text:
Feet on the Street series continues with a 1:1 w/ Teri McFaul. Hear what Teri does for Intel & vPro.
Feet on the Street - Matt Royer (Microsoft vPro Guru)
Feet on the Street - vPro Series - Meet Wendy West
Feet on the Street - It's time to talk with Gregory Bryant
Feet on the Street - vPro Series - Meet Jake G. - Part I
Intel® System Defense Utility is an easy to use tool for small and medium businesses to take advantage of valuable proactive security and manageability features of Intel® vPro™ processor technology. Combined with systems built on Intel® Desktop Boards Executive Series, this tool lets you unleash the power of proactive management in your local network.
It enables you to remotely perform security and manageability functions such as setting security policies, BIOS configuration, remote reboot, asset management, event logging, and more.
Click here for a demo!
Intel System Defense Utility may be used with the Intel® Desktop Boards based on:
· Intel® Q965 Express Chipset
· Intel® Q45 Express Chipset
· Intel® Q35 Express Chipset
For more information: http://www.intel.com/design/motherbd/software/isdu/index.htm
People often say to me - "I've got encryption, so I'm protected," or "I always use a laptop lock," so I'm protected.
In response I always remind them that laptop security should be looked at like a three-legged stool. If any of the three legs are missing, the stool falls over (unless the person on the stool is a member of the Beijing Circus, but that's a rare exception).
What are the three legs?
The first leg is Physical Security, like a laptop lock and/or an alarm on your laptop bag. If you're leaving your machine, lock it down!
The second leg is Data Protection like encryption. If your machine does get out of your control and someone nefarious removes your hard drive, you can be "reasonably" confident they won't get at your data. (I say "reasonably" because we've all seen the laptops at airports on in presentations where the password is written on a sticky note stuck to the machine!)
The third and final leg on the stool is a Protection Solution like AT-p. If your machine fails to check in to the monitoring center after a certain length of time then presto it bricks. Or if you know your machine is lost you can send it a poison pill and lock it down.
How many legs does your stool have?
I've updated the vPro-ready systems that are available from Panasonic. These include the fully rugged, business rugged, and semi-rugged notebooks. John Hilliker just blogged about the Park and Patch use case which features the CF-19. The full line of Panasonic Toughbook notebook computers available with vPro is shown here: http://communities.intel.com/docs/DOC-2033#Panasonic. In case it isn't clear from the list, all CF-19K and CF-19L series (CF-19Mk3), CF-30K and CF-30L series (CF-30Mk3), and the CF-T8, CF-W8, and CF-F8 come standard with vPro.
We have two checklists on the Expert Center to help you plan your vPro and Microsoft SCCM deployments. The Discovery Checklist was just published today. Take a look!
Discovery Checklist for Microsoft SCCM[1]
Use this checklist to start gathering the information required for deploying Intel® vPro™ technology in your enterprise.
Infrastructure Prep Checklist for Microsoft ConfigMgr
Use this checklist to ensure prerequisites are completed before deploying Intel® vPro™ technology in your enterprise.
I have finally finished the Park N Patch Use case on how you can leverage a Management console and Intel vPro Technology. In this example I am using Symantec Management Console and a Panasonic CF-19 toughbook.
The specific model of Panasonic is a CF-19Mk3 - http://www.panasonic.com/business/toughbook/fully-rugged-laptops-toughbook-19-details.asp
HD Version
Youtube Version
Here's the graphical picture of the use in deployment.
Park N Patch Use case
Hi all,
Intel has been working with various companies on implementing the concept of Dynamic Virtual Clients. Driven by the need to control costs of desktop management, Providence Health & Services – Oregon (PH&S – Oregon) recently undertook an initiative to gain greater control and standardization of desktop configurations, while providing performance and flexibility to meet business unit needs. Goals for this initiative included maximizing system availability, reducing operating costs, increasing security, and better using IT time and resources to support business strategies rather than day-to-day maintenance.
After evaluating various computing models, including virtual desktop infrastructure (VDI), blade computing, and terminal services, PH&S – Oregon deployed a pilot solution with streamed delivery of a centralized OS image using Citrix Provisioning Server* (Citrix PVS) along with application streaming and virtualization using Microsoft SoftGrid,* now called Microsoft Application Virtualization* (Microsoft App-V).
For PH&S – Oregon, this solution offered the lowest cost of ownership for both conversion and operation, met management and security requirements, and met or exceeded user expectations for boot time, application launch times, and performance.
Check it out in the attached case study.
"Yes we can!" - SCS 6.0 now reaches the SMBs
When we first got back to the drawing board and thought about new SCS Architecture, for SCS6.0, we had several things in mind.
It was clear that the existing provisioning flow (end to end) had to be simplified – Feedbacks from the field, showed that the required IT setup and configuration interaction required steep vPro specific learning curve, even before the actual provisioning process that happens through the SCS tool.
We also realized that in order to improve the ISV integration we had to listen to Key ISVs' trends. Some of them requested the ability to configure vPro from the local host while others - SMB/MSP ISVs had different needs.
Interoperability and scalability were also 2 focus items when we started the new design.
The plan was to hit the road with a new agile development methodology – SCRUM.
In parallel, we decided to break the setup and configuration logic into different components that ISVs can use as their building blocks.
This new architecture allows ISVs greater flexibility in order to provide a more integrated solution that will be easier to use by IT administrators, or on the other hand, can be used by small scale ISV who are not interested to deal with provisioning as part of their offering.
Let the SCRUM begin!
SCRUM is defined as agile development process that allows teams to deliver usable software periodically throughout the life of the project, absorbing change and new requirements as the project proceeds.
Working agile for us, meant being able to divide the SCS deliverables into short iterations ("sprints" ) and by the end of each sprint be able to provide "potentially shippable" product - Something that can be actually used by the customers.
This way, in an incremental effort, we are sharing more features and high quality releases on a regular basis.
This is how the SMB requirements started floating around. First, through several email threads and then, after the team looked at the requests, they all said: "Yes we can!"
In an effort to reduce the number of tools trying to solve similar problems to the customers, and in reality only adding to the confusion, we defined the following milestones for SCS6.0:
• Release #1 – Q1'09 (ww03'09) - SCS 6 Technology Preview #1 - SMB Provisioning
• Release #2 – Q2'09 (ww15'09) - SCS 6 Technology Preview #2 - Enterprise Provisioning
• Release #3 – Q3'09 (ww32'09) - SCS 6 Technology Preview #3 - Maintenance, Installer and improvements
• Release #4 - Q4'09 (ww45'09) - SCS 6.0 Final - AMT6 Features Support
The Lightweight provisioning and the SMB provisioning story
The recent technology preview provides a lightweight solution aimed for small and medium business (SMB) customers. In the spirit of the SCS 6.0 approach, pre-requisites were reduced to minimum: No DB is needed (XML based solution is the alternative), No configuration is needed - Profile is ready. It can be installed on any windows based host, No prerequisites from the "server" and … Low footprint on the host system.
In only 3 simple steps, that take only few minutes, the user can now configure the machine (with or without PSK).
All that is required is:
• User step 1: IT installs SCS 6.0 LW with default profile out of the box
• User step 2: IT buys RCFG certificate
• User step 3: IT remotely distribute host based Activator (Through existing Management consoles that are out there already, in the organization)
Or … with PSK:
• User step 2: IT remotely distribute host based activator
• User step 3: IT admin creates USB file containing PSK/PID pair to be consumed by the Intel® AMT (One touch end-user restart is required)
Lastly, there is also an option to do Local USB key configuration through the Activator's GUI in SCS 6.0. This manual configuration takes 2 steps:
• User step 1: User insert USB key containing GUI Activator SCS 6.0 application
• SCS Activator Determine Local AMT State
• SCS Activator creates setup.bin file containing all information needed to configure the system (using user input regarding password and information if no DHCP is present)
• SCS Activator formats the USB key then copies both setup.bin file and the Activator application to the disk again.
• User Step 2: USB Key – Reboot & Approve
• End User Shut Down Applications and Reboot PC
• End User "Approve" BIOS AMT Provisioning Process
Under the hood
For those interested to know what's going on under the hood, the new SCS6.0 technology preview #1 contains 3 elements:
• AMT Configuration Server Service — A Windows service (known as the SCS service) performs the steps required to make an Intel AMT system operational. (This includes Intel AMT Release 2.0 and later releases.) The configuration is determined by a configuration profile stored in an xml file. The SCS service exposes a WMI interface for managing the configuration file, creating and importing USB keys and performing configurations (see the MOF API section for details on the interface). The SCS service writes log messages to a file.
• Intel® vPro™ Technology Activator Utility — This application runs on an Intel® AMT system. It performs a diagnosis of the current state of the Intel AMT system and triggers the SCS (via its WMI interface) to perform configuration or unconfiguration.
• SCS Console — A GUI application for managing the SCS configuration profiles and creating and importing USB keys via the SCS WMI interface.
The new technology will be demonstrated in 2009 ISMC, but you also have the ability to download it and experience it yourself. The ease of use of the Intel® AMT Setup and Configuration Service (SCS) 6.0 first Technology Preview can be checked here:
See also a simple demo that shows the usage of this release using the link above listed under "Additional Information": Sprint 5 Demo
Do you have a bunch of systems that are Intel AMT capable, yet currently set to ASF Manageability mode? If you're looking for a way to remotely switch these over - take a look at the updated Intel vPro Activator Utility in the Intel SCS v6 preview - http://software.intel.com/en-us/articles/download-the-intel-AMT-SCS-technology-preview/
If you extract out the Activator directory - the exe and dll files are what you want. Test it out on a system. The command is as follows:
activator /transition
You will notice the system's network connection disconnect\reconnect during the transition. Once complete - you're system is not set to AMT manageability mode. If the system supports remote configuration (Intel AMT 2.2, 2.6, 3.x or higher), and your infrasrtucture is ready to support remote configuration, then you can immediate start the provisioning event.
A great new addition to the toolset!
Matt & I were able to spend a few moments in Las Vegas during a sales event to talk about certificates & vPro. If you are having console issues listen in on this one. it will be worth the time.
Josh H
Last year I had an opportunity to talk with GB about vPro, I was able to do the same this year & spend a few moments with him on 3 questions. In this first series he talks about vPro in 2009. Listen in & let me know what you think..
