Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

Install OOB Site Service with Altiris 7.1

Created: 28 Apr 2011 • Updated: 28 Apr 2011 | 10 comments
Language Translations
Terry Cutler's picture
+3 3 Votes
Login to vote

The OOB Site Service is used to configure and maintain Intel Active Management Technology solutions within a Symantec environment.   Installation of the Out-of-Band Management module will not automatically configure the OOB Site Service.   Similarly, deploying the OOB Site Service within the environment may not automatically install and configure the Intel Setup and Configuration Service package.   Although at first this may be frustrating, in reality it provides flexibility to the environment.   Not every site server must host the OOB site service, and not every OOB site service must have Intel SCS installed.

Identify Potential OOB Site Servers

Within the Symantec Management Console of Altiris ITMS 7.1, click Home > Remote Management > Out of Band Management.   After the page loads, on the left side expand Configure and Assign OOB Site Servers.

In the example screenshot below, the yellow warning indicator on the right states that no OOB Site Servers are installed and at least one must be installed to configure Intel® AMT.

If you have multiple Site Servers in your environment, the View Potential OOB Site Servers may show a filtered list of candidates.  

Note: If no servers are listed, continue following the steps below.   Obviously you have at least one site server installed otherwise the Symantec Management Console and Out of Band Management Component menus shown would be appear otherwise.

Next, click on step 2 – Run OOB Site Server Prerequisites Check.   In general, the default settings are sufficient.

Once completely installed, the OOB Site Service will reference a secondary database.   The default database name is Symantec_CMDB_IntelAMT.   The database typically resides on the same SQL server as Symantec_CMDB.   On the right side of the screen, ensure the target database server is named along with database name.  Windows authentication is the default setting for the database.   The OOB Site Service install will add the Windows service AMTconfig, which can run under the Altiris AppID account.

Once the settings are determined, use the Task Scheduling options at the bottom of the window to target a specific Altiris Site Server.   When the task runs on the target server, a command prompt and script will open similar to the example below.  

The collected data will be summarized in a canned report by clicking step 3 – View the Prerequisites Check Results - as shown below.  In the example screenshot, the target server (ITMS71) will support the OOB Site Service with Intel SCS.   Remote configuration supported returned an answer of false due to missing remote configuration certificate. 

For more information on acquiring a certificate, see http://communities.intel.com/docs/DOC-1277

 

Configure and Assign OOB Site Servers

Using the list of potential OOB Site Servers, select step 4 – Configure and Assign OOB Site Servers.   In the middle column, expand Site Management > Site Servers and select the target Site Server based on your previous steps.

Click the Configure button located in the upper-right of Site Management.  In the Add/Remove Services window, select OOB Service similar to the example below.

You may see a warning box regarding the OOB Service running on an IIS 7 server, similar to the example below.   Ignore and click OK.

IIS 6 compatibility mode is presently required for ITMS 7.1 installation.  

A series of steps will be shown, similar to the example below.   Complete each of the steps as indicated to ensure the OOB Site Server agent is installed, update filter membership, and so forth.   Focus first on the OOB Site Server Agent installation to get past the pending status.

In the example below, the updated filter membership shows the target server (ITMS71) has been assigned to receive the OOB Site Server agent install.

Once the agent install is completed on the target server, it will be shown under the Agents\Plug-ins similar to the example below.

Within the Symantec Management Console, reload the OOB Service page similar to the example below.   The OOB Site Service Agent Installation is listed as successful.   The next focus is to install the Intel AMT Setup and Configuration service.   In the example below, this is listed as pending.

 

Similar to the previous steps, click through each of the items listed. 

The OOB Service installation settings page should be reviewed to validate the desired settings.   In general – leave default settings, unless you desire and are familiar with advanced installation options.   If you plan to use a different SQL Server, database instance, enable SSL connections between Altiris OOBM and Intel SCS, or other customizations – now is the time to make these changes.

 

Once the settings have been validated, click on the link to run the Intel SCS installation.   This will open a default TaskServer job as shown below.

Schedule the task to run on the target server.   Once complete, the OOB Site Service with Intel SCS is now installed on the target system.  You will need to define the Configuration Profile, obtain and apply the remote configuration certificate (for information on where to place the certificate, see http://www.symantec.com/connect/articles/readyfour-insights-oob-site-service-installation-and-usage), and so forth.

Manually Confirming the Installation Completed

The following steps and screenshot provide additional points of reference to ensure the service installed correctly.

First, check the Task Status of the target Site Server.   The Install Intel® Setup and Configuration Server task will show a successful completion with return code 0.

Second, check to ensure the AMTconfig service is installed and started.  With the release of ITMS 7.1, the AMTconfig service version will be 5.4.0.9.

Note: Unless directed by a Symantec support specialist, customers should stay with the Intel SCS version provided in the Altiris Out-of-Band Module.  

Third, a new database instance will be shown on the SQL server.    The default instance name is Symantec_CMDB_IntelAMT as shown below.

Common Questions and Additional Resources

Question: When are multiple OOB site services needed?

Answer: A single OOB Site Service will scale to several 10’s of thousands of systems.   In general, if your Intel AMT settings will be vastly different between domains within an environment, then multiple OOB Site Services may be needed.   If this is the case, it will mostly likely align to the multiple hierarchical structures of your various Altiris deployments.   Contact Symantec support to discuss further.

Question: What if I am migrating from Altiris 6.x to 7.x environment?

