Server Remote Management: iLO, iDRAC and IMM Explained
Remote management is the difference between fixing a server from your desk and driving to a data centre at two in the morning. On any server that is not physically beside you, it is arguably the most useful feature on the machine.
This guide covers what these controllers do, what the licence tiers change, and what to check when buying second-hand hardware.
What a management controller is
Server motherboards include a small dedicated processor that runs independently of the main system. It has its own network connection, its own firmware and its own power path, and it stays running whenever the server has power — whether or not the operating system is up, and whether or not the server is even switched on.
Each vendor has its own name: HPE calls it iLO, Dell iDRAC, IBM and Lenovo have used IMM and XCC, and there are others. The underlying idea is the same.
Because it is independent, it can do things nothing running inside the operating system can.
What it lets you do
Power control. Power on, power off and reset the server remotely. On a machine that has hung completely, this is the difference between a click and a site visit.
Remote console. See the screen and use keyboard and mouse as though you were at the machine — including during POST and firmware setup, before any operating system loads. This is what lets you fix a boot failure remotely.
Virtual media. Mount an ISO from your workstation as though it were a drive in the server, so you can install or repair an operating system without physical media.
Hardware monitoring. Temperatures, fan speeds, power draw, memory errors, drive health and predictive failure warnings, reported independently of the OS. If the server crashes, the controller still knows why.
Logging. A hardware event log that survives operating system reinstalls and crashes, which is frequently the only record of what actually happened.
Licence tiers change what you get
This is the part that catches people, particularly on second-hand hardware.
Basic functionality is generally included: hardware monitoring, event logs, and simple power control. That is enough to know the server is healthy and to turn it off and on.
The features that make remote management genuinely valuable — remote console and virtual media in particular — are commonly behind a licence on most vendors’ platforms.
Without them you can see that the server has failed to boot, and you cannot see the screen to find out why. That is the difference between diagnosing remotely and driving to site.
When buying a server, establish which tier it has. When budgeting, treat the licence as part of the server cost rather than an optional extra, because for any machine you do not sit next to, it usually is not optional.
Buying second-hand: what to check
Four things, and all four are worth asking before ordering.
Is a licence present, and does it transfer? Licences are frequently tied to the server’s serial number rather than the owner, in which case they travel. Some vendors treat them differently. Ask explicitly rather than assuming.
Have the credentials been reset? A server arriving with the previous owner’s management credentials is common, and so is one where nobody knows them. Most platforms allow a reset via a physical jumper or a boot-time utility, but establish this before deployment.
What firmware version is on it? Management controllers have their own firmware and their own vulnerabilities, and old versions have known issues. Check whether you can obtain updates, which on some platforms depends on entitlement.
Is the dedicated port present? Some servers have a dedicated management network port; others share a system port. Which you have affects network design.
This is the same set of questions that applies to refurbished network switches, and for the same reason: on hardware with software entitlements, licensing is the real risk rather than the hardware.
Security matters more than people treat it
A management controller is a computer with full control over a server, reachable over the network, running whenever the server has power.
That makes it a serious target, and three practices are worth insisting on.
Do not expose it to the internet. Management interfaces belong on a separate management network or VLAN, reachable only from where administrators work.
Change default credentials. Default passwords for common platforms are widely documented, and second-hand hardware may arrive with defaults or with the previous owner’s credentials.
Keep the firmware current. The controller runs whenever the server has power, so a vulnerability in it is reachable even when the server is nominally off.
It is worth noting that a compromised management controller is worse than a compromised operating system, because it sits underneath and survives an OS reinstall.
Why it matters most on older hardware
A point worth making for anyone maintaining end-of-life platforms.
Older servers fail more often. Drives reach wear-out, capacitors age, fans degrade. The hardware event log and predictive failure warnings from the management controller are frequently the earliest indication, and on a platform where parts take time to source, early warning is worth more than on current hardware.
If you are running servers past manufacturer support, make sure someone is actually reading those alerts. A controller reporting a failing drive to an unmonitored interface is doing its job and achieving nothing.
Common questions
What is iLO, iDRAC or IMM?
Vendor names for the same thing: a small dedicated processor on the motherboard with its own network connection and firmware, running whenever the server has power, independently of the operating system. HPE calls it iLO, Dell iDRAC, IBM and Lenovo IMM or XCC.
Why can I not see the screen remotely?
Remote console and virtual media are commonly licensed features. Basic monitoring, event logs and power control are usually included, but seeing the screen — which is what lets you diagnose a boot failure — typically requires the higher tier.
Does a management licence transfer with used hardware?
Often yes, because licences are frequently tied to the server’s serial number rather than the owner. Some vendors treat it differently, so ask explicitly before ordering rather than assuming.
Can I reset management credentials on a second-hand server?
Most platforms allow it via a physical jumper or a boot-time utility. Establish the procedure before deployment, since a server arriving with the previous owner’s credentials, or with credentials nobody knows, is common.
Should a management interface be on the main network?
No. It should sit on a separate management network or VLAN reachable only from where administrators work, and never be exposed to the internet. A compromised management controller is worse than a compromised OS, because it sits underneath and survives a reinstall.
Send us the server model and we will confirm which management tier it carries before quoting.