Thank You
Curious about how Intel vPro and Symantec's Altiris software work together? Using Symantec's Altiris CMS to manage your vPro machines? Or, are you somewhere in between? In either case, the Symantec SP Zone was designed for you. The new vPro Expert community houses info that offers a better understanding of the products, describes how others are benefiting from the combined solution and, can help you get up and running.
So check it out, post a blog or start a discussion.
Symantec SP Zone
Julie Nusom
Community Manager
Intel has been working with various companies on implementing the concept of Dynamic Virtual Clients. Driven by the need to stay competitive under brutally challenging market conditions, a global financial services firm has mounted an innovative "stateless" desktop virtualization initiative, using streaming OS and application technology to make IT more agile and cost-effective. (The firm wishes to remain anonymous.)
In a previous effort to control desktop management costs for over 100,000 workstations, the firm implemented a solution based on VDI, which did not work well for certain segments – the power users and some knowledge workers. VDI also did not solve the underlying complexity issue of managing at least one desktop image for each user. To service the power users and provide a solution for centralized desktop image management, the firm implemented a "stateless client" architecture that centralized management and distribution of desktop images through real-time streaming technology, deployed on economical, scalable PCs or "virtual thin desktops."
The firm's stateless solution assembles desktop images on the fly from a set of master OS images combined with virtualized, streamed applications. This solution combines the security and control of server-based models with the high performance and multimedia user experience offered by rich client workstations.
Microsoft has just released Hotfix KB960804. This is a hotfix rollup package that addresses issues that involve the Out of Band Management (OOB) feature in Microsoft System Center Configuration Manager 2007 Service Pack 1 (SP1). These issues are documented in the following Microsoft Knowledge Base articles: (Even if you have all or some of the other Hotfixes installed that are included in this rolled up HotFix, it is recommended that you install KB960804 Roll-up Hotfix)
--Matt Royer
Intel has been working with various companies on implementing the concept of Dynamic Virtual Clients. As innovators among Harvard University's IT community, the School of Engineering and Applies Sciences (SEAS) is an ideal environment for implementation of Application Streaming technology. Within SEAS, the office of Computing and Information Technology's (CIT) CyberInfrastructure Labs (CI Labs) supports faculty, researchers, students, and staff by deploying and maintaining up-to-date, effective computing technologies.
With application streaming, applications are streamed on demand from the data center to the client, where they are executed locally. The goal of the scientific application streaming project, as outlined in the attached white paper, is to simplify the deployment of large, complex engineering and scientific applications to a highly diverse user population of around 1,000 students and faculty.
Initial results show install times decreasing from hours to minutes, as well as fewer problems caused by human error during complex installation and licensing procedures. As innovators among Harvard's IT community, the CI Labs anticipates wider implementation of application streaming, both within its user base and across Harvard.
Check out the details in the attached case study.
The release of the Notification Server 7.0 platform will provide a new design and infrastructure. Out of Band Management will also provide a new release with this platform. First I'll provide a brief description of what Out of Band Management is used for. This article will also cover the differences between the 6.2 version of Out of Band and version 7.0. The changes include UI improvements, relabeling to be in line with current Intel terms, and the addition of limited Dash support.
Out of Band Management 7.0 allows an administrator or IT Professional to setup and configure several protocol technologies for use in the greater Notification Server infrastructure, or even any other solution that supports the protocols handled by Out of Band Management. The supported technologies are:
The greater focus is on Intel's AMT technology. Using the provided configuration pieces with Out of Band, systems with the above technologies can be configured to respond to functions called from either the RTSM interface or via Task Server. Once configured, the Notification Server is a trusted entity to the local systems and all available functions are available.
More information can be found by browsing through the articles generated on Out of Band Management 6.x at http://www.symantec.com/community/intel.
It's important to understand the changes in terminology and labeling so the transition from 6.2 to 7.0 Out of Band Management goes smoothly. This section will also help explain the naming scheme for Out of Band Management. The following list provides the term, and the previous label (if different), and a brief description:
Out of Band Management now has a Portal page that provides access to most function from a user-friendly UI. It's accessed in the Symantec Management Console by going to Home > Remote Management > and click on Out of Band Management. The following screenshot shows a view of the portal:
The upper left-hand pane shows a list of setting groups that will enable a user to go through those steps necessary to enable or complete Out of Band setup and configurations. Please note the following items and what they can be used for:
As a note, Site Servers allow distribution of Out of Band functions across the environment, and helps alleviate any problems with large rollouts involving a large amount of Configuration. This brings us closer to having true hierarchy support with Out of Band Management.
Those who are familiar with Out of Band Management 6.2 can use this section to find corresponding functions, configuration pages, and utilities when upgrading to Out of Band 7.0. If you are unfamiliar with this version skip to the next section.
Out of Band Management looks much the same as it did in 6.2, with some notable exceptions. The following items cover the differences between the two. The method used to reach the console area for Out of Band Management is as follows: Browse down through Settings > All Settings > in the left-hand tree browse down through Remote Management > Out of Band Management. The three subfolders are by the same name as they were in 6.2, lacking the fourth folder: Delayed Provisioning.
The component that Out of Band Management plugs into has not changed between versions. Intel SCS (Setup and Configuration Services) is still the backbone of Out of Band, and handles all the transactions between the server and the remote Intel AMT clients during the Configuration process. Please note that management functions of AMT are NOT handled by Intel SCS. SCS stands for only the Configuration process, including maintenance and reconfiguration tasks (for example for profile updates) as part of maintaining the configured state.
Out of Band Management 6.2 used Intel SCS version 3.0 (or 3.2.1 per the Knowledgebase article found at this location: https://kb.altiris.com/article.asp?article=40076&p=1). Intel SCS version 5.0 ships with Out of Band Management. While the UI does not reveal all the additional capabilities, SCS 5.0 comes with a tool called Activator. This utility can handle a number of scenarios that were sticky points in the previous versions of Out of Band and Intel SCS. The abilities include the following:
The above two functions can be utilized by sending Activator down using a Delivery Software job in the Software Management Solution.
Hopefully this introduction will help those familiar with Intel vPro, and especially familiar with Out of Band Management in the Notification Server 6.0 infrastructure, to understand the changes and functions in version 7.0 of Out of Band Management. In depth articles will be generated in the future to cover some of the new features such as the MPS and CIRA functionality.
As an first MSP in Eastern Europe, I had a dilema which software or solution to use.I made my decision but still I'm not sure did I made a good decision.
Before I make my finall decision, I tried couple of software and mostly I'm was looking for a solution that can satisfied all the needs.
I wish to manage vPro platforms and non vPro platforms as well.
Solutions which were more apropriate to vPro platform has a lot of problems with non-vPro machines, SNMP devices etc...
The other one were very good with non-vPro platforms and SNMP devices but were poor with vPro platforms.
Still, I don't have a perfect answer, which solution is the best for MSP bussines and my personal opinion is that combination of few solutions are the only possible winning combination.
Normally, there is no recepies for perfect combination, as well but there is always a "winning" combination for specified situation.
I would be very greatfull if someone share some experiance with me in finding the best combination for MSP bussiness and to find out the best possible way for this kind of bussiness.
From my experiance, vPro is just a "cream of chocolate cake" and lots of "free" software for vPro is only something which should promovate technology in small bussiness companies.
But when we get to some serious bussiness !?!?
Sasa Milasinovic
Intel® Client Manageability Add-on for Microsoft* SMS 2003 version 5.0.1 has been released.
Version 5.0.1 contains the following improvements:
The lastest version of the Add-on can be downloaded here.
If you want to have the Intel Manageability Tool Kit interoperate with a vPro client that has been provisioned by Microsoft System Center Configuration Manager SP1, there are two key things you need to do: Configure Manageability Commander to trust the Issuing Certificate Authority of AMT Web Certificates and to authenticate with a Kerberos user that has access to the vPro Client.
Before configuring Manageability Commander, you will need to obtain a copy of the Root Certificate Authority Certificate that the vPro Client AMT Web Server Certificate was issued from. This is the same Certificate Authority that was configured in "Microsoft System Center Configuration Manager Console" -> "Out of Band Component Configuration" -> "Site Database" -> "Site Management" -> "Site" -> "Site Settings" -> "Component Configuration" -> "Out of Band Management" -> "General Tab" -> "Certificate Template".If you are issuing AMT Web Server Certificates from a subordinate certificate authority, you should still use the certificate from the Root Certificate Authority the SubCA is chained up to.
Export a copy of the Root CA
1) To export of a copy of the Root CA Certificate, you can open your local certificate store, select "Trusted Root Certificate" -> "Certificate" and search for the proper Root CA Certificate. If you do not have the Root CA certificate in your trusted root store, your CA Administrator can obtain a copy for you from the CA by selecting the "Properties" of the Certificate Authority and selecting "View Certificate".
2) Once you have the certificate open, select the "Detail" tab and then select "Copy to File".
3) When the "Certificate Export Wizard" appears, click "Next".
4) Select "DER encoded binary X.509(.CER)" and click "Next".
5) Select a location to export the certificate to and then click "Next".
6) On the "Complete the Certificate Export Wizard", click 'Finish".
Trusting your Root Certificate Authority in Manageability Commander
Now that you have a copy of the Root CA certificate, you are able to configure Manageability Commander so that it can manage a vPro client provisioned by SCCM.
1) If you have not already done so, you can download a copy of the Manageability Tool Kit from the following location: http://software.intel.com/en-us/articles/download-the-latest-version-of-manageability-developer-tool-kit/. Follow the onscreen instructions on how to install it.
2) Once Manageability Tool Kit is install and Manageability Commander is open, select "File" -> "Certificate Manager".
3) In the "Certificate Manager" window, ensure you delete all other existing certificates by highlighting them and clicking the "Delete" button. After which, select "Import".
4) Browse for the Root Certificate Authority Certificate you exported (which is the Root CA Certificate that is chained up from your AMT Web Server certificates) and click "Open".
5) Back in the "Certificate Manager" window, click the "Refresh Displayed Certificates" button. You should now see your CA in the "Trusted Root Certificates" list. Click "Close" to exit the Certificate Manager window.
Adding a Client to Manageability Commander
Once the Root CA certificate has been trusted, you can now add the client (that is provisioned by SCCM) you want to manage via Manageability Commander.
1) To add the vPro client, select "File" -> "Add" -> "Add Intel® AMT Computer".
