User Consent Tool

User Consent Tool

The User Consent Tool is an application that demonstrates how an IT technician can connect to a remote Intel AMT system that is defined to require user consent.

For more information about the User Consent Tool, see the following:

· General Information

· User Consent Tool Flow

· Connection Settings Window

· Main Window

· Advanced Tab

· Status Tab

· Settings Tab


General Information

The User Consent Tool is an application that demonstrates how an IT technician can connect to a remote Intel AMT system that is defined to require user consent.

Required user privileges

The user running the User Consent Tool must be defined in the Access Control List (ACL) of the remote Intel AMT device:

· A user with the ADMINISTRATION_REALM privilege can use all the User Consent Tool options.

· A user with the REMOTE_CONTROL_REALM and the GENERAL_INFO_REALM privileges can use all options except change the monitor settings.

· A user with the SOLIDER_REALM and the GENERAL_INFO_REALM privileges can use all options except change the monitor settings or the boot options.

Microsoft .NET Framework and slow reaction of the application

To use the User Consent Tool, Microsoft .NET Framework must be installed on the computer. Intel recommends .NET Framework version 2.0 (SP1), version 3.0 (SP1), or higher. Some other versions can cause the User Consent Tool to operate slowly. This can occur because .NET Framework repeatedly attempts to verify the signed DLL files, even when there is no internet connection.

The User Consent Tool includes a configuration file (UCT.exe.config.exe) in the same folder as the exe file. You can add this entry to the configuration file to prevent .NET Framework from connecting to the internet to verify the signed DLLs:

<runtime>

<generatePublisherEvidence enabled="false"/>

</runtime>


User Consent Tool Flow

The following steps describe how an IT technician can connect to a remote Intel AMT system using the User Consent Tool.

1. Double-click the UCT.exe file. The Connection Settings window appears.

2. Define the settings that will be used to connect to the remote Intel AMT system (see Connection Settings Window).

3. Click Connect. The following window appears while the User Consent Tool attempts to connect to the remote Intel AMT system.

When trying to connect to the system using TLS, and the host name defined in the Intel AMT device does not match the host name defined in the host operating system, the following window appears.

You can select whether you want to continue and connect to the system, or cancel the connection. You can also click View Certificate to display the certificate.

When connection is established, the Connection Settings window closes and the main window of the User Consent Tool appears (see Main Window).

4. Click Start Consent. The remote Intel AMT generates the user consent code and attempts to display a sprite with a user consent code. The Timeout section displays for how long the user consent code is valid (in minutes) and starts to count down to zero.

Note:

From Intel AMT Release 7.0, you can define for how long the user consent code is valid (see Advanced Tab).

The User Consent Tool polls the AMT to determine if the user consent code has been displayed to the remote user. One of the following will occur:

· If a sprite was displayed to the remote user, the Consent State field value changes to Displayed. Continue to step ‎6.

· If, after ~15 seconds, the Consent State status does not change to Displayed this indicates that Sprites are not supported. Continue to step 5.

5. If sprites are not supported on the remote Intel AMT system, the Intel AMT system must be rebooted to display the user consent code. The type of message displayed and the options available depend on the network interface.

· If the connection is via a wired interface:

If this message is displayed, click Yes to close the message and reboot the remote Intel AMT system.

· If the connection is via a wireless interface:

To remain connected via a wireless connection during reboot, control of network connections on the system must be passed to the Intel AMT Manageability Engine (by changing the “Link Preference” of the Intel AMT system to “ME”). Select one of the following options:

· Yes – Set the link preference to ME and reboot the system.

· No – Set the link preference to ME and do NOT reboot the system.

· Cancel – Cancel the user consent process (make no changes).

Note:

· If no wireless profiles exist in the Intel AMT device (user defined or IT defined), the User Consent Tool will cancel the user consent process.

· If there is an SSID mismatch, and only IT defined profiles exist, the User Consent Tool will cancel the user consent process since it definitely cannot reconnect with same IP. If user defined profiles exist, you will be asked if you want to continue (reconnection with the correct IP is not guaranteed.)

If you selected to reboot the system, the User Consent Tool displays the Graceful Shutdown window while the system is rebooted.

When the remote Intel AMT system reboots, the user consent code is displayed to the remote user by the MEBx.

6. When the Consent State has changed to Displayed, the Send button in the Operations tab Code section is enabled. Enter the code that the remote user communicated to you and click Send. (To view the code that you entered, select view code.) When the code is verified by the remote Intel AMT, the User Consent Tool displays the following message:

7. Click OK. The Operation Information window closes. You can now start a redirection session on the remote Intel AMT system. The redirection session must start within 15 minutes of generating the consent code. The remaining time is displayed in the Timeout section of the Operations tab.

