Intel Communities : All Content - Intel® vPro™ Expert Center

SCCM Certificates required for child sites?

webadmin@intel.com — Fri, 27 Nov 2009 19:09:54 GMT

As long as the two OOB service points exist in the same DNS namespace, differing hostnames should not matter. You will need to import the certificate (include the certificate chain, and the private key, when you export it) directly into the properties page of the Out of Band Component Configuration node in the ConfigMgr console.

Cheers,

Trevor Sullivan

http://trevorsullivan.wordpress.com

AMT Web UI - SCCM Provisioned

webadmin@intel.com — Wed, 25 Nov 2009 23:49:05 GMT

This scarcely documented registry key IS REQUIRED however when i had input the key previously, i incorrectly setup a DWORD of iexplore instead of the correct value of iexplore.exe.

BTW im on a Windows 2008 server with Internet Explorer 7. You would think M$ would have adressed this issue by now

Internal Enterprise Root CA Cert Expiration

webadmin@intel.com — Wed, 25 Nov 2009 20:37:08 GMT

Thats what i wanted to confirm; whether or not the hash stays the same upon a cert renewal.

Thanks!

Known Issues, Best Practices, and Workarounds

steve.lewis@intel.com — Mon, 12 Nov 2007 15:34:27 GMT

Best Practices

Automatically disabling the Intel® AMT Privacy Notification window
Changing Terminal Emulation Type
Customizing the Intel® AMT Status dialog box
Intel® AMT platform may have up to 8 client certificates that can define different 802.1x profiles
How To Remove the CMOS Battery on a Lenovo* ThinkPad* T400
Root certificate size limit is 2048-bits
How to hide the Intel(R) Management & Security Status (IMSS) tool system tray icon
Tips on ME firmware updates
Intel(R) AMT does not allow multiple simultaneous commands
Password issue causes WebUI to report "The system may be under attack" in the event log

BIOS

F10 does not exit BIOS on HP clients
The TCP/IP DHCP Mode setting in MEBx must be enabled for remote control of an Intel(R) AMT platform
After reflashing a full image, is a "clear CMOS" required?
Remote BIOS update with AMT Commander does not see BIOS update files
Intel(R) AMT Event log includes Platform Event Traps from the BIOS

Client Drivers

Using Intel vPro technology and Linux
Linux-based wireless drivers
Wireless management does not work when the operating system is running
LMS/SOL driver setup program fails to install privacy icon if installation path includes square brackets

Infrastructure

Is an IDE-R recommended over a WAN?
Firewalls may not let Intel® AMT clients communicate with management consoles
Secondary DNS IP makes Intel® AMT configuration fail in basic (formerly SMB) mode
ME NIC remains at lowest negotiated speed and half duplex mode after booting
GenScript produces errors on Windows* Vista OS, Windows* Server 2008, and clients with 802.1x profiles
Usage of Locally Administered Address on Intel(R) Active Management Technology enabled systems
ICMP Router Discovery Protocol (IRDP) is not supported

Altiris

Troubleshooting DNS when configuring Altiris
Can the Default 'provisionserver' naming conventions be changed?
Hardware inventory on Altiris* console requires Altiris* inventory solution

LANDesk

No drivers required for bare metal provisioning
Need to set LANDesk* root certificate as trusted certificate
LANDesk* Management Suite 8.8 SP2 patch fixes loss of in-band connectivity
LANDesk* 8.8 SP2 console requires repeated deletion of two directories when provisioning

Microsoft ConfigMgr (see also: http://communities.intel.com/openport/docs/DOC-1627#cf)

Enabling native (no translation required) support within Microsoft SCCM SP1
Virtual adapters may cause network discovery to fail
Microsoft* SCCM unable to use Intel® AMT features when run on Microsoft* Vista* Operating System
Microsoft* SCCM 2007 SP1 hotfix roll-up KB960804 includes KB959040
SoL/IDER fails on Microsoft SCCM 2007 SP1 with two-tiered PKI model
Failure of collection-based power control in Microsoft* SCCM SP1
Cannot provision HP* DC7700 using Microsoft* ConfigMgr SP1 and PKI method

Management Engine

Maximum number of agents that can be monitored simultaneously
Hewlett-Packard 6910P returns UUID=00000 during activation
Running virtual machines and DHCP can cause Intel AMT to be inaccessible
Wildcard certificates are currently not supported for remote configuration
No inventory data available
Weybridge issue causing network disconnects; impacting Dell Optiplex 755
Synchronizing the operating system and the Intel AMT hostname.
Best Practices: Setting up application servers and Internet Explorer* for Intel(R) AMT Kerberos support
Network issues with NS Lookup
Does Intel AMT 3.0 support Windows 2000 Active Directory?
Switching from NAC to 802.1x results in loss of connectivity
Using Intel(R) AMT wirelessly without user intervention
Cannot provision a system that uses an underscore in the host name
Does the Intel SCS automatically push updates to the CRL (Certificate Revocation List) to clients?
Firewalls may not let Intel(R) AMT clients communicate with management consoles
Cisco ACS Certificate Configuration for Intel AMT
What are some common hardware issues that are tracked by Intel® AMT?
Q&A on customized Intel® AMT firmware
Wrong IP address for Intel ME on Lenovo M58p using Hypervisor

Microsoft Systems Management Server (SMS) Add-on

Fix available: Microsoft System Management Server (SMS) Add-on V3.0 has local echo when using Serial over LAN (SoL)
Fix available: Using the Intel AMT add-on for Microsoft SMS 2003 on a Dell 755 returns a UUID error
Fix available: The Intel AMT Add-on for Microsoft* SMS is unable to communicate with the SCS over a standard HTTP connection.
Do management workstations running the SMS console and SMS Add-on require patches as outlined in the documentation for the Intel(R) AMT Add-on for Microsoft SMS*?

BIOS

Lenovo* M55p returns UUID=00000 during activation
Dell* 755 returns a duplicate UUID during activation
Ctrl + P prompt missing when CMOS battery unplugged
When Intel AMT is disabled, there is a HECI driver problem in the HP* dc7800
What does the Intel AMT status application dialog box signify?
Are there DLLs in the operating system that access vPro?
Unattended install of Intel(R) AMT client software/drivers not working properly on Microsoft Windows*
SoL/IDER does not work with the Lenovo* X61 Tablet
SoL/IDER can’t be disabled on Lenovo* M55p
BIOS password screen unavailable on HP* systems during SoL session
Dell* D630c laptops reboot when sent a shutdown command via Intel® AMT
The look of the BIOS Setup screens using SoL depends on OEM support for terminal emulation modes

Platform: Averill

Are the Weybridge SoL and HECI drivers backward-compatible with Averill?

Profiles

Intel SCS returns an error during a partial unprovision
Validation of SCS service users takes over 30 minutes when installed in a large Active Directory environment

Setup and Configuration Service

GoDaddy* requires High-Assurance SSL certificates
Using static IP addresses and Basic (formerly known as SMB) mode
Error displays when provisioning HP* 6910p
Will PKI-CH consistently support wildcard certificates across Intel(R) AMT versions?
SCS service crashes due to excessive logs
Network Load Balancing of SCS Servers
Is SNMP Trap Service required for SCS?
Intel(R) AMT Active Directory error message
Organizational Unit Field in Configuration Parameters must be populated to complete provisioning
Unable to access web interface using Kerberos authentication
Is Static IP addressing possible in Enterprise Mode?
Is it possible to have an operating system with static IP address and Intel® Management Engine in DHCP mode?
Cannot log into SCS Console with Enterprise Admin account
Intel® MEBX, Web UI, and remote admin passwords are not automatically synchronized
Using international keyboards to create MEBx passwords via Setup and Configuration Service (SCS)
What is the Authorized column in SCS?
SOAP error (0xCFFF06AC) when attempting remote configuration
Local Manageability Service (LMS) does not allow host VPN traffic when environment detection is not defined
Unable to remove wireless profiles in Intel SCS
Time synchronization errors using Intel(R) SCS 3.x and Active Directory
SCS Installation Account Security Requirements
SCS 5.0 Does Not Support 64-bit Operating Systems
The SCS Console Operator role does not appear to give users the right to access the security keys
Consistent RCFG failure with SCS
How often are log files purged in Intel SCS?
Is the Intel® SCS supported on EMT64 bit versions of Microsoft Windows* Server?
Can't import setup.bin made with USBFILE2.EXE into the SCS
The SCS Console Operator role does not appear to give users the right to access the security keys
Minimum security requirements for installing Intel(R) SCS
Intel(R) SCS is only supported on English versions of Windows* Server 2008

USB Provisioning

USB provisioning only effective on "factory new" systems
USB Key Configuration Guidelines
USB Compatibility Matrix for Intel® Centrino® with vPro Technology (Intel® AMT 2.5)
USB Compatibility Matrix for Intel® vPro™ Technology (Intel® AMT 3.x)
USB Compatibility Matrix for Intel® vPro™ Technology (Intel® AMT 4.x)
USB Compatibility Matrix for Intel® vPro™ Technology (Intel® AMT 5.x)
USB Provisioning Tips for Lenovo T61
What is the maximum number of PID/PPS pairs that can be used during USB provisioning?
Automating PID/PPS key generation using LANDesk utility

Check back often -- I'll be adding more content to this wiki on a weekly basis, at minimum. Don't see what you need? Send your wishlist to Michele Gartner.

Best Practices

Automatically disabling the Intel® AMT Privacy Notification window

PROBLEM

A Privacy Notification window automatically displays when each user logs into the Intel® AMT system.

RESOLUTION

End users can disable this window by selecting the "Do not display this message" checkbox.

However, you can also disable the Privacy Notification window and still keep the application running by modifying a registry key.

To modify the registry key:

Open the registry and locate this key: HKEY_LOCAL_MACHINE\Software\Intel\Network_Services\atchk
Create a new dword value named +MinimizePrivacyIconAtStart +and set it to 00000001.

11.9.2007

Changing Terminal Emulation Type

PROBLEM

Some vendor BIOS versions only support the display of specific emulation types. Using this command, specific ISVs will be able to redirect and emulate without issue.

RESOLUTION

This command only applies to users running Altiris, HP Openview, and Microsoft SMS.

On the console machine:

At the Start menu, select Run.
In the Open field, enter CMD and click OK. A command window opens.
At the command prompt, type telnet and press Enter.
In the telnet session, type set term ansi or set term vt100 and press Enter.
Type quit and press Enter.

Your terminal emulation type is now set to ANSI or VT100, depending on what you entered. You can re-enter the telnet session at anytime and type d to verify the emulation type.

NOTE: If you do not properly quit the telnet session, the setting will not be saved.

6.11.2008

Customizing the Intel® AMT Status dialog box

You can view the status of Intel AMT on a machine by double-clicking the system tray icon and choosing Status. This dialog box displays whether Intel AMT is enabled or disabled. It also has a hyperlink that allows the user to visit a site for more information about Intel AMT. You can customize this hyperlink to go to any site you wish. For example, you may want to modify it to point to your organization’s help desk page or to the Intel® vPro™ Expert Center (http://www.intel.com/go/vproexpert).

