NightWatchman Enterprise

An Office 2012 upgrade needs to go out to 1,000 systems overnight. Because of the size of the install and disruption to business users, it cannot be installed during the day.

The Configuration Manager administrator determines that 1,000 systems must be upgraded between the hours of 01:00 am and 08:00am. It is common that around 20% (200) of users leave their systems switched on. The rest are powered off but can be booted using Wake-On-LAN. The Office software was sent to distribution points the previous evening so a mandatory assignment schedule is created for the Office 2000 advertisement starting at 01:00 am.

The Configuration Manager administrator also calculates that the 200 systems that are already on will receive the advertisement first. The administrator sets the WakeUp hours of operation to between 01:00 and 07:00. This allows 1 hour after the last wake up for the install to complete.

The administrator must now calculate the number of wake ups and the frequency of polling intervals to spread the load of the installations over the hours of operation (01:00 to 07:00).

The administrator uses the following calculation:

(Number of systems/Available Hours) /Polling cycles per hour= Maximum required wake ups per polling cycle

Assuming that the polling cycle is every 300 seconds (5 minutes) this works out as follows.

(800 / 6) / 12 = 11.111111…

So the administrator needs to set the Maximum Wakeups per polling interval parameter to 12 (rounding the value up) to ensure all the machines are covered.

At 01:00 the advertisement becomes available and the systems that were left switched on install the software immediately. At the same time WakeUp starts to wake up systems at a rate of 12 every five minutes until 07:00. The last systems to be awakened have the remaining hour to complete the installation, ensuring that all updates are completed by 08:00.

In addition, WakeUp can be configured to shut down systems that it has awoken so the out-of-office wake ups are accompanied by shutdowns after the critical updates have taken place, thereby minimizing power consumption and cost.

Using WakeUp to stage the software installs over the entire out-of-hours period means minimum network load, minimum load on the Configuration Manager distribution points and ensures that all of the targeted systems are available for the upgrade.

A large bank has 500 branches, each containing 10 systems which are Configuration Manager 2012 clients and are Wake-On-LAN compliant. It is company policy to power off these systems every evening in order to save power consumption. The brief is to power on all of the bank's workstations before their employees arrive at 8:00am. This will mean that they do not have to wait around for system start-up and their workstations will be ready to use.

The Configuration Manager hierarchy at the bank consists of a central site, 5 primary sites, each of which has 100 secondary sites reporting to it (1 per branch). Because the forwarding of directed subnet broadcasts across the bank routers is disabled, the WakeUp Server is installed in multi-agent mode on the single server in each branch. It is also installed in Stand-alone Server mode on each of the 5 primary site systems.

Because of this highly distributed environment, WakeUp is configured to wake as many systems as possible as quickly as possible with no restrictions. Each primary site is responsible for 1,000 branch workstations, so at each primary site Maximum Wake ups per polling interval is set to 1,000 and the polling interval is set to every 5 minutes. This means that WakeUp can add all 1,000 systems to the wake up list in one polling interval if required. WakeUp is also configured to connect to a maximum of 50 agent systems concurrently, and can send 10 wake ups every 10 seconds to each agent system in the branches. This is set using Burst Delay and Maximum Burst.

Within the Configuration Manager central site, the administrator has defined a collection named All Branch Workstations containing all of the 5,000 systems. In order to wake all 5,000 of these systems each morning at 7:00 - to make sure they are up and running by 8:00, all the administrator has to do is to create an Advertisement which runs the following command on each workstation:

cmd.exe /c

This is in effect a dummy Advertisement, its only purpose being to invoke WakeUp to wake the machines.

Using the WMI interface or the WakeUp Send WakeUp... menu options in the Configuration Manager Admin Console you can wake machines immediately, the Advertisement or Assignment option will wake up the machines at a time appropriate to their local time zone and will automatically be aligned with the receipt of the Advertisement or Assignment. For waking machines in general we recommend that you use the Alarm Clock feature, which is part of the Power Policy capability, in the NightWatchman Management Console to establish wakeup times for your PCs local to their time zone.

Autoshutdown does not occur for manually requested wake ups (these include: the right-click option from the Configuration Manager console, via the WMI interface or on the WakeUp command-line).

So for the Advertisement wake ups, you will need to override the WakeUp auto shutdown option and prevent shutdown by including the text 'NoAutoShutdown' in the Advertisement name or Advertisement comment. A suitable name for the Advertisement would be: Wake all machines at 7 NoAutoShutdown

07:00 - The advertisement becomes available and each primary site server enumerates the systems that are to receive the advertisement. Because there are no restrictions to the WakeUp service, each site can add all 1,000 systems to the wake up list for forwarding to the 1E Agent systems.

