Using the WakeUp console

Configuration is managed from the WakeUp Console (started from the WakeUp program group on the Start menu). Configuration options vary depending on whether you are using Configuration Manager or NightWatchman Management Center.

Configuration consists of:

• Connecting to the WakeUp server.

• Setting the behavior of the Agents. Refer to The General screen.

• Setting the level of detail for the log file. Refer to The Logging/Control screen.

• Adding bespoke wake up events. Refer to The Advanced screen.

• Discovering Agents. Refer to The Agent Finder screen.

• Setting the communication protocols between the Agents and the WakeUp server. Refer to The Communications screen.

• Setting the behavior of magic packets. Refer to The WakeUp Packets screen.

• Setting an exclusion (only available in Configuration Manager mode). Refer to The Exclusions screen.

• Viewing and modifying Agents. Refer to The Agent Finder screen.

• Viewing Advertisement Statistics (only available in Configuration Manager mode). Refer to The Advertisements screen.

• Viewing Software Updates Statistics (only available in Configuration Manager mode). Refer to The Software Updates screen.

• Viewing Application Statistics (only available in Configuration Manager mode). Refer to The Applications screen.

Connecting to the WakeUp server

The first step is to connect to the required WakeUp Server.

The parameters to connect to the server are:

The General screen

The options for General settings are:

The Logging/Control screen

The options for Logging/Control are:

The Advanced screen

Advanced Settings control how WakeUp deals with specific timing or operational requirements. These parameters are typically left at their default values.

The Agent Finder screen

The Agent Finder screen controls how 1E Agents are discovered (using ping packets) when using Multi-Agent mode. You can set the number and frequency of pings sent, the timeout for receiving a response and how often the subnet is rescanned. This lets you set a balance between successfully finding all the Agents against the amount of network traffic generated.

The following options are only available if Enable Multi-Agent is enabled in the General screen.

The Communications screen

The Communications parameters are:

The WakeUp Packets screen

WakeUp Packets enables 1E Agent configuration (regardless whether the system is in Multi-Agent or dedicated Agent mode). When a wake up request is sent, agent configuration parameters is also broadcast to the 1E Agents ensuring that they function according to WakeUp Server and not by settings made during the 1E Agent installation.

The Exclusions screen

This is a Configuration Manager only screen and is used to prevent wake ups for taking place during certain times of the day. Check the Enable WakeUp Exclusions box and define the time periods for the exclusion. For example:

• To define an All Hours exclusion, click the shaded cell next to All Hours.

• To define an exclusion for a particular day, click the shaded cell next to the day.

• To define an exclusion for a particular hour for all days, click the shaded cell below the hour of the day.

Choose Prevent Wake Ups or Allow Wake Ups to define the behavior of the exclusion. An example below illustrates an exclusion that disables wake ups between 8AM to 8PM, Monday to Friday

Click Apply to enforce the WakeUp exception.

The Agents screen

The Agent screen displays a list of all discovered 1E Agent systems and enables centralized control over their settings. When a subnet is discovered, the Primary and Alternative Agents are displayed under Agent List.

In Dedicated Agent mode the 1E Agent systems populate the list box by registering with the WakeUp Server at service start-up. In multi-agent mode the 1E Agents are listed after they have been found. In the Agent screen, you can:

Explaining the Agent List box

The following describes the columns for the Agent List box:

See the WakeUp status page for more details.

The significance of the status icons are:

Clicking on a column a column header will cause the list to be sorted in ascending order of that column. Clicking the column header again will cause the list to be sorted in descending order.

Manually adding a new subnet

The Agent Discovery Process is a background task that automatically locates and processes new subnets. It is also possible to manually add a new subnet – most useful in lab environments or during a roll-out when performing targeting testing.

You can manually add a new subnet to the WakeUp discovery by clicking on the Add Subnet button to open the Add Subnet dialog.

Once a new subnet has been added, it is displayed in the console. Adding the subnet also triggers a discovery, though you may have to wait for the WakeUp Console to refresh before the 1E Agents are listed. You can always force a discovery by selecting the subnet and clicking the Check Agents button.

Modifying the discovered agents

Agent discovery is largely automatic, but from the console you do have the ability to de-register both the primary and alternate agents and trigger a discovery for a particular subnet. You can modify the primary and alternate agents for a subnet by selecting a subnet in the Agent List. If the subnet has already been discovered, the De-Reg Agent, De-Reg Alt and Check Agents buttons are enabled.

• Clicking the De-Reg Agent button de-registers the primary agent for the selected subnet. If an alternate agent has been previously discovered, it will become the new primary agent.

• Clicking the De-Reg Alt button de-registers the alternate agent for the selected subnet.

• Clicking the Check Agents button forces a rediscovery of the selected subnet. This may rediscover previously de-registered 1E Agents.

The Advertisements screen

Only applicable to Configuration Manager, displays the statistics of WakeUp behavior in relation to Configuration Manager advertisements that have been sent. The Software Distribution Advertisements table lists the successful wake ups for each Advertisement sent to clients of this particular Configuration Manager site.

