Lenovo ThinkCentre M90p User manual

ThinkCentre M90p with
Intel Active Management Technology
Configuration Guide

First Edition (January 2010)
© Copyright Lenovo 2010.
LENOVO products, data, computer software, and services have been developed exclusively at private expense and
are sold to governmental entities as commercial items as defined by 48 C.F.R. 2.101 with limited and restricted
rights to use, reproduction and disclosure.
LIMITED AND RESTRICTED RIGHTS NOTICE: If products, data, computer software, or services are delivered
pursuant a General Services Administration ″GSA″contract, use, reproduction, or disclosure is subject to restrictions
set forth in Contract No. GS-35F-05925.

Contents
About this document .........v
Chapter 1. Introduction to Intel vPro and
Intel AMT ..............1
Acronyms ...............1
Chapter 2. Features and benefits of Intel
AMT................3
Features and benefits ...........3
Chapter 3. Introduction to ISV
applications .............5
Chapter 4. Main features of computers
built with Intel AMT ..........7
CIRA .................7
KVM redirection .............8
Chapter 5. Intel AMT setup and
configuration on Lenovo ThinkCentre
M90p desktop computers .......9
Intel AMT configuration settings in Setup Utility . . 9
Intel MEBx setup and configuration ......10
Entering the MEBx configuration user interface 11
Intel(R) ME General Settings........11
Intel(R) AMT Configuration ........19
Intel(R) Quiet System Technology Configuration 20
Driver description ............20
MEI................20
LMS................21
SOL................21
Chapter 6. Web user interface .....23
Accessing the Web user interface .......23
Provisioning the Intel AMT computer ....23
Logging on to the client .........24
Functions in the Web user interface ......24
Appendix A. Examples of configuring
Intel AMT in manual and automatic
setup and configuration modes ....25
Configuring Intel AMT in manual setup and
configuration mode............25
Configuring Intel AMT in automatic setup and
configuration mode............25
ZTC provisioning ...........25
USB provisioning ...........26
Appendix B. Factory default settings
for the Intel MEBx ..........27
Appendix C. Notices .........29
Trademarks ..............30
© Copyright Lenovo 2010 iii

iv ThinkCentre M90p with Intel AMT Configuration Guide

About this document
This document provides information about Intel®Active Management Technology
(Intel AMT) for Lenovo®ThinkCentre®M90p desktop computers. This document
provides step-by-step instructions on how to use Intel AMT.
This document is intended for trained IT professionals or those responsible for
configuring computers throughout their organizations. The readers should have
basic knowledge of network and computer technology, and be familiar with the
terms TCP/IP, DHCP, IDE, DNS, Subnet Mask, Default Gateway, Domain Name,
and so on.
This document provides information about the following topics:
Chapter 1, “Introduction to Intel vPro and Intel AMT,” on page 1: This chapter
provides a general introduction to Intel vPro™and Intel AMT.
Chapter 2, “Features and benefits of Intel AMT,” on page 3: This chapter
introduces the features and benefits of Intel AMT.
Chapter 3, “Introduction to ISV applications,” on page 5: This chapter provides a
general introduction to ISV applications.
Chapter 4, “Main features of computers built with Intel AMT,” on page 7: This
chapter introduces the main features of Intel AMT built-in computers.
Chapter 5, “Intel AMT setup and configuration on Lenovo ThinkCentre M90p
desktop computers,” on page 9: This chapter provides detailed instructions on how
to configure Intel AMT settings on Lenovo ThinkCentre M90p desktop computers.
Chapter 6, “Web user interface,” on page 23: This chapter provides instructions on
how to access the Intel AMT Web user interface.
© Copyright Lenovo 2010 v