This procedure applies to Intel® AMT 2.5 and greater. See the readme file, included in the download, for more information.

Download the files to modify the registry.
The files are located here: http://communities.intel.com/docs/DOC-1797
1. Save the OemUrlRegistry.zip file to your desktop.
2. Extract the files: oementry.re_ and readme.txt.
Customize the hyperlink.
1. Open oementry.re_ in a text editor.
2. Edit the destination hyperlink. The default entry is: "OemUrl"=http://www.intel.com/vpro.
3. Rename oementry.re_ to oementry.reg.
Run the *.reg file to modify the registry.
1. Double-click oementry.reg.
2. A cautionary dialog box displays. Click OK.
3. An information dialog box displays that the registry was modified. Click OK.
Restart the computer.

Intel® AMT platform may have up to 8 client certificates that can define different 802.1x profiles

PROBLEM	Some users need to move a PC between several networks. For example, a support technician may support multiple clients that require different client certificates.
RESOLUTION	Users may install up to 8 client certificates.

2.24.2009 QA1312

How To Remove the CMOS Battery on a Lenovo* ThinkPad* T400

PROBLEM

If the administrator forgets the MEBx password, the only way to clear the password is to remove the CMOS battery.

RESOLUTION

To remove the CMOS battery on a Lenovo* ThinkPad* T400 you must remove the keyboard to get to the battery. The battery is located under the palm rest. Please refer to the Lenovo* instructions at the following URL**: HTTP://www-307.ibm.com/pc/support/site.wss/document.do?lndocid=MIGR-71484.

**This URL to a non-Intel web site is provided for the reader's convenience. This is not an endorsement or recommendation by Intel of the site or products.

Note for Intel(R) Anti-Theft (Intel AT) Technology users: if your PC is enrolled in an Intel AT service, and you remove the CMOS battery, the ME may detect this as tampering and lock the system. You will then need the Intel AT passphrase to unlock the system after you reboot.

WARNING: To avoid personal injury or property damage, follow the manufacturer's safety instructions that apply henever accessing the inside of the product.

CAUTION: There is the danger of explosion if the battery is incorrectly replaced. When replacing the battery, use only the battery recommended by the equipment manufacturer and follow the manufacturer's instructions. Electrostatic Discharge ESD) can damage disk drives, boards, and other parts. We recommend that you perform all procedures at an ESD workstation.

3.9.2009 QA1330

Root certificate size limit is 2048-bits

PROBLEM	Intel(R) AMT is incompatible with a 4096-bit PKI if Intel(R) AMT systems need to validate a certificate chain containing this key size. For example, in 802.1X networks.
SOLUTION	If a customer already has a PKI with a 4096-bit root certificate, you can work around this issue by adding a 2048-bit root CA and then using this to issue certain certificate (for example, RADIUS).

4.2.2009 QA1341

How to hide the Intel(R) Management & Security Status (IMSS) tool system tray icon

SOLUTION

To hide the IMSS system tray icon, delete the key at the following registry location:
HKLM\Software\Microsoft\WindowsCurrentVersion\Run\Picon\"C:\Program Files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe"

4.2.2009 QA1342

Tips on ME firmware updates

PROBLEM

To successfully upgrade your ME firmware, follow the guidelines listed below.

SOLUTION

Version number format for ME firmware

Intel(R) AMT firmware versions use the following format:

W.X.Y.ZZZZ

W = platform

X = major version

Y = minor version

ZZZZ = build number

Rules for successful upgrades

(1) The platform number (W) of the update must match the existing firmware.

(2) The major number (X) of the update must be the same, or higher, than the existing firmware. The only two exceptions are: 2.0 can only be upgraded to 2.1 or 2.2; version 2.5 can only be upgraded to 2.6.

(3) The minor version (Y) for the update must be greater than, or equal to, the minor version for the existing version if the major version is unchanged (for example, 3.0.0 to 3.0.1).

(4) Always use the FWUPDLCL utility from the upgrade toolkit.

(5) ME Firmware Local Updates must be enabled in the MEBx, or the Local FWU Override Counter and Local Firmware Override Qualifier must be set appropriately to allow an override.

TIP: Run MEInfoWin.exe against the platform, or log-on to the MEBx (on the local machine) to check, or change, the ME Firmware Local Update setting. You can also check or change the status of the FWU Override Counter and FWU Override Qualifier settings.

9.11.2009 QA1359

Intel(R) AMT does not allow multiple simultaneous commands

PROBLEM	For an example of this problem, if a SoL session is active from the Microsoft* SCCM Out of Band console, then the Intel® AMT firmware will not process a collection-based power control command from the console.
SOLUTION	Intel® AMT firmware will ignore a second command if it is still processing an active command. This is a security feature.

9.11.2009 QA1327

Password issue causes WebUI to report "The system may be under attack" in the event log

PROBLEM

The password policy is configured by the OEM during manufacturing. The primary setting allows a one-time chagne from Admin/admin to a unique password and to have both the remote and local access synched-up. If you changed the password on the remote client you will have two passwords. This is intended to allow customers to have a unique password for local access and to allow the user to change it randomly to ensure the security of the system.

SOLUTION

The system was working as designed. The local MEBx password and the WebUI remote passwords may be different if the user has changed the MEBx password on the local machine.

11.12.2009 QA1389

BIOS

F10 does not exit BIOS on HP clients

PROBLEM	During a SoL session to an HP* client, pressing F10 does not exit BIOS.
RESOLUTION	Press ESC and 0 (zero) at the same time as an alternative to exit BIOS.

1.30.2008

The TCP/IP DHCP Mode setting in MEBx must be enabled for remote control of an Intel(R) AMT platform

PROBLEM

Current tools from Intel do not control the TCP/IP DHCP Mode setting. Additionally, only an un-provisioned platform will give you the option to set this option locally.

Disabling TCP/IP DHCP Mode requires an onsite physical touch to either do a clear CMOS, or from MEBx, to do a full unprovision. All tools related to remote provisioning, un-provisioning, or updating/modifying Intel® AMT firmware settings require that TCP/IP already be enabled. There is also no known in-band solution using ISV applications.

If the TCP/IP DHPC Mode setting is set to NONE, then the IP address is 0.0.0.0 and the ME cannot receive or execute any commands.

RESOLUTION

When purchasing a system, customers should verify that their OEM has a tool to remotely turn on the TCP/IP setting before deploying systems with the TCP/IP setting disabled.

In some cases where the DHCP Mode setting in the MEBx is Enabled, but the user is not ready to provision the systems already deployed, they will see heavy DHCP network traffic. To avoid heavy network traffic on the DHCP server caused by the hello packets from numerous unprovisioned systems, set the Manageability Feature Selection setting to NONE and keep the TCP/IP DHCP Mode setting enabled.

If the systems with the TCP/IP DHCP Mode disabled are already deployed, and the OEM doesn't have a tool to remotely enable this setting, the administrator must go to each system and either clear CMOS, or do a full unprovision from MEBx.

3.3.2009 QA1309

After reflashing a full image, is a "clear CMOS" required?

PROBLEM

Is a "Clear CMOS" required after a full image flash?

RESOLUTION

No, the "clear CMOS" is not required, but is recommended on systems with legacy BIOS code (as opposed to UEFI) if problems arise after full image flash (i.e., the Clear CMOS can be used as a "fix" for post-flash issues).

Also, it is recommended that you use an image tool with full erase, program, and reboot steps; perform an update on a duplicate/test environment first; use defaults, then compare updated file to source file BEFORE rebooting (should be 100% compare). After reboot, go into BIOS and set optimal defaults.

6.1.2009 QA1355

Remote BIOS update with AMT Commander does not see BIOS update files

PROBLEM

When using AMT Commander to perform a remote BIOS update using SOL/IDE-R, AMT Commander does not display the text of the BIOS update files; it only displays the bootable ISO files.

RESOLUTION

Problem is likely with terminal emulation between remote system running AMT Commander and target system where BIOS update is to be performed. AMT Commander (part of AMT SDK) contains many terminal emulators, not just the common vt100 or PC ANSI. Ensure that the AMT Commander terminal emulation matches the target system's terminal emulation (contact target system OEM if necessary).

Also, some OEM's supply a local keyboard lockout feature during remote SOL/IDE-R sessions. This can get corrupted so that the remote keyboard is locked out, not the local one. If this happens, the target system OEM must supply an update for the corrupt feature. AMT Commander contains a control for local keyboard lock; make sure this is set to off.

5.27.2009 QA1356

Intel(R) AMT Event log includes Platform Event Traps from the BIOS

PROBLEM	Some events listed in the Intel(R) AMT event log are generated by the BIOS and simply passed through to the Intel(R) AMT event log. For example, if the system fails to boot using the PXE option, you may see a "System boot failure" event in the log. The source may say Intel(R) AMT only because it was passed by the BIOS to the Intel(R) AMT firmware.
RESOLUTION	No solution is required. This is expected behavior.

6.1.2009 QA1345

Client Drivers

Using Intel vPro technology and Linux

PROBLEM	Where can I find more information about Intel vPro technology on Linux?
RESOLUTION	Information about Linux support is available at the Open Source Intel AMT Drivers and Tools\ site.

10.11.2007

Linux-based wireless drivers

PROBLEM	Where can I find the most recent Linux drivers for an Intel vPro system?
RESOLUTION	Visit http://www.intellinuxwireless.org/ to download Intel wireless drivers.

11.9.2007

Wireless management does not work when the operating system is running

PROBLEM	Wireless management does not work when the operating system is running.
RESOLUTION	Check if there are missing or faulty Intel AMT drivers (HECI & LMS/SOL) in Microsoft Windows*. Get the latest drivers from the OEM's web site and install them. Once the drivers are installed, the Intel(R) Management Engine should work properly with the wireless connection.

1.30.2008

LMS/SOL driver setup program fails to install privacy icon if installation path includes square brackets

PROBLEM	If the path to the LMS/SOL driver setup.exe contains square brackets, then the driver will be installed but the privacy icon will not be installed. For example, setup will fail with this path: c:\drivers\[HP]\lms_sol\setup.exe.
RESOLUTION	This issue is expected to be fixed in Intel® AMT 4.2. To workaround the issue, remove the square brackets from the path.

4.2.2009 QA1333

Infrastructure

Is an IDE-R recommended over a WAN?

PROBLEM	Is there a performance hit for IDE-R over a WAN?
RESOLUTION	We do not recommend using an IDE-R session to boot large CD-ROM images over a WAN. Instead, we recommend using a stripped down IDE-R image that can load up a network stack on the AMT client. The network stack can be used to access local shares at the branch that have the tools you need to either rebuild the OS or diagnose problems.

2.8.2008

Firewalls may not let Intel® AMT clients communicate with management consoles

PROBLEM

The wired LAN NICs are not recognized by the Intel® AMT management consoles. They do show up in the DHCP listings. Only the wireless NICs were discovered as Intel® AMT devices. IPCONFIG on each notebook shows IP addresses assigned to both WLAN and LAN NICs.

