used with TLS mutual authentication, which
checks for the client certificate for expiration based on its PRTC. PRTC has a valid date range of 1/1/
2004 to 1/4/2021.
24. Select Idle Timeout.
Default Setting = 0x1, Recommended Setting = 0x1
This option sets the timeout value for Wake-On-ME.
The default timeout value is 0x1 from the factory, but 0x0 if CMOS is cleared. A value of 0x0 means
the Wake-On-ME feature is disabled and the ME will not go to sleep when not being used in a non-
active system. HP recommends a setting of 0x1, which allows the ME to go to sleep after 1 minute of
inactivity.
The timeout value can be set in both decimal and hexadecimal notation and is in units of minutes. It
must be set to a non-zero value for the ME to take advantage of Wake-On-ME. Hexadecimal settings
are preceded by a “0x”, so one minute is “0x1”.
This value is not used when the system is in an active state - S0.
This value is used only if the ME On in Host Sleep State setting is set to Always.
See “Appendix C: Wake-On-ME Explained” on page 30 for an explanation of Wake-On-ME.
25. Select Return to previous menu.

20
26. Select Exit, and then select Yto exit the MEBx Setup and save settings. The system displays an Intel
ME Configuration Complete message and reboots.
27. Turn off the system and remove power. The system is now in In-Setup Mode and is ready for deploy-
ment.
28. Plug the system into a power source and connect the network. Use the integrated Intel 82566DM
NIC. Intel AMT does not work with any other NIC solution.
When power is reapplied to the system, the system immediately looks for a Setup and Configuration
Server. If the system finds this server, the AMT system will send a “Hello” message to the server.
DHCP and DNS must be available for the Setup and Configuration Server search to automatically
succeed. If DHCP and DNS are not available, then the Setup and Configuration Server’s IP address
must be manually entered into the AMT system’s MEBx.
The “Hello” message contains the following information:
•PID
• UUID (Universally Unique Identifier)
• IP address
• ROM and firmware version numbers
The “Hello” message is transparent to the end-user. There is no feedback mechanism to tell the user
the system is broadcasting the message.
The Setup and Configuration Server uses the information in the “Hello” message to initiate a
Transport Layer Security (TLS) connection to the AMT system using a TLS Pre-Shared-Key (PSK) cipher
suite if TLS is supported.
The Setup and Configuration server uses the PID to lookup PPS in provisioning server database and
uses the PPS and PID to generate TLS Pre-Master Secret. TLS is optional. For secure and encrypted
transactions, use TLS if the infrastructure is available. If you do not use TLS, then HTTP Digest will be
used for mutual authentication. HTTP Digest is not as secure as TLS.
Setup and Configuration Server logs into AMT system with the user name and password and
provisions all required data items:
• New PPS and PID (for future Setup and Configuration)
•TLScertificates
•Privatekeys
• Current date and time
• HTTP Digest credentials
• HTTP Negotiate credentials
You can set other options depending on S&CS implementation.
The system goes from In-Setup phase to Operational phase, and AMT is fully operational. Once in
the Operational phase, you can remotely manage the system and you can provide the system to end-
users for regular use.