Video Screencast Help
Symantec Secure Login will be live on Connect starting February 25. Get the details here.

Part 2 - Using Intel vPro PowerShell Module with Symantec CMS

Created: 28 Dec 2012
Language Translations
Terry Cutler's picture
0 0 Votes
Login to vote


After completing Part 1, you are now ready to test and implement solutions with Intel vPro PowerShell Module.

The first and most frequently requested Intel vPro PowerShell command for a Symantec CMS environment is the Alarm Clock feature.

The Alarm Clock capabilities of Intel® AMT enable you to set a defined wake-up time into the Intel Management Engine.   This is different from a BIOS wake-up schedule for a number of reasons:

  • All systems with Intel AMT version 5.1 or higher use the same command.   Regardless of the OEM or BIOS vendor, the communications are to the configured Intel AMT firmware.
  • Intel AMT Alarm Clock can be set or changed on clients that are connected to the network, regardless of the current power or operating system state.
  • The ability to query the current Intel AMT Alarm Clock setting, again regardless of the current power or operating system state

Back in 2011, I wrote an article introducing the concept of using Intel vPro PowerShell Module to power on multiple Intel vPro Systems.   Building upon that earlier article and using Part 1 of this series, the idea can be expanded to utilize the Symantec management infrastructure via a script TaskServer job.

A few reminders about setting the Intel AMT Alarm Clock feature:

  • When setting - Use a date and time that is in the future, preferably 15 minutes or greater.
  • Setting of the Alarm Clock is in the format of start-date:hour:minute:second
  • Alarm Clock works only when the system has power attached (Click here for a related blog)
  • The recurrence interval is based on a days:hours:minutes:seconds format
  • The Alarm Clock is based on the system clock.   If the system clock is synchronized throughout your environment, there is a chance that all system will power-on exactly at the same time.
    • Note: The system clock will differ based on timezones.
    • To avoid flooding your network, two options to consider: use different scripts to randomize the alarm clock time value, or see how to adjust the Alarm Clock cmdlet.

Understanding the Basic Command

Before integrating the Microsoft PowerShell script into a Symantec TaskServer job, become familiar with how the scripting language and command works.    The focus Intel vPro PowerShell commands relate to setting and checking the status of the Alarm Clock.   The following steps and examples require completion of Part 1 in this article series.

First, open the Windows PowerShell environment and run the following command to get base understanding.

                Get-Help Set-AMTAlarmClock

The Get-Help command  provides a summary explanation on the target cmdlet.   If you add “ -examples” to sample command, the output screen will provide examples in using the command.   In addition, the user guide included with the Intel vPro PowerShell Module download provides syntax examples.

Second, identify a target Intel AMT client in your environment to set and test the Intel AMT Alarm Clock.   Using the guidance provided above, set the Alarm Clock event to occur 30 minutes from your current system time.    For example, if the time is 1:00pm on September 17, 2012, the client name is “AMTclient”, and TLS is being used, the following command would be used:

                Set-AMTAlarmClock AMTClient –TLS –credential $amtcred –AlarmTime:2012-09-17:T13:30:00

Third, to prove Alarm Clock event works and that communications to Intel AMT work regardless of the system power state, shutdown the target client system.

To prove Intel AMT communications are still available when the client is powered off, run the following command:             

                Get-AMTPowerState AMTClient –TLS –credential $amtcred

The client system is indeed off, as reported by the Power State Description.   In addition, communications to Intel AMT are still available, hence the common statement “out-of-band management”.

To check the currently set Intel AMT Alarm Clock value, run the following command:

                Get-AMTAlarmClock AMTClient –TLS –Credential $amtcred

The client is scheduled to power-on at 1:30pm.   The value can be changed even with the system powered off, as long as Intel AMT is accessible.   In addition, the recurrence interval of 1 day is assumed based on the Set-AMTAlarmClock command provided.

Fourth and final step is to wait for the designated time to occur and valid the Intel AMT system did power-on.   One approach to remotely determine is the client powered-on is to re-run the Get-AMTPowerState cmdlet as shown previously.   Another is to query the Intel AMT event log.

The example command below also demonstrates the “piping” capabilities of Microsoft PowerShell.   The Get-AMTEventLog output is piped to a Format-Table action.

Testing the client at 1:34pm local Pacific Daylight Time (PDT), the system is truly powered on.   The Intel AMT Event Log shows events in UTC time, which is 7 hours later than PDT.   The entries show 8:30:01 PM UTC Time when the Intel AMT Alarm Clock event occurred, which is 1:30:01 PM PDT.    This also shows that the local system clock time is used when setting the Intel AMT Alarm Clock event, and not the Intel AMT clock.

Create a PowerShell Script Task

With the Intel vPro PowerShell Module initialized, the command shell parameters set via the .ps1 file, and a base understanding of the desired commands – you are now ready run the command via Symantec TaskServer.

Within the Symantec Management Console, create a scripting task.   The Task Script must run on the Server (i.e. Notification Server) or on the Task Server.   Communications to Intel AMT occur via the network interface.

Set the Script Type to “PowerShell”.   Type the desired command, replacing the computer name with the token %COMPNAME%.

Shown in the following example, the Set-AMTAlarmClock cmdlet will set all designated systems to wake-up at 2am in the morning, starting September 18, 2012.   As indicated previously, the interval of every day is assumed if a different value is not specified in the command.

The above Task Script is set to run via the Task Server.   For environments with more than one Task Server, this will help to distribute the load and possibly execute the event closer to the actual target clients.

On the lower right of the task script window, select “Advanced” and ensure the script output will be saved.

Test and Validate the Script Task

Schedule the Task Script to execute on a few target Intel AMT clients.   Observe the task status to ensure successful completion.   In the example below, three Intel AMT clients were targeted.   Even through two of the systems were powered off when the task script was executed, all completed successfully

By double clicking a system in the list, the command output can be viewed and verified

In addition, from the Windows PowerShell console window the status of the Intel AMT Alarm Clock can be checked for all target clients.   The following command shows another feature of Microsoft PowerShell where the list of systems is stored in a text file, piped to the command, and only successful clients shown.

The command used in the example below is

                Get-Content .\computers.txt | Get-AMTAlarmClock –TLS –Credential $amtcred | Where {$_.Status –eq “Successful”}

A similar command can be used to check for failed systems by exchanging “Successful” with “Failed”

Concluding Thoughts

You are now able to set the Intel AMT Alarm Clock feature using Intel vPro PowerShell Module and Symantec TaskServers within your environment.   Systems will awake at the designated time, enabling a better power control capability.

The article showed a few additional cmdlets of the Intel vPro PowerShell module.    Explore the possibilities!

The opinions expressed on this site are mine alone and do not necessarily reflect the opinions or strategies of Intel Corporation or its worldwide subsidiaries