When the firewalls are turned off, the Intel® AMT consoles can communicate with the LAN NICs.

RESOLUTION

Firewalls can prevent clients from registering an FQDN (fully qualified domain name), which prevents them from being discovered by the console. Verify that the firewall is not configured to block these kinds of requests.

11.25.2008

Secondary DNS IP makes Intel® AMT configuration fail in basic (formerly SMB) mode

PROBLEM

When configuring Intel® AMT in basic (formerly SMB) mode during boot up, some values for the secondary DNS server IP address make the configuration fail.

If a secondary DNS server's last octet value is 223 or higher, the configuration fails.

RESOLUTION

This is a known issue in the Intel® Management Engine and will be fixed in the next release. The current workaround is to change the secondary DNS server's IP address, or to not use the secondary DNS server at all in the configuration.

11.25.2008

ME NIC remains at lowest negotiated speed and half duplex mode after booting

PROBLEM	When you reboot the system and enter a SoL/IDER session, the ME NIC will remain in the lowest negotiated speed setting and half duplex mode if the SoL/IDER session remains connected during boot. The NIC does not renegotiate to the highest available speed or full duplex mode after the operating system boots.
RESOLUTION	To force the ME NIC to renegotiate to full speed/full duplex mode, disconnect the SoL/IDER session then reconnect.

11.25.2008

GenScript produces errors on Windows* Vista OS, Windows* Server 2008, and clients with 802.1x profiles

PROBLEM	The Intel® WS-MAN translator package used with Microsoft* SCCM 2007 SP1 generates some errors due to scripting language changes introduced in Windows* Vista. The scripts will not run correctly on Microsoft* Vista and Microsoft* Server 2008 operating systems. Also, wired 802.1X scripts produced by GenScript only execute properly the first time they are run.
RESOLUTION	An updated version of the WSMAN translator is available.

3.3.2009 QA1322

Usage of Locally Administered Address on Intel(R) Active Management Technology enabled systems

PROBLEM	An incompatibility exists between Intel(R) Active Management Technology (Intel(R) AMT) and Locally Administered Address (LAA) environments. As a result, Intel AMT enabled systems configured to work in LAA environments might encounter LAN disconnects.
RESOLUTION	A Locally Administered Address (LAA) is an option allowing users to set their own MAC address on the platform and thus bypass the Burned-in address (BIA) MAC. Intel AMT was not designed to support LAA environments and there are no plans to add this capability in the near future. Intel recommends avoiding usage of LAA together with Intel AMT technology to avoid this issue.

5.18.2009 QA1350

ICMP Router Discovery Protocol (IRDP) is not supported

PROBLEM	ICMP turned on by DHCP Option 31. ICMP is not supported by Intel(R) AMT technology.
RESOLUTION	No solution is available.

11.25.2009 QA1377

ISV

Altiris

Troubleshooting DNS when configuring Altiris

PROBLEM

DNS configuration issues display when configuring Altiris.

RESOLUTION

Use these troubleshooting tips to help resolve DNS configuration issues with Altiris:

Verify that the Altiris host has fully qualified records in the DNS infrastructure. This would constitute an A record for forward lookups and a PTR record for reverse lookups.
Make sure the Intel Setup and Configuration Service (SCS) is up and running on the box.
Upgrade the SCS Console to the current version. This process is not supported by Altiris and is only for troubleshooting.
IMPORTANT: When you upgrade, only install the console. DO NOT upgrade the entire SCS application.

To upgrade to the current version:

Download the SCS package at http://softwarecommunity.intel.com/articles/eng/1025.htm.
When the download is complete, open the ZIP file and double-click 3.1.0.7.zip.
Double-click AMTConsole.zip and run AMTConsole.exe.The console will prompt you to use the fully qualified domain name. An SSL session may be necessary to connect to it, depending on the server configuration. The console client works like a web browser and a URL is required to connect to the SCS, for example: http://server.something.com/atmscs or https://server.something.com/atmscs.

12.20.2007

Can the Default 'provisionserver' naming conventions be changed?

PROBLEM	Can Intel AMT firmware be reconfigured to change the default 'provisionserver' naming convention to a value of a customer's choosing?
RESOLUTION	The provisionserver value is hard coded and cannot be changed. It is recommended that the customer set up a second A record or a CNAME record in the DNS that points the provisionserver.yourdomain.com to the ISV server.

2.8.2008

Hardware inventory on Altiris* console requires Altiris* inventory solution

PROBLEM

Altiris* has a complete Server and Client inventory application/service that is independent of Intel(R) AMT features. An agent is required to obtain this level of support in Altiris* products.

RESOLUTION

Refer to the following URL**: HTTP://www.symantec.com/business/inventory-solution (servers), or http://www.symantec.com/business/solutions/projects/projectdetail.jsp?solid=sol_infrastruct_op&solfid=sol_client_management&projectid=client_discovery_inventory (clients).
**This URL is provided for the reader's convenience.?It should not be construed as an endorsement by Intel of the products or services on the web site.

11.25.2009 QA1338

LANDesk

No drivers required for bare metal provisioning

PROBLEM

A customer with LANDesk* LDMS 8.8 or similar provisioning server does not need to load drivers or an OS image on the Intel(R) AMT clients to perform bare-metal provisioning.

SOLUTION

No drivers are required for bare-metal provisioning of an Intel(R) AMT client. The system administrator will, however, need to pre-populate the provisioning server database with the client configuration information (UUID, FQDN, OU if Active Directory is used, Profile). Refer to the LANDesk documentation for information on how to enter the client configuration information into LDMS 8.8. The Intel AMT client will send out a hello packet as soon as the network and power cables are plugged in. If the provisioning server is found, and the client configuration information is in the provisioning database, then the client will be provisioned.

7.28.2008

Need to set LANDesk* root certificate as trusted certificate

PROBLEM

In the default configuration, the LANDesk root certificate is not trusted by the Microsoft* CA. The user is then unable to use the WebUI.

SOLUTION

From Microsoft* Internet Explorer, add the LANDesk* root certificate to the list of trusted certificates.

Open Microsoft* Internet Explorer.
Choose Tools->Internet Options.
Click on the Content tab.
Click on the Certificates tab.
Under the Trusted Root Certificates tab, import the root certificates.
Under the Intermediate Certificate Authorities tab, import the intermediate certificates.
Verify that the certificate used can be traced back to the root.

9.10.2009 QA1370

LANDesk* Management Suite 8.8 SP2 patch fixes loss of in-band connectivity

PROBLEM

After provisioning, the in-band network connection on some Intel(R) AMT systems may shut down. The LANDesk console will then place the systems in remediation. These Intel(R) AMT systems can, however, still be managed with LANDesk* OOB tools and the Intel(R) AMT Web GUI. This is an intermittent issue. The time between provisioning the system and the loss of in-band connectivity ranges from a few minutes to about an hour.

SOLUTION

If you have LANDesk* Management Suite 8.8 SP2, and you have lost in-band connectivity, but you can still access the remote systems using OOB tools, try the following patch or upgrade to a later LANDesk* service pack (SP3 or later). The URL** for the patch is: HTTP://community.landesk.com/downloads/ServicePack/LD-88-AMT-CR20525-88.zip

**This URL to a third-party site is provided for the reader's convienience. This should not be construed as a recommendation by Intel for the products or services provided by the third party.

9.11.2009 QA1344

LANDesk* 8.8 SP2 console requires repeated deletion of two directories when provisioning

PROBLEM	The RootCA and the SubCA directories must be deleted repeatedly to enable provisioning to continue.
SOLUTION	No solution exists at this time. The issue is expected to be fixed in v8.8 SP3.

10.09.2009 QA1349

Microsoft ConfigMgr (see also: http://communities.intel.com/openport/docs/DOC-1627#cf)

Enabling native (no translation required) support within Microsoft SCCM SP1

A BIOS update is available to provide native support within Microsoft SCCM SP1 for Dell 755, HP DC7800, and Lenovo M57p computers.

OEM Model	Link to BIOS Update
Dell 755	Click here.
Lenovo M57p	Click here.
HP DC7800	Click here.

7.23.2008

Virtual adapters may cause network discovery to fail

PROBLEM	When discovering vPro systems via a console that has a virtual adapter enabled with an IP address assigned, such as Microsoft SCCM, the discovery process may fail if the virtual adapter IP address is used for the discovery process.
RESOLUTION	Before performing the discovery, disable any virtual adapters that were created by software such as VMWare.*

7.30.2008

Microsoft* SCCM unable to use Intel® AMT features when run on Microsoft* Vista* Operating System

PROBLEM	When the Microsoft* SCCM management console is run on a Microsoft* Vista* SP1 operating system, all Intel® AMT based objects and functionality is missing.
RESOLUTION	No solution is available at this time.

1.29.2009 (QA1304)

Microsoft* SCCM 2007 SP1 hotfix roll-up KB960804 includes KB959040

PROBLEM

Microsoft* System Center Configuration Manager 2007 Service Pack 1 (SP1) hotfix roll-up KB960804 includes KB959040 (a fix to enable PKI provisioning with Intel® AMT 2.2 and 2.6.) The original description of the roll-up incorrectly omitted the KB959040 hotfix.

RESOLUTION

To get KB959040 hotfix, users may download the KB960804 hotfix roll-up.

Refer to the Micorsoft* support website for more information about the hotfix packages. The Microsoft* URL** is: http://support.microsoft.com/kb/960804

**This URL is provided for the reader's convenience. It is not an endorsement of products or services by Intel Corporation.

2.24.2009 QA1323

SoL/IDER fails on Microsoft SCCM 2007 SP1 with two-tiered PKI model

PROBLEM	SoL and IDER fails using Microsoft* SCCM in an environment with a Root CA and a Subordinate Issuing CA.
RESOLUTION	This issue has been fixed by a hotfix for Microsoft* SCCM 2007 SP1. URL for hotfix HTTP://support.microsoft.com/hotfix/kbHotfix.aspx?kbnum=960804 This URL is provided for the reader's convenience. It is not an endorsement of products or services by Intel Corporation.

2.24.2009 QA1319

Failure of collection-based power control in Microsoft* SCCM SP1

PROBLEM	In a Microsoft* SCCM hierarchy with a central site and a primary child site, power control operations from the central site work for some clients and fail for others. The same power control operations work correctly from the child site.
RESOLUTION	Not all client settings are being transferred up the Microsoft SCCM hierarchy to the central database. This issue will be resolved in the Microsoft SCCM SP2. Alternatively, system administrators may change the TlsMode setting in the dbo.AMT_MachineProperties table in the SCCM site database, it should be set to "1" for each client.

10.09.2009 QA1362

Cannot provision HP* DC7700 using Microsoft* ConfigMgr SP1 and PKI method

PROBLEM	The HP* DC7700 with Intel(R) AMT firmware build 2.2.10.1039 has a date/time stamp issue with the certificates that prevents remote provisioning. The Microsoft ConfigMgr logfile AMTOPMGR.LOG shows error 0x80090308 that indicates a problem with the certificate.
RESOLUTION	Update the firmware to to 2.2.20 or later. The firmware is available on the HP* website.

