Intel Confidential Slide 1 Intel vPro Provisioning Process with Microsoft System Center Configuration Manager SP1 These process flows focus on Advanced Security by enabling Kerberos Authentication and TLS security

Intel Confidential Slide 2 Purpose of Foils The following foils are intended to show the detailed flow of the Intel vPro Provisioning Process with Microsoft System Center Configuration Manager SP1 –SCCM Agent Based Provisioning (PKI + FW >=3.2.1) –Bare Metal Provisioning (PKI + FW >=3.2.1) –Bare Metal Provisioning (PSK + FW <3.2.1) –Full UnProvision – Reset to Factory Default –Partial UnProvisioning

Intel Confidential Slide 3 Agent Based Provisioning (PKI + FW >=3.2.1) 1.Based on policy, the Configuration Manager Agent will assess if the Client can be provisioned,. If it can, it will create a One Time Password and send the OTP to both the OOB Service and into the AMT Firmware 2.OOB Service Point secures connection with the AMT client through Embedded AMT Self Sign Certificate, Present Provisioning Certificate along with the OTP for initial Authentication 3.OOB Service Point sets the Remote Admin and MEBx password (if not changed) 4.OOB Service Point requests a web server certificate on behalf of the AMT client 5.OOB Service Point created an Object in AD for the vPro Client 6.OOB Service Point pushes web server certificate to AMT client 7.OOB Service Point pushes ACL, power schema, and other configuration data to AMT to finalize provision

Intel Confidential Slide 4 Bare Metal Provisioning (PKI + FW >=3.2.1) 1.Admin imports provisioning data* for Client being provisioned into ConfigMgr 2007 SP1 2.vPro Client sends a PKI hello packet to provisioning server (defined firmware schedule) 3.OOB Service Point secures connection with the AMT client through Embedded AMT Self Sign Certificate and Present Provisioning Certificate for initial Authentication 4.OOB Service Point sets the Remote Admin and MEBx password (if not changed) 5.OOB Service Point requests a web server certificate on behalf of the AMT client 6.OOB Service Point created an Object in AD for the vPro Client 7.OOB Service Point pushes web server certificate to AMT client 8.OOB Service Point pushes ACL, power schema, and other configuration data to AMT to finalize provision * - the collection of client provisioning data can be automated from the vPro client to SCCM, which requires an OS to run the utility but could be done from a WinPE image

Intel Confidential Slide 5 Bare Metal Provisioning (PSK + FW <3.2.1) 1.Admin imports provisioning data* for Client being provisioned into ConfigMgr 2007 SP1 2.vPro Client sends a PSK hello packet to provisioning server (defined firmware schedule) 3.OOB Service Point forwards the provisioning request to the Intel WS-MAN Translator 4.The Intel WS-MAN Translator passes the PSK - PID to establish the Secure Connection 5.OOB Service Point sets Remote Admin and MEBx password routed through the Intel WS-MAN Translator 6.OOB Service Point requests a web server certificate on behalf of the AMT client 7.OOB Service Point created an Object in AD for the vPro Client 8.OOB Service Point pushes web server certificate to AMT client routed through the Intel WS-MAN Translator 9.OOB Service Point pushes ACL, power schema, and other configuration data to AMT to finalize provision routed through the Intel WS-MAN Translator * - the collection of client provisioning data can be automated from the vPro client to SCCM, which requires an OS to run the utility but could be done from a WinPE image

Intel Confidential Slide 6 Full UnProvisioning – Reset to Factory Default* 1.Using TLS-secured connection and Digest Authentication, OOB SP sends a Full Unprovision command to client 2.OOB Service Point requests revocation of web server certificate of the AMT client 3.OOB Service Point deletes corresponding Object in AD for the vPro Client 4.Management Engine does the following: a)resets the Remote Admin and MEBx password and deletes all ACL information b)deletes web server certificate in ME c)clears audit log, deletes audit policy, and disables auditing d)deletes provisioning profile such as power schema, wireless profiles, and other configuration data in ME e)removes HOST Name, Domain Name, Provisioning Server IP and port * - At conclusion of Full Unprovision, client is at Factory Default with the exception of Local Admin password for access through the MEBx

Intel Confidential Slide 7 Partial UnProvisioning 1.Using TLS-secured connection and Digest authentication, OOB SP sends a Partial Unprovision command to client 2.OOB Service Point DOES NOT request revocation of web server certificate of the AMT client 3.OOB Service Point DOES NOT delete corresponding Object in AD for the vPro Client 4.Management Engine DOES NOT reset the Remote Admin and MEBx password and deletes all ACL information 5.Management Engine DOES NOT delete web server certificate in ME 6.Management Engine DOES NOT clear audit log, delete audit policy, or disables auditing 7.Management Engine DOES NOT remove HOST Name, Domain Name, Provisioning Server IP and port 8.Management Engine deletes provisioning profile such as power schema, wireless profiles, and other configuration data in ME

Intel Confidential Slide 8