2) When the "Add Intel® AMT Computer" window appears, enter in the full qualified domain name (FQDN) of the client you want to manage. If you want Manageability Commander to use Kerberos authentication of the local user logged, leave the Username and Password blank. If you want to specify a different Kerberos user then the local logged on user, enter in the desired Kerberos user as domain\user and the appropriate password. Click "OK" to close the "Add Intel® AMT Computer" window.
3) Once you have added the vPro client, you should see it in the list of clients to manage. Right click on the client, and select "Connect".
4) Once connected, you can invoke any of the vPro / AMT use cases that the Manageability Commander Tool supports on the client provisioned and also managed by SCCM.
Debugging Connection
If you are having connection issue, you can perform some general troubleshoot by viewing the debug information.
1) To view the debug information, select "Help" -> "Show Debug Information..."
2) Once the "Manageability stack" window opens, you can see additional detail of any issues encountered.
A recent discovery (thank you Frank) of Intel Proset that may impact your ability to wireless manage your vPro systems. While I realize this may impact a very small group of folks I still believe it's valueable to post out. Here's the issue if you have users log out of their notebook system and leave it powered on windows, while utilizing Intel Proset you may loose control of the machine for vPro management.
Need to be sure this box is checked. It's part of the properties for the wireless profile. Note, Microsoft Zero Configuration has this set by default. Hopefully this helps if you run into this problem.
If- you have any questions about Intel® IT Director, we have a new demontration that illustrates how IT Director works! To view the demo visit: www.intel.com/go/itdirector
Please feel free to start a discussion if you have any questions regarding Intel IT Director!
Take a minute to provide quick feedback on your experience with Intel vPro and this website
A poll to the community has been added to the vPro Expert Center main page (see widget on left side) - http://communities.intel.com/community/vproexpert
...along with a separate poll on the activation page (Again, see widget on left side) - http://communities.intel.com/community/vproexpert/activation
If you have ideas or suggestions for future polls - add a comment.
Look forward to seeing responses from the community
The new generation of notebook PCs with Intel vPro technology includes Intel Anti-Theft Technology PC Protection (Intel AT-p). Intel AT-p offers you the option of activating hardware-based client-side intelligence to secure the PC and data if a notebook is lost or stolen. Because the technology is built into PC hardware, it provides local, tamper-resistant defense that works even if the OS is re-imaged, a new hard-drive is installed, or the notebook is not connected to the network.
For a good introduction of the Intel® AT-p Technology please visit - http://communities.intel.com/community/openportit/vproexpert/blog/2008/12/04/anti-theft-technology-has-arrived
In the following we describe an example of how this technology is deployed and used in the life of a typical employee working for a security conscious company. Consider a user Jane who is a new employee of a company called SecureBank. SecureBank wants all its employees laptops to be protected against theft and is therefore utilizing the Intel® vPro Anti-Theft Technology for Asset Protection (AT-p) with Absolute ISV.
In particular Jane has two (rather adventurous) days –
- Day 1: IT admin receives a new laptop and sets it up for Jane. Jane uses the new laptop for the day when she receives her new laptop and manages to loose it to a thief!
- Day 2: the thief is unable to use the laptop due to the poison pill sent as a feature of the AT-p technology. The thief therefore gives up on it and leaves it in a coffee shop. The laptop is subsequently recovered by SecureBank, made functional again and is ready to be handed over to Jane.
Below are the details –
(Check out the video uploaded at youtube –
Day 1:
(1) Initial Setup by IT Admin:
The IT admin receives a new laptop and creates the SecureBank IT image on the laptop. This includes the Absolute agent which would be used for AT-p. The Absolute Client Windows Installer is a part of the IT image. The two key steps are undertaken -
- Enrollment: The IT admin runs the Absolute Client Windows Installer which installs the Absolute agent on the client. As part of the installation this client is enrolled with the Absolute server. Enrollment consists of the following steps –
1. The Absolute Agent checks the local platform to ensure that the platform is eligible for Intel® AT-p.
2. The Agent requests permission of activate AT-p with the ISV Server i.e. the Absolute Server.
3. The ISV Server takes this unique client request and sends it (along with a license key) to the Intel permit signing server.
4. Once the Intel signing server has validated this request, an AT-p permit is generated for that unique client. The client system is now ready to validate signed messages from the ISV server.
Once the machine is enrolled it shows up on the administrator console. The machine is identified using a unique identifier generated by the Absolute server, Detected Full Computer Name and Detected Serial Number. At this point a default policy for the client machine is also applied.
- Policy Setup: The IT admin can also fine tune the policy for Jane. Examples of Attributes he can set include:
Policy Attribute
Example Value
AT-p Timer Value
48 hours
The machine's disablement timer (time after which the machine is disabled if it does not connect with the server) is 48 hours.
AT-p Timer Action
Immediate Lock
The action a machine performs once the AT-p Timer has expired. In this case, the machine will shut down immediately (even if OS was up and running) and not allow the boot process to be carried out.
AT-p Theft Action
The action a machine performs once the machine is marked stolen when connecting with the server. In this case, the machine will shut down immediately, same as above.
AT-p Password
Admin Password used to recover the machine when it is disabled or locked.
Marks whether AT-p is currently active or not on a machine. When it has a legitimate working user then it is marked as active.
Theft Status
Marks whether the machine is stolen or secure. In this case, the machine is not stolen.
Once the IT admin has set the above policy he is ready to hand over the laptop to Jane.
(2) Normal Usage:
On receiving her new Laptop, Jane logs in with her domain credentials and uses it seamlessly (as if there were no AT-p). The rendezvous may occur without any active participation of Jane. As such the rendezvous happens in the background and is transparent to Jane.
- Rendezvous (Machine Not Stolen)The Absolute solution has a rendezvous timer of 24.5 hours. After this time the following steps would occur –
1. As the Rendezvous Timer (24.5 hours) expires the ISV Client Agent initializes a rendezvous.
2. The ISV Server's response is relayed to the Intel Management Engine (in the firmware) through the ISV Client Agent. Any new settings are relayed.
3. Acknowledgments are generated for any message received.
4. Once finished, the Disablement Timer (or AT-p Timer) reset message is sent to the Intel Management Engine.
(3) Theft:
After a good first day of work, Jane's colleagues take her out for a dinner. She leaves her laptop in the car and heads to the restaurant. To Jane's bad luck her car is broken into and the notorious thief steals her laptop.
- Malicious Usage: The thief has a hacking tool that allows bypassing the windows login/password challenge and can use the laptop. He feels he can make a good fortune by selling this laptop in the black-market.
- Theft Reporting: When Jane returns to the car, she is shocked to see her car broken into and her laptop stolen. She immediately calls the IT admin helpdesk and reports the theft. The IT admin sets the Theft Status to Stolen. Next time the laptop checks in with the Absolute server, the Theft Action, which is Immediate Lock, will take place.
Day 2:
(4) Poison Pill:
The attacker logs in again using his hacking tool. Since it is past 24.5 hours (i.e. the rendezvous timer has expired) the agent initiates a rendezvous. At this time the following steps happen -
- Rendezvous (Machine Stolen)
As the action is to immediately lock, the thief to his surprise observes that the machine just shuts down. When he tries to power on the machine he sees a pre-boot authentication screen which requests him to insert admin credentials. The thief's hacker tools are not able to bypass this screen as the same OS (which is potentially more vulnerable) as the pre-boot environment serves as an extension of the boot firmware and guarantees a secure, tamper-proof environment external to the operating system as a trusted authentication layer. Brute force attacks in this environment are also much harder as the tamperproof firmware reboots the machine after a threshold time or number of attempts to login has expired.
To the thief's dismay, he cannot really use the laptop and leaves it in the coffee shop where he logged in from.
(5) Asset Recovery:
The IT admin of SecureBank was able to get the IP of the location where the thief last logged in from and contacts the coffee shop. SecureBank officials pick up the laptop and bring it back to the IT admin desk for recovery. To recover the platform the IT admin carries out the following steps –
Once this is done, the IT admin is ready to return this machine back to Jane without loosing any time. Thus we can see that AT-p solution not only provides a way to secure machines against theft and continued malicious use, but also ensures efficient recovery and continued use of the recovered machine!
While at Fall IDF 2008, we asked industry analysts and Intel partners what superhero they would call Intel Anti-Theft Technology. Watch and listen to their responses below.
Last month, Intel introduced Intel® Anti-Theft Technology with support from Lenovo and Absolute Software.
There are various use models that this new technology enables, such as:
Watch the following Intel Anti-Theft Technology demo with Intel executives Dadi Perlmutter and Pat Gelsinger from Fall IDF 2008 and learn more about how this new technology helps with theft deterrance.
For a more in-depth demonstration of Intel Anti-Theft Technology with Absolute Software, watch the following video:
Listen to industry analysts discuss benefits of Intel Anti-Theft Technology and why this technology is an important milestone that will help with notebook PC theft deterrence in the future.
Listen to a Lenovo executive discuss the benefits that Intel Anti-Theft Technology will bring to Lenovo based notebook PCs.
Listen to Absolute executives discuss how they are taking advantage of Intel Anti-Theft Technology in their software and services.
Last, listen to Intel's Anand Pashupathy, George Thangadurai and Duncan Glendinning comment on the benefits of the new technology.
Another Add, here's Josh Hilliker talking about Anti-Theft Technology @ the beach.
I'm sure we've all either experienced or had a close encounter with a notebook nightmare (which is when you lose a laptop with some very valuable data on it). Well, with the release of Intel Anti-Theft Technology (go to the Intel vPro expert center to learn more about this new technology) - Intel wants to help consumers and professionals not have to worry about that data seeing the light of day in the wrong hands.
To see how notebook nightmares in the future may change, see the videos below:
In the taxi
At the cafe
In the hotel lobby
My final video with Jake (a bit overdue), here we sit down and Jake shows me how the team automates their console build out for rapid testing of each platform. This capabilty was just installed in my lab right before the holiday's and I'm fired up to use it when I return to the plant.
The key here is that automation is very critical for us to test without spending hours/days building an infrastructure on the fly to test a certain configuration. Who wouldn't want an automated console build out WEB UI, that just works when you need it.
Prior to vacation I was asked to show how to manage a vPro via an iPhone. Here it is..
At Fall IDF 2008, we had a chance to talk to industry analysts, Intel partners, and Intel engineers and they commented on whether Intel is a security company. Watch their responses below.