Note:

For detailed information about the options and parameters available in the User Consent Tool, see the following:

· Connection Settings Window

· Main Window

· Advanced Tab

· Status Tab

· Settings Tab


Connection Settings Window

The Connection Settings window defines the settings that the User Consent Tool uses to connect to the remote Intel AMT system. It is displayed the first time the User Consent Tool is started, and until the first successful connection is established. The defined settings are used by default for all connections, or can be changed per connection by clicking Edit from the Main window.

The following table describes the options available from the Connection Settings window.

Option

Description

Authentication Settings

These settings define how the User Consent Tool will authenticate itself with the remote system:

· IP or FQDN – The IP address (in IPv4 or IPv6 format) or the FQDN of the remote Intel AMT system. The User Consent Tool saves the latest connection settings for each system. If you select a system from the drop-down list, the connection settings fields are populated automatically.

· Digest – If selected, a user name and password must be supplied.

· Kerberos – If selected, the User Consent Tool will use the currently logged on user, unless a different user is specified. The Kerberos user must be provided in the format of DomainName\UserName.

· Save password as plain text – If selected, the User Consent Tool saves the password for future connections. Note that the password is NOT encrypted. (By default this check box is not selected.)

TLS Settings

These settings define the level of security that the User Consent Tool will use when communicating with the remote system.

· None –Do not use Transport Level Security (TLS).

· Server Authentication – If selected, the root certificate needed for server TLS must be installed in the trusted root store of the computer running the User Consent Tool.

· Mutual Authentication – If selected, the client certificate needed for mutual TLS must be installed in the personal certificates store of the computer running the User Consent Tool. Optionally, you can also provide a Common Name (CN) in the Client Certificate CN field.

Proxy Settings

These settings define if the User Consent Tool will connect to the remote system via a proxy.

If the Use Proxy (Remote Access) check box is selected, an address (in IPv4 or IPv6 format) or the FQDN of the proxy must be provided. If required by the proxy, provide the user name and password.

Connect

Click to connect to the remote Intel AMT system.

Cancel

Click to cancel a connection request to the remote Intel AMT system.

Clear all fields

Click to clear the entries of all fields in the Connection Settings window.


Main Window

The Main window of the User Consent Tool is where the main actions of the user consent request flow are performed.

The following table describes the options available from the main window

Option

Description

Connection Icon

Indicates if the User Consent Tool is connected to the Intel AMT remote system:

– Not Connected [image] – Connected

Connected to

Contains the IP address (in IPv4 or IPv6 format) or the FQDN of the remote Intel AMT system. Entering a new value here and clicking the green arrow, or pressing <Enter>, starts a connection request.

Edit/Disconnect

If the User Consent Tool is connected to a system, a disconnect button is displayed. Clicking Disconnect ends the connection and displays an Edit button. Clicking Edit opens the Configuration Settings window (see Connection Settings Window).

Consent State

Displays the Consent State (see Status Tab).

Power State

Displays the power state of the Intel AMT system.

Start Consent

Click to start the User Consent flow. If the User Consent Tool is connected to a system, a Cancel Consent button is displayed. Click to Start/Cancel the user consent request.

Note that you cannot cancel a user consent request once a KVM or IDE-R session has started.

Connection interface

Displays the type of interface the User Consent Tool is using to connect to the Intel AMT system: Wired or Wireless. If the connection is wireless, the following additional information is displayed:

· LAN ID – The SSID of the access point to which the Intel AMT system is connected.

· Link Control – Indicates whether the link is currently owned by the ME or the host.

· Link Preference – Indicates whether the link is preferred to be owned by ME or host.

For more information about wireless, see the Wireless Operations section of the Advanced Tab.

Operations Tab

Timeout

A countdown display indicating how much longer the user consent code is valid. If a KVM or redirection session is not started before this value reaches zero, a new user consent code must be generated (by clicking Start Consent).

From Intel AMT Release 7.0, you can define for how long the user consent code is valid (see Advanced Tab).

Code

The options in this section are enabled only after the Consent State is Displayed. Enter the code that the remote user communicated to you and click Send. (To view the code that you entered, select view code.)

Monitor

If the remote Intel AMT system user cannot see the sprite, try clicking Switch to change the monitor screen on which the sprite is displayed.

Status Bar

Open/Close Viewer

The status bar, located at the bottom of the User Consent Tool window, includes the status of the user consent request flow. Click the +/- sign to open/close the log viewer.

The log viewer displays the actions that the User Consent Tool performs, as they occur and writes them to the log file. Clicking this icon clears the loge records displayed in the log viewer, but does not delete them from the log.

Click this icon to open the full log file in notepad. A separate log file is created each day that the User Consent Tool is run, and stored in the same folder as the User Consent Tool application.

Indicates that there is an error with the certificate used when trying to connect to the system using TLS. Click the icon for more details.


Advanced Tab

The Advanced tab includes additional options that can be used independently of the main flow.

The following table describes the options available from the Advanced tab.

Option

Description

Monitor Settings

Defines on which monitor screen (on the remote system) the user consent code will be displayed by default. Select the monitor and click Apply.