The Software Updates screen

Only applicable to Configuration Manager, displays the statistics of WakeUp behavior in relation to Configuration Manager Software Update Assignments that have been sent. The Software Update Assignments table displays the successful wake ups for each Software Update Assignment sent to clients of this particular Configuration Manager site.

The Applications screen

Only applicable to Configuration Manager, displays the statistics of WakeUp behavior in relation to Configuration Manager Application Assignments that have been sent. The Application Assignments table displays the successful wake ups for each Application Assignment sent to clients of this particular Configuration Manager site.

Explaining the Software Distribution Advertisements, Software Update Assignments and Application Assignments table columns

The console reporting can be enabled or disabled by checking the Enable Agent Reporting checkbox in the Communications screen. Refer to The Communications screen.

Configuring 1E Agents

In general, 1E Agents are configured at install time, see Installing and upgrading. You can, additionally, set wake up parameters for 1E Agents at runtime using the WakeUp Server console.

WakeUp in conjunction with Configuration Manager

We describe two typical situations that WakeUp is used and show how the individual WakeUp components are configured.

• Out-of-hours software distribution.

• Starting systems at predetermined times.

Typically, WakeUp is configured once and subsequent usage is done without the need for further intervention – providing a 'set and forget' function. The default WakeUp configuration is valid for 90% of scenarios encountered, thus making the 'set and forget' functionality possible.

Using WakeUp for out-of-hours software distribution

WakeUp can be used to increase the success rate of out-of-hours software distribution. It does this by making sure that systems are powered on when an advertisement becomes available. As many users power down their systems in the evening before leaving, this is an essential to ensure software installs successfully. WakeUp can also be used to spread the load on the network by gradually waking batches of systems during the out-of-hours period.

Scenario

An Office 2012 upgrade needs to go out to 1,000 systems overnight. Because of the size of the install and disruption to business users, it cannot be installed during the day.

Configuring WakeUp for optimum performance

The Configuration Manager administrator determines that 1,000 systems must be upgraded between the hours of 01:00 am and 08:00am. It is common that around 20% (200) of users leave their systems switched on. The rest are powered off but can be booted using Wake-On-LAN. The Office software was sent to distribution points the previous evening so a mandatory assignment schedule is created for the Office 2000 advertisement starting at 01:00 am.

The Configuration Manager administrator also calculates that the 200 systems that are already on will receive the advertisement first. The administrator sets the WakeUp hours of operation to between 01:00 and 07:00. This allows 1 hour after the last wake up for the install to complete.

The administrator must now calculate the number of wake ups and the frequency of polling intervals to spread the load of the installations over the hours of operation (01:00 to 07:00).

The administrator uses the following calculation:

(Number of systems/Available Hours) /Polling cycles per hour= Maximum required wake ups per polling cycle

Assuming that the polling cycle is every 300 seconds (5 minutes) this works out as follows.

(800 / 6) / 12 = 11.111111…

So the administrator needs to set the Maximum Wakeups per polling interval parameter to 12 (rounding the value up) to ensure all the machines are covered.

At 01:00 the advertisement becomes available and the systems that were left switched on install the software immediately. At the same time WakeUp starts to wake up systems at a rate of 12 every five minutes until 07:00. The last systems to be awakened have the remaining hour to complete the installation, ensuring that all updates are completed by 08:00.

In addition, WakeUp can be configured to shut down systems that it has awoken so the out-of-office wake ups are accompanied by shutdowns after the critical updates have taken place, thereby minimizing power consumption and cost.

Conclusion

Using WakeUp to stage the software installs over the entire out-of-hours period means minimum network load, minimum load on the Configuration Manager distribution points and ensures that all of the targeted systems are available for the upgrade.

Using WakeUp to start systems at a set time

WakeUp allows an enterprise's systems to be powered off at night and ensures that they are up and running by the time the workers are due to arrive in the morning. This saves time, energy and money.

Scenario

A large bank has 500 branches, each containing 10 systems which are Configuration Manager 2012 clients and are Wake-On-LAN compliant. It is company policy to power off these systems every evening in order to save power consumption. The brief is to power on all of the bank's workstations before their employees arrive at 8:00 am. This will mean that they do not have to wait around for system start-up and their workstations will be ready to use.

Configuring WakeUp for mass system start-up

The Configuration Manager hierarchy at the bank consists of a central site, 5 primary sites, each of which has 100 secondary sites reporting to it (1 per branch). Because the forwarding of directed subnet broadcasts across the bank routers is disabled, the WakeUp Server is installed in multi-agent mode on the single server in each branch. It is also installed in Stand-alone Server mode on each of the 5 primary site systems.