11.16.2009 QA1364

Management Engine

Maximum number of agents that can be monitored simultaneously

PROBLEM

How many agents can the Intel Management Engine monitor at one time?

RESOLUTION

This data is undocumented, however, testing shows that Intel AMT 2.0 can monitor up to sixteen agents.

NOTE: The number of agents that can be monitored depends on how the ISV is implementing agent presence.

12.20.2007

Hewlett-Packard 6910P returns UUID=00000 during activation

PROBLEM

HP 6910p returns a hello packet of UUID=00000 during activation.

RESOLUTION

This is a known issue with the firmware and will be fixed when the 2008 platform is released.

Meanwhile, your customers can request a BIOS update from HP to work around this issue.

12.20.2007

Running virtual machines and DHCP can cause Intel AMT to be inaccessible

PROBLEM

Using DHCP in a virtual machine can cause Intel AMT to become inaccessible when you close the virtual machine session. This is because your computer and Intel AMT will now have different IP addresses.

RESOLUTION

To work around this issue, exit the virtual machine session(s) and then do one of the following:

Reboot your system.

Release and renew the IP address as follows:
1. Click Start and choose Run.
2. Enter cmd and click OK.
3. At the command prompt, type:

ipconfig /release and press Enter.
ipconfig /renew and press Enter.

This is a known issue and will be updated as more information is available.

1.24.2008

Wildcard certificates are currently not supported for remote configuration

PROBLEM

When provisioning enterprises with multiple domains via remote configuration, individual certificates are required for each domain that needs to communicate with the Management Console. Wildcard certificates are currently not supported.

RESOLUTION

Wildcard certificate support is a feature request for AMT 3.2 (Weybridge) and AMT 2.6 (Centrino).

Meanwhile, you can workaround this issue by deploying an SCS server and a certificate for each domain.

MORE INFORMATION

This issue will be updated as more information becomes available.

1.24.2008

No inventory data available

PROBLEM

Inventory data does not appear after provisioning an Intel AMT client, even though the provisioning process was successful and without errors.

RESOLUTION

POST needs to occur for the data transfer to take place. The inventory data resides within the BIOS SMI tables and cannot be successfully transferred to the Intel Management Engine and viewed by the WebUI or retrieved programmatically. The BIOS and ME handshake must occur during POST to transfer data. Make sure the system has run through POST, so that the inventory data is transferred from BIOS into ME.

1.30.2008

Weybridge issue causing network disconnects; impacting Dell Optiplex 755

PROBLEM

Currently shipping non-provisioned Intel(R) vPro(TM) or Intel(R) AMT PCs on some Weybridge configurations may report a network disconnect/reconnect on five minute cycles when the 24 hour provisioning period expires while in a low power state. An unused security feature of Intel(R) AMT triggers the network disconnect and then resets the network connection on 5 minute cycles.

RESOLUTION

This issue has been resolved in the A09 BIOS release from Dell for the Optiplex 755. The BIOS release is available at the following URL:

http://support.us.dell.com/support/downloads/download.aspx?c=us&l=en&s=gen&releaseid=R181510&formatcnt=1&libid=0&fileid=247483

Click here for the update.\

2.27.2008

Synchronizing the operating system and the Intel AMT hostname.

PROBLEM

Is there an automated way to synchronize the operating system and Intel(R) AMT hostname?

RESOLUTION

The Intel(R) AMT Reflector tool\ is now available on the Intel(R) vPro(TM) Expert Center.

See the Tools wiki\ for more helpful vPro tools.

Best Practices: Setting up application servers and Internet Explorer* for Intel(R) AMT Kerberos support

Verify that your Internet Explorer settings are correct for pass through authentication.
- Open Internet Explorer and choose Tools > Internet Options > Advanced Tab.
- Select Enable Integrated Windows Authentication. Exit and restart Internet Explorer before attempting to access the Intel AMT device.
Install these Kerberos patches on the system you will use to access the Intel(R) AMT device.
- WindowsServer2003-KB899900-X86-ENU.exe
- WindowsServer2003-KB908209-X86-ENU.exe
- WindowsServer2003-KB899900-X86-ENU.reg
If you are using Windows XP* as the operating system for the computer used to access the Intel AMT web interface, then install these patches:
- WindowsXP-KB899900-X86-ENU.exe
- WindowsXP-KB908209-X86-ENU.exe
- WindowsXP-KB899900-X86-ENU.reg
Ensure that the time settings for the Intel AMT client(s), domain controllers, and the application server are synchronized.
Before provisioning:
- Create an AMT OU on the domain controller existing on the domain on which your Intel(R) AMT devices reside. For example, if your device exists on child.parent.com, and your provisioning server (or Intel SCS) resides on parent.com, then create an OU for AMT objects on child.parent.com.

IMPORTANT: If there are multiple domains, then add an OU to each domain.

Provision your Intel AMT client.

5.30.2008

Network issues with NS Lookup

PROBLEM

A single vPro machine can be accessed via WebUI, but does not appear in DNS. Its name does not get resolved in NSLookup?

RESOLUTION

NSLookup does not use the standard client resolver routines but uses similar routines of its own. If true, this means a valid name-IP record could be cached on the client and being used by IE to resolve the name even though NSLookup fails to resolve the name and there is no DNS record.

To determine this, do the following:

In the command prompt program, enter ipconfig /displaydns to inspect the cache for the dns record.
Enter ipconfig /flushdns to clean out records and retry (it should fail if there is no DNS record).

6.13.2008

Does Intel AMT 3.0 support Windows 2000 Active Directory?

For support of Windows 2000 Active Directory, AMT 3.2 is required. Intel AMT 3.2 was released to the OEMs during Q1 2008. Please contact your OEM to find out when the update will be publically available.

6.13.2008

Switching from NAC to 802.1x results in loss of connectivity

PROBLEM

In an EAC*-enabled network, where a NAC or NAP server is deployed and configured to request “posture” or SoH, Intel® AMT connectivity may be lost to clients that are not in H0 state if the server configuration is modified to work with 802.1x only.

RESOLUTION

If the NAC/NAP server configuration is changed to work with 802.1x only, then do one of the following:

Restart LAN switch ports, or
Restart the clients.

6.25.2008

Using Intel(R) AMT wirelessly without user intervention

PROBLEM

Intel AMT wireless connectivity is not available when the operating system is running and the user is not logged in.

RESOLUTION

To work around this issue, configure the Single Sign On (SSO) driver to maintain a wireless connection. Once the SSO properties are set according to the table below, Intel® AMT will be able to connect to the wireless profile using Microsoft* Windows credentials before the user actually logs on.

SSO Properties

Pre-logon. This feature is identified with the “SSO” term. It allows you to connect to a wireless profile using the Windows credentials entered by the user before the actual Windows log-in.

Persistent. This feature allows you to connect to a wireless profile that doesn’t require user credentials (but alternatively requires “system credentials”), in case the user is not logged on (either after reboot or after log-off). In order to use it, the IT admin has to configure such a profile that doesn’t rely on user credentials.

Security. Profiles for pre-logon and persistent connect are stored securely on the machine, cryptographically bound to the machine so that it cannot be transferred to another machine. The profiles are shared across all users on the machine, but certain user-based credentials such as PACs are stored on a per-user basis.

NOTES

Microsoft Windows XP users: Using persistent connection adds a service to handle establishing connections when users are not logged on.

Microsoft Vista users: The persistent connection is enabled on a per profile basis if the configured EAP (Extensible Authentication Protocol) method supports authentication with machine credentials.

7.16.2008

Cannot provision a system that uses an underscore in the host name

PROBLEM

Cannot provision a system that uses an underscore in the host name.

SOLUTION

Special characters cannot be used in host names. DNS host names may only contain dash "-", letters or numbers. Underscores and other special characters are not supported by the RFC's that define host name conventions. Some DNS servers, including Microsoft's, can support host names outside of the RFC specifications. See the links below for more information.

MORE INFORMATION

Microsoft KB article 909264: http://support.microsoft.com/kb/909264

RFC 952: http://www.ietf.org/rfc/rfc952.txt

RCF 1123: http://www.ietf.org/rfc/rfc1123.txt

9.5.2008

Does the Intel SCS automatically push updates to the CRL (Certificate Revocation List) to clients?

SOLUTION	The CRL does not automatically update on the clients. It needs to be pushed down from the SCS, by pushing it to individual AMT clients via the Operations screen, or to all clients via the Global Operations screen in the SCS Console.
MORE INFORMATION	The Certificate Revocation List contains the revoked certificates maintained by a CA. It is used when Intel AMT clients are configured to use Mutual TLS (MTLS) authentication.

9.5.08

Firewalls may not let Intel(R) AMT clients communicate with management consoles

PROBLEM

The wired LAN NICs are not recognized by the Intel AMT management consoles. They do show up in the DHCP listings in the Microsoft SMS* and Altiris* demos. Only the wireless NICs were discovered as Intel AMT devices. IPCONFIG on each notebook shows IP addresses assigned to both WLAN and LAN NICs.

When the firewalls are turned off, the Intel AMT consoles can communicate with the LAN NICs.

SOLUTION

9.5.08

Cisco ACS Certificate Configuration for Intel AMT

See this article to find specific configuration information.

10.15.08

What are some common hardware issues that are tracked by Intel® AMT?

SOLUTION

ASF Sensor Events

Temperature
Voltage
Fan
Chassis Intrusion
System FW Error (descriptor codes and descriptions are in the ASF spec 2.0) Examples:
Unrecoverable hard disk/ATAPI/IDE device failure
No video device detected
FW ROM corruption detected

BIOS Events

System Boot Failure
BIOS errors

OS Events

OS Hangs

12.4.08

Q&A on customized Intel® AMT firmware

DESCRIPTION

Scenario: a customer would like to have an OEM deliver systems with custom Intel® AMT firmware settings and client certificate.

QUESTION 1: Will the customized firmware force the customer to use only customized firmware or BIOS updates for future releases?
ANSWER 1: The custom settings and client certificate will be preserved across firmware or BIOS updates if the OEM inserts the customized bits before the descriptor region manufacturing bit is locked.

QUESTION 2: Can an OEM customize all the Intel® AMT management engine settings?
ANSWER 2: Yes. All the features seen on the web GUI can be customized by an OEM.

QUESTION 3: Does Intel have a list of default settings for each OEM?
ANSWER 3: No. Customers should contact their OEM for the latest available information.

Caution: The custom settings and client certificate will not be preserved across updates if the OEM programmed the firmware after setting the descriptor manufacturing bit. This will require users to reinstall the client certificates before the systems can be managed.

SOLUTION

Customers should work with their OEM to develop a custom firmware image, then run a small pilot program to test it. Clear the CMOS and then try to reprovision the systems.

2.13.09 QA1308

Wrong IP address for Intel ME on Lenovo M58p using Hypervisor

PROBLEM

For a system runing a Hypervisor on a platform with Intel(R) AMT 4.x or 5.x, the mismatch between the IP address assigned to the physical hardware and the guest operating system will prevent the manageability software from communicating with the Intel ME.

