Intel®EndpointManagement Assistant (Intel®EMA)

1 intel EndpointManagementAssistant( intel EMA)AdministrationandUsageGuideIntel EMAV ersion: : Tuesday,November23, ,andyouruseofthemisgovernedbytheexpressl icenseunderwhichtheywereprovidedtoyou("L icense").UnlesstheLicenseprovidesotherwi se,youmaynotuse,modify,copy,publish,dist ribute,discloseortransmitthissoftwareort herelateddocumentswithoutIntel' ,withnoexpressorimpliedwarranties, , (expressorimplied,byestoppelorotherwise) ,includingwithoutlimitation,theimpliedwa rrantiesofmerchantability,fitnessforapar ticularpurpose,andnon-infringement,aswel lasanywarrantyarisingfromcourseofperform ance,courseofdealing, featuresandbenefitsdependonsystemconfigu rationandmayrequireenabledhardware, ,theIntellogo, EMA AMTP rovisioning/SetupFlowinIntel (s) DNS SuffixinIntel ,Modifying.

2 EMA EMAA dministrationandUsageGuide-Tuesday,Novem ber23,202111 IntroductionIntel EndpointManagementAssistant( intel EMA)isasoftwareapplicationthatprovidesan easywaytomanageIntelvPro platform-baseddevicesinthecloud, :lIntelEMAcanconfigureanduseIntelAMTonIn telvProplatformsforout-of-band,hardware- levelmanagementlIntelEMAcanmanagesystems usingitssoftware-basedagent,whiletheOSis running,onnon-IntelvPro platformsoronIntelvPro platformswhereIntelAMTisnotactivatedlInt elEMAcanbeinstalledonpremisesorintheclou dlYoucanuseIntelEMA sbuilt-inuserinterfaceorcallIntelEMAfunc tionalityfromAPIsThisdocumentdescribesho wsetupandconfigureIntelEMAtomanageyouren dpoints, (referredtoasaTenant.)

3 ,itdefineskeyconceptsandterminologyforus ingIntelEMA, ,itpresentsthemanagementactionsyoucanper formonyourmanagedendpoints, EMAtomanageyourendpoints:lSupportedwebbr owsers:InternetExplorer*11+,Chrome*63+(s tartingfromDecember2017),Firefox*52+(sta rtingfromMarch2017).lKnowledgeofIntel ActiveManagementTechnology( intel AMT) : IntelAMTknowledgeisrequiredonlyifyouplan touseOut-of-Bandfeatures( ).ForadditionalinformationaboutIntel AMT,pleaseseethefollowingdocumentation: :lOperatingSystem: intel EMAA gentisofficiallysupportedonMicrosoftWind ows7and10, : EMAA dministrationandUsageGuide-Tuesday,Novem ber23,20212 EMA :WhenIntelEMAA gentisinstalled, ,makesurethatthefollowingin-boundrulesar esetfortheinstalledagentbinaryprocess:lP eer-to-peertraffic:UDPwithlocalportat169 90,anyIPforlocalandremoteaddresses, :TCPwithlocalportat16990,anyIPforlocalan dremoteaddresses, :TCPwithlocalportat16991, , ActiveManagementTechnology( intel AMT).

4 IntelEMAonlysupportsIntel VersionBuildNumberIntelAMT (SupportforIntelAMT )IntelAMT 15allFormoreinformationaboutUSBR, ,components,roles,andprocessesusedintheI ntel ,atenantcanbeacompany, ,endpointgroups, : TheIntelEMAinstallerdoesnotcreateaTenant AdministratoruserfortheinitialTenant, ,profiles, EMAA dministrationandUsageGuide-Tuesday,Novem ber23,20213 Figure1: intel ,however, :lGlobalAdministrator:Thisroleperformsus ermanagement,tenantmanagement, (andcannot) scontrolspansalltenantsinasingleIntel :Thisroleisspecifictoaparticulartenantan dcanperformalloperations(userman-agement ,endpointmanagement) ,theTenantAdministratordoesnot(andcan-no t) :Thisroleisspecifictoaparticulartenant, ,anAccountManagercannotmanageuserswithhi gher-levelroles( ,aTenantAdministratororGlobalAdministrat or).

5 AccountManagerscannotperformendpointmana gement, , ,theycanseethelistofallusergroupsandthel istofallEndpointGroupCreatorsandEndpoint GroupUsersinthattenant( ,userrolesinthattenantthatareequalorlowe rintheuserrolehierarchy;theycannotseeAcc ountManagers,TenantAdministrators,orGlob alAdmin-istrators). intel EMAA dministrationandUsageGuide-Tuesday,Novem ber23,20214lEndpointGroupUser:Thisroleis specifictoaparticulartenant, ,buttheycannotperformuserman-agement, , , AMTauto-setup: intel EMAserver, (EndpointGroupCreatorsorEndpointGroupUse rs) (UserBinthefigurebelow).AnEndpointGroupa ndausermustbeassociatedwiththesameUserGr oupinorderfortheusertoperformactionsonth atEndpointGroup(UserBcanperformactionson EndpointGroup2becausetheyarebothinUserGr oup1,whichhasexecuterights).

