Intel®EndpointManagement Assistant (Intel®EMA)

1 intel EndpointManagementAssistant( intel EMA)SingleServerInstallationGuideIntel EMAV ersion: : Tuesday,November23, ,andyouruseofthemisgovernedbytheexpressl icenseunderwhichtheywereprovidedtoyou("L icense").UnlesstheLicenseprovidesotherwi se,youmaynotuse,modify,copy,publish,dist ribute,discloseortransmitthissoftwareort herelateddocumentswithoutIntel' ,withnoexpressorimpliedwarranties, , (expressorimplied,byestoppelorotherwise) ,includingwithoutlimitation,theimpliedwa rrantiesofmerchantability,fitnessforapar ticularpurpose,andnon-infringement,aswel lasanywarrantyarisingfromcourseofperform ance,courseofdealing, featuresandbenefitsdependonsystemconfigu rationandmayrequireenabledhardware, ,theIntellogo, PKI (ACL) ChangeIIS EMA ,Modifying, ,Modifying,andDeletingUsers314 PerformingIntel EMAS erverfromBackup385 Appendix: EMAS ingleServerInstallationGuide-Tuesday,Nov ember23,202111 IntroductionIntel EndpointManagementAssistant( intel EMA)isasoftwareapplicationthatprovidesan easywaytomanageIntelvPro platform-baseddevicesinthecloud, :lIntelEMAcanconfigureanduseIntelAMTonIn telvProplatformsforout-of-band,hardware- levelmanagementlIntelEMAcanmanagesystems usingitssoftware-basedagent,whiletheOSis running,onnon-IntelvPro platformsoronIntelvPro platformswhereIntelAMTisnotactivatedlInt elEMAcanbeinstalledonpremisesorintheclou dlYoucanuseIntelEMA sbuilt-inuserinterfaceorcallIntelEMAfunc tionalityfromAPIsThisdocumentdescribesth eproceduretoinstallandconfiguretheIntelE MAserverinafullproductionenvironment.

2 Asimplifiedtutorialinstallationprocedure forlearningpurposesisavailableintheIntel ,configuration,andmanagementoftheIntelEM Aserverasawhole,aswellascreatingTenantus agespaceswithintheIntel ,suchasTenantAdministratorsandAccountMan agersareresponsibleforsettingupandmainta iningtheusers,usergroups,endpointgroups, :Keyconceptssuchasuserroles,tenants,ande ndpointgroupsaredescribedindetailintheIn tel EMAA dministrationandUsageGuide,whichalsoprov idesdetailedinformationaboutthesetupandm aintenanceofIntel ,explainstheconfigurationparameters,andp rovidesdetailedinstallationstepsfortheIn tel EMAserveranditscomponentsisfairlystraigh tforward, ,beforestartingtheprocedure, , , EMAS ingleServerInstallationGuide-Tuesday,Nov ember23,20212lDeterminetheFullyQualified DomainName(FQDN) ,decideifyouwanttouseWindowsauthenticati onmode(recommended,forsecurityreasons) , :byFQDN/hostnameonly;usingFQDN/hostnamef irst,thenIPAddress; ,andtomanagethem, (Kerberos)ornormalaccount(username/passw ord)mode, , ,followITpracticetosetuptheSer-vicePrinc ipleName(SPN) secureportsbydefault(LDAPS secureport636andGlobalCatalogport3269).

3 PreviousversionsofIntelEMA usedthestandardnon-secureLDAP ports(LDAP port389andGlobalCatalogport3268).Ifyouar einstallingIntelEMA , , ,thenafterinstallingIntelEMA,opentheinst allerprogramagain( ,runasadministrator)andselectFile> AdvancedMode,thenclickSettings> SwitchfromLDAPstoLDAP toresettheLDAP portsIntelEMA ,youcanchangetheportsintheWebserversetti ngsontheServerSettingspageintheIntelEMA provisioning, : ,theIntel EMAA gentcanbeinstalledonthefollowingoperatin gsystems:lMicrosoftWindows*7( )lMicrosoftWindows10lMicrosoftWindows11 IntelEMAS ervercanbeinstalledonthefollowingoperati ngsystems:lMicrosoftWindowsServer2012R2( supportwillendwhenIntelEMA )lMicrosoftWindowsServer2016lMicrosoftWi ndowsServer2019 EMAS ingleServerInstallationGuide-Tuesday,Nov ember23, Xeon Processors,16threads,24 GBRAM,1 , , , ,English-USsystemlocale,andEnglish-USfor mat(matchWindowsdisplaylanguage).