Because of this highly distributed environment, WakeUp is configured to wake as many systems as possible as quickly as possible with no restrictions. Each primary site is responsible for 1,000 branch workstations, so at each primary site Maximum Wake ups per polling interval is set to 1,000 and the polling interval is set to every 5 minutes. This means that WakeUp can add all 1,000 systems to the wake up list in one polling interval if required. WakeUp is also configured to connect to a maximum of 50 agent systems concurrently, and can send 10 wake ups every 10 seconds to each agent system in the branches. This is set using Burst Delay and Maximum Burst.

Within the Configuration Manager central site, the administrator has defined a collection named All Branch Workstations containing all of the 5,000 systems. In order to wake all 5,000 of these systems each morning at 7:00 - to make sure they are up and running by 8:00, all the administrator has to do is to create an Advertisement which runs the following command on each workstation:

cmd.exe /c

This is in effect a dummy Advertisement, its only purpose being to invoke WakeUp to wake the machines.

Advertisement or assignment wake ups and auto shutdown

Using the WMI interface or the WakeUp Send WakeUp... menu options in the Configuration Manager Admin Console you can wake machines immediately, the Advertisement or Assignment option will wake up the machines at a time appropriate to their local time zone and will automatically be aligned with the receipt of the Advertisement or Assignment. For waking machines in general we recommend that you use the Alarm Clock feature, which is part of the Power Policy capability, in the NightWatchman Management Console to establish wakeup times for your PCs local to their time zone.

Autoshutdown does not occur for manually requested wake ups (these include: the right-click option from the Configuration Manager console, via the WMI interface or on the WakeUp command-line).

So for the Advertisement wake ups, you will need to override the WakeUp auto shutdown option and prevent shutdown by including the text 'NoAutoShutdown' in the Advertisement name or Advertisement comment. A suitable name for the Advertisement would be: Wake all machines at 7 NoAutoShutdown

Sequence of events

07:00 - The advertisement becomes available and each primary site server enumerates the systems that are to receive the advertisement. Because there are no restrictions to the WakeUp service, each site can add all 1,000 systems to the wake up list for forwarding to the 1E Agent systems.

The WakeUp Server connects to 50 1E Agent systems and sends 10 wake up requests to each one. As Agent connections are dropped, new ones are created until the second 50 agent systems are processed.

The whole process takes less than 10 minutes.

Conclusion

WakeUp is ideal for this type of housekeeping task that improves user productivity. Once configured correctly for the environment, no further intervention is required. WakeUp simply integrates with existing Configuration Manager working practices.

Using WakeUp in multi-tier Configuration Manager environments

When creating Adverts in a multi-tier environment where you want to use WakeUp to process the Adverts and send wake ups with policy refresh you must bear in mind the following factors:

• How long will it take the Advert to be passed down the Configuration Manager hierarchy to the desired sub-primary where the machines to be woken are located?

• What is the desired intention for the Advert? To wake up machines at a specific time or run as soon as possible?

WakeUp advert processing

• To achieve the desired behavior when processing Adverts with WakeUp it is important to understand the following concepts/terms:

• Advert polling is the process by which WakeUp checks current advertisements in Configuration Manager and checks their schedules and mandatory assignments for due dates.

• Advert processing is the act of investigating the Advert and queuing wake ups for the appropriate machines.

• WakeUp will process all Adverts that have been scheduled in the last poll interval. This is configurable (please refer to the admin guide).

• When an Advert is polled, if the scheduled time is in the past and prior to the last poll time this advert will not be processed.

Advert processing in a multi-tier environment

In a multi-tier environment when an Advert is created it will take a variable amount of time to ripple down the tiers. If by the time the Advert is polled at a lower tier the advertisement's scheduled time has passed, WakeUp will not action any wake ups for that advertisement.

If you create a mandatory assignment with the current time (this also occurs when doing a re-run) this is not guaranteed to be processed at the lower tiers.

What this means in practice is that if you want to use WakeUp to wake up machines for an Advert, you need to create the Advert in the right way. Depending on the purpose of the Advert you should create it in one of the following two ways:

1. If you create an Advert with an "as soon as possible" mandatory assignment this will be processed by WakeUp the first time it detects the Advert during the next poll.

2. If you want a controlled synchronized update then create an Advert scheduled further in the future than the lag time it takes for an Advert to reach the bottom tiers of the hierarchy.

Configuring the WakeUp Server

We show how the WakeUp Server can be configured to support the specific Configuration Manager site configuration and guide you through configuring and optimizing WakeUp on both the Server and remote listening systems in your hierarchy.

When first installed, the service should be configured according to your Configuration Manager hierarchy, the number of clients and the preferred hours of operation.

All configuration of the service is performed from the WakeUp Console which is started from the the 1E WakeUp program group on the Start menu. If you start the console from the Configuration Manager Administrator Console, you will not be shown the Connect to Server dialog.

WakeUp Console reporting

In multi-agent mode, as target machines wake, each primary agent reports successful wake-ups as quickly as possible back to its WakeUp server, but has to wait before trying to ping machines that have not reported and then report the remaining successes and failures.

• If a target machine is already on and has a 1E Agent installed, it will broadcast: Was Awake.