vi ThinkCentre M90p with Intel AMT Configuration Guide

Chapter 1. Introduction to Intel vPro and Intel AMT
Intel vPro is a business computer platform that provides business computers with
enhanced remote management capabilities. For computers built with Intel vPro, IT
administrators can use a third party software to remotely collect inventory
information, diagnose problems, and provide various services regardless of the
computer power state or the operating system state. IT administrators can also
isolate and protect individual computers and the network from threats.
As a feature of Intel vPro, Intel AMT is designed to provide remote management
of computers regardless of the computer power state or the operating system state
as long as the computers are connected to an electrical outlet and a network.
Acronyms
The following table lists and explains some acronyms used in this document.
Acronym Description
ACL Access Control List
AMT Active Management Technology
ASF Alert Standard Format
CIRA Client Initiated Remote Access
DHCP Dynamic Host Configuration Protocol
DNS Domain Name Server
FQDN Fully Qualified Domain Name
FW Firmware
HECI Host Embedded Controller Interface
IDE-R Integrated Device Electronics - Redirection
IP Internet Protocol
ISV Independent Software Vendor
KVM Keyboard-Video-Mouse
LMS Local Manageability Service
ME Management Engine
MEBx Management Engine BIOS Extension
MEI Management Engine Interface
NVM Nonvolatile memory
OEM Original Equipment Manufacturer
OOB Out-of-band
PID/PPS Provisioning ID and Provisioning Pre-shared Key
PKI Public Key Infrastructure
PRTC Protected Real Time Clock
PSK Pre-shared Key
PXE Preboot Execution Environment
SHA Secure Hash Algorithm
© Copyright Lenovo 2010 1

SMB Small and Medium Businesses
SOL Serial-over-LAN
TCP Transmission Control Protocol
TLS Transport Layer Security
WOL Wake on Lan
ZTC Zero Touch Configuration
2ThinkCentre M90p with Intel AMT Configuration Guide

Chapter 2. Features and benefits of Intel AMT
This chapter introduces the features and benefits of Intel AMT.
The following table lists the Lenovo business computers with Intel AMT installed.
Lenovo computer Intel AMT version
ThinkCentre M90p Intel AMT 6.X
ThinkCentre M58p Intel AMT 5.X
ThinkCentre M57p Intel AMT 3.X
ThinkCentre M55p Intel AMT 2.X
Features and benefits
ThinkCentre M90p computers built with Intel AMT enable IT administrators to
better discover, heal, and protect the networked computing assets.
vDiscover: Intel AMT stores hardware and software information in nonvolatile
memory (NVM). With built-in manageability, Intel AMT enables IT
administrators to discover assets remotely, even when computers are turned off.
vHeal: The built-in manageability of Intel AMT provides out-of-band (OOB)
management capabilities, which enable IT administrators to remotely diagnose
computer problems and recover computers even if the operating systems are
inoperable. Proactive alerting and event logging help IT administrators detect
problems quickly to reduce computer downtime.
vProtect: The Intel AMT system defense feature enables better protection for
computers by proactively blocking incoming threats, controlling infected
computers before the computers cause problems in the network, and alerting IT
administrators when critical software agents are removed from the computers.
The following table shows the features and benefits of Intel AMT.
Table 1. Features and benefits of Intel AMT
Features Benefits
OOB system access Enables remote management of clients regardless of client power
state and operating system state
Remote
troubleshooting and
recovery
Significantly reduces IT helpdesk visits and increases IT service
efficiency
Proactive alerting Decreases computer downtime and minimizes IT service time
Remote hardware asset
tracking
Increases speed and accuracy with reduced accounting costs,
compared with manual inventory tracking
© Copyright Lenovo 2010 3