4 *. , , ,configuring,andusingSQL andActiveDirectoryisrequired( ).IMPORTANT: Toachievesecurityin-depth, :lMicrosoftSQLS erver2012,2014,2016,2017,and2019(English -US versiononly) Server2012willnotbesupportedonceIntelEMA Serverisrunningmustbeasupportedoperating systemversionandneedstohaveEnglish-USWin dowsdisplaylanguage,English-USsystemloca le,andEnglish-USformat(matchWindowsdispl aylanguage).SeeSupportedOperatingSystems , (CPU,memory,SSD,etc.)toSQL Server'sresourcesaredynamicallyallocated , ,youmayseeerrormessageslike"Unabletogetd atabaseconnection,allconnectionsarebusy" inthecomponentserverlogfilesinProgramFil es(x86)\ intel \PlatformManager\ "ServiceBroker" ,youwillseewarn-ingstothateffectinthecom ponentserverlogfilesinProgramFiles(x86)\ intel \PlatformMan-ager\ ,ensurethatanSQL accountexistsontheSQL serverthatcanbeusedbytheIntelEMA installertoconnecttotheSQL databaseadministrator(SQL DBA),contacttheSQL DBA ,sinceyouwillbeaskedtospecifytheSQL accountunderSQL ,theSQL EMAS ingleServerInstallationGuide-Tuesday,Nov ember23,20214defaultdatabasecanbeanyexis tingdatabaseontheSQL installercanconfirmthatthespecifiedSQL account/usercancontacttheSQL ,ensurethattheSQLaccountusedintheIntelEM A SQL connectionstringhassysadminrights(tocrea tenewaccountforIIS defaultapplicationpoolidentity)

5 Andhasatleastdbcreatorpermission,whichal lowsittocreate,modify, ,thisaccountmusthavethedatabaselevelrole sdb_owner,db_datawriter, sysadmin rightisneededinordertocreatethenewuser IISAPPPOOL\\DefaultAppPool\ fortheSQLserver(ifitdoesnotexist).Ifitex istsalreadyoryoudonotusethataccountforth eIISapplicationpooloftheIntelEMAwebsite, thentheroleneededduringinstallationis dbcreator , sysadmin or dbcreator "SUBSCRIBEQUERYNOTIFICATIONS"totheuserof IntelEMA : Ifyoudonotgrant"sysadmin"rightstotheSQL connectionaccount,theinstall-ationwillst illcompletesuccessfully, "sysadmin"rightstotheSQL connectionaccount,youMUST manuallycreatethisuserontheSQL serveraftertheinstallationcompletesinord erforIntelEMA usesMicrosoftInternetInformationServer(I IS).UsethelatestIIS8, , ,IntelEMAwillsetupthewebsitesettingtorem ovetheIISserverversionfromtheresponsehea der,theHSTS header,thecookieSameSitestrict, , :IfIISisalreadyinstalled,ensurethatallau thenticationmethodsaredisabledexceptfor Anonymous and Windows (onlythosetwoshouldbeenabled).

6 PKI CertificateIntelAMTA dminControlMode(ACM) , (thisistheuniqueIntelAMTOID). intel EMAS ingleServerInstallationGuide-Tuesday,Nov ember23, ,theIntelEMA ,youmustspecifythevalue(eitherhostnameor IPaddress) , , ,ifusingActiveDirectory,ensureallcompute rs(includingthecomputerhostingtheloadbal ancer) ,theAJAX serverandManageabilityserverwillestablis haTCPconnection(locallyorremotely) (CIRA) ; ,console, EMAS ingleServerInstallationGuide-Tuesday,Nov ember23, , "Appendix-ModifyingCom-ponentServerSetti ngs"onpage , "Appendix-ModifyingComponentServerSettin gs"onpage , "Appendix-ModifyingComponentServerSettin gs"onpage , "Appendix-ModifyingComponentServerSettin gs"onpage (secure/non-secure)3269/3268 Thesecure(3269)andnon-secure(3268) ,whichitusestocreateoneormoreMeshSetting sCertificatesthatarestoredintheLocalMach ine\ certificates(EmaMtlsXXX)fortheTCP-TLScom municationsbetweentheIntelEMA componentservers(Ajax,Swarm,Manageabilit y,Web).

7 TheyarestoredintheLocalMachine\ ,thereisnowaytomakeIntel ,afterinstallingtheIntelEMAserver(oreach serverinadistributedenvironment),itisstr onglyrecommendedthatyouperformthefollowi ngsteps:lBackupIntelEMAdatabase(thisshou ldalsobedoneperiodically,notjustafterset up).lBackuptheMeshSettingsCertificatewhi chisstoredintheLocalMachine\ EMAS ingleServerInstallationGuide-Tuesday,Nov ember23, (ACL)forKeyConfigurationFilesAftertheInt elEMAserverinstallation,youshouldmodifyt heACLtolimitaccesstothefollowingfiles\fo lders:l[IntelEMAwebsiterootfolder( ,C:\inetpub\wwwroot)]\ [IntelEMAserverinstallationfolder( ,C:\ProgramFiles(x86)\ intel \PlatformMana ger)]\PlatformManagerServer\ [IntelEMAserverinstallationfolder( ,C:\ProgramFiles(x86)\ intel \PlatformMana ger)]\Runtime\MeshSet-tings\ [IntelEMAserverinstallationfolder( ,C:\ProgramFiles(x86)\ intel \PlatformMana ger)]\Runtime\MeshSet-tings\ [IntelEMAserverinstallationfolder( ,C.)]