When designing a vPro deployment strategy it is important to understand the implications of your decisions on your ability to scale your vPro deployment beyond one management application. Here are a few of the basic principles that are important in these decisions:
· Reduce the number of client dependencies by updating your vPro firmware and vPro drivers
· Choose one application and method for initial setup and configuration
· Determine which application is going to manage which aspect of vPro feature configuration
· Use Kerberos authentication
· Understand how to share TLS across applications
The details behind these principles are described below.
Intel vPro is a suite of individual technologies. The term vPro means manageability, security and power efficiency among other things. Depending on your companies needs you may desire to take advantage of some or all of the individual features of a given vPro system. Similar to the rest of your infrastructure the ways that you interact with vPro may be different depending on the use case. For example, you may find yourself with a software deployment console that needs to use vPro for waking up machines that are powered off and security software that uses vPro to manage a System Defense firewall. Both pieces of software would need access to vPro functionality and need to cooperate together to provide a full set of vPro functionality. As an analogy, it would be uncommon for a given IT department to only have one tool that manages Windows clients. They would more likely use a combination of tools such as MMC snap-ins, Remote Desktop, Group Policy Objects, 3rd party consoles, etc.
This article attempts to speak to vPro ISV interoperability and outline the path to success in sharing access to vPro across ISVs. Understanding the interoperability decisions relating to vPro will ensure that your vPro deployment is scalable beyond your initial usage of vPro. Also, as vPro progresses as a product the list of features that the vPro suite contains will expand. It will become increasingly difficult to use one tool to get all of the functionality out of vPro.
The basic concepts that make for an interoperable vPro deployment are the following:
· vPro Lifecycle – How the vPro lifecycle impacts interoperability
o Separation of Duties – Determining which features of vPro are managed by which ISV
· Authentication – Understanding how authentication decisions impact interoperability
· Encryption – Figuring out how to share encryption keys used to protect communication transport
There are several aspects to the vPro lifecycle that impact interoperability ranging vPro firmware/software versions to turning on vPro to managing the feature. Putting together a plan to manage each aspect of the lifecycle can help make for an easier path to interoperability.
When you obtain a new machine it is important to check with the OEM to ensure that your machine has the latest firmware and vPro drivers. The reason this is so important is because it will help to make your interoperability matrix as small as possible. As a general rule, there has historically been a new major version of firmware and drivers for each new platform year. Beyond each year's release, there are also updates that fix issues or back-port features for consistency and forward compatibility. Maintaining each of your machines firmware and driver versions will decrease the number of different vPro configurations you have in your environment and make management through consoles easier and more consistent.
vPro firmware and drivers are typically available on the OEMs support/download section of their site. The firmware is usually coupled with the BIOS firmware and available through a BIOS update. The drivers include the HECI (low level driver) and LMS (higher level service) as well as other components that help complete the vPro use cases.
The enablement of vPro on a given machine is often referred to as 'vPro provisioning'. The term provisioning can be broken into two parts – initial setup and initial configuration. Since it is important to differentiate these two parts of provisioning for this conversation, the term Initial setup and configuration will be used to describe these two sub-processes of provisioning.
Initial setup at a high level is the initial trust establishment that allows the machine to know that you are authorized to turn on the vPro features. This can be done through a number of methods including through MEBx, USB Key One-Touch, and Remote Configuration. This initial configuration step is typically completed using ISV software assistance. For example the ISV software might create the USB key utilized through the One-Touch configuration or act as the coordination point for remote configuration. The initial setup phase is broken down into a smaller subset of steps all utilized to establish trust for the subsequent configuration phases. These steps include (but are not necessarily limited to) the following:
· Setting the remote administrator password
· Synchronizing the clock (important for the Kerberos authentication protocol)
· Configuring TLS mode
Once initial setup is completed, the initial configuration can be applied to the machine. This initial profile should include the minimal necessary information in order to manage the system from there on out. Some primary examples of what is included in initial configuration are the network/wireless settings as well as authentication configuration (discussed in a later section). The basic idea is to then allow multiple ISVs to utilize this information (network access and credentials) in order to configure the different features of vPro that they care about. Here are a few examples of configuration that is set during initial configuration:
· Wireless profiles
· Additional digest users or Kerberos ACLs
· Enablement of the web administrative interface
This initial setup and configuration should be managed by one source. Having a consistent way of enabling vPro and setting the initial configuration network and authentication credentials is critical to achieving ISV interoperability. That way there is one consistent way to access the machines after the initial configuration is done.
To be clear, this initial setup and configuration should not be confused with subsequent usage of vPro. Policies and settings such as System Defense Filters, Agent Presence, Third Party Data Storage (3PDS), etc are all examples of things that are outside of the scope of initial setup and configuration and therefore can be managed easily outside this single setup and configuration source. The only requirement being that the software configuring these usages should be configured to use the authentication credentials / encryption mechanisms that were established via initial setup and configuration. This concept and examples on how this is achieved is discussed throughout this post.
If for some reason the method of initial configuration needs to change midway through deployment, you may need to either migrate the data that was set through initial configuration using a tool such as the SCS to SCCM migration tool or as a last resort go back through the initial setup and configuration process again using the new console. Instructions on how to do this can be found here.
When multiple vPro enabled software applications are used to manage the same client it is important to clearly delineate between the roles of the two applications. This delineation might be decided for you based on the functionality of the software and the indented usage of vPro, however there may be overlap between two software offerings. In that case, IT policy should take over.
The basic idea behind determining a clean separation of duties for vPro enabled applications is to figure out which applications will manage which parts of vPro. An easy way to think about this is based on the origination of the data. Here are some examples:
· Security software the manages the System Defense filters
· Auditing software that maintains the audit logs and event logs
· Management software that manages Client Initiated Remote Access (CIRA) settings
There also might be examples where multiple software applications might utilize the same features of vPro at different times. For example most or all of them might utilize the following:
· Remote power control capabilities
· Asset inventory
The ability for these software applications to manage the features of vPro that they are responsible for and share the usage of the other features is made possible by setting up the proper authentication/authorization and encryption policies.
Authentication is the act of proving you are who you say you are. It is important to understand the different ways that you can authenticate to vPro and the role that the IT infrastructure can play in this proof of identity. This not only applies to individuals but service accounts as well. vPro supports both HTTP Digest Authentication as well as Active Directory Kerberos Authentication. Here is a brief description of both:
Digest authentication is a simple passing of a username and password through the digest protocol. It is considered to be reasonably secure when coupled with SSL and easy to setup since all you have to do is create a username and password in order to establish a trust between two endpoints. The drawback to digest authentication lies in scalability and interoperability.
When using vPro with digest authentication, it is recommended for security reasons that the console creates a unique password for each vPro system so that if one password is compromised, then all machines are not compromised. This creates a difficult interoperability problem. This means that the console that is responsible for initial configuration (and therefore creates the initial digest password) will need to store all of the unique passwords in their data store. If another ISV wants to then subsequently gain access to that vPro system they need to either gain access to that data store to get the passwords or have the initial configuration console create a new account with new passwords on each machine for that application. Since there is no standard interface for this console to console communication and sharing of usernames and passwords and because this large number of accounts can quickly become difficult to manage, it is strongly recommended to use Kerberos if interoperability is a goal of your deployment.
If digest must be used and interoperability between vPro enabled software is desired, it might be a worthwhile exercise to investigate your needs for interoperability vs. the risk of security exposure by making the digest password the same across all managed vPro clients. Making the digest password the same across machines would allow all software access to all machines without having to share machine specific credentials. Again, Kerberos gives you these same benefits without the same exposures. The primary reason is that the Kerberos account is centrally controlled. If compromised, the password can be changed once centrally to mitigate the exposure without having to connect to each remote machine to change it. Also since the account is managed centrally with Kerberos, it is easier to create vPro software specific service accounts that only have access to a smaller number of vPro features. Doing this with Digest could result in an unreasonably large number of usernames and passwords that would be difficult to manage per machine.
Kerberos is an authentication protocol that allows someone to gain access to network based resources based on that initial authentication by trusting the central source that originally authorized that user. The Kerberos protocol is a bit more complicated than digest; however it has the advantage of providing a secure answer for scalability and interoperability. If you have Active Directory deployed in your company, you have the infrastructure you need to support Kerberos authentication.
Kerberos works by sending the username and password securely to a central authentication server. The authentication server then authorizes them to gain access to other network resources that trust that same authentication server. This means that the username and password only needs to be stored once on that authentication server and because the authentication server is trusted by the environment it provides one place for central management of those credentials.
Microsoft centered their Active Directory solution around Kerberos in order to simplify account management and allow for interoperability between different resources based on a single authentication. For these same reasons and based on the fact that vPro seamlessly integrates with Active Directory, Kerberos is a far better choice for vPro authentication in the context of interoperability, scalability and manageability.
Again, here are some of the reasons that centrally managed Active Directory Kerberos accounts are superior to Digest for interoperability:
· Reduces the number of individual usernames and passwords to manage/share
· Better security since control is centralized
· Account management such as changing passwords can be done once rather than once per machine
Once a user or service is authenticated using either digest or Kerberos authentication the user then needs to be mapped to a set of allowed actions. In vPro this association between a user and the actions they are authorized to perform is controlled through Realms. vPro Realms are predefined groupings of control that can give one user or service access to a given feature of vPro and another user access to another feature isolating the ability for each to control the other. Here are some examples:
· Users that need administrative access to the entire set of vPro features should be assigned to the PTAdministrationRealm
· Software that needs access to manage System Defense should be assigned to the CircuitBreakerRealm
· Software that needs to wake up or shut down a machine should be part of the RemoteControlRealm
It is common that the software managing these realm assignments abstracts the names or even blurs lines between the realms. There are even software applications that completely abstract the realm assignment by inserting the authorization logic into their application. Regardless of how the software chooses to utilize these realm assignments it is important to understand the realm assignments and how they impact your plans to allow for interoperability. As you are doing this ensure that you are assigning the least privilege necessary to get the job done, which will not only help to isolate your applications, but ensure a more secure deployment.
vPro supports SSL and TLS in order to protect the information passing between the vPro enabled software application and the vPro client. This is an optional component of the vPro configuration but is strongly suggested for security reasons. Some of the vPro enabled software consoles extract the complexity of configuring encrypted communication and enable it by default. If there is an expectation that multiple vPro enabled software applications should be able to communicate securely to vPro clients, then there needs to be a strategy for trusting the CA used to secure that connection.