• Machines with 1E Agents that have just woken will broadcast: Just Woke.

• For remaining machines, the primary agent waits WakeUp Result Delay and then pings. Successful ping responses are reported as No Agent and failed responses are reported as Failed.

The WakeUp Result Delay (WUResultDelay) is configurable in the Agent registry and is in seconds. By default it is 0 which means the WakeUp Server will tell the Primary Agent how long to wait – configure the delay to be slightly longer than the time it takes for machines to boot up and start their 1E Agent.

The WakeUp server combines all information it receives. Status is reported in the Advertisements node of the WakeUp server console. If it is integrated with Configuration Manager, statuses for software updates and applications are reported.

• As some adverts are repeating, statistics are gathered on a daily basis. Historical data can be found in \Application Data\1E\WakeUpSvr*.csv files.

• Advertisement Wakeup Success information is sent asynchronously by the 1E Agent and does not affect WakeUp performance.

• Wakeup Success figures per subnet can be retrieved from the WakeUp Server using WMI. Example web pages exist in the WakeUp Server installation directory.

Causes of incorrect reporting:

• Statistics will be skewed if client machines are multi-homed i.e. have more than one network card. A wake up request is sent for each network card, but only one reply is returned.

• Data will be lost if the WakeUp Server or the active 1E Agent is stopped and restarted. This can occur if the Configuration Manager Advertisement asks for a machine reboot before the WUResultsDelay time has elapsed.

• Only machines running the 1E Agent can report back as Woke Up or Awake. An incomplete roll-out of the multi-agent service will cause machines to be registered as No Agent rather than Woke Up.

Sending an immediate wake up request

WakeUp can be used to wake up machines immediately and explicitly from the Configuration Manager Admin Console or automatically, without user intervention to ensure machines are woken up prior to a Configuration Manager Advertisement.

When installed, WakeUp extends the Configuration Manager administrator console menus. The menu extensions permit the explicit immediate waking up of single machines or entire collections.

There are the following options:

• Send WakeUp: Sends a wake up request.

• Send WakeUp with Policy Refresh: Sends a wake up and additionally requests that the computer will check Configuration Manager for new policy.

Collection wake up

To perform an immediate wake up to a Configuration Manager collection, right-click on the collection in the left hand pane of the Configuration Manager administrator console and from the WakeUp sub-menu select Send WakeUp.

Single resource wakeup

Sending a wake up packet to a single resource is similar to sending a wake up to a Configuration Manager Collection. Simply select the required resource in the right hand pane of the Configuration Manager administrator console, right click and from the WakeUp sub-menu select Send WakeUp.

A key feature of WakeUp is that it can be configured to run automatically without impacting on the workflow of the Configuration Manager administrator.

All the administrator needs to do is create the advertisements and WakeUp works out which machines need waking and when and performs the task in time for the advertisement to be processed.

To do this the WakeUp service performs the following steps:

• It scans all assigned (mandatory) advertisements which are yet to run.

• It keeps a list of all processed advertisements – an advertisement will only be reprocessed when its next valid time is greater than the Minimum advertisement re-processing interval.

• All valid systems within the advertised collection will then be enumerated and all machines added to a list of requested wake ups. A wake up list is generated in this way for each subnet.

• The wake up lists are enumerated in stages. At each polling interval a batch of machines will be woken up and removed from the wake up list. As this wake up list is enumerated, only entries which have not been woken up recently will be processed. Others will be silently discarded.

The wake up list is enumerated in different ways depending upon your installation scenario.

• Scenario A: Stand-Alone server only – wake up requests are sent out directly to the machines.

• Scenario B: Dedicated agent – the wake up list is sent to the dedicated or alternate 1E Agent for that subnet. This 1E Agent then enumerates the wake up list in stages and wake up requests are sent out to machines for that subnet.

• Scenario C: multi-agents – a live 1E Agent is discovered for each subnet. This becomes the active 1E Agent. The wake up list is sent to this 1E Agent. The active 1E Agent then enumerates the wake up list in stages and wakeup requests are sent out to machines for that subnet.

You will have noticed that there are many different configuration options available for WakeUp. This ensures that performance can be controlled to fit in with any network infrastructure.

Policy Refresh

Policy Refresh is only operational in multi-agent mode. This is because a client component is required to initiate the Policy Refresh action.

By default, WakeUp will send a Policy Refresh prompt to ensure that newly awoken machines get any pending advertisements as soon as possible. You can turn the Policy Refresh behavior off globally by checking the Check Policy Refresh in Name option in the Configuration tab of the WakeUp console, or you can turn it off for a particular advertisement by putting the text NoPolicyRefresh into the name of the advertisement.

When you turn Policy Refresh off globally, it can still be explicitly requested for specific advertisements by including the text PolicyRefreshEnabled in the advertisement name.

Supported advertisement schedules

In order for the WakeUp service to process an advertisement, the schedule for that advertisement must be assigned (mandatory). The following types of advertisement schedules are all valid for processing by WakeUp.