6 AnexceptiontothisisTenantAdministratorus ers, ( ,readorexecute).lUserGroupscanhaveeither read or execute EMAA dministrationandUsageGuide-Tuesday,Novem ber23,20215 Figure2:RelationshipbetweenUsers,UserGro ups, EMA AgentTheIntel , , ,whichmustbothbepresentonthemanagedendpo intfortheagenttowork(seeSection4).Theage ntalsohasacommandlineinterfacethatcanbeu sedtodisplaybasicinformationabouttheagen t' :lOperatingSystem: intel EMAA gentisofficiallysupportedonMicrosoftWind ows7and10, : :WhenIntelEMAA gentisinstalled, ,makesurethatthefollowingin-boundrulesar esetfortheinstalledagentbinaryprocess:lP eer-to-peertraffic:UDPwithlocalportat169 90,anyIPforlocalandremoteaddresses, :TCPwithlocalportat16990,anyIPforlocalan dremoteaddresses, :TCPwithlocalportat16991, , EMAA dministrationandUsageGuide-Tuesday,Novem ber23,20216lIntel ActiveManagementTechnology( intel AMT).

7 IntelEMAonlysupportsIntel VersionBuildNumberIntelAMT (SupportforIntelAMT )IntelAMT 15allFormoreinformationaboutUSBR, sinstallationdependonthearchitectureofth eMicrosoftWindowsOSandtheIntelEMAA gent(consoleandservice).Thesearetheregis trypathsforIntelEMAA gentbyarchitecture:lWin64 Service:lHKEY_LOCAL_MACHINE-> Software\ intel \EmaAgent lWin32 Service(on64bitOS):lHKEY_LOCAL_MACHINE-> Software\Wow6432 Node\ intel \EmaAgent lWin64orWin32 Console:lHKEY_CURRENT_USER-> Software\ intel \EmaAgent Thefollowingregistrykeysshouldexistatthi sregkeyrootwhentheEMAA gentisinstalled/ : in-band , ,IntelEMAcantalktoIntelAMTviaoneofthefol lowingapproaches: intel EMAA dministrationandUsageGuide-Tuesday,Novem ber23,20217lTLSR elay.

8 Inthisapproach, , ,itsagentbroadcaststotheotherIntelEMAage ntsinthegroup/sub-net,establishingcontac twithits neighbors , AMTCIRA(ClientInitiatedRemoteAccess):Int hisapproach,theendpointsystem sIntelAMTconnectstotheIntelEMAS erverviaaTCPTLS connectionatport8080(notethatthein-bandI ntel EMA AgentalsoconnectstotheIntelEMA serverviaTCPTLS atport8080).IntelAMTCIRA createsitsownencryptedtunnel, ,ifallattemptsfail, ,though, feature environmentdetection. Whentheendpointsystem snetworkdomainmatchestheconfiguredCIRA domain, , , AMTP rovisioning/SetupFlowinIntel EMAT hissectiondescribeswhathappensprogrammat icallywhenyoueitherenableauto-setupofInt el AMTforyourmanagedendpointsystems( ),ormanuallyperformanon-demandsetupofInt elAMT( ).

9 Note: intel EMAusesHostBasedConfiguration(HBC) (PKI)certificate,IntelEMAsetsIntelAMTtoC lientControlMode(CCM) ,suchasrequiringuserconsentateachendpoin tinordertoperformsomeofIntelEMA sIntelAMTintoAdminControlMode(ACM).LAN-l essendpointsrequireamanualIntelMEBX update(seeRound1below).Theaddedsecurityo fthePKIcertificateandACMallowsIntelEMAto connecttotheendpoint ,anduploadingPKIcertificatesforthem, : RefertoIntelAMTdocumentationformoreinfor mationaboutHostBasedConfiguration,Client ControlMode, ,ifyouhaveuploadedaPKIcertificateandsele c-tedTLS-PKIassetupmethodinyourIntelAMTa uto-setup, : ForLAN-lessendpoints,youmustfirstmanuall yupdatetheendpoint'sIntelMEBX toaddtheuploadedPKIcertificate'sDNS suffixinorderforIntelEMA EMAA dministrationandUsageGuide-Tuesday,Novem ber23.

10 Afterround1iscomplete( ,IntelAMTissuccessfullyprovisioned,eithe rinCCMorACM), intel EMAconfiguresotherIntelAMTsettingssuchas powerpolicy,KVMinterface,CIRA, ,IntelEMAwillun-provisiontheendpoint, , : Forunprovision(deactivation)ofIntelAMT,i ftheunprovisionfails, (Round1,Round2,orunprovision),ifIntelEMA isdisconnectedfromtheendpoint, AMTC lientControlMode,IntelEMAtriestouseIntel EMAA genttoissueaCFG_UnprovisioncommandviaInt el MEIdriver, ,IntelEMAsendstoWSMAN requestAMT_SetupAndConfigurationService\ , , performsafullunprovisionofIntelAMTanddel etesanycustomrootcertificatehashesandthe PKIDNS ,ifyouunprovisionasystemonaremotenet-wor kandthenwanttoreprovisionthatsystemusing AdminControlMode, RedirectionTheUSB Redirection(USBR)featureofIntelEMA allowsyoutomountaremote diskimage(.)