Answer: See http://www.symantec.com/connect/articles/migrating-oobm-6x-7x-what-happens-intel-scs

Question: What about an upgrade path from Altiris Out-of-band Management 7.0 to 7.1?  

Answer: At this time, I am not aware of an upgrade path from Altiris 7.0 to 7.1.   However, the IntelAMT database can be upgraded and reassociated to a newer version of the service. 

Question: What is I need to move the IntelAMT database or service to a different server?

Answer: The database contains both the service configuration settings and list of configured systems.   The database can be moved and reassociated to other instances of the Intel SCS service.   In addition to the insights shared at http://www.symantec.com/connect/articles/moving-or-reassociating-intelamt-database, use the existing database name when defining the OOB Service settings as noted earlier in this article.   For further assistance, contact Symantec support.

Question: Will the Altiris OOB Site Service support the new host based configuration capabilities introduces with Intel AMT 7?

Answer: Unfortunately it will not.   More information on host based configuration is referenced at http://www.symantec.com/connect/articles/intel-amt-7-introduces-host-based-configuration.   If you configure an Intel AMT system in client control mode, you only need to run OOB Discovery and update your Connection Profile to start using the Intel AMT functionality.

The opinions expressed on this site are mine alone and do not necessarily reflect the opinions or strategies of Intel Corporation or its worldwide subsidiaries

Comments 10 CommentsJump to latest comment

andykn101's picture

The manual states SQL Server 2008.

Is 5.4.0.9 the version of the Intel Setup and Configuration Service (SCS) in OOB Management Solution?

Authorised Symantec Consultant (ASC) with Endpoint Management Limited, an Authorised Symantec Delivery Provider based in the UK.

Connect Etiquette: Please "Mark as Solution" posts that fix your problem.

0
Login to vote
Terry Cutler's picture

Current version of Intel SCS in the Symantec OOB Management Solution is 5.4.x.

A minor update is expected before end of 2011.  

Did you have further questions in this regard?

The opinions expressed on this site are mine alone and do not necessarily reflect the opinions or strategies of Intel Corporation or its worldwide subsidiaries

0
Login to vote
andykn101's picture

Or is it just SQL Server 2008?

Authorised Symantec Consultant (ASC) with Endpoint Management Limited, an Authorised Symantec Delivery Provider based in the UK.

Connect Etiquette: Please "Mark as Solution" posts that fix your problem.

0
Login to vote
Terry Cutler's picture

The following comes from Intel SCS user guide on the Operating System and SQL versions supported.

A similar statements should be in the SMP documentation (I personally haven't checked)

Click on image to enlarge

The opinions expressed on this site are mine alone and do not necessarily reflect the opinions or strategies of Intel Corporation or its worldwide subsidiaries

0
Login to vote
andykn101's picture

The Platform Support Matrix and ITMS 7.1 SP1 Planning and support guide both say that SQL Server 2008 R2 is supported for ITMS 7.1 SP1

The 7.1 SP1 OOB Implementation Guide says SQL Server 2008 is required

The Intel guide you kindly provided says SQL Server 2005 or 2008 is supported.

It's just that, if OOB does't support SQL Server 2008 R2 I'd expect a note somewhere saying that ITMS 7.1 only supports SQL Server 2008 R2 without OOB, or that OOB needs to be on a separate SQL Server 2008 server, and I haven't seen one.

Authorised Symantec Consultant (ASC) with Endpoint Management Limited, an Authorised Symantec Delivery Provider based in the UK.

Connect Etiquette: Please "Mark as Solution" posts that fix your problem.

0
Login to vote
Terry Cutler's picture

I'll forward a note to Symantec internal contacts

Yes - The OOB Site Service and SCS 5.4 will install on SQL 2008 R2 as shown in the example below

The opinions expressed on this site are mine alone and do not necessarily reflect the opinions or strategies of Intel Corporation or its worldwide subsidiaries

0
Login to vote
andykn101's picture

I'll let you know how I get on.

Authorised Symantec Consultant (ASC) with Endpoint Management Limited, an Authorised Symantec Delivery Provider based in the UK.

Connect Etiquette: Please "Mark as Solution" posts that fix your problem.

0
Login to vote
cathossie's picture

I have ran the OOB site server Prereq for the current NS (and another site server set up as a package server) and they both result in

Generally supported = False
Remote configuration supported = False

Is there some further doco to explain other prerequisites that may be required beforehand - I've attached a screenshot of results on OOB inventory.

Cat

oob server prereq.png
0
Login to vote
andykn101's picture

which is "Generally Supported" = True, is my "Firewall Enabled" is False.

"Remote configuration supported returned an answer of false due to missing remote configuration certificate." is in the article above.

Edit: There is a "Firewall Configuration" Task (Jobs and Tasks > Samples > Remote Management > Intel SCS Tasks and Jobs > Troubleshooting Tasks and Jobs) that may help.

Authorised Symantec Consultant (ASC) with Endpoint Management Limited, an Authorised Symantec Delivery Provider based in the UK.

Connect Etiquette: Please "Mark as Solution" posts that fix your problem.

0
Login to vote
Terry Cutler's picture

Have you contacted Symantec support for further analysis of the results?

The firewall can be enabled as long as the following ports are allowed: 9971, 16992, 16993, 16994, 16995.  Inbound\outboud.

Additional insights will be provided by support.

The opinions expressed on this site are mine alone and do not necessarily reflect the opinions or strategies of Intel Corporation or its worldwide subsidiaries

0
Login to vote