Utilizing Intel® vPro AMT Technology with Task Server – Part 3: Job Integration with Software Delivery

Software Delivery provides a plug-in for Task Server that enables Software Delivery Packages and Programs to be used directly with Task Server Tasks and Jobs. When used in conjunction with Intel vPro technology, the possibilities are endless. What can these two pieces available in Task Server accomplish for you? Learn how to integrate the two, and explore some examples of combining Intel vPro functions with Software Delivery packages and programs.

Introduction

Task Server provides default abilities to run scripts and other basic items. Via Out of Band Manager and Real Time System Manager, Intel vPro technology functions can also be employed by the Task Server. Now add to these the ability to download files and run executions provided by the Software Delivery Solution for Task Server Plug In and the possibilities are endless.

Software Delivery

The configuration items for Software Delivery are the same ones provided by the Standard Software Delivery Solution for Windows. The Software Package and Software Program items can be selected with the 'Delivery Software' Task type within Task Server.

So what can be accomplished with Software Delivery? The following list provides a list of possibilities, but is in no way all inclusive:

1. Download files to the target computer
2. Execute a Script
3. Execute an EXE with a specified command line
4. Launch MSI command (Install, remove, repair, modify)
5. Run a Registry update
6. Execute from an existing file/object on the target computer

Note the following screenshot that shows the Deliver Software Task type.

Click to view.

Note that the Deliver Software Task is under the 'Client Tasks' tree node. This means that the following items must be installed for this function to work on destination machines:

• Altiris Agent
• Altiris Client Task Agent
• Altiris Software Delivery Agent for Task Server

Now note that the Intel vPro operations are under the 'Server Tasks' node, which means the above agents are not required. As long as AMT is available on the destination machines these tasks can be used.

Software Package

The software Package consists of a folder and all contained files and subfolders, including additional files contained down the chain. Regardless of what is in the Package, selecting one in the Task Server job list will have that package downloaded by the Software Delivery Agent (via Altiris Agent) to the following location: C:\Program Files\Altiris\Altiris Agent\SWDAgentForTS\<Guid folder>\cache\. See the following example:

Click to view.

The cache folder will contain all files and subfolder (with files). Any Programs will by default execute from t his package location.

Software Program

The Program instructs Software Delivery on how to execute someone within the package, including under what execution context with other functions available in conjunction with this. All settings within the Program tab are applicable when the Program is chosen for execution. Note the first screenshot. The check-box to run a Program is not checked by default, which means this Task will only delivery the package as previously covered. Check the box and select the appropriate Program from the dropdown. The options available for a Software Delivery Program are showed here:

Click to view.

Task Server Integration

Task Server makes both the Program and Package available for use within the framework. Once selected, The Software Delivery Task can be part of a Task Server Job. A condition can be added either before or after the Deliver Software Task. When a Condition is added, the following configuration screen appears:

Click to view.

Currently the only Condition type is connected with the preceding task, but can be specific for the following parameters:

1. Execute if preceding Task Succeeds
2. Execute if preceding Task Fails
3. Execute if preceding Task returns the specified return code

The last item available through the Task Server framework is the ability to fail the job if any of the tasks fail. This should be used if all executions are required to succeed to make the job successful. If some tasks are setup to fail under certain conditions, then this option can be unchecked. In other words use as the job requires...

Task Server Job

Creating a Task Server Job enables the use of any of the Task Server task types, including vPro and Software Delivery line items.

Anatomy of a Job

The components used within a Task Server job allow a sequenced and conditional list of Task Server Tasks. The following components are in every Task Server job involving vPro and Software Delivery:

1. Job Start node – This marks the start of the Job.
2. Conditions – Conditions are set between two Tasks. See the above Task Server Integration for more information on how they can be used.
3. Tasks, including:
   • Script executions – Scripts can be run either through Software Delivery's agent, or through eh script agent for Task Server.
   • Intel vPro Server actions – This are provided by Out of Band Management, and RTSM version 6.3 (new for this version).
   • Power Management (including AMT) – This can be through AMT or the Power Management Agent for Task Server.
   • Deliver Software – This is strictly provided by Software Delivery
4. Stop node – The Job ends at the Stop node.

Every job has a 'Task Input' section. For most jobs the defaults are fine, but for some this will change the behavior of the Task. For example, the vPro Power Management task can be configured to use output from a previous task. Reference the following screenshot:

Click to view.

Note that the selected task takes the output from the previous task 'Power Systems On'.

Where does vPro fit?

So where does vPro technology fit in with Software Delivery within a Task Server job? Consider the functions available through vPro, Real Time System Manager, and Out of Band Management:

• Reliable Power Management
• Reliable quick AMT Inventory gathering
• SNMP Alerts configuration
• System Defense initiation (available in RTSM 6.3)

The prime functions of reliable power management and System Defense can be used directly. See the examples of inclusions of this functionality.

Where does Software Delivery fit?

From Software installs, MSI Repairs, to any other file-execution based action; Software Delivery is the work-horse of any Task Server Job. Use vPro to wake up systems reliably, limit network resources if necessary, and then execute critical patch installations, antivirus software, or simply apply a required application to the computer with Software Delivery.

Examples

The following examples show how a Task Server job can utilize its own framework, Software Delivery, and the Intel vPro Tasks. By combining the technologies, a greater, more robust solution can be developed for issues commonly found in IT environments.

Example: Antivirus Remediation

Not sure if Antivirus is installed on the network, or have virus attacks become common within the network? The following job does the following:

1. Wakes up computers via AMT (those that are already awake automatically move on to the next task)
2. Applies a System Defense network filter that only allows traffic to the NS
3. Runs a script that checks to see if Antivirus is installed. This script contains two possible output codes, 0 for installed, 1 for not installed
4. A condition runs for a return code of 1. If it's 1, the next task runs, but if not it skips to the subsequent task
5. Deliver Software that installs antivirus
6. A System Defense network filter removal is applied that restores default network access
7. A power management task that takes the output of Task 1 and sets the computer to the previous power state. This means those computers that were off will turn off, and those that were on will remain on

This is how the Job looks in the console:

Click to view.

A variation of this task can be a Task Server Service Agent attempt to restart the antivirus service. If it succeeds, it moves on, but if it doesn't it will run an install or repair of the antivirus software.

Example: Critical Patch Application

A new super-critical patch is released by Microsoft, and you know you have the associated virus that exploits the security hole plugged by the patch. The following Task Server job quickly rolls out the new patch:

1. Run a reliable AMT power management Task to wake those computers not powered on
2. Capture AMT Inventory for reporting purposes surrounding the deployment of this patch
3. Run a Deliver Software to apply the patch (command-line suppresses the installer's reboot function)
4. Run another reliable AMT power management Task to reboot all machines (a reboot is required for the patch to fully apply).
5. Run a third reliable AMT power management to restore the computer to the state it was in before the job ran.

This is how the job looks in the console:

Click to view.

This type of organization can be used for any type of application or patch rollout.

Conclusion

The fusion of the two functionalities provides a reliable way to manage vPro enabled systems. Without vPro power management functions are unreliable and can result in the Task failing or running at a much later time when the systems are manually powered up. Other functions such as Inventory and System Defense can also not be utilized. Intel vPro is the way to go when using the Task Server in conjunction with Software Delivery Tasks.

Utilizing Intel® vPro AMT Technology with Task Server – Part 2: AMT Inventory

Utilizing Intel vPro AMT Technology with Task Server, Part 4: SNMP Alerts