The WakeUp Server connects to 50 1E Agent systems and sends 10 wake up requests to each one. As Agent connections are dropped, new ones are created until the second 50 agent systems are processed.

The whole process takes less than 10 minutes.

WakeUp is ideal for this type of housekeeping task that improves user productivity. Once configured correctly for the environment, no further intervention is required. WakeUp simply integrates with existing Configuration Manager working practices.

In a multi-tier environment when an Advert is created it will take a variable amount of time to ripple down the tiers. If by the time the Advert is polled at a lower tier the advertisement's scheduled time has passed, WakeUp will not action any wake ups for that advertisement.

If you create a mandatory assignment with the current time (this also occurs when doing a re-run) this is not guaranteed to be processed at the lower tiers.

What this means in practice is that if you want to use WakeUp to wake up machines for an Advert, you need to create the Advert in the right way. Depending on the purpose of the Advert you should create it in one of the following two ways:

We show how the WakeUp Server can be configured to support the specific Configuration Manager site configuration and guide you through configuring and optimizing WakeUp on both the Server and remote listening systems in your hierarchy.

When first installed, the service should be configured according to your Configuration Manager hierarchy, the number of clients and the preferred hours of operation.

All configuration of the service is performed from the WakeUp Console which is started from the the 1E WakeUp program group on the Start menu. If you start the console from the Configuration Manager Administrator Console, you will not be shown the Connect to Server dialog.

In multi-agent mode, as target machines wake, each primary agent reports successful wake-ups as quickly as possible back to its WakeUp server, but has to wait before trying to ping machines that have not reported and then report the remaining successes and failures.

The WakeUp Result Delay (WUResultDelay) is configurable in the Agent registry and is in seconds. By default it is 0 which means the WakeUp Server will tell the Primary Agent how long to wait – configure the delay to be slightly longer than the time it takes for machines to boot up and start their 1E Agent.

The WakeUp server combines all information it receives. Status is reported in the Advertisements node of the WakeUp server console. If it is integrated with Configuration Manager, statuses for software updates and applications are reported.

WakeUp can be used to wake up machines immediately and explicitly from the Configuration Manager Admin Console or automatically, without user intervention to ensure machines are woken up prior to a Configuration Manager Advertisement.

When installed, WakeUp extends the Configuration Manager administrator console menus. The menu extensions permit the explicit immediate waking up of single machines or entire collections.

There are three options:

To perform an immediate wake up to a Configuration Manager collection, right-click on the collection in the left hand pane of the Configuration Manager administrator console and from the WakeUp sub-menu select Send WakeUp.

Sending a wake up packet to a single resource is similar to sending a wake up to a Configuration Manager Collection. Simply select the required resource in the right hand pane of the Configuration Manager administrator console, right click and from the WakeUp sub-menu select Send WakeUp.

Wake up prior to advertisements

A key feature of WakeUp is that it can be configured to run automatically without impacting on the workflow of the Configuration Manager administrator.

All the administrator needs to do is create the advertisements and WakeUp works out which machines need waking and when and performs the task in time for the advertisement to be processed.

To do this the WakeUp service performs the following steps:

The wake up list is enumerated in different ways depending upon your installation scenario.

You will have noticed that there are many different configuration options available for WakeUp. This ensures that performance can be controlled to fit in with any network infrastructure.

Policy Refresh is only operational in multi-agent mode. This is because a client component is required to initiate the Policy Refresh action.

By default, WakeUp will send a Policy Refresh prompt to ensure that newly awoken machines get any pending advertisements as soon as possible. You can turn the Policy Refresh behavior off globally by checking the Check Policy Refresh in Name option in the Configuration tab of the WakeUp console, or you can turn it off for a particular advertisement by putting the text NoPolicyRefresh into the name of the advertisement.

When you turn Policy Refresh off globally, it can still be explicitly requested for specific advertisements by including the text PolicyRefreshEnabled in the advertisement name.

In order for the WakeUp service to process an advertisement, the schedule for that advertisement must be assigned (mandatory). The following types of advertisement schedules are all valid for processing by WakeUp.

The following advertisement schedules are not supported when used with WakeUp:

Software updates assignments, WakeUp and Configuration Manager

When configuring the use of WakeUp with Software Updates Assignments in Configuration Manager you need to ensure the following items are done:

The Software Updates Properties dialog in Configuration Manager 2012 lets you configure wake-up on the Deployment Settings tab. Ensure that the Use Wake-on-LAN to wake up clients for required deployments checkbox is checked.

In Configuration Manager 2012 software distribution is performed using Deployments. Select the Send wake-up packets option.