• Single Schedule.

• Multiple Schedules.

• Repeating Schedules.

• 'Soon as Possible' Schedules.

Unsupported advertisement schedules

The following advertisement schedules are not supported when used with WakeUp:

• Next Logon and Next Logoff: If the package cannot run until next user logon or logoff, there is no point in waking the system, as this will be done by the user.

• Advertisements to collections containing Users or User groups.

Software updates assignments, WakeUp and Configuration Manager

When configuring the use of WakeUp with Software Updates Assignments in Configuration Manager you need to ensure the following items are done:

• You need to check the Send wake ups on Software Updates Assignments at deadline checkbox on the General tab of the WakeUp console

• You will also need to check the Enable Wake On LAN option in the Properties dialog for the Software Updates, Advertisement or Deployments you want to associate with WakeUp.

The Software Updates Properties dialog in Configuration Manager 2012 lets you configure wake-up on the Deployment Settings tab. Ensure that the Use Wake-on-LAN to wake up clients for required deployments checkbox is checked.

In Configuration Manager 2012 software distribution is performed using Deployments. Select the Send wake-up packets option.

WakeUp and the software updates process

Once all the settings have been configured as described above WakeUp will then wake up machines that are found to be non-compliant with the Software Updates Assignment (i.e. they require the software updates to be applied) when the deployment deadline for the Software Update is reached.

WakeUp Intel® AMT component

The WakeUp Intel® AMT component consists of a single service that runs on the same server as WakeUp and registers with the service. Intel® AMT systems should be enabled and set up so that the WakeUp Intel® AMT component service can perform management functions on them.

Intel® AMT must be enabled in the system's BIOS. Bare Intel® AMT systems contain the technology but it is not supported until they are configured. See refer to the OEM's BIOS documentation for details on how to enable this technology.

Enterprise and small business modes

The WakeUp Intel® AMT component supports two modes of operation:

• Enterprise mode: In enterprise mode, an Intel® AMT platform uses secure communications via transport layer security (TLS) communication protocols. It also provides a standard and single-sign-on style of authentication by integrating its authentication framework with Microsoft Active Directory Server which manages domain authentication based on the Kerberos protocol. Intel® AMT maintains an access control list (ACL) of users that can access realms within the device.

• Small business mode: In small business mode, when digest authentication (user id and password) is used, the ACL contains an entry per user. When using Active Directory and Kerberos in enterprise mode, an ACL contains a SID, a list of realms and access permissions.

Although the device can be configured to operate in both modes, the WakeUp Intel® AMT component can only be configured to work in a single mode. Please refer to the Intel® AMT Small Business and Enterprise Configuration User Guides for details on how to set up the preferred authentication mode and realms.

Configuring WakeUp to use AMT instead of Last Man Standing

In order to wake machines up, WakeUp in multi-agent mode requires a single machine on the subnet to be always awake to receive messages from the WakeUp service on Primary Configuration Manager Server. There are two alternative methods that WakeUp can use to achieve this.

1. The administrator can enable Last Man Standing (LMS) in the 1E Agents to allow the agents to constantly monitor shutdowns to keep a single machine up in the subnet.

2. With the WakeUp Intel® AMT component, if an Intel® AMT machine is available in the subnet; WakeUp LMS can be disabled allowing all machines to be shut down in the subnet. The Intel® AMT machine on the subnet can then be awoken remotely to act as an agent for waking up targeted machines on the subnet.

Last Man Standing is disabled on the 1E Agent with LASTMANENABLED=0. This can be set during an installer repair, if the 1E Agent has already been installed to use LMS.

WakeUp Intel® AMT component and Configuration Manager

The WakeUp Intel® AMT component installs an additional service on the Configuration Manager Server that communicates with WakeUp. This service queries Configuration Manager for discovered Intel® AMT machines and dispatches SOAP messages to wake up them.

Intel® AMT machines discovery

The 1E Agent service installed on every machine attempts to communicate with Intel® AMT Board Management Controller via the Management Engine (ME) interface driver or Host Embedded Controller Interface (HECI) driver. The state set by the 1E Agent is sent to Configuration Manager as an extension to hardware inventory. A hardware inventory WMI class, called SMS_G_SYSTEM_WAKEUP_1E_IAMT, is created in Configuration Manager that contains a list of all machine resources known to Configuration Manager that are Intel® AMT machines with 1E Agent installed.

Waking up an Intel® AMT machine

WakeUp only requires a single machine in a remote subnet to wake up targeted machines on the subnet. If the existing agent finder in WakeUp fails to find any currently awake machines in the subnet, it dispatches a request to the WakeUp Intel® AMT Service to find a suitable agent in the subnet and wake it using an Intel® AMT SOAP message and the pre-configured authentication mechanism. WakeUp subsequently uses the 1E Agent on that machine to wake up other targeted machines on the subnet using magic packet technology.

