Intel vPro technology is an umbrella marketing term used by Intel for a large collection of computer hardware technologies, including VT-x, VT-d, Trusted Execution Technology (TXT), and Intel Active Management Technology (AMT). When the vPro brand was launched (circa 2007), it was identified primarily with AMT, thus some journalists still consider AMT to be the essence of vPro.
vPro features
Intel vPro is a brand name for a set of PC hardware features. PCs that support vPro have a vPro-enabled processor, a vPro-enabled chipset, and a vPro-enabled BIOS as their main elements.
A vPro PC includes: Multi-core, multi-threaded Xeon or Core processors. Intel Active Management Technology (Intel AMT), a set of hardware-based features targeted at businesses, allow remote access to the PC for management and security tasks, when an OS is down or PC power is off. Note that AMT is not the same as Intel vPro; AMT is only one element of a vPro PC. Remote configuration technology for AMT, with certificate-based security. Remote configuration can be performed on "bare-bones" systems, before the OS and/or software management agents are installed. Wired and wireless (laptop) network connection. Intel Trusted Execution Technology (Intel TXT), which verifies a launch environment and establishes the root of trust, which in turn allows software to build a chain of trust for virtualized environments. Intel TXT also protects secrets during power transitions for both orderly and disorderly shutdowns (a traditionally vulnerable period for security credentials). Support for IEEE 802.1X, Cisco Self Defending Network (SDN), and Microsoft Network Access Protection (NAP) in laptops, and support for 802.1x and Cisco SDN in desktop PCs. Support for these security technologies allows Intel vPro to store the security posture of a PC so that the network can authenticate the system before the OS and applications load, and before the PC is allowed access to the network. Intel Virtualization Technology, including Intel VT-x for CPU and memory, and Intel VT-d for I/O, to support virtualized environments (these features are also supported without vPro). Intel VT-x accelerates hardware virtualization which enables isolated memory regions to be created for running critical applications in hardware virtual machines in order to enhance the integrity of the running application and the confidentiality of sensitive data. Intel VT-d exposes protected virtual memory address spaces to DMA peripherals attached to the computer via DMA buses, mitigating the threat posed by malicious peripherals. Execute disable bit that, when supported by the OS, can help prevent some types of buffer overflow attacks.
The 12th generation of Intel Core processors introduced four distinct platforms: vPro Essentials, vPro Enterprise for Windows, vPro Enterprise for Chrome and vPro Evo Design. The difference of vPro Essentials is that it does not support some features: Out-of-band KVM remote control, Wireless Intel® AMT, Fast call for help, Intel® Remote Secure Erase with Intel® SSD Pro. Intel processors that support vPro Essentials are using Intel Standard Manageability (a subset of Intel AMT) which supports out-of-band management and can be monitored with the "Access Monitor" feature.
Remote management
Intel AMT is the set of management and security features built into vPro PCs that makes it easier for a sys-admin to monitor, maintain, secure, and service PCs. Intel AMT (the management technology) is sometimes mistaken for being the same as Intel vPro (the PC "platform"), because AMT is one of the most visible technologies of an Intel vPro-based PC.
Intel AMT includes: Encrypted remote power up/down/reset (via wake-on-LAN, or WOL) Remote/redirected boot (via integrated device electronics redirect, or IDE-R) Console redirection (via serial over LAN, or SOL) Preboot access to BIOS settings Programmable filtering for inbound and outbound network traffic Agent presence checking Out-of-band policy-based alerting Access to system information, such as the PC's universally unique identifier (UUID), hardware asset information, persistent event logs, and other information that is stored in dedicated memory (not on the hard drive) where it is accessible even if the OS is down or the PC is powered off.
Hardware-based management has been available in the past, but it has been limited to auto-configuration (of computers that request it) using DHCP or BOOTP for dynamic IP address allocation and disk-less workstations, as well as wake-on-LAN for remotely powering on systems.