User Consent Code Setting

Enables you to set, in the firmware of the Intel AMT system, the number of seconds that the user consent code will be valid. The timer starts after the Consent State has changed to “Received”. If a successful KVM or redirection session is not started within this time, the Consent State reverts to “Not Started” (see the “Consent State” field in the Status Tab).

Enter the required number of seconds and click Apply.

Valid values: 60 – 900 (15 minutes).

Default: 120 (2 minutes).

Note: This option is supported from Intel AMT Release 7.0.

Power Operations

Enables you to perform a power operation on the remote system. If the Perform graceful shutdown check box is selected, before performing the power operation the User Consent Tool will display a message to the remote user instructing him to close all applications. Select the required options and click Apply.

Wireless Operations

These options are available only for wireless Intel AMT systems.

Enables you to define whether the wireless link connection on the Intel AMT system is controlled by the host driver or by the Intel ME (the embedded Manageability Engine running the Intel AMT firmware).

The Intel AMT system can be in one the following link preference states:

· Host – The host controls the link (as long as ME identifies a functional host driver over that link’s interface). In this default state, the User Consent Tool will lose connection to the system when a reboot is performed.

· ME – ME takes control of the link, regardless of host driver status. In this state, the User Consent Tool remains connected to the system even after the system is rebooted. However, the host operating system will not have WLAN connectivity. Control is returned to the host after the number of seconds you define here.

When you need to reboot a wireless Intel AMT system (for example to display the user consent code when sprites are not supported) the link preference must be set to ME. Select the required options and click Apply.


Status Tab

The Status tab provides information about the current remote Intel AMT system to which the User Consent Tool is connected.

The following table describes the information available from the Status tab.

Field

Description

Power State

The current power state of the Intel AMT system.

AMT Host Name

The AMT host name of the currently connected system.

FW Version

Firmware version of the Intel AMT system.

Build Number

The build number of the firmware version.

Consent Policy

Displays the IPS_OptInService.OptInRequired property.

The consent policy of the Intel AMT system indicates which operations on the AMT require user consent. Valid values:

· None

· KVM

· All

Consent State

Displays the IPS_OptInService.OptInState property.

The consent state can be one of the following:

· Not Started – The process has not started.

· Requested – The process started and the Intel AMT generated the user consent code, but the code has not been displayed to the user on the remote Intel AMT system.

· Displayed – The user consent code has been displayed to user on the remote Intel AMT system (either by a sprite or by the MEBx after reboot). When the system is in this state, the User Consent Tool can send the user consent code supplied by the remote user.

· Received – The user consent code was sent by the User Consent Tool and accepted by the remote Intel AMT system. When the system is in this state, operations that require user consent can be started (such as KVM or IDE-R sessions).

· In Session – A KVM or IDE-R session is open on the remote Intel AMT system. Note: You cannot cancel a user consent request once a KVM or IDE-R session has started.

Consent Timeout (seconds)

Displays the IPS_OptInService.OptInCodeTimeout property.

This value is the number of seconds during which the generated user consent code is valid after the Consent State has changed to “Received”. If a successful KVM or redirection session is not started within this time, the Consent State reverts to “Not Started”. The Consent Timeout value can be defined in the Advanced Tab (User Consent Code Setting).

The valid range is 1-15 minutes. The default is two minutes.

Display Timeout (seconds)

Displays the IPS_OptInService.OptInDisplayTimeout property.

This value is the number of seconds that the user consent code will be displayed on the remote Intel AMT system. If the code is not entered within this time, the display closes and the Consent State changes to “Not Started” (this code is then no longer valid).

The valid range is 1-10 minutes. The default is five minutes.

Default Monitor

The monitor of the remote Intel AMT system on which the user consent code will be displayed.


Settings Tab

The Settings tab includes several definable User Consent Tool application settings.

The following table describes the options available from the Settings Tab.

Option

Description

Log Settings

Defines if and how the User Consent Tool records to a log file.

If the Create log file check box is selected, the User Consent Tool records a log file according to the selected Logging level:

· Regular – Only the main actions and errors are logged.

· Detailed (default) – All operations, errors, and user selections are logged.

The log file is created in a Logs sub-folder where the User Consent Tool is run. To apply changes made to these settings, restart the User Consent Tool.

Application Settings

Defines general application settings.

If the Attempt graceful shut-down before AMT reboot check box is selected, before rebooting a remote Intel AMT system the User Consent Tool will display a message to the remote user instructing him to close all applications. The message will be displayed for the amount of minutes defined in the Timeout field. If the check box is not selected, (or the timeout is reached) the User Consent Tool performs reboot directly from the AMT, regardless of the state of the remote systems operating system.

Performing graceful shutdown requires the following:

· The user account running the User Consent Tool must have the SeRemoteShutdown privilege on the remote Intel AMT system.

· The host name/IP address defined in the Intel AMT must be identical to the host name/IP address defined in the host operating system.

Apply

Click to reset the User Consent Tool settings back to the default settings.