Configuration Manager Integration

The WakeUp Intel® AMT component needs to be installed on all Configuration Manager Primary Site Servers where WakeUp is installed. It uses system inventory information to send out SOAP messages on requests from the WakeUp service in time for any advertisement schedules.

WakeUp Intel® AMT feature pack components

The main feature pack consists of:

• WakeUp Intel® AMT service.

• 1E Agent and extensions to Configuration Manager hardware inventory.

WakeUp Intel® AMT service

The WakeUp Intel® AMT service is responsible for communicating with the WakeUp service and sending SOAP messages to Intel® AMT machines via the preconfigured authentication mechanism.

When running with Configuration Manager this service should be installed in each Configuration Manager Site server in the hierarchy that has WakeUp installed – providing the site has Intel® AMT Configuration Manager clients and those clients have been provisioned.

When running solely with NightWatchman Management Center, this service only needs to be installed on the WakeUp Server set as the NightWatchman Management Center wake up provider.

If Intel® AMT is configured in enterprise mode using Active Directory for authentication with Kerberos, the service will run using an account that is a member of the Intel® AMT Collections Managers group. The WakeUp Intel® AMT service will attempt to use WinHTTP to impersonate the account and connect to the targeted machine.

If Intel® AMT is configured in small business mode; the WakeUp Intel® AMT service will use a username and password for digest authentication. Once installed, WakeUp will detect the WakeUp Intel® AMT service and dispatch requests when agents are not found on a targeted subnet.

1E Agent

The WakeUp Intel® AMT component provides an alternative to the Last Man Standing mechanism. The alternative still relies on the 1E Agent being installed on every machine. The 1E Agent is responsible for discovering the Intel® AMT Board Management Controller and building up a database of Intel® AMT machines in Configuration Manager or NightWatchman Management Center. Once discovered, the WakeUp Intel® AMT Service will wake up the machine. The 1E Agent on the machine will receive instructions from WakeUp Server to send out magic packets to any systems that need waking.

Intel® AMT support for Last Man Standing

Computers that have Intel® AMT hardware and are configured to support remote wake ups circumvent the WakeUp requirement that there is at least one 1E Agent on the subnet running to handle wake up signals from WakeUp Server. This is because WakeUp is able to use the Intel® AMT capabilities to wake the machine remotely without using magic packet broadcasts, which are liable to be disabled in secure networks.

To use Intel® AMT for a subnet where such hardware exists instead of Last Man Standing, you need to enable the Intel® AMT option during WakeUp Server installation and, except for the 1E Agent on the Intel® AMT computer, install all the other 1E Agents on the subnet with LASTMANENABLED=0.

Configuration Manager Hardware Inventory

A hardware inventory WMI class is created by extending the Configuration Manager Hardware Inventory MOF compiled. Hardware inventory information sent by every Configuration Manager client will contain extended data identifying whether the machine resource is an Intel® AMT machine.

This information is used to enhance the existing hardware inventory information in Configuration Manager providing the WakeUp Intel® AMT service with a means of identifying Intel® AMT machines for a specific subnet.

NightWatchman Management Center Inventory

When running solely with the NightWatchman Management Center, the 1E Agent sends information about the computers running Intel® AMT to be stored in the NightWatchman Management Center database.

Configuring the WakeUp Intel® AMT feature pack

This section describes the two different authentication modes for Intel® AMT and then shows how the individual components of the WakeUp Intel® AMT component are configured. Typically, WakeUp Intel® AMT is configured once and subsequently works without the need for further intervention – thereby providing set and forget functionality.

The WakeUp Intel® AMT component is designed to self-register with an existing WakeUp Server ensuring zero configuration for WakeUp itself. During installation, the WakeUp Intel® AMT service registers a free TCP/IP port on the server with WakeUp Server. Thereafter, WakeUp Server automatically detects the service whenever it needs to dispatch requests to wake up remote Intel® AMT machines.

When starting up, the 1E Agent runs an inexpensive test to check whether its local machine is an Intel® AMT machine. A local registry key is updated which is in turn picked up by the ConfigMgr client and sent up to the ConfigMgr Server on each Hardware Inventory cycle.

Configuring the WakeUp Intel® AMT Service

The WakeUp Intel® AMT service must be configured to use one of the pre-configured authentication modes for managing the power state of the Intel® AMT machine. This section describes the setup in two modes: small business mode (SMB) using digest authentication and enterprise mode using Kerberos.

Small business mode (SBM)

The WakeUp Intel® AMT service runs as LOCAL SYSTEM and uses a username and password specified at install time to connect to Intel® AMT machines. The administrator can modify this username and password from the command-line.