The encryption technology vPro uses is the same that is used to protect you when you are going to your banks website to check your account balance. The way it works is through a public/private key pair where the vPro client is similar to the banks web server containing the private key and the vPro enabled software application or web browser used to manage vPro needs the public certificate. vPro only supports storing one private key used to establish secure communication so similar to other features of vPro you will need to choose which console will manage the lifecycle of that certificate. It would typically make sense that this is the same console that owns the initial setup and configuration. Once you have made this decision, the other consoles need to utilize that same key pair to communicate securely with the vPro clients.
The high level process used to share this key pair includes exporting the public key from the console that originally configured encryption and importing it into the other vPro enabled software applications certificate store. This isn't as hard as it sounds. For example, here are the steps to export the Root CA certificate that is used with SCS. This process only needs to be done once per server that needs to manage vPro.
To export the certificate and save it as a file:
Note: There are several methods of exporting a certificate. This section describes one method.
1. Click the Windows Start button > Programs > Administrative Tools > Certification Authority.
2. Right-click on the first sub-branch. A popup menu is displayed.
3. Click Properties and click the General tab.
4. Select the certificate and click View Certificate.
5. Click the Details tab and click Copy to file.
6. Follow the steps in the Wizard: Select an export format (any of the options is acceptable), name the certificate file, and save it in a known location. A message indicates that the export was successful. Click OK. The Details tab returns to focus.
7. Click OK > OK. The Certification Authority Management Console returns to focus.
To install the CA certificate in the certificate store as a trusted root certificate:
Note: This step is not required if the CA is installed on the local platform.
1. Find the certificate. If it was exported directly to another computer, find it on the other computer. If it was exported to a USB key, move it from the USB key to the computer.
2. Right-click on the certificate and from the popup menu and select Install Certificate. The welcome screen of the Certificate Import Wizard is displayed. Click Next.
3. Select Place all certificates in the following store and click Browse. The Select Certificate Store window opens.
4. Select Trusted Root Certification Authorities and click OK.
5. Click Next > Finish. A message indicates that the import was successful. Click OK.
With proper planning vPro configuration can easily be managed by several vPro enabled applications. Having an understanding of the separation of duties for those applications and the authentication/encryption technology vPro uses can make for a vPro deployment that scales beyond one ISV.
Here is a simple video that demostrates how SCCM and Altiris can interoperate together to manage vPro Out of Band functionality.
Craig Owen & Matt Royer


text:
Didn't even know this **** had started... and Hogg's not even playing.
Didn't even know this **** had started... and Hogg's not even playing.
Dream XI: M Hyder, J Linker, M Clock, S Wetsin, A Simms, A Golcrhist, B Hugg, S Worde, B Leap, J Giuseppe, G MacGrith
Top thread.
I know a place where a royal flush
Can never beat a pair
"The requested not to be named" strikes again.
Last edited by Richard; 18-09-2007 at 04:24 PM. Reason: Name edited out on request
Appreciating cricket's greatest legend ever - HD Bird...............Funniest post (intentionally) ever.....Runner-up.....Third.....Fourth
(Accidental) founder of Twenty20 Is Boring Society. Click and post to sign-up.RIP Fardin Qayyumi (AKA "cricket player"; "Bob"), 1/11/1990-15/4/2006
Shocker of a thread.
The one, the only CW Black
Code:47.3 W Coppinger to Heads Smacked the ball straight into the groin of Iwuajoku who has fallen over, miraculously with the ball still caught in his scrotal area! Out!
There are currently 1 users browsing this thread. (0 members and 1 guests)

subset: commoncrawl


text:
There are no guaranteed connecting rooms. No matter what you were told, it's a request, not a guarantee. I don't know if putting in another request for a king bed will be a problem for the connecting rooms. If the connecting rooms is most important I'd just go with that.
What is the problem with the walk from LM to Animation Hall or the bus stops...it's 5 mins max!! I read all of the complaints about the long walk from 90's at POP to the food court - we always ask for 90's..it's a short walk. No offence intended, but I sometimes think you US guys have forgotten what your legs are for. And before I get flamed, I understand that guests with small children or disabilities may need to be closer, but c'mon guys, you can walk around the parks all day so what's the problem with a little walk at your resort!!!
People can flame me too, because I agree with you completely. Although, there may be an upside to this; it might make it easier for me to book our room for next April if people aren't staying in the LM area because of the walk.
I hope you don't think my response to Eliza32's post was inappropriate or rude towards you. I just meant it towards able-bodied guests. I know that she did too, and I hate how things can get misconstrued on the internet .
That's my thought as well. Last year we stayed in the 70s facing the lake at Pop, so not quite as long a walk as the 90s but still a nice stroll. I really noticed it seemed like about 15 miles in the evenings when we would get back to the resort, walk to our room, walk BACK to Classic Hall to fill our mugs, walk back to the room...all on sore tired blistered feet. By the way, get some ice and fill your tub with cold ice water, and sit on the edge and soak your feet. I did that many times and it helped so much when my feet were sore. Hopefully I'll be 40 pounds lighter our next trip and that will help too...
I am curious in the distance as well. We are looking to book next year. We will do POFQ, but our daughter wants the LM room so we will probably do a couple of days there. I am curioius for the distance as my husband has a medical condition so while he would do it, I would prefer to keep the extra distance to a minimum.
LOL - sounds like me talking to my 11-yr-old DD! I always tell her it's a great thing to be able to just get up and walk to everywhere you need to go. When we stayed at CSR last year, I read post after post about that VERY LONG DISTANCES between the various buildings and the main building (El Centro?). We stayed at the very back of the resort (back edge of Ranchos one step away from the parking lots) and it was still only a few minutes to walk to El Centro.
I have not stayed in the Little Mermaid rooms at Art of Animation, but I have been there. I really enjoyed my visit and all of AOA did scream Disney! I think AOA will please alot of children and Disney fans. The Little Mermaid section is far from the food court & lobby & bus stop. For me personally & if I could afford it, I would rather have a suite near the lobby and food court area just for the convenience & time of running back and forth with children for the arcade, food, buses, refills in my Disney cup etc ! But if I could not afford a suite and I had to choose a room in the Little Mermaid Section I think it would be worth it and would just go prepared to not to be close to lobby! If not on the dining plan I would not purchase the cup and spend at least 20 minutes of time running from my room to food court & back again just for a refill! I would plan on keeping water, drinks, small coffee maker, snacks, breakfast items etc.,in my room to cut down on trips made! So...I think it just depends on how much a family or individual, is going to enjoy all the animation, enough to stay at Little Mermaid section vs the convenience of a room at another resort, and using the food court & arcade close to their room for a cheaper price than a suite. Do you have a car? You could drive to the lobby! If you cannot afford a suite or a car then Disney has not left you with any choice but a standard room in the Little Mermaid section and to walk! At other resorts I have stayed in standard rooms and preferred rooms, and even camped at Fort Wilderness(alot of walking there.) I don't think one really made that much difference over the other in my vacation and had a great time every time. You just plan a little more differently.
Stayed there in Dec and booked it for two nights in May. Yes, it's a bit further from the main bldg than other bldgs. But, it's only about 5-6 mins, depending on walking pace. There is a lot to look at along the way as well. I loved walking through the Lion King section...so very cool!!!
I stayed in the Little Mermaid section in October. From looking at the map and from driving from the lobby over to the buildings, it did seem like it was a long way from the main building. But, then I walked it the first time, and it really wasn't that far at all. Just a few minute walk. Definitely not worth stressing over.
I was going to say this exact same thing! We stayed here for Marathon weekend last month in an LM room. We have a 1 year old (stroller) and a 5 year old. One of my 5Y/O DS's favorite things to do was play in the Lion King area on the way to and from our room. There was so much to see that we didn't notice the distance from Animation Hall to the LM buildings.
Its good to hear some positive input about it because it is such a pretty new resort! One year I stressed out about staying in a standard room (and I'm used to walking at Fort Wilderness for goodness sakes)at another resort and we ended up loving it! We were close to our car and their wasn't many people at the smaller pool!
I asked because walking in the parks is a challenge and even seriously injured me one year. I was a little nervous about adding a long hike to the room.
Although we didn't stay at AoA, we stayed at Pop and actually walked over there a couple of times to have lunch and check out the resort. We walked through all the areas, and then returned to Pop via the bridge. I didn't think the walk was long at all. The grounds are lovely and there is so much to look at.


text:
LSO St Luke's
Storytelling concert for under-5s
Suitable for under-5s
John Webb and LSO musicians re-tell a popular children's story through music, offering younger children the chance to experience live music in the beautiful Jerwood Hall. Dance and sing your way through the concert as we hear the instruments bring the story to life.
Tickets: £3 per person (babies under 12 months free, no ticket required)
To book please call the Barbican Box Office on 020 7638 8891
£0.70 telephone booking fee per transaction - click here for more information on booking fees


text:
Chateau Mouton Rothschild 1995
Bordeaux Red Blends from Pauillac, Bordeaux, France
Winemaker's Notes
The wine has a fine, deep red colour with a slightly brickish tint and a subtle nose, a lovely marriage of jammy fruit, black cherry, some toasty, roasted notes and a pleasant touch of mint that brings freshness and refinement. Seductive on the palate, it has compact, well-balanced tannins in a nicely rounded structure enhanced by rich and complex flavours of blackcurrant liqueur, with powerful mineral notes. The finish is full and dense, long, stylish and generous, entirely typical of the vintage.