8 \ProgramFiles(x86)\ intel \PlatformManager )]\ , , , ,youwouldneedtouninstallandreinstalltheI ntelEMAserverusingnewcertificates, , EMARESTAPIandJavaScriptlibraryThesamplef ilesareinthefolder[IntelEMAinstallationp ackagefolder]\ : ,copytheSamplesfoldertotheIntelEMAwebsit erootfolder( ,C:\inetpub\wwwroot\). ,authentication,encryption, , : intel EMAS ingleServerInstallationGuide-Tuesday,Nov ember23,20218l64-bitblockcipher3 DESvulnerabletoSWEEET32attacklBrokenciph erRC4isdeprecatedbyRFC7465lCBC-modeciphe rinSSLv3(CVE-2014-3566) OraclepaddinglCiphersuiteusesMD5formessa geintegritylWeakcertificatesignatureforS HA1lKeyexchange(DH1024)isoflowerstrength thanthecertificatekeyOneworkaroundtoavoi dthesethreatsandwarningsistodownloadIISc ryptofromthiswebsite: :unifiedhello, , ,MD5, (exceptfortheSHA1warning).IMPORTANT! ,enabling TLS_RSA_WITH_AES_128_GCM_SHA256 :lTLS_RSA_WITH_AES_128_GCM_SHA256lTLS_RS A_WITH_AES_256_CBC_SHAlTLS_RSA_WITH_AES_ 128_CBC_SHAI ntelAMTversion15 , , , , , ,andinsteadenablestrongencryptionprotoco ls, ,werecommendthatyouusetheDiffie-HellmanE phemeral(DHE) : IfyourenvironmentincludesendpointswithIn telAMT , ReplacetheTemporaryWebTLSC ertificateTheWebTLScertificateisusedforH TTPS communicationsbetweentheWebbrowserandthe Web+ (andtheIntelEMAsettingscertificate), EMAS ingleServerInstallationGuide-Tuesday,Nov ember23,20219 IISdefaultapplicationpoolwillrununder, \ (IISS erver).

9 ChangeIIS UserAccountBydefault,IntelEMAusestheIIS defaultapplicationpool(apppool) toruntheIntelEMA ,wheretheIntelEMA componentserversneedtoaccessaremoteSQL Server,youmayneedtochangetheaccounttheIn telEMA websiterunsundertoonethatcanaccesstherem oteSQL , (filesandfolders,certificate'sprivatekey ). connectionisusingWindowsauthentication,e nsurethenewIIS useraccountsatisfiesthepermissionandrole requirementsfortheSQL "ModifypermissionsofSQLS erveruserifdesired"onpage [Systemdrive]\ProgramFiles(x86)\ intel \Pl atformMan-ager\ :l[Systemdrive]\inetpub\ [Systemdrive]\inetpub\wwwroot\ [Systemdrive]\ProgramFiles(x86)\ intel \Pl atformMan-ager\Runtime\MeshSettings\ [Systemdrive]\ProgramFiles(x86)\ intel \Pl atformMan-ager\Runtime\MeshSettings\ [Systemdrive]\ProgramData\ intel \EMA\USBR -OrtheUSBR ,"ManageabilityServer"onpage \Personal\Certificatesandgive"read"permi ssionforthefollowingcertificatesbyright- clickingthetargetcertificateandselecting AllTasks\ManagePrivateKeys:lTemporaryWeb TLScertificate.

10 "IssuedTo"istheIntelEMAwebsiteFQDNorIP." IssuedBy"is"MeshRoot-XXXX".lSettingscert ificate."IssuedTo"is"MeshSettingsCertifi cates-XXX"."IssuedBy"is"MeshRoot-XXXX".l Inter-componentTLScertificateforwebserve r."IssuedTo"is"EmaMtlsWeb-XXX"."IssuedBy "is"MeshRoot-XXXX". ,Integratedpipelinemode, EMAS ingleServerInstallationGuide-Tuesday,Nov ember23, ,accesstheIntelEMA websiteinabrowser, EnablingtheTransportLayerSecurityProtoco lItisstronglyrecommendedthatyouenableTra nsportLayerSecurity(TLS), :lMessagetamperinglMessageinterceptionlM essageforgeryHTTPS trictTransportSecurity(HSTS)isanopt-inse curityenhancementpolicy,whichmustbeenabl edtoensureconnectionscanonlybesuccessful iftheTransportLayerSecurity(TLS) (forexample,HMACSHA256) RestrictUnlistedIISE xtensionsExecutionIfIISfeaturesISAPIE xtensionsorCGIareinstalled,ensurethatuns pecifiedISAPI modulesorunspecifiedCGImodules,respectiv ely, ,inIISM anager,enable DenyIPAddressbasedonthenumberofconcurren trequests ,enable DenyIPAddressbasedonthenumberofrequestso veraperiodoftime , ,seethefollowinglink.