RESOLUTION

To sync-up the IP addresses, do the following:

Modify the configuration settings so that Dom0 is configured to use the virtual MAC address.
Assign #1 Guest operating system with the physical MAC address of the Intel ME NIC.

This soluton will produce the following result:

The hardware initialization then the VMM and Dom0 will be brought-up.
Dom0 will provide the physical MAC address to the #1 Guest operating system, and virtual MAC addresses for each subsequent guest operating system.
The #1 Guest operating system will initiate a DHCP request with the physical MAC address.
The management console will now be able to communicate with the Intel ME using the IP address assigned to #1 Guest operating system.

9.11.2009 QA1366

Microsoft Systems Management Server (SMS) Add-on

Fix available: Microsoft System Management Server (SMS) Add-on V3.0 has local echo when using Serial over LAN (SoL)

PROBLEM	When performing SOL/IDER with SMS Console V3.0, the SOL console screen is set for local echo to be on and it cannot be disabled.
RESOLUTION	This issue is fixed in version 3.1 of the SMS Add-on, which you can download at http://softwarecommunity.intel.com/articles/eng/1356.htm.

Updated 2.8.2008

Fix available: Using the Intel AMT add-on for Microsoft SMS 2003 on a Dell 755 returns a UUID error

PROBLEM

Using the Intel AMT add-on for Microsoft SMS 2003 on a Dell 755 returns this error:

Current system UUID is different from last discovered UUID. Please rediscover the system.

RESOLUTION

An Intel AMT add-on for Microsoft SMS 3.0 hot fix 3 is available online at http://www.intel.com/software/sms-add-on.
This hot fix removes the continuity check between the SMBIOS and the Digest UUID, which was determined to be an unnecessary check.

MORE INFORMATION

Click here to download the hot fix\.
Please review the release notes\ and the Read Me\ file to learn more.

12.20.2007

Fix available: The Intel AMT Add-on for Microsoft* SMS is unable to communicate with the SCS over a standard HTTP connection.

PROBLEM	The Intel AMT Add-on for SMS will communicate with the SCS over an HTTPS/SSL connection, however it will not communicate over an insecure HTTP/non-SSL connection, even if TCP port 80 is defined in the Intel AMT Add-on configuration.
RESOLUTION	Upgrading to version 3.1 of the Intel AMT Add-on for SMS resolves this issue. The update can be obtained from: http://softwarecommunity.intel.com/articles/eng/1356.htm

2.8.2008

Do management workstations running the SMS console and SMS Add-on require patches as outlined in the documentation for the Intel(R) AMT Add-on for Microsoft SMS*?

PROBLEM

The SMS Add-on documentation states that two hot fixes and registry patches are required. Are these patches/hot fixes required on the workstations that are running the Microsoft SMS console and Intel AMT add-on only?

Are they required only if the end user from that workstation is planning to use the web interface?

Are they required for the SMS add-on to function properly?

RESOLUTION

These patches are required on a management workstation if you wish to access the web interface on vPro clients.

5.8.2008

OEM

BIOS

Lenovo* M55p returns UUID=00000 during activation

PROBLEM

Lenovo M55p systems return a hello packet of UUID 00000 during activation. This problem occurs on machines that shipped with factory-default BIOS of 36 or less.

RESOLUTION

A firmware update to version AMT2.1.0.1032 is available from Lenovo to resolve this problem. Contact your Lenovo representative if you need this update.

A BIOS update is not required, but is recommended. Visit the Lenovo web site and navigate to the Support & downloads section of the site to find BIOS 37a.

10.19.2007

Dell* 755 returns a duplicate UUID during activation

PROBLEM

Dell 755 returns a duplicate UUID 00000 during activation.

RESOLUTION

A BIOS update (version A04) resolves this issue and is available on Dell's web site.

Click here to download the A04 BIOS update.\

Note: If you are using the Intel AMT add-on for Microsoft SMS 2003, then you also need to download Hot fix 3. See Using the Intel AMT add-on for Microsoft SMS 2003 on a Dell 755 returns a UUID error\ for instructions.

1.24.2008

Ctrl + P prompt missing when CMOS battery unplugged

PROBLEM

When the CMOS battery is unplugged from the HP 7800p, the Ctrl+P command for accessing the Intel Management Engine is missing.

When SCS is opened and the refresh button is selected, the Intel AMT device does not appear.

RESOLUTION

Use the following steps to the resolve this issue:

Press F-10, when prompted during the boot, to access the BIOS on the system.
In the BIOS choose the advanced menu -> Power-On Options and select the “MEBx Setup Prompt”
Use the right arrow key to cycle it to “Displayed.”
Press F-10 to accept the change.
Go to the file menu and select Save Changes and Exit.
The Ctrl-P prompt will reappear.

2.7.2008

When Intel AMT is disabled, there is a HECI driver problem in the HP* dc7800

PROBLEM

In vPro-capable HP dc7800 systems, when Intel AMT is turned on, everything works fine. When the Intel AMT driver is turned off in the Intel Management engine, the Intel HECI driver in the operating system causes an error to occur in the device manager: "device cannot start".

RESOLUTION

Follow these steps to correct this problem:

Boot the client and press Ctrl + P to access the AMT/ME configuration settings.
Go to the Intel ME Configuration and press Enter.
Type Y to continue.
Select Intel ME Features Control and press Enter.
Select Manageability Feature Selection and press Enter.
Select None and press Enter.
Press ESC to go back to the main screen.
The system will reboot.
Go into device manager and verify that there are no failed devices.

2.14.2008

What does the Intel AMT status application dialog box signify?

PROBLEM

On brand new vPro systems, the Intel AMT Status Application dialog box displays the Intel AMT Status as "Enabled" even though Intel AMT has not been configured. Are OEMs shipping systems with Intel AMT enabled (provisioned)?

RESOLUTION

The Intel AMT status application is designed to show if the Intel AMT is or is not enabled in the Intel Management Engine. It does not reflect if a system has been provisioned/configured. Even when Intel AMT is disabled in the Intel Management Engine, the Intel Management Engine can still be accessed. OEMs do not ship provisioned systems unless that service is requested and purchased by the customer.

2.14.2008

Are there DLLs in the operating system that access vPro?

PROBLEM	Are there DLLs, in the operating system, that access vPro?
RESOLUTION	Individual OEMs manage the Microsoft Windows drivers that use Intel vPro technology. To access current drivers for clients, visit the OEM’s website.

2.14.2008

Unattended install of Intel(R) AMT client software/drivers not working properly on Microsoft Windows*

PROBLEM

Command line switches are not working properly to enable a silent install with the Intel AMT drivers.

RESOLUTION

The issue is that the wrong hyphen/dash character is being used. If the code is copied from an MS Word* document, the regular hyphen is replaced with another hyphen-like character which causes the command line options to work incorrectly.

Typing the command, rather than copy and paste, solves this problem.

2.27.2008

SoL/IDER does not work with the Lenovo* X61 Tablet

PROBLEM

The SoL/IDER sessions do not work on the X61 tablet.

RESOLUTION

This issue is resolved using the 1.07 BIOS release.

Visit the Lenovo web site and navigate to the Support & Downloads section of the site to find BIOS 1.07.

2.27.2008

SoL/IDER can’t be disabled on Lenovo* M55p

PROBLEM	Unchecking SoL and IDER, under the network tab, isn’t disabling the feature on the Lenovo M55p.
RESOLUTION	Update the BIOS to version 37a or newer versions. Visit the Lenovo web site and navigate to the Support & Downloads section of the site to find BIOS 37a or later.

3.4.2008

BIOS password screen unavailable on HP* systems during SoL session

This problem occurs when the Terminal Emulation Mode is not set correctly in the BIOS.

Here is the screen when Terminal Emulation Mode is set to VT100 through BIOS:

How to switch Terminal Emulation Mode:

Open the HP ProtectTools Security Manager, click BIOS Configuration, and then select System Configuration.
In the AMT Options section, change Terminal Emulation Mode to ANSI.
Click OK.

The BIOS Password screen is now available during SOL sessions.

4.25.2008

Dell* D630c laptops reboot when sent a shutdown command via Intel® AMT

PROBLEM

Sending the "power down" command to the Dell* D630c notebook immediately shuts it down, but then it automatically re-boots.

RESOLUTION

This issue is resolved in BIOS version A02 for the Dell* D630c. You can download the BIOS update package from Dell at the following URL**:

Click here.

**This Wiki contains links to other Internet sites. Such links are not endorsements of any products or services in such

sites, and no information in such site has been endorsed or approved by Intel, Inc.

11.25.2008

The look of the BIOS Setup screens using SoL depends on OEM support for terminal emulation modes

PROBLEM	Intel® AMT supports several terminal emulation modes. These are used to display the BIOS Setup GUI when using SoL. The look and feel may vary between manufacturers. Intel® AMT supports VT52, VT100, VT100+, and ANSI terminal emulation modes.
RESOLUTION	Check your OEM BIOS documentation for information about the supported terminal emulation modes and how to select the mode. Usually, the terminal emulation mode option will be in the Intel® AMT section of the BIOS Setup utility. Use ANSI mode for a more graphical looking display.

3.3.2009 QA1332

Platform: Averill

Are the Weybridge SoL and HECI drivers backward-compatible with Averill?

PROBLEM	Are the Weybridge SoL and/or HECI drivers backward-compatible with Averill? Can they be used and supported on an Averill platform?
RESOLUTION	Backward compatibility depends on the OEM and if they choose to support the drivers and platforms. For instance, HP does support the same drivers for 7700's, 7800's and 6910p, but other OEMs may not support the same drivers.

2.27.2008

Profiles

SCS

Intel SCS returns an error during a partial unprovision

PROBLEM	Partial unprovisioning of a system fails. The SCS log reports the following messages: "SOAP Failure (21): cannot partially unprovision AMT" or "SOAP Failure(21): cannot GetLowAccuracyTimeSync"
RESOLUTION	The partial un-provision command requires a FQDN to work. Accurate client DNS records are required to provide an FQDN for this functionality.

2.27.2008

Validation of SCS service users takes over 30 minutes when installed in a large Active Directory environment

PROBLEM	Validation of SCS service users takes over 30 minutes when installed in a large Active Directory environment
RESOLUTION	This issue is scheduled to be resolved in Intel(R) AMT SCS 5.0, to be released by the end of Q2.

2.27.2008

Setup and Configuration Service

GoDaddy* requires High-Assurance SSL certificates

PROBLEM

The standard domain-only validation SSL certificates from the GoDaddy Certificate Authority are not suitable for Intel AMT remote configuration. These types of certificates do not contain the OU information required by the firmware to accept them.

RESOLUTION

If GoDaddy is used as the CA, then request a High-Assurance SSL certificate, which should include the OU information required by the Intel AMT client.

For more information, see the Intel AMT SCS Installation and User Manual\, Chapter 3, section “Preparing Intel AMT for Future Configuration.”

