If you haven't yet purchased the computers that you want to manage out of band with Configuration Manager 2007 SP1 and later, decide whether you need a customized firmware image from your computer manufacturer.

Note
The information in this topic applies only to Configuration Manager 2007 SP1 and later.

Computers that can be managed out of band have BIOS extensions that can include options such as enabling serial over LAN and IDE redirection and that can set values such as a certificate thumbprint of a root certification authority that is used during the AMT provisioning process.

Check which BIOS extension settings are available from your computer manufacturer, and decide whether you need a customized image to enable or disable options and specify your choice of values.

Some typical examples of why you might need a customized firmware image include the following:

• You want to specify an alternative external certification authority to issue the AMT provisioning certificate, or you want to use your own internal certification authority to issue the AMT provisioning certificate.
  
  

  Note
  If you want to use your own internal certification authority, you will need to supply the certificate thumbprint of your root certification authority. If you need more information about how to do this, see How to Locate the Certificate Thumbprint of Your Internal Root Certificate for AMT Provisioning.

• The default firmware image enables serial over LAN and IDE redirection, but to comply with your internal security policies, computers on your company network must not support these highly privileged management options. For more information about serial over LAN and IDE redirection, see Overview of Out of Band Management.
  
  
• The default firmware image does not enable bypassing the BIOS password, and you want to be able to use this option when powering up or restarting computers out of band with the out of band management console.
  
  
• The default firmware image has the value of ProvisionServer for the provisioning server name, but you want to use either a different name or the IP address of the server that will host the out of band service point role. For more information about this scenario, see Decide Whether You Should Register an Alias for the Out of Band Service Point in DNS.
  
  
• You want your AMT-based computers to use a MEBx password that is different from the default value of admin.
  
  

If you think you might benefit from a customized firmware image, discuss the available BIOS extensions with your computer manufacturer or supplier.

See Also