The following parameters are supported by the command-line:

In order to set the authentication to the default Intel® AMT username and password:

C:\Program Files\1E\WakeUp\Server>WakeUpAMT.exe –username=admin –password=admin

Enterprise mode

The WakeUp Intel® AMT service runs as a domain account that is a member of the Intel® AMT Collections Manager Active Directory group.The administrator can configure the service to run in this mode by manually configuring the service via the Service Control Manager MMC snap-in and forcing Kerberos authentication mode from the command line:

After modifying the properties of the service, run:

C:\Program Files\1E\WakeUp\Server>WakeUpAMT.exe –useKereberos=1

Configuring network access control security

Port-based Network Access Control (NAC) uses the 802.1x standard. It provides increased network security by requiring authentication for computers before they access a network. Typically, this relies on dividing the network into two sets of VLANs:

• Authenticated VLANs (also known as the main, live or corporate network).

• Corresponding unauthenticated VLANs, that act as a holding ground for computers that have not yet been authenticated (also known as guest network).

In this model, the division into authenticated and unauthenticated VLANs is handled by the network switches. The unauthenticated network ports are in a blocking state and do not allow traffic to or from a computer unless part of the authentication process. In practice, this means that computers move off of the authenticated network and onto the unauthenticated network as soon as they are turned off. Depending on the authentication mechanism, this move can also occur when the computer goes to sleep. When off or asleep, the computer does not respond to ARP queries and will respond only to broadcasts.

WakeUp does not know if a powered down computer is on an authenticated or unauthenticated network, and the normal methods used by WakeUp will not work. Normally, to wake a computer from off or from sleep, the WakeUp system only needs to send a Wake-On-LAN (WOL) magic packet as a directed broadcast to the last-known subnet of the target computer, which is the authenticated subnet. When NAC is implemented, WakeUp must send an additional broadcast to the unauthenticated subnet. When the computer wakes, it uses its normal authentication method to get back onto the authenticated network.

The problem of sending wakeups to unauthenticated subnets has two parts:

• WakeUp configuration: Determines how WakeUp identifies the corresponding unauthenticated subnet where the computer has moved

• Network configuration: Determines how the network allows a subnet directed broadcast to reach the computer on the unauthenticated subnet

Solutions

The WakeUp system identifies unauthenticated subnets using one of two methods described below that are subject to various considerations. Each method uses a list of unauthenticated subnets specified in a WakeUp Agent registry value called SubnetOverride.

Considerations	WakeUp Agent method	WakeUp Server method
Overview	A WakeUp Agent on each authenticated subnet uses a list of unauthenticated subnet(s) to send WOL packets via subnet directed broadcast. The list contains all the unauthenticated subnet(s) that correspond to the authenticated subnet on which the Agent resides. All configuration is done on WakeUp Agents and network switches.	Each WakeUp Server uses a list of unauthenticated subnet(s) to send WOL packets via subnet directed broadcast. The list contains all the unauthenticated subnets that correspond to the authenticated subnets for which the WakeUp Server is responsible. All configuration is done on the WakeUp Agent running on the WakeUp Server(s) and network switches.
Supported WakeUp Scenarios	This method is supported by a WakeUp Server in Multi-agent or Dedicated agent scenarios. This method is not supported by the Standalone Server scenario.	This method is supported by a WakeUp Server in Multi-agent, Dedicated agent or Standalone Server scenarios. This is the only method supported if the WakeUp Server is operating in Standalone Server scenario.
WakeUp Configuration (for details see Configuring SubnetOverride on a WakeUp Agent)	The SubnetOverride registry value is configured on each WakeUp Agent, to contain the list of unauthenticated subnet(s) that correspond to the authenticated subnet on which the Agent resides. In Multi-agent mode, all Agents on a subnet are configured identically. In Dedicated agent mode, only the dedicated Agent needs to be configured. In some instances, AdditionalSubnets registry value also needs to be configured the same as SubnetOverride. The Agent method does not use the AlwaysQueueToLocalAgent registry value.	The SubnetOverride registry value is configured on the WakeUp Agent of each WakeUp Server, to contain the list of all unauthenticated subnets that correspond to the authenticated subnets for which the WakeUp Server is responsible. The AlwaysQueueToLocalAgent registry value is configured on each WakeUp Server. In Multi-agent and Dedicated agent modes, this registry value should be set to ON. In Standalone Server mode, this registry value should be set to OFF, or not used.
Network Configuration	Network switches are configured to allow directed broadcast in one direction only. The network is configured to permit forwarding of UDP packets on the WakeUp port 1776 (default, but is configurable). The network is optionally configured with an Access Control List (ACL) that specifies the WakeUp UDP port 1776 and the IP address of the host computer(s) that send the WOL packets. In Dedicated agent scenario, the ACL should specify the IP Address of the Dedicated agent on the corresponding authenticated subnet. In Multi-agent scenario, any Agent can broadcast, therefore the ACL should specify an IP wildcard for Agents on the corresponding authenticated subnet.	Network switches are configured to allow directed broadcast in one direction only. The network is configured to permit forwarding of UDP packets on the WakeUp port 1776 (default, but is configurable). The network is optionally configured with an Access Control List (ACL) that specifies the WakeUp UDP port 1776 and the IP address of each WakeUp Server.
Best Practice	The Multi-agent scenario is recommended. The SubnetOverride list on each Agent need only contain the subnet for the unauthenticated subnet corresponding to the authenticated subnet on which the agent resides.	The SubnetOverride list should be limited to a maximum of 10 subnets. This best practice should prevent overloading network components with excessive wakeup broadcasts causing unacceptable network performance for all uses of the network. WakeUp is designed to handle wakeups of large numbers of clients across multiple subnets. Each attempt by the WakeUp Server to wake a single client, causes a broadcast to the client’s last known subnet. However, the WakeUp Server then has to send a broadcast to each of the subnets listed in the SubnetOverride list, before repeating the process for the next client in the wake list. For example, to wake 1,000 clients with a list of 10 unauthenticated subnets causes 11,000 broadcasts (1,000 x 1 authenticated subnet + 10 unauthenticated subnets). The WakeUp Server in the 1E lab took approx. 4 minutes to process this many broadcasts, before it could process any other requests. If a subnet is unreachable, the process is slowed down by approx. 3 seconds per client due to multiple ARP queries. Using the WakeUp console describes Maximum Burst Size (100) and Burst Delay (5 seconds). These WakeUp Server settings can be used to avoid overloading the server's WakeUp Agent, but will not remove any backlog.