Critical Acclaim
The Wine Advocate - "Bottled in June, 1997, this profound Mouton is more accessible than the more muscular 1996. A blend of 72% Cabernet Sauvignon, 9% Cabernet Franc, and 19% Merlot, it reveals an opaque purple color, and reluctant aromas of cassis, truffles, coffee, licorice, and spice. In the mouth, the wine is "great stuff," with superb density, a full-bodied personality, rich mid-palate, and a layered, profound finish that lasts for 40+ seconds. There is outstanding purity and high tannin, but my instincts suggest this wine is lower in acidity and slightly fleshier than the brawnier, bigger 1996. Both are great efforts from Mouton-Rothschild. Anticipated maturity: 2004-2030." -
International Wine Cellar - "Very dark, fully saturated ruby to the rim. Deep, brooding, rich aromas of blackberry, violet, milk chocolate, black pepper, cedar and incense; sexy and captivating. Bright and focused on entry, then rich, very smooth and suave, with highly concentrated flavors of red berries, dark plum, cedar and graphite. The extremely long, juicy finish features lively acids, great balance and persistent notes of underbrush and minerals. The mounting tannins coat the palate dry and are still years away from resolving fully. Harvested from September 12 through 27, which suggests that the merlot was probably very ripe." -
Wine Spectator - "Aromas of ripe fruit and grilled meat follow through to a full-bodied palate, with velvety tannins and a long caressing finish. Very beautiful wine. Mouton shows finesse yet richness in this vintage." - View All
Chateau Mouton Rothschild Winery
Château Mouton Rothschild, a Premier Cru Classé from the Bordeaux region and one of the world's greatest wines, is owned by Baroness Philippine de Rothschild. The estate includes 205 acres of vines at Pauillac planted with Cabernet Sauvignon (77%), Merlot (11%), Cabernet Franc (10%) and Petit Verdot (2%). In 1853, Baron Nathaniel de Rothschild bought Château Brane-Mouton. In 1922, his great-grandson Baron Philippe de Rothschild (1902-1988) decided to take the future of the estate into his own hands. His 65 years at Mouton bear witness to the strength of his personality, his spirit of enterprise and his sense of innovation.
In 1922, he was the first to introduce château bottling. In 1926, he built the famous Grand Chai, the majestic 100-meter first year cellar, which has become a major attraction for visitors to Mouton. 1945 marked the start of a fascinating collection of works of art, created every year for the Mouton label by famous painters. In 1973, after a twenty-year battle, Baron Philippe obtained a revision of the 1855 classification and Mouton was officially recognized as a First Growth.
In 1988, Baroness Philippine de Rothschild succeeded her father Baron Philippe. She has become the guarantor of the quality of an illustrious wine whose motto proudly proclaims, "First I am, second I was, I Mouton do not change." View all Chateau Mouton Rothschild Wines
About Pauillac
View a map of Pauillac wineries (pouy-YACK) The Big ThreeHome to three premier cru (first growth) chateaux, Pauillac is a leader in quality Bordeaux. Chateaux Latour, Lafite Rothschild and Mouton Rothschild are situated within the Pauillac appellation. Sandwiched between St.-Estèphe and St.-Julien, Pauillac wines are big - known for their combination of elegance and power.
Notable Facts
The gravel-based soils of Pauillac are key in creating the structured wines produced there. Like most of Bordeaux's left bank, Cabernet Sauvignon is the leading grape. Some typical descriptions of wine from Pauillac include: concentrated, full-bodied, powerful, firm tannins, ability to mature. Not all of the Pauillac wines are top price collectibles that you can only find at auctions. There are great values in the lower level crus, like the fifth growth, Chateau Lynch-Bages, as well as great Cru Bourgeois such as Chateau Pibran. These wines are more affordable and often mature a bit sooner.About France - Other regions
When it comes to wine, France is a classic. Classic blends, grapes and styles began in the country and they still remain. Think about it - people ask for a Burgundian style Pinot Noir, they refer to wines as Bordeaux or Rhone blends - Champagne even had to pass a law to stop international wineries from putting their region on the label of all sparkling wine.The top regions of France are: Bordeaux, Burgundy, Champagne, Languedoc-Roussillon, Loire, Rhone. And these regions are so diverse! It makes sense that wine regions throughout the world try to emulate their style. Pinot Noir, Chardonnay, Cabernet Sauvignon and Syrah are no longer French varieties, but international varieties. They may not be the leader of cutting edge technology or value-priced wines, but there is no doubt that they are still producing wines of great quality and diversity.
Customer Reviews
Sign In to Add Your Review0 }div>Related ProductsAlcohol By Volume Guide
Most wine ranges from 10-16% alcohol by volume. Some varietals tend to have higher (for example Zinfandel and Cabernet Sauvignon) or lower alcohol levels (Pinot Noir and many white varietals), but there is always some variation from producer to producer. Some wine falls outside of this range, for instance Port weighs in closer to 20%, while Muscat and Riesling are usually a bit below 10%.Wine Style Guide
Light & Fruity
- Red wines that are more fruit-forward and lighter in tannin and body.
Smooth & Supple
- Medium bodied reds that go down easy, with smooth tannins and supple fruit.
Earthy & Spicy
- Wines where earthy and/or spicy dominate the flavors – typically medium to full body.
Big & Bold
- Full bodied wines that have concentrated fruit and are higher in alcohol and/or tannins. Some need age.


text:
Youth Fest
Sanghol (Bassi Pathana), October 15 Dr Gurmohan Singh Walia, directorate education, SGPC, was the chief guest in the morning session. He motivated students for hard work and said in the era of competition, the overall development matters. In the evening session, The Rt Hon The Lord Diljit Rana, Member, British Parliament, The House of Lords, Honorary Counsel of India to North Ireland, chairman, Rana Charitable Trust, UK, was the chief guest on the prize distribution ceremony. In giddha and bhangra, Cordia College, Sanghol, won trophies; in mime, Mata Gujri College, Fatehgarh Sahib; in skit, BZSFS Khalsa Girls College, Morinda; in mimicry, Desh Bhagat Institute of Management and Computer Science, Mandi Gobindgarh; in one-act play, Baba Zorawar Singh Fateh Singh Khalsa Girls College, Morinda; in collage making, Guru Hargobind Sahib Khalsa College for Women, Hansali Khera; in poster making, Patel Memorial National College, Rajpura; in cartooning, Chandigarh College of Education, Landran; in group shabad/bhajan, Mata Gujri College, Fatehgarh Sahib; in classical vocal, Mata Gujri College, Fatehgarh Sahib; in classical instrumental (percussion), Patel Memorial College, Rajpura; in classical instrumental (non-percussion), Mata Gujri College, Fatehgarh Sahib; in classical dance, Patel Memorial College, Rajpura; in on-the-spot painting, Desh Bhagat College of Education, Mandi Gobindgarh; in clay modelling, Mata Gujri College, Fatehgarh Sahib, and in rangoli, Govt College, Dera Bassi, won the first position. Dr RK Sharma, director, Cordia Group of Institutions, appreciated the quality displayed by students in different categories. |
Sharodo Utsav
Ambala, October 15 The festival lasting five days is being celebrated at the Kharga Auditorium Complex at Ambala Cantonment with active participation of the community. The Pooja Committee, in its earnest to showcase the culture of India, would organise variety of cultural programmes on October 16, which would include performance by a troupe from Kolkata, magic show by a renowned magician and cultural show from the local talent of Ambala Cantonment, sources said. |
Ropar, October 15 The Ropar police said the family had recently shifted to Kharar. However, the Kharar police said no DDR or complaint of missing person was lodged with them. The water level in Sirhind canal decreased owing to one of the spillways at Ropar head water works getting destroyed and obstructing flow of water into the canal. The police is investigating the case. 2 booked for illegal storage of crackers
Ambala: The Ambala police has seized huge quantity of crackers from a godown located in Dhulkot village, near Ambala City, today. The police has registered a case under the Explosive Act against the owner of the godown and his son. The police received information that around 300 boxes of crackers were stored in a godown in Dhulkot village by a wholesale dealer of crackers. The police said the dealer did not obtain any licence from the authority concerned for storing crackers in huge quantity in residential locality. Some of the wholesale dealers of crackers have stored huge quantity of explosive crackers in various godowns located in urban areas. They have not made any arrangement of fire fighting in case of a mishap. Some of the wholesale cracker dealers are also running their shops in the most crowded areas of the city. Property dealer looted
Panchkula: Dacoits struck in Pinjore, about 10 km from here, and took away Rs 2 lakh and a gold chain from a property dealer this evening. After receiving information, the police from Pinjore and Kalka arrived on the scene. The proprietor of Kaithal Property Dealer, Chuni Lal, in his complaint to the police said five armed robbers came to his shop in a Skoda car and took away cash and jewellery from the cash box at gun point. Chuni Lal said all masked robbers were armed with pistols and other lethal weapons. He said though he could not see the faces of the accused, he was able to partially read the figures on the number plate (CH-0005). SHO, Pinjore, Dilip Kumar said they were investigating the case. He added that it could be a case of an old enmity. One booked
for cheating
MOHALI: The police has registered a case of cheating against Phase III-A-based career consultant, Eon Carriers. The case has been registered on a complaint lodged by Harp Singh, who stated that Vaibhav Raj, owner of Eon Carriers, charged Rs 11.60 lakh for admission of his daughter in a nursing college in the USA. The suspect deposited only Rs 2 lakh as fee and gave no account of the remaining money. |
Two killed, 3 injured in accident
Fatehgarh Sahib, October 15 The deceased have been identified as Jarnail Singh and Naushad Chaudhary. Others who were travelling in the car and received serious injuries were identified as Anil Bagga, Sandeep and Raj Kumar. They were going towards Delhi from Amritsar. Police officials said while Jarnail Singh died on the spot, Naushad died on way to the PGI, Chandigarh. A case in this connection has been registered against the truck driver. Family members of the victims have been informed about the incident. |
Congestion on Kalka-Parwanoo stretch