4ThinkCentre M90p with Intel AMT Configuration Guide

Chapter 3. Introduction to ISV applications
Intel AMT is designed as a building block and not a complete solution. This
enables Original Equipment Manufacturers (OEMs) to incorporate Intel AMT into
their client and server hardware platforms. Competent and authorized third party
applications provide management and security services that take advantage of the
Intel AMT features, such as out-of-band access to asset information, event logs,
hardware and software tables, and embedded capabilities.
The following table lists the common third party Independent Software Vendor
(ISV) management applications.
Table 2. List of common third party management applications
Application ISV
Microsoft®System Management Server 2003 Microsoft
Microsoft System Center Configuration Manager Microsoft
LANDesk Management Suite LANDesk
Altiris Real Time System Manager Altiris
© Copyright Lenovo 2010 5

6ThinkCentre M90p with Intel AMT Configuration Guide

Chapter 4. Main features of computers built with Intel AMT
Computers built with Intel AMT version 2.0 or later have the following features
and improvements:
vRemote power control
– Power on
– Power off
– Power reset
– Power cycle
vAsset management
– E-Asset tag
– OOB hardware inventory
vIntegrated Device Electronics - Redirection (IDE-R)
– Floppy redirection
– CD redirection
vSerial-over-LAN (SOL)
– Screen redirection based on text
– Keyboard redirection
– Network redirection
vRemote restart
– Restart from a local hard disk drive
– Restart from a local CD or DVD drive
– Restart from a local Preboot Execution Environment (PXE)
vEvent management
– Event alerting
– Event logging
– Audit log
vAgent presence
vSystem defense
v“CIRA”
v“KVM redirection” on page 8
CIRA
ThinkCentre M90p computers built with Intel AMT support the Client Initiated
Remote Access (CIRA) function. You can perform this function through ISV
applications. For more information about ISV applications, see Chapter 3,
“Introduction to ISV applications,” on page 5.
The CIRA function enables client-initiated, secure OOB communication to the
manageability console, which includes:
vUser-initiated call-home feature
vScheduled, automated call-home feature (no user input required)
vTransport Layer Security (TLS) session established through client initiation
© Copyright Lenovo 2010 7

KVM redirection
ThinkCentre M90p computers built with Intel AMT 6.X support
Keyboard-Video-Mouse (KVM) redirection over Internet Protocol (IP). As an
important new feature in Intel AMT 6.X, KVM redirection enables IT
administrators to remotely control the keyboard, video or visual display unit, and
mouse of the managed clients. KVM redirection has the following advantages:
vWork stably
vBased on hardware
Note: KVM redirection is based on hardware so that it can work correctly
regardless of the operating system state of the managed clients.
vManage clients through management servers remotely
vHealing, installation and applications support
Notes:
1. KVM redirection in Intel AMT 6.X can be used only on computers with Intel
integrated graphics. For computers with discrete graphics cards, the
Serial-over-LAN (SOL) function can be used to support remote diagnostics and
repair.
2. The KVM user interfaces are only available on computers that support KVM
redirection. For more information about KVM user interfaces, see “KVM
Configuration” on page 20.
8ThinkCentre M90p with Intel AMT Configuration Guide

Chapter 5. Intel AMT setup and configuration on Lenovo
ThinkCentre M90p desktop computers
The Intel Management Engine (ME) is an isolated and protected computing
resource that runs on an Intel AMT computer. The Intel Management Engine BIOS
Extension (MEBx) provides a user interface to change or configure settings that
control the operation of the Intel Management Engine (ME).
All changes to the ME platform configuration settings are not cached in the MEBx,
but committed to the ME nonvolatile memory until you exit the MEBx. If the Intel
MEBx crashes in the process of the configuration, the changes that you have made
will not be saved.
Note: To perform the CIRA function, configure your computer in the MEBx for
manual setup and configuration mode or automatic setup and configuration
mode, and then use the CIRA function through ISV applications. You do not
need to do any additional setup and configuration in the MEBx.
Intel AMT configuration settings in Setup Utility
The Setup Utility program enables you to view and change the Intel AMT related
configuration settings for your computer.
To view or change the Intel AMT configuration settings, do the following:
1. Repeatedly press and release the F1 key when turning on the computer. When
you hear multiple beeps or see a logo screen, release the F1 key. The Setup
Utility program starts.
© Copyright Lenovo 2010 9