Configuring SubnetOverride on a WakeUp Agent

This registry value should be populated in the WakeUp Agent registry with a comma separated list of values each of which defines a subnet. Duplicate subnets are ignored. The subnet on which the Agent resides is also ignored because it has already been sent a broadcast. The WakeUp Server first instructs the relevant WakeUp Agent to broadcast to the Authenticated subnet on which it resides, before processing the SubnetOverride list.

The Server method requires the registry for the WakeUp Agent on the WakeUp Server(s) to be configured. The Agent method requires the registry for the WakeUp Agent on the 1E Agents to be configured.

HKLM\Software\1E\WakeUpAgt\SubnetOverride (REG_SZ)

The format for each value can be one of the following:

You can mix different format values in the same string as long as each value is consistent with one of the above formats. For example:

192.168.13.0/24,192.168.34.0/255.255.255.0,192.168.10.255

Configuring AdditionalSubnets on a WakeUp Agent

This registry value is not always necessary, but may be required when using the Agent method in Multi-agent or Dedicated agent scenarios. If the WakeUp Agent starts up before the computer has authenticated, it will attempt to report the unauthenticated subnet as the last known subnet. The information is not reported back until the computer switches to the authenticated network, but it means the WakeUp Server will attempt to use its normal process to discover an Agent on both subnets on the next wakeup attempt. The discovery process will fail for the unauthenticated subnet and delay the wakeup.

If this problem should occur, this registry value allows the WakeUp Agent to inform the WakeUp Server that it will also act as the Agent for the additional subnets, and should be populated with the same list of subnets as specified in the SubnetOverride list.

HKLM\Software\1E\WakeUpAgt\AdditionalSubnets  (REG_SZ)

Each subnet must be in the following format (which is different to the formats available for SubnetOverride).

Multiple subnets would be represented as follows, for example:

192.168.13.0,255.255.255.0,192.168.34.0,255.255.255.0,192.168.10.0,255.255.255.0

Configuring AlwaysQueueToLocalAgent on a WakeUp Server

This registry value must be set to ON when using WakeUp Server in Multi-agent and Dedicated agent scenarios, so that the WakeUp Server will instruct its local WakeUp Agent to send the additional WOL broadcasts.

This registry value is either not used, or set to OFF, when using WakeUp Server in Standalone Server scenario, because the WakeUp Server will always use its local WakeUp Agent to send WOL broadcasts, and setting this value to ON would cause these broadcasts to be duplicated.

HKLM\Software\1E\WakeUpSrv\AlwaysQueueToLocalAgent (REG_SZ)

Configuring Configuration Manager to work with WakeUp

To integrate WakeUp seamlessly with Configuration Manager, you need to enable Hardware Inventory. We assume that the primary Configuration Manager site has already been installed.

To enable the client agents:

1. Open the Configuration Manager Console.

2. Expand the Overview tree under Administration.

3. Select Client Agents.

   

   For WakeUp, you need to enable the Hardware Inventory Client Agent:

   1. Double-click Default Client Settings in the Client Settings list.

   2. Select Hardware Inventory and select the Yes option for the Enable hardware inventory on clients field.
      

4. Click OK.

Complete client hardware inventory

This is an important step, as WakeUp uses the network adapter hardware inventory data to determine the correct IP subnet mask for a system.

To force Hardware Inventory to run on a client in Configuration Manager,

1. Open Configuration Manager from the Control Panel.

2. Go to the Actions tab.

3. Select Hardware Inventory Cycle.

4. Click Initiate Action.

Wait 5-10 minutes for the inventory data to update the Configuration Manager database. To check that the hardware inventory is complete, open the Configuration Manager Resource Explorer for a client and expand the Hardware node.