1.25.2008

Using static IP addresses and Basic (formerly known as SMB) mode

PROBLEM	Intel AMT functionality works in DHCP IP with Enterprise mode and SMS. However, SMS does not find asset information from the vPro machine when using Static IP with Basic mode.
RESOLUTION	Static IP addresses are not recommended. If they must be used, then the Intel Management Engine and the operating system will each need their own static IP address in order for AMT to function properly.

1.25.2008

Error displays when provisioning HP* 6910p

PROBLEM

Setup and Configuration Service (SCS) reports an error when provisioning Hewlett-Packard (HP) 6910p computers when using Wake on LAN (WoL) power policies 4 and 5.

RESOLUTION

This error occurs for all HP platforms shipped in 2007 and there is no workaround. HP does not support these power policies and the SCS is accurately reporting that they are unsupported.

Escalate this known issue to your HP sales representative.

1.25.2008

Will PKI-CH consistently support wildcard certificates across Intel(R) AMT versions?

PROBLEM

Will the PKI-CH implementation currently available in Intel AMT 2.2, Intel AMT 2.6, and Intel AMT 3.0 consistently support wildcard RCFG certificates?

Intel AMT 2.6 supports wildcards; but Intel AMT 2.2 and 3.0 do not. Will Intel AMT 2.2 and 3.0 will support wildcard certificates?

RESOLUTION

There are no plans to enable support for wildcard certificates in Intel AMT 2.2 or any future updates for that generation of hardware. There are plans to support wildcard certificates in the future release of Intel AMT 3.2

3.4.2008

SCS service crashes due to excessive logs

PROBLEM	The SCS service crashes repeatedly due to excessive logs. In the SCS Win Log, the OLE database error for timeout is displayed.
RESOLUTION	Reduce the database logs to a reasonable size, based on available processes.

2.27.2008

Network Load Balancing of SCS Servers

PROBLEM	Are there any known issues or limitations in pointing provisionserver.company.com to a Network Load Balancing address that balances between two or more SCS servers (all are in the same domain)?
RESOLUTION	The SCS support team confirmed that this is a supported configuration, provided all the SCS servers point back to a single SCS database.

2.27.2008

Is SNMP Trap Service required for SCS?

PROBLEM

Is the Microsoft Windows* SNMP trap service required in the latest SCS version?

RESOLUTION

The SNMP trap service is not required for installing or using SCS, but it is required for the Intel® AMT Add-on for SMS* V3.0 to receive PET alerts from Intel AMT clients per the SMS manual.

It is used as a receiver for platform trap events. Clients can be configured to send platform traps to an SNMP service. Since the Intel AMT Add-on is capable of configuring clients, an SNMP trap service is required during installation for a complete solution.

3.4.2008

Intel(R) AMT Active Directory error message

PROBLEM

After setting the properties for the Intel AMT system, the status goes to InProvisioning, but nothing changes. The logs contain the following message: Cannot create AD AMT Object: Failed on CreateDSObject with ht-73207ty, - Process Delayed.

RESOLUTION

This error message normally occurs for the following reasons:

The AD schema extension has not been applied
The Schema extension has been applied, but the SCS service user does not have necessary permissions to AD OU to create and manage Intel AMT ME objects.

If the extension for the AD schema is not needed, then uncheck the Active directory Integration checkbox in the SCS General Settings screen to prevent SCS from trying to create AD objects during provisioning.

3.4.2008

Organizational Unit Field in Configuration Parameters must be populated to complete provisioning

PROBLEM	SCS cannot complete provisioning of a system if the Configuration Parameters do not have a value specified in the OU column, even if the SCS is not using the Integrated with Active Directory option. Users must either manually add a value (during the manual process) or define a value when using remote tools like the RCT.
RESOLUTION	This is a known issue with SCS and it is slated to be corrected in SCS 5.0.

3.4.2008

Unable to access web interface using Kerberos authentication

PROBLEM	The web interface cannot be accessed using Kerberos authentication. When the Firefox web browser was used, Admin authentication could be accessed, but the https digest could not be accessed. Internet Explorer* cannot access either Admin authentication or Https digest.
RESOLUTION	If the AD schema is not extended, the Kerberos user authentication will not work. Using digest users resolves this issue.

3.21.2008

Is Static IP addressing possible in Enterprise Mode?

PROBLEM	What is the technical limitation of having static IP addresses in an Enterprise Mode environment and what would be workarounds that would allow a customer to use both? Since DHCP dynamically updates DNS, if you manually entered DNS suffix in Intel(R) Management Engine and maintained DNS manually then would that allow customers to use static IP addresses with enterprise mode?
RESOLUTION	While this is not recommended, the DNS entries can be maintained as described in the question. Multiple computer entries, in the management console, will be needed for managing clients that use Static IP.

3.21.2008

Is it possible to have an operating system with static IP address and Intel® Management Engine in DHCP mode?

PROBLEM	Is it possible to have an operating system setup with static IP address and Intel Management Engine setup for DHCP mode? Can the IP address of the operating system and Intel Management Engine be on different subnets? Or do they need to be on same subnet?
RESOLUTION	This scenario is not supported and has not been tested.

3.21.2008

Cannot log into SCS Console with Enterprise Admin account

PROBLEM	The SCS console can only be logged into using the initial setup account that is provided during SCS installation. Any attempts to log in with a user account that has enterprise admin rights and has been added to SCS Users and Groups fail. The error message received is: Login Failed and the reason is: The remote server returned an error: (502) Bad Gateway.
RESOLUTION	The root cause is that the customer has an Internet Explorer* configuration that uses a proxy. On the https connection, both the SCS console login and the SCS service uses the same proxy settings and that causes it to fail with error 502 bad gateway. Un-checking the use of the proxy in Internet Explorer solves the problem.

3.21.2008

Intel® MEBX, Web UI, and remote admin passwords are not automatically synchronized

PROBLEM	Changing the Intel® MEBX password from the local console will not change the Web UI or remote admin passwords.
RESOLUTION	Before the Intel® AMT system is provisioned, changing the Intel MEBX password from the local console will also change the remote admin password. After the system is provisioned, changing the local Intel MEBX password will not change the remote admin password. During provisioning, the Intel MEBX password and the remote admin password can be set.

04.28.2009

Using international keyboards to create MEBx passwords via Setup and Configuration Service (SCS)

PROBLEM

When creating a MEBx password via SCS and deploying to client machines located in different countries, IT administrators are advised that international keyboards may have different layouts for Latin characters. This may result in password failures as a result of entering the same password on two different keyboards supporting different languages.

As an example, a multi-national company headquartered in France may deploy a client to one employee in France and Japan. Because the keyboard layouts are different, the passwords may be inadvertently different and may fail when entered on a different keyboard.

Below is a comparison of different language keyboards.

Japanese keyboard

US English keyboard

RESOLUTION

When creating your password, use character keys that are common between all keyboards and follow the guidelines below. These guidelines assume that the password is user-defined. In high security instances, the password will be auto-generated and you will need to compare the keyboard layout diagrams to help determine your MEBx password.

The following is a list of keyboard keys that are common keys for all keyboard types: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, B, C, D, E, F, G, H, I, J, K, L, N, O, P, R, S, T, U, V, X

EXCEPTION: These keys are not common between Japanese and US keyboards: 2, 8, and 9. Be sure to use the illustrations above to verify common keys when creating passwords.

Note: Passwords can be created using characters generated by the Key and Shift Key

MEBx passwords require special characters to ensure security. Use SHIFT+N, where N equals 0, 1, 2, 3, 4, 5, 6, 7, 8, or 9, to include special characters in your password.

For example, if your strong password is JOK&F49!, you would relay this password to international users as:

Passwords using the A,M,Q,W,Y and Z keys can cause problems and are not recommended.

5.7.2008

What is the Authorized column in SCS?

PROBLEM	The Intel(R) AMT Systems screen of the SCS web console has a column titled Authorized. All the systems that are provisioned show up as False. What does this column mean?
RESOLUTION	The Authorized column signifies systems that can be provisioned that have not been authorized to complete the process.

5.8.2008

SOAP error (0xCFFF06AC) when attempting remote configuration

PROBLEM

When attempting to use the latest SCS with RCT 3.3 with a Remote Config Cert from GoDaddy, this error displays in SCS: Cannot handle provisioning exception: (0xCFFF06AC) SOAP Failure (23): getFullCoreVersion: SSL error - SSL authentication failed in tcp_connect(): check password, key file, and CA file.

RESOLUTION

The remote config certificate needs to be in the personal store of the SCS service account.

Log into your server with the SCS service account.
Launch MMC.
Select File > Add/Remote Snap-in.
Select Certificates from the snap in menu and click Add.
When prompted, select My user account and click Finish.
Click the Close button to close the snap-in selection window.
Click OK to close the snap-in Add/Remove menu.
Open Certificates, then open Personal.
Right-click the Personal folder, select All Tasks and then Import.
Use the wizard to import your remote configuration certificate into personal store of your SCS service account.

6.13.2008

Local Manageability Service (LMS) does not allow host VPN traffic when environment detection is not defined

PROBLEM

If environment detection is not configured, Intel AMT VPN connection cannot be enabled even though there is no direct relationship between these two.

RESOLUTION

Define the DNS suffix in the environment detection list with one which matches with the host's list of DNS suffixes.

To define the suffix:

Open the Intel SCS Console.
Expand the Configuration Service Settings branch.
Select Profiles. The Profiles screen displays.
Select the profile to be modified.
Click Edit. The Profile Configuration dialog box displays.
Display the Network tab.
Click Environment Detection.
In the Environment Detection dialog, click Add.

Enter up to five domain suffixes that define permitted domains within the enterprise network. The Intel AMT device uses this list to determine whether the platform is operating inside or outside the enterprise network. Management consoles can define the behavior of the device when it is outside the enterprise, including setting a policy that will block network traffic.

9. Click OK.

7.18.2008

Unable to remove wireless profiles in Intel SCS

PROBLEM	Error code 998 displays when trying to remove a wireless profile in the SCS, indicating that the profile is in use.
RESOLUTION	This error is generated if the wireless profile you are using is assigned to a system profile within the SCS. In order to delete the wireless profile, first remove it from any system profiles.

7.18.2008

Time synchronization errors using Intel(R) SCS 3.x and Active Directory

PROBLEM

The client machine logs errors related to setting the time when time synchronization is enabled in Intel SCS 3.x and the OS is also using Active Directory to synchronize system time.

|RESOLUTION|Disable time synchronization in SCS 3.x.|

7.28.2008

SCS Installation Account Security Requirements

PROBLEM	What are the minimum security requirements required for the account which is installing SCS?
RESOLUTION	The account needs to be a member of the local administrators group and an administrator on the SQL server.

7.28.2008

SCS 5.0 Does Not Support 64-bit Operating Systems

PROBLEM

SCS 5.0 does not support 64-bit operating systems. Customers using 64-bit operating systems need to use SCS 5.1 or later.

At this time there is no workaround for SCS 5.0 to support 64-bit operating systems. This issue is not documented in the SCS 5.0 documentation.