The 1E Agent service installed on every machine attempts to communicate with Intel® AMT Board Management Controller via the Management Engine (ME) interface driver or Host Embedded Controller Interface (HECI) driver. The state set by the 1E Agent is sent to Configuration Manager as an extension to hardware inventory. A hardware inventory WMI class, called SMS_G_SYSTEM_WAKEUP_1E_IAMT, is created in Configuration Manager that contains a list of all machine resources known to Configuration Manager that are Intel® AMT machines with 1E Agent installed.

WakeUp only requires a single machine in a remote subnet to wake up targeted machines on the subnet. If the existing agent finder in WakeUp fails to find any currently awake machines in the subnet, it dispatches a request to the WakeUp Intel® AMT Service to find a suitable agent in the subnet and wake it using an Intel® AMT SOAP message and the pre-configured authentication mechanism. WakeUp subsequently uses the 1E Agent on that machine to wake up other targeted machines on the subnet using magic packet technology.

The WakeUp Intel® AMT component needs to be installed on all Configuration Manager Primary Site Servers where WakeUp is installed. It uses system inventory information to send out SOAP messages on requests from the WakeUp service in time for any advertisement schedules.

The WakeUp Intel® AMT service is responsible for communicating with the WakeUp service and sending SOAP messages to Intel® AMT machines via the preconfigured authentication mechanism.

When running with Configuration Manager this service should be installed in each Configuration Manager Site server in the hierarchy that has WakeUp installed – providing the site has Intel® AMT Configuration Manager clients and those clients have been provisioned.

When running solely with NightWatchman Management Center, this service only needs to be installed on the WakeUp Server set as the NightWatchman Management Center wake up provider.

If Intel® AMT is configured in enterprise mode using Active Directory for authentication with Kerberos, the service will run using an account that is a member of the Intel® AMT Collections Managers group. The WakeUp Intel® AMT service will attempt to use WinHTTP to impersonate the account and connect to the targeted machine.

If Intel® AMT is configured in small business mode; the WakeUp Intel® AMT service will use a username and password for digest authentication. Once installed, WakeUp will detect the WakeUp Intel® AMT service and dispatch requests when agents are not found on a targeted subnet.

The WakeUp Intel® AMT component provides an alternative to the Last Man Standing mechanism. The alternative still relies on the 1E Agent being installed on every machine. The 1E Agent is responsible for discovering the Intel® AMT Board Management Controller and building up a database of Intel® AMT machines in Configuration Manager or NightWatchman Management Center. Once discovered, the WakeUp Intel® AMT Service will wake up the machine. The 1E Agent on the machine will receive instructions from WakeUp Server to send out magic packets to any systems that need waking.

Computers that have Intel® AMT hardware and are configured to support remote wake ups circumvent the WakeUp requirement that there is at least one 1E Agent on the subnet running to handle wake up signals from WakeUp Server. This is because WakeUp is able to use the Intel® AMT capabilities to wake the machine remotely without using magic packet broadcasts, which are liable to be disabled in secure networks.

To use Intel® AMT for a subnet where such hardware exists instead of Last Man Standing, you need to enable the Intel® AMT option during WakeUp Server installation and, except for the 1E Agent on the Intel® AMT computer, install all the other 1E Agents on the subnet with LASTMANENABLED=0.

A hardware inventory WMI class is created by extending the Configuration Manager Hardware Inventory MOF compiled. Hardware inventory information sent by every Configuration Manager client will contain extended data identifying whether the machine resource is an Intel® AMT machine.

This information is used to enhance the existing hardware inventory information in Configuration Manager providing the WakeUp Intel® AMT service with a means of identifying Intel® AMT machines for a specific subnet.

When running solely with the NightWatchman Management Center, the 1E Agent sends information about the computers running Intel® AMT to be stored in the NightWatchman Management Center database.

The WakeUp Intel® AMT service runs as LOCAL SYSTEM and uses a username and password specified at install time to connect to Intel® AMT machines. The administrator can modify this username and password from the command-line.

The following parameters are supported by the command-line:

In order to set the authentication to the default Intel® AMT username and password:

C:\Program Files\1E\WakeUp\Server>WakeUpAMT.exe –username=admin –password=admin

The WakeUp Intel® AMT service runs as a domain account that is a member of the Intel® AMT Collections Manager Active Directory group.The administrator can configure the service to run in this mode by manually configuring the service via the Service Control Manager MMC snap-in and forcing Kerberos authentication mode from the command line:

After modifying the properties of the service, run:

C:\Program Files\1E\WakeUp\Server>WakeUpAMT.exe –useKereberos=1

This is an important step, as WakeUp uses the network adapter hardware inventory data to determine the correct IP subnet mask for a system.

To force Hardware Inventory to run on a client in Configuration Manager,

Wait 5-10 minutes for the inventory data to update the Configuration Manager database. To check that the hardware inventory is complete, open the Configuration Manager Resource Explorer for a client and expand the Hardware node.