2. From the Setup Utility program main menu, select Advanced →Intel(R) AMT.
The following window will be displayed.
In the window, you can view the following Intel AMT configuration settings:
Option Default setting Description
Intel(R) AMT Control Enabled Used to enable or disable the Intel AMT
interface.
Intel(R) AMT Reset Disabled Used to enable or disable the Intel AMT reset
function.
Press <Ctrl-P> to Enter
MEBx
Enabled Used to enable or disable the entrance of the
MEBx setup configuration menu.
For more information, see the instructions and the help messages on the screen.
Intel MEBx setup and configuration
This section provides instructions on how to set up and configure Intel AMT for
your computer.
Figure 1. Intel AMT configuration settings in Setup Utility
10 ThinkCentre M90p with Intel AMT Configuration Guide

Entering the MEBx configuration user interface
Repeatedly press and release Ctrl+P when turning on the computer. When you see
the Intel Management Engine BIOS Extension window, release the Ctrl and P keys.
Press 1 to enter the Intel MEBx MAIN MENU window (Figure 2). You will be
prompted to enter the Intel ME password. Type the Intel ME default password
admin and then you will be promoted to type a new password. To set a new Intel
ME password, see “Change ME Password” on page 12.
Intel(R) ME General Settings
Select Intel(R) ME General Settings in the Intel MEBx MAIN MENU window and
press Enter. The INTEL(R) ME PLATFORM CONFIGURATION window opens
(Figure 3). This window enables you to configure the general settings of the Intel
ME, such as ME state, ME password, power control, and so on.
Figure 2. Intel MEBx MAIN MENU window
Figure 3. INTEL(R) ME PLATFORM CONFIGURATION window
Chapter 5. Intel AMT setup and configuration on Lenovo ThinkCentre M90p desktop computers 11

The following options are listed in the INTEL(R) ME PLATFORM
CONFIGURATION window:
Intel(R) ME State Control
The Intel(R) ME State Control option allows you to enable the Intel ME on the
platform or disable the Intel ME for debugging purposes.
Note: The DISABLED option allows you to disable the Intel ME for debugging
purposes. The DISABLED option is used to stop the Intel ME code from
executing at the early stage of the Intel ME boot process so that the system
has no traffic originating from the Intel ME on any of the buses. Disabling
the Intel ME enables an IT technician to debug a system problem without
any interference from the Intel ME.
Change ME Password
The Change ME Password option enables you to change the Intel ME password.
To change the Intel ME password, select Change ME Password and press Enter.
Type your new password and press Enter. When prompted to confirm the new
password, type your new password again.
Password considerations: For security reasons, it is recommended to use a strong
password that cannot be easily compromised. To set a strong password, use the
following guidelines:
vHave eight to 32 characters in length
vContain at least one alphabetic character, one numeric character, and one symbol
(!@#$%^&*andsoon)
vContain at least one upper case letter and one lower case letter
vYou can also use the space bar and underscore (_).
Password Policy
The Password Policy option specifies when you can change the MEBx password
through the network interface.
Select Password Policy and press Enter, the following three options will be
displayed.
Option Description
DEFAULT
PASSWORD ONLY
This option enables you to change the MEBx password when the
MEBx password has not been modified.
DURING SETUP
AND
CONFIGURATION
This option enables you to change the MEBx password during the
setup and configuration. You cannot modify the MEBx password
after the setup and configuration process is completed.
ANYTIME This option enables you to change the MEBx password anytime.
Network Setup
The Network Setup menu enables you to configure network settings. Select
Network Setup and press Enter. The INTEL(R) NETWORK SETUP window opens.
The following options will be displayed:
v“Intel(R) ME Network Name Settings” on page 13
v“TCP/IP Settings” on page 13
12 ThinkCentre M90p with Intel AMT Configuration Guide