SOLUTION

SCS 5.1 supports 64-bit operating systems.

9.25.2008

The SCS Console Operator role does not appear to give users the right to access the security keys

PROBLEM	The SCS Console Operator role does not appear to give users the right to access the security keys, which conflicts with the documentation and is a pre-requisite for an operator performing a pre-provisioning function.
SOLUTION	This issue was fixed in SCS 5.0.

11.25.2008

Consistent RCFG failure with SCS

PROBLEM

Remote configuration fails consistently when attempting to provision clients with SCS. The error message in the SCS log is 'Cannot handle provisioning exception: (0xCFFF06AC) SOAP Failure (23): getFullCoreVersion: SSL_ERROR_SSLerror:14094438:SSL routines:SSL3_READ_BYTES:tlsv1 alert internal error - SSL connect failed in tcp_connect()'

The provisioning server has the correct (non-wildcard) RCFG certificate and certificate chains from the signing Certificate Authority. The client domain name from the DHCP server (option 15) matches the domain in the RCFG certificate and the SCS domain. The server also correctly provisions clients using the TLS-PSK method.

The Clients can also be correctly provisioned using RCFG when connected to a separate test network.

SOLUTION

Intel® AMT supports a maximum encryption key length of 2048-bits.

12.4.2008

How often are log files purged in Intel SCS?

PROBLEM	How often does the SCS purge log files and can the retention date be configured?
SOLUTION	There are maintenance procedures that SCS executes once every five minutes: cspi_cleanRequestStatus and cspi_cleanLog. These procedures did not execute automatically in SCS 3.3 and earlier. This was fixed in SCS 3.3. Both procedures will execute automatically. The default value of cspi_cleanRequestStatus is five days.

12.4.2008

Is the Intel® SCS supported on EMT64 bit versions of Microsoft Windows* Server?

SOLUTION

The 3.x versions of the SCS are not supported on EMT64 versions of Windows Server. SCS 5.0 is supported in 32-bit mode on EMT64 enabled versions of Windows* Server.

Download SCS 5.0 at http://software.intel.com/en-us/articles/download-the-latest-version-of-intel-amt-setup-and-configuration-service-scs

12.4.2008

Can't import setup.bin made with USBFILE2.EXE into the SCS

PROBLEM	The USBFile version 2 utility was used to create PID/PPS pairs, but the SCS console cannot import the setup.bin file. It displays an error message indicating the supplied setup.bin has an incorrect file format.
SOLUTION	USBFILE2's file format is not supported by the SCS at this time. Use the -v 1 switch with USBFILE2 to force it to create a v1 file, or use the original USBFILE utility.

12.4.2008

The SCS Console Operator role does not appear to give users the right to access the security keys

PROBLEM	The SCS Console Operator role does not appear to give users the right to access the security keys, which conflicts with the documentation and is a pre-requisite for an operator performing a pre-provisioning function.
SOLUTION	This is a known issue and will be fixed in SCS 5.0.

11.25.2008

Minimum security requirements for installing Intel(R) SCS

SOLUTION

The user installing Intel® SCS must be a member of the local
administrators group and a SQL administrator. The user
installing the software does not need to be a domain
administrator.

4.2.2009 QA1326

Intel(R) SCS is only supported on English versions of Windows* Server 2008

SOLUTION

Check future versions of Intel SCS to determine if it is supported on non-English versions of Microsoft* Windows* Server 2008.

9.18.2009 QA1381

USB Provisioning

USB provisioning only effective on "factory new" systems

PROBLEM	USB provisioning failed after multiple attempts.
RESOLUTION	This is by design. USB provisioning only works on a "factory new" system, meaning that it has never been provisioned. Once Intel(R) AMT is provisioned, the one-touch USB method will not work again until the CMOS battery is pulled and reset.

11.9.2007

USB Key Configuration Guidelines

Use these criteria when preparing a key for USB provisioning:

Keys should only be formatted with Intel SCS. Keys should be formatted as a FAT16 device with a null volume label.
Setup.bin must be the first file on the key. If the file is overwritten, or erased and then re-added, it may no longer be the first file on the key. Always reformat the key before a new setup.bin file is copied to it.
Keys should be 2GB or less. FAT16 cannot address more than 2GB on these devices.
Purchased keys should not have any preinstalled software on them.
Keys should only be used for USB key provisioning and not for any other purpose.
Keys should never have been created as a bootable device.
BIOS settings can impact USB provisioning. If you experience problems, load the manufacturer's default BIOS settings before doing USB provisioning.

12.20.2007

USB Compatibility Matrix for Intel® Centrino® with vPro Technology (Intel® AMT 2.5)

The keys marked YES are acceptable for USB provisioning. The keys marked NO are not recommended for USB provisioning. New keys were used in these tests.

System	Model	BIOS	SanDisk 1GB Cruzer Micro SDCZ61024A10	Kingston 1GB DT1001GBKR	Sony 1GB Micro Vault Classic USM1GJ	PNY 2GB Optima Pro Attached Enhanced for Windows ReadyBoost PFD02GHSPFS
Acer	TravelMate 6592	1.53	Not supported	Not supported	Not supported	Not supported
Dell	Latitude D630c	A09	Yes	Yes	Yes	Yes
FSC	LifeBook E8410	1.16	Not supported	Not supported	Not supported	Not supported
HP	2510p	F.0D	Yes	Yes	Yes	Yes
HP	6910p	F.16	Yes	Yes	Yes	Yes
Lenovo	ThinkPad T61	7LETB9WW(2.24)	No	Yes	No	No
Lenovo	ThinkPad X61 Tablet	7SET31WW(1.19)	No	Yes	No	No
Lenovo	ThinkPad X300	7TUJ05US (1.08)	No	Yes	No	No
Samsung	NP-P55	07AY	Not supported	Not supported	Not supported	Not supported
Toshiba	Protege M700	1.40	Not supported	Not supported	Not supported	Not supported
Toshiba	Tecra M9	1.90	Not supported	Not supported	Not supported	Not supported

*Fujitsu-Siemens Corporation (FSC) and Toshiba do not support USB provisioning on their Intel® Centrino® Pro processor technology platform.

04.23.09

USB Compatibility Matrix for Intel® vPro™ Technology (Intel® AMT 3.x)

The keys marked YES are acceptable for USB provisioning. The keys marked NO are not recommended for USB provisioning. New keys were used in these tests.

System	Model	BIOS	SanDisk 1GB Cruzer Micro SDCZ61024A10	Kingston 1GB DT1001GBKR	Sony 1GB Micro Vault Classic USM1GJ	PNY 2GB Optima Pro Attached Enhanced for Windows ReadyBoost PFD02GHSPFS
Intel Desktop Board	DQ35JO	86.A.0954.2008.0922.2331	Yes	Yes	Yes	Yes
FSC	Esprimo P5925	6.00 R1.15.2584.A1	Yes	No	Yes	No
Dell	Optiplex 755	A11	Yes	Yes	Yes	Yes
HP	dc7800	01.24	Yes	Yes	Yes	Yes
Lenovo	ThinkCentre M57p	2RKT57AUS	Yes	No	Yes	No

04.23.09

USB Compatibility Matrix for Intel® vPro™ Technology (Intel® AMT 4.x)

The keys marked YES are acceptable for USB provisioning. The keys marked NO are not recommended for USB provisioning. New keys were used in these tests.

System	Model	BIOS	SanDisk 1GB Cruzer Micro SDCZ61024A10	Kingston 1GB DT1001GBKR	Sony 1GB Micro Vault Classic USM1GJ	PNY 2GB Optima Pro Attached Enhanced for Windows ReadyBoost PFD02GHSPFS
Acer	TravelMate 6493	v1.02	Yes	Yes	Yes	Yes
Dell	Latitude E6400	A11	Yes	Yes	Yes	Yes
Fujitsu	LifeBook 8420	v1.06	Yes	Yes	Yes	Yes
HP	EliteBook 6930P	68PCU ver F.0E	Yes	Yes	Yes	Yes
Lenovo	T400	7UET43WW (1.15)	Yes	Yes	Yes	Yes
Lenovo	X200	6DET30WW (1.07)	Yes	Yes	Yes	Yes
Toshiba	Tecra A10	1.90	Yes	Yes	Yes	Yes

04.23.09

USB Compatibility Matrix for Intel® vPro™ Technology (Intel® AMT 5.x)

The keys marked YES are acceptable for USB provisioning. The keys marked NO are not recommended for USB provisioning. New keys were used in these tests.

System

Model

BIOS

SanDisk 1GB

Cruzer Micro

SDCZ61024A10

Kingston 1GB

DT1001GBKR

Sony 1GB

Micro Vault
Classic

USM1GJ

PNY 2GB Optima

Pro Attached

Enhanced for

Windows ReadyBoost

PFD02GHSPFS

Lenovo

M58p

5CKT40AUS

Yes

dc7900

786G1 v01.11

Yes

Dell

OptiPlex 960

A01

Yes

04.23.09

USB Provisioning Tips for Lenovo T61

Use these tips when provisioning a Lenovo T61 notebook:

Don't attempt to USB provision after a forced power off (holding the power button for 5 seconds). Only attempt a USB provision after a normal shutdown or restart.
If the USB key fails to provision, load the factory BIOS defaults and try again. If this does not resolve the issue, then do the following:

Disable Intel(R) AMT from the BIOS.
Boot the system with the USB key.
Re-enable Intel AMT from the BIOS.
Provision the system using the USB key.

2.12.2008

What is the maximum number of PID/PPS pairs that can be used during USB provisioning?

PROBLEM

Customers activating a high number of systems using One Touch/USB provisioning may run into performance degradation attempting to import these keys in a management console.

RESOLUTION

There is no theoretical limit to how many PID/PPS pairs can be on a USB key, but there may be a threshold above which the performance degrades significantly. At this time, the largest known deployment using USB provisioning was with a 30,000 PID/PPS pair. Altiris* was unable to process this setup.bin file, however the Intel SCS Console was able to import these keys despite the timeout error that the console indicated.

4.29.2008

Automating PID/PPS key generation using LANDesk utility

There is a utility available in your LANDesk installation that allows you to quickly generate a specific numbers of PID/PPS pairs for USB provisioning. Follow these instructions; the steps represent a standard installation.

Open Windows Explorer and navigate to your LANDesk program files.
Open the managementsuite folder and locate AMTUSBFile.exe.
Open a command window and navigate to the path where AMTUSBFile.exe resides. Use the table below to run the utility.

To do this...	Then type this and press Enter...
List all available parameters	AMTUSBFile.exe –h
Generate X number of pairs	AMTUSBFile.exe –c current ME password new ME password –n number of pairs For example, to generate 625 records would take ~1 second: AMTUSBFile.exe –c admin Landesk1! –n 625
Import the keys from the generated setup.bin to the LANDesk database	AMTUSBFile.exe –i Note: LANDesk uses an encrypted string when saving credentials to the database. Sometimes, this encrypted string is invalid to databases, such as Oracle. If this occurs, you may need to run the command several times before the keys are added. Records already imported will not be imported again.
Verify the list of records in the database	AMTUSBFile.exe –g

6.27.2008

*Other names and brands may be claimed as the property of others.