Chandigarh, October 15 It has been forwarded by the Division Bench of Chief Justice Mukul Mudgal and Justice Ajay Tewari to the Bench of Justice Rajive Bhalla, who is already hearing cases related to road safety and streamlining of traffic. The report was brought to the Division Benchs notice by Justice PK Palli, a former judge of the Rajasthan and Himachal Pradesh High Courts. Justice Palli, along with a communication on the issue, had annexed a copy of the report carried in these columns on October 10. The Division Bench, while forwarding the matter, observed that the condition of the NH-22, along with the plight of commuters and shopkeepers, had been brought to the fore. The Bench observed that the road was in bad shape due to monsoon rain. Also, the road in front of the Kali Mata Mandi was congested and long traffic jams were commonplace. These were a cause of harassment not just to commuters but also to devotees coming to pay obeisance at the historic temple. In the report, it was mentioned: Hundreds of tourists and daily commuters had to face great inconvenience on October 9 due to traffic disruption on the National Highway-22 in Kalka... Tourists and daily commuters remained stranded in the traffic jam for hours. Long queues were seen from the Housing Board in Kalka to the Kalka-Parwanoo barrier in the evening.... Due to traffic congestion, those devotees who had come to pay obeisance at the historic Kali Mata temple were a harassed lot.... Notably, yesterday a senior citizen of Kalka had lost his life, as he was hit by a truck. Last year, a girl also died when a bus hit here.... The congested NH-22 stretch and blind curve, opposite the main gate of Kali Mata temple, has caused many accidents in the recent years and needs to be widened. The deteriorated condition of the NH-22 has turned into a bad shape after the recent rain. |
Former District Health Officer booked for molestation
Panchkula, October 15 The Sector 5 police registered a case under Section 354 against Dr Garg on October 12 on the victims complaint. Repeated attempts by this reporter to elicit the views of Dr Garg and Civil Surgeon VK Bansal proved futile, as they did not answer the call. Confirming the same, SHO Om Parkash said they have registered a case on the complaint filed by Dr Chaudhary. He said they have called her again to the police station to get her statement recorded. Giving the details of the incident to The Tribune, Dr Chaudhary said that she, along with Dr Anjuman, District Programme Manager, went to room number 12 of the hospital to have tea around 1 pm. She said steno Manish also arrived in the room and they were all having tea. She said Dr Garg entered the room and instead of sitting on one of the vacant chairs, he occupied a chair beside her. She said she was stunned for a moment and did not know what to do when Dr Garg, who had been on contract as medical officer, urban slum dispensaries, allegedly patted on her shoulder. I could not react immediately as I did not know what to do. But later I realised that such actions should not be tolerated and finally lodged a complaint with Civil Surgeon VK Bansal and at the Sector 5 police station, said Dr Chaudhary. She said an inquiry committee was constituted by the hospital after the incident, which recorded the statements of six persons, including Dr Anjuman and Manish. She said instead of taking any action against the accused or preparing any report the hospital authorities forwarded the same to the police. However, the police returned the same asking for the action taken report. Neither the hospital authorities nor the police took any action against the former District Health Officer, she claimed. Some of the doctors, on the condition of anonymity, said Dr Chaudhary and Dr Garg had an old enmity and the complainant did not want him to be appointed on contract as medical officer of urban slum dispensaries. |
Ex-HCS officer hurt in assault
Chandigarh, October 15 The 70-year-old victim suffered a head injury and was taken to the Government Multi-Speciality Hospital, Sector 16, where he was administered stitches. Aroras son Rajeev Chug told the TNS that his father also suffered a fracture on the shoulder after their neighbour, Ritesh Batish, attacked him around 2 pm outside their residence. He said his father was standing outside his house when their neighbour attacked him with a brick. The brick hit the back of his fathers head and he collapsed. The accused then assaulted the victim as he lay on the floor. Hearing cries for help, Chug rushed outside and saw the accused assaulting his father. The accused also manhandled him when he tried to intervene and fled. He took his father to the hospital from where the police was reported about the incident. ASI Jagdish Chand reached the hospital and recorded the victims statement. In the evening, police station-39 SHO Janak Rana said a case of causing voluntary injuries and criminal intimidation against Ritesh Batish, a charter accountant by profession, had been registered. He was absconding and efforts were on to arrest him, the police added. |
2 vehicles stolen
Chandigarh, October 15 Amanjot Singh, a resident of Mani Majra, reported to the police alleging that his Bajaj Discover motorcycle (PB 10 BW 6974) was stolen from Sahib Singh Parking in Sector 17 on October 10. In another incident, Sarabjit Kaur, a resident of Phase V, Mohali, filed a complaint with the police alleging that her Activa Honda scooter (PB 65 C 8170) was stolen from Sector 35 on October 13. Two cases of theft have been registered at different police
stations. |
Cricket: Rohan leads Saupins into q-finals
Chandigarh, October 15 Wining the toss and deciding to bowl first turned out to be a blessing for Saupins, as fiery bowling helped wickets fall in quick succession, bundling out St Josephs team at a score of 60 runs in 15 overs. The opening batsman of St Joseph was bowled out in the fourth over with only three runs to his credit. Saupins Karaninder bagged three wickets for 14 runs and Abhi Kochhar scalped two wickets for eight runs, respectively. Karaninder was the highest wicket taker, as he scalped three wickets for 14 runs. In reply, Rohan Sodhi with his batting prowess piled up a mammoth of 24 in only 23 balls, including three boundaries. Saupins overhauled the target in just nine overs without any wicket lost and thereby winning the match in mere 9.2 overs. With this, the team sailed into the quarterfinals where they will be facing GNPS, Sector 36, on October 19 at GMSS, Sector 32. Brief scores: St Josephs School: 60 runs all out in 15 overs (Rasamjeet 9 runs in 19 balls, Waris 9 runs in 16 balls; Karaninder 3 for 14, Abhi 2 for 8). Saupins-32: 61 in 9.2 overs (Rohan 24 runs in 23 balls, Abhishek Sharma 22 runs). |
SD school pocket basketball title
Chandigarh, October 15 For SD Public School, Ravi (45), Aman (16) and Gurpinder (12) were the main scorers, while for NPS-18, Sartaj (29) and Anshuman were the main scorers. |
120 golfers to tee off today
Chandigarh, October 15 This is for the first time that Chandigarh is playing host to the national event. The national final will be held in Delhi in February next year. The tournament, sponsored by Honda Siel cars, will be played on a stable ford format with 75 per cent of the handicap being applied for scoring purposes. |
Punjab | Haryana | Jammu & Kashmir |
Himachal Pradesh | Regional Briefs |
Nation | Opinions | | Business | Sports | World | Letters | Chandigarh | Ludhiana | Delhi | | Calendar | Weather | Archive | Subscribe | Suggestion | E-mail | |


text:
Kingsport Board of Mayor and Alderman member Elmer Jantry Shupe has resigned effective immediately, according to Kingsport City Spokesman, Tim Whaley.
Shupe was charged with DUI and violation of implied consent on Friday night. The Tennessee Highway Patrol told us a trooper saw Shupe's car driving erratically and stopped him.
Mayor Dennis Phillips said in a statement that Shupe's decision to resign is the best thing for the community.
"It's just not something that he or any of us are proud of but it's one of those things that happened and the first priority here is for him to get his life back in order and, like I said, be the citizen he's capable of being," said Phillips.
Officers previously charged Shupe with DUI on June 2, 2013. He was found not-guilty for that offense.
Shupe's next court date is set for September 4th.
Mayor Phillips told us they will appoint someone to Shupe's seat within the next 30 days. He said he already has a candidate, from Colonial Heights, to bring to the board in the next few days.
Whoever is appointed to fill the vacancy, will serve until June 30, 2015. They can decide to run in the May election for a full four year term, according to Phillips.


text:
Jane Iredale Handi Brush
120 reviews
94% would repurchase
Package Quality: 4.4
Price: $$$$
Package Quality: 4.4
Price: $$$$
Not tested on animals
Age: 19-24
Skin: Combination, Medium, Not Sure
Hair: Brunette, Other, Other
Eyes: Brown
This makeup brush I have found to work good with my powder foundation as well as applying blush.
Age: 36-43
Skin: Sensitive, Fair, Neutral
Hair: Blond, Straight, Fine
Eyes: Blue
I've had this brush sitting in my drawer for a few years, barely used because I rarely use powder, mineral or otherwise. One day when my usual brushes were still wet from washing, I grabbed this to use with one of my new Hourglass blushes. This is a thick, natural hair brush with a flat top and short handle--think kabuki shaved off completely flat. I put the brush face down on the blush, knocked off the excess, and gently stamped it on my cheek, just tapping where my cheekbones ought to be. Using just that brush, the dimensional Hourglass powder, and my accidental technique produced the perfect color/contour/highlight in one step. I've always used a big domed blusher brush and swiped it sideways in a "blush shape" and never been really happy with the results. I too often miscalculate and end up with too much or too little or even bare spots. Stippling with a flat-topped brush gives me so much control over placement! I could pretty handily get the look I always aim for, one I'd call natural-plus. This brush is years old, never sheds, is not scratchy, and the handle is just the right length to work with in this way. It is also great for buffing and blending. Very Handi indeed!
If you're looking to invest in a great brush, this is one to look at---incredibly high quality, and extremely versatile.
Age: 56 & Over
Skin: Sensitive, Fair, Warm
Hair: Red, Straight, Fine
Eyes: Blue
I bought this brush along with the Jane Iredale mineral powder foundation and peach nectar blush, and spray brush cleaner at my dermatologist's office (there is a cosmetic center for Botox and filler that has a makeup artist and a separate office in the same building for medical issues - rashes, rosacea, excising actenic keratosis, etc.). The four products ran about $150. The mineral powder was fine, the powder blush nothing spectacular, and I did not repurchase. I switched to the $3 Elf spray brush cleaner that I can get at Weis grocery stores.
Ready for the dramatic twist at the end? I bought these products in 2006 and 8 years later I am still using and liking this brush. Blends well with any powder I've tried, bristles are soft, and the brush is still in great shape 8 years later. I keep it in my medicine cabinet, wash it with brush cleaner as needed, and throw it in my makeup bag when I travel overnight. If I ever lost it, I'd definitely repurchase.
Age: Unknown
Skin: Acne-prone, Dark, Warm
Hair: Black, Relaxed, Coarse
Eyes: Black
Very necessary when I was using the Pure Pressed Base from Jane Iredale as it really buffs it all on nicely and smoothly so that it all looks even on me. I couldn't stand the silly flat powder puff the compact of that foundation comes with. I still have my Handi Brush from several years ago that I have used with blush and bronzer but all the bristles are falling out now.
Age: 30-35
Skin: Combination, Medium, Not Sure
Hair: Brunette, Other, Other
Eyes: Grey
Best brush for pressed minerals ever! This brush is soo much better than Bare Minerals handi brush,I really love it! It makes flawless,but still good coverage and very smooth. Also this brush is sooo soft!
Age: 25-29
Skin: Acne-prone, Fair, Not Sure
Hair: Blond, Other, Other
Eyes: Hazel
I love this brush. I don't use J.I makeup anymore, but I still love the brush for my other mineral makeup. It stays soft, and doesn't feel scratchy on my super delicate skin. It helps the makeup to cover well. Love love love it.
Age: 36-43
Skin: Sensitive, Fair, Cool
Hair: Brunette, Wavy, Fine
Eyes: Green
I have had this brush for about 10 years. I was getting a facial at a spa and the facialist talked me into trying some Jane Iredale mineral makeup. She said this was the brush I had to get to go with it. Don't remember all the details of my purchase, but know the pricetag was hefty and often wonder what my younger self was thinking spending so much on a brush just on some facialist's say so? Nowadays, I am not so easily convinced by cosmetics salespeople!
Anyway, the Jane Iredale mineral powder was tossed out long ago - and not even used up. However, I still have this brush hanging around. It looks brand new. I sometimes used it for dusting on translucent powder over my liquid foundation, but it was too dense to do a good job.
It's true purpose is applying mineral makeup. Not sure it is good for anything else. Recently I am trying the Laura Mercier Mineral Powder and have the chance to use this brush again. It works perfectly. The bristles are soft on my face and don't shed. They have kept their shape very nicely. The handle is just the right length and really quality material. The whole item feels very luxurious and the product goes on like airbrushing (though don't know how much of this is Laura Mercier Mineral Powder and how much is the Handi!).
I don't think I will ever need to buy another one. This brush seems indestructible. And I can't imagine my grown up self ever paying this much for a brush again, especially one with such a limited repertoire.
Age: 30-35
Skin: Combination, Fair, Not Sure
Hair: Black, Other, Other
Eyes: Black
Wonderful brush for mineral powder !!!!! Absolutely gentle feeling everyday!
started with Bobbi Brown 's mineral brush and ended up with big disappointment after days! did not have a lot of expectation for Hardi brush but was surprisingly pleased with the results.
Age: 19-24
Skin: Combination, Olive, Warm
Hair: Black, Straight, Fine
Eyes: Brown
Hands down the best mineral foundation brush; really creates a flawless face. The animal hair bristles pick up so much more product than taklon or nylon bristles, which is thrifty. I thought the brush was a little scratchy when I first started using it because I was used to synthetic brushes, but now it's soft and fluffy. I'm seriously considering buying a second.
Age: 30-35
Skin: Other, Tan, Not Sure
Hair: Brunette, Other, Other
Eyes: Brown
Love this brush! hands down the best brush I have used for mineral makeup. I actually bought it off a review I read for mineral makeup on Amazon that suggested it. I use to use the BE kabuki brushes but they shed and deteriorate quickly after daily use and regular cleanings. I would have to always replace it every few months. This brush is a dream. Well made, quality bristles that don't shed, and does not deteriorate after cleanings! I usually clean my makeup brushes weekly. It also makes my mineral makeup go on so well and non-cakey.
It is a pricey brush that retails for $45. Trust me, I tried to find a website that sold it cheaper but couldn't find one...lol. Dermstore carries this brush for $45, but if you create and account and add it to your favorites you save 10% and shipping is always free!
Popular Makeup Brushes


text: Just dropped by to say howdy. Oh, and in your debate thread, I suppose it'd help if you explained better those two positions you've just drawn out, which one you'll be taking, and why you believe your position to be true, and your reasons for believing so. You just can't take both sides and expect anything substatial to come out of the discussion.


text:
Text Size:
Text Only
Turn on more accessible mode
Turn off more accessible mode
Skip Ribbon Commands
Skip to main content
About Us
Contact Us
Public Health
Birth and Death Certificates
Diseases and Conditions
Healthy Environments
Healthy People and Families
Laboratory Services
Prevention and Wellness
Provider and Partner Resources
Get Vital Records
Change Vital Records
Register Vital Records
Vital Statistics
Baby Names
Chronic Disease
Communicable Disease
Diseases A-Z
Genetic Conditions
HIV, STDs and Viral Hepatitis
Injury and Fatality Data
Chronic Disease Data
Heart Disease and Stroke Prevention
Living Well with Chronic Conditions
Medical Marijuana Program
CD Summary Newsletter
Communicable Disease Reporting
Communicable Disease Surveillance Data
Disaster Epidemiology
Emerging Infections
Healthcare-Associated Infections
Outbreak Investigation
Tuberculosis Control
Veterinary Public Health
HIV Care and Treatment
HIV/AIDS Prevention
Integrated Planning Group
STD Prevention
Viral Hepatitis
Climate Change
Drinking Water
Food Safety
Healthy Homes and Neighborhoods
Radiation Protection
Tracking and Assessment
Workplace Health
County and Department of Agriculture Resources
Cross Connection and Backflow Prevention
Emergency Preparedness and Security
Groundwater and Source Water Protection
Monitoring and Reporting
Operator Certification
Plan Review
Rules and Implementation Guidance
Safe Drinking Water Revolving Fund
Water System Operations
Brownfields Initiative
Clandestine Drug Labs
Healthy Gardening
Lead Poisoning
Pesticide Exposure
Radon Gas
Emergency Response
Radiation Monitoring
Radioactive Materials Licensing
Tanning Devices
Beach Water Quality
Fish Consumption
Harmful Algae Blooms
Pools and Lodging
Environmental Health Assessment
Environmental Public Health Tracking
Health Impact Assessment
Work-Related Lead Poisoning
Reproductive and Sexual Health
Maternal and Child Health Data
Health At Childcare
Health Screening
Home Visiting
Safe Surrender for Newborns
Promoting Healthy Weight
Adolescent Growth and Development
Health at School
Youth Sexual Health
Health Screening
Maternal Mental Health
Preconception Health
Health Education
Oregon Contraceptive Care
Reproductive Health Provider Resources
Online Nutrition Education
MCH Title V Block Grant
Perinatal Data Book
Clinical Laboratory Regulation
Communicable Disease Testing
Environmental Laboratory Accreditation
Image Library
Laboratory Response Network
Newborn Screening
Submitting Samples
Forms and Collection Kits
Get Test Results
Current Hazards
Get Involved
Media Center
Preparedness 101
Resources for Partners
Health Alert Network (HAN)
Flu Prevention
Healthy Communities
Obesity Prevention
Oral Health
Physical Activity
Safe Living
Self Management
Tobacco Prevention
Vaccines and Immunization
Community Planning
Cross Agency Health Improvement Project
Healthy Worksites
Kids and Junk Food
Menu Labeling
Shared Meals
Obesity Task Force
TV and Screen Time
Dental Pilot Projects
First Tooth Project
Antibiotic Resistance
Falls Prevention for Older Adults
Keeping Children Safe
Suicide Prevention
Educational Resources
Get Help Quitting
Smokefree Workplace Law
ALERT Immunization Information System
Getting Immunized
Immunization Partnerships
Immunization Provider Information
Perinatal Hepatitis B
Rules and Laws
Vaccine Safety
Community Liaison for Local Health Departments
EMS and Trauma Systems
Evaluation and Research
Health Care Providers and Facilities
Health in All Policies
Public Health Accreditation and Quality Improvement
Public Health and Health System Transformation
EMS Provider Licensure
Education and Training
Ambulance Service Licensing
Professional Standards
Mobile Training Unit
Awards and Recognition
EMS for Children
Trauma Systems
Death with Dignity Act
Institutional Review Board
Program Design and Evaluation Services
Certificate of Need
Facilities Planning Safety
Health Care Regulation and Quality Improvement
Patient Safety
Public Health Meaningful Use
Drinking Water
County & Dept. of Agriculture Resources
Cross Connection & Backflow Prevention
Drinking Water State Revolving Fund
Emergency Preparedness & Security
Groundwater & Source Water Protection
Monitoring & Reporting
Operator Certification
Plan Review
Rules & Implementation Guidance
Water System Operations
Advisory Committee
Administrative Rules
Annual Fee for Community Water Systems
Annual Summary Reports
Approved Assemblies
Certification Requirements and Applications
Cross Connection Advisory Board
Public List of Backflow Assembly Testers
Resources and Training
Incentives & Eligibility
Letter of Interest
Project Priority List
Drinking Water Source Protection Fund
Intended Use Plan
Current Hazards
Emergency Preparedness
Water System Security
Domestic Well Safety
Groundwater Under the Direct Influence of Surface Water
Source Water Protection
Unregulated Contaminants
Laboratory Lists, Forms, and Reporting Information
Monitoring & Reporting Forms
Consumer Confidence Reports
Health Effects of Contaminants
Distribution and Treatment Systems Levels 1-4
Small Water System Operator
Training Opportunities
Plan Review Exemption
Drinking Water Rules
Groundwater Rule
Stage 2 Disinfection Byproducts Rule
Long Term 2 Enhanced Surface Water Treatment Rule (LT2)
Rulemaking Actions
Surface Water Treatment
Capacity Development
Public Notice Resources & Templates
Fact Sheets & Best Management Practices
Outstanding Performance
Circuit Rider Program
Pipeline Newsletter
A to Z
Data &
Forms &
News &
Licensing &
Rules &
Public Health
Public Health
Healthy Environments
Drinking Water
Monitoring & Reporting
Bromate Monitoring
Bromate Monitoring
More Resources
Drinking Water Data Online
Site Map
For Consumers
Contact Us
Drinking Water Services
Center for Health Protection
Page Content
Find current bromate monitoring schedules here.
Bromate monitoring applies to community and non-transient non-community systems using ozone as a disinfectant or oxidant. Bromate is a disinfectant byproduct that is formed when ozone is used as a disinfectant in the presence of bromide, which is a naturally occurring element found in ground and surface water sources. Some people who drink water containing bromate in excess of the MCL over many years may have an increased risk of getting cancer.
Bromate Monitoring for Systems Using Ozone
Routine Monitoring
Reduced Monitoring
1 Sample per Month
1 Sample per Quarter
Note: Systems required to analyze for bromate may reduce monitoring from monthly to once per quarter, if the system demonstrates that the running annual average bromate concentration is less than or equal to 0.0025 mg/L based upon routine monthly bromate measurements for the most recent four quarters. In addition, the samples must be analyzed using Method 317.0 Revision 2.0, 326.0, or 321.8.
Sample Site
Sampling should occur at the entry point to the distribution system.
Maximum Contaminant Level (MCL)
The MCL for bromate is 0.010 mg/L. Compliance with the MCL is based on a running annual average. A running annual average is the arithmetic average of results and is calculated at the end of every quarter. Systems must continue to compute the RAA quarterly after qualifying for reduced bromate monitoring and, if the RAA exceeds 0.0025 mg/L, the system must return to monthly monitoring.