Unable to Provision Windows 7 via SCCM

webadmin@intel.com — Wed, 25 Nov 2009 09:36:03 GMT

Mike,

Glad to hear you got things working finally. Remote provisioning with Configuration Manager does require you to be using DHCP. Static IPs can be used if you are provisioning in SMB mode (I think). I don't typically get into the SMB side of things.

I'll add this to my checklist for remote provisioning issues for ConfigMgr

Cheers,

Trevor Sullivan

Do it yourself - Power on, patch, and go back to sleep with 4, free .exes

jacob.gauthier@intel.com — Thu, 19 Nov 2009 23:54:40 GMT

Having worked with Intel Active Management Technology and Intel vPro Technology since version 1.0, it seems to me that there are a whole host of possibilities for those who are do-it-yourself-ers. One is the ability to programmatically wake a system, remotely trigger a process such as a software patch, and then put the system back to sleep. As it turns out, this is not so hard, even for me who has a limited scripting (read batch file) capability. The video chronicles the results of my effort.

Disclaimer: this is not meant as a how-to or best method. Rather, it is an exploration of what’s possible, meant to educate and stimulate conversation. With that out of the way, let’s get to the fun stuff.

To accomplish this goal I knew I'd need some help via command line tools. I did an Internet search and found these 4 freely downloadable tools that made it all possible. They are;

Remote Control Util - to determine the current power state and turn the system on.

PsService - to start a process remotely

PsShutdown - to put the system back to sleep

sleep.exe - so the batch file can sleep while an event takes place.

The setup is simple; 2 systems. One is the console that executes the batch file and these commands. The other is my vPro system. I setup and configured my it using this Use Case Reference design (another of my batch file creations). That is to say, there's no TLS and I'm using only the admin account. I then ran the batch file on the console system which triggered the whole process. The process is as follows:

1. Remote control util gets vPro's original power state via AMT (on, sleep, hibernate, or off)

2. Remote control util power's on vPro via AMT

3. Remote control util get's vPro's new power state to verify it has turned on

4. ping vpro and check the TTL. Once it changes to <=128 the OS has booted. For more info

5. PsService starts a process on vPro. I used notepad but it could be anything, including triggering a download and run of software patch

6. PsService exits when the process finishes

7. PsShutdown gracefully places vPro back to it's original sleep state

8. Remote control util get's vPro's new power state to verify it has returned to it's original power state

Couple of notes.

· I set an auto login on my vPro so I could see the process. However, PsService will work without a user being logged in. Also, it can run processes in the back ground so an end user would not be able to interact.

· I used Notepad as my remote process since it made it easy to see success. However, any process can be started. In fact, PsService supports downloading the executable to run. As such, it may be possible to download and then run a patch or batch file as part of this whole process

· I used a single vPro system. But, with a simple loop the same core batch file could trigger this action on many vPro systems.

Hope you found this post enjoyable and thought provoking. If you have your own do-it-yourself vPro ideas, or want to recreate this one, please share. And, hey, who says batch files are dead?

Success Story: Packet Vision Achieves up to a 200% Performance Increase in IPTV Advertising Insertion Stream Density by Migrating to the Intel® Xeon® Processor 5500 Series

sally.sams@intel.com — Tue, 24 Nov 2009 17:01:10 GMT

Intel® vPro™ Technology and HP SDP* for Telecom Operators

sally.sams@intel.com — Tue, 24 Nov 2009 16:22:37 GMT

PC Refresh Cycles and Windows 7 … what’s the financial connection?

webadmin@intel.com — Tue, 24 Nov 2009 04:23:28 GMT

It’s understandable that in today’s economy that you might consider pushing out your PC refresh cycle to save cash today. This is an area of cost cutting that many companies consider so you’re not alone. But if you have considered, or are considering, pushing out your PC refresh cycle, have you factored in all of the costs that impact that decision? These costs include the unexpected costs of supporting older machines once the warranty has expired, higher energy costs compared to new machines, and more. The total cost of ownership starts to increase out in time and will eventually reach a point where it makes more sense to replace your PCs versus continuing to maintain them. But how do you know what the optimal replacement time is? And is delaying your refresh really the best financial decision?

There are strong financial reasons to refresh PCs now and, with the Windows 7 operating system, there are even stronger reasons to do so with PCs powered by Intel® Core™ 2 processors with vPro™ technology. Join me for a webcast on Tuesday, December 1^st, where I’ll walk through our analysis on the PC refresh cycle and the framework we use, discuss the true cost of older PCs and how to assess your own PC refresh cycle, and share our experience with Windows 7 as part of the Technical Adopter Program (TAP). I’ll also be joined by Amy Stephan from Microsoft who will provide more insight into why it makes sense to refresh now and why Windows* 7 and New PCs with Intel® vPro™ Technology are better together.

Webinars: Learn More About Intel vPro Technology

webadmin@intel.com — Fri, 17 Jul 2009 20:54:49 GMT

Getting Started

Introduction to Intel® vPro™ Technology

Management Consoles

Microsoft System Center Configuration Manager

Activate Today! Realize ROI with Intel® vPro Technology and Microsoft System Configuration Manager
Intel® vPro™ Technology with Microsoft System Center - Session 1
Intel® vPro™ Technology with Microsoft System Center - Session 2

Symantec Altiris

Enhancing the Symantec Management Platform (Altiris) with Intel® vPro™ Technology
Activate Today! Realize ROI with Intel® vPro Technology and Symantec Altiris
Lower Your IT Manageability Costs with Intel vPro Technology and Symantec Altiris CMS

Technologies

Dynamic Virtual Client

Introduction to Dynamic Virtual Client with Intel vPro Technology

Intel Anti-Theft Technology

Securing Your Environment with Intel Anti-Theft Technology
Intel® Anti-Theft Technology with Absolute Software

Microsoft Windows 7*

Use Cases

Power Management

Energy Efficient Performance with Intel® vPro™ Technology and Verdiem Surveyor

Getting Started

Introduction to Intel® vPro™ Technology

Jeff Torello covers the basics of Intel vPro Technology in this webinar. Learn what it is, how you can use it to simplify your IT environment, and next steps for activating your PCs with Intel vPro technology.

Aired 8.19.09

The Bottom Line on Hardware Refresh

IT capital budgets are more challenging than ever. Many IT departments have postponed their PC refresh, but applying models from the corporate finance office can reveal the true costs of older hardware. Intel and Dell subject matter experts take an in-depth look at the balance sheet to help you determine an optimal refresh cycle.

Management Consoles

Microsoft System Center Configuration Manager

Activate Today! Realize ROI with Intel® vPro Technology and Microsoft System Configuration Manager

Join the team from the Intel vPro Expert Center for an informative Webcast on the ROI savings and activation process for PCs with Intel® vPro™ technology and Microsoft System Configuration Manager.

Aired 7.15.09

Intel® vPro™ Technology with Microsoft System Center - Session 1

This webinar covers the important prerequisites for the infrastructure and configurations necessary in Microsoft System Center Configuration Manager (SCCM) to take advantages of the Intel vPro use cases – Power Management and Remote Diagnostic and Repair. After this session, you will have a general understanding how to configure your SCCM SP1 environment to support Intel vPro technologies and start leveraging the use cases to improve support for the end customer. For detailed explanation of all configuration steps, it will be necessary to review the online training session: http://bit.ly/Hn2n

Aired 5.8.09

Intel® vPro™ Technology with Microsoft System Center - Session 2

The webinar covers Intel(r) vPro technology features, such as built-in manageability, proactive security, and energy-efficient performance. This session will demonstrate how you can take advantage of Microsoft System Center's Configuration Manager 2007 SP1 to provision, discover, accomplish help desk features to break/fix, and do remote power control for Intel vPro clients.

Aired 5.22.09

Symantec Altiris

Enhancing the Symantec Management Platform (Altiris) with Intel® vPro™ Technology

Terry Cutler, a Solution Architect at Intel, discusses the benefits of using the Symantec Management Platform to manage your PCs with Intel vPro technology. Terry demos several use cases in this webinar.

Aired 9.2.09

Resources and recording from Symantec Altiris & Intel vPro webinar

Activate Today! Realize ROI with Intel® vPro Technology and Symantec Altiris

Join the team from the Intel vPro Expert Center for an informative Webcast on the ROI savings and activation process for PCs with Intel® vPro™ technology and Symantec Altiris.

Aired 7.8.09

Recording and Q&As Available: Activate Today! Realize ROI with Intel® vPro Technology and Symantec Altiris

Lower Your IT Manageability Costs with Intel vPro Technology and Symantec Altiris CMS

Nearly 90 percent of an organization’s IT budget and time is spent keeping their business running securely and smoothly. When provisioned with Altiris solutions, computers with Intel vPro processor technology allow unprecedented ability to solve business IT problems.

Aired 4.16.09

Technologies

Dynamic Virtual Client

Introduction to Dynamic Virtual Client with Intel vPro Technology

This webinar will go over the spectrum of client computing models and guide you towards the model that accomplishes centralized management, policy-driven data security with client-side computing. Intel® vPro™ Technology can be leveraged to ease your Windows 7 operating system enterprise deployment and reduce the end user disruptiveness the transition may cause.

Watch it on-demand! Intro to DVC recording now available

Aired 11.17.09

Intel Anti-Theft Technology

Securing Your Environment with Intel Anti-Theft Technology

Today’s business environment is extremely difficult. All types of organizations are being asked to do more with less. And with the cost and impact of PC theft, security has become even more important to corporations and IT leaders. Join us to hear how IT professionals can take advantage of new technologies to protect their business. Join Dr. Larry Ponemon (Ponemon Institute), Mike Schulien (Intel), and Geoff Glave (Absolute Software) as they discuss the impact of data breaches, Intel Anti-Theft technology, and Computrace Software from Absolute.

Click to read the Q & As.

Aired 6.23.09

Intel® Anti-Theft Technology with Absolute Software

This webinar introduces Intel® Anti-Theft Technology (Intel® AT). Intel AT provides a set of hardware and software security building blocks to disable lost/stolen laptops with a poison pill, disable access to data, and allow simple and secure reactivation for recovered laptops.

Aired 6.2.09

Microsoft Windows 7*

Windows 7 and Intel vPro Technology - Technical Overview

This webinar will give you a technical overview of the Windows 7 operating system and Intel® vPro™ Technology and how they complement each other to enhance the manageability and security of the business client. The webinar will also focus on how Intel® vPro™ Technology can be leveraged to ease your Windows 7 operating system enterprise deployment and reduce the end user disruptiveness the transition may cause.

Miss the Win7 and Intel vPro technical webinar? Recording now available.

Aired 11.18.09

Use Cases

Power Management

Energy Efficient Performance with Intel® vPro™ Technology and Verdiem Surveyor

The webinar focuses on Intel® vPro™ technology's energy efficient performance and how it can save money by reducing PC energy usage. This session includes demos of specific use cases with Verdiem Software.

Aired 6.19.09