Intel Communities: Message List

Re: WebUI takes two times to connect and authenticate

webadmin@intel.com — Mon, 07 Feb 2011 17:34:52 GMT

Update, so far James W. has written an application to resolve most of the problems with Reboot, Turn On and Turn Off commands without having the user to log in by hard coding a local user account in AMT. When trying to utilize the Kerberos method, we've notices it's a hit and miss with being able to connect to the machine. After further research, we're coming to a conlusion about the kerberos issue and we feel it's not something to do with the network or how certificate services are configured. Instead it's something with the code in the AMT chipset and how it's trying to interact with Kerberos. With this application, James W. added the option to utilize Kerberos or not. With Kerberos being an option, we're able to conclude without Kerberos interaction there is 100% functionality.

In conclusion, as of right now, if we create a local account through the WEBUI and utilize his program, it works perfect. However, once an update is pushed from SCCM, it overwrites the local memory and erases the local account which was created manually.

The Million Dollar questions are, How do we create a local account on the AMT chip either through SCCM or another product? And if we have to do it through a seperate product or script, then is there a way to have that automatically update when an update is pushed from SCCM?

WebUI takes two times to connect and authenticate

webadmin@intel.com — Tue, 01 Feb 2011 15:33:04 GMT

We have WebUI up and working. However, we're seeing a weird quirk happening. Sometimes, when we connect to the WebUI on a desktop (AMT v6.0) we can see the WebUI log in page and click the log in button and authenitcate quickly. Othertimes, we do the same thing and it doesn't connect, then we have to try again and wait about 30 seconds (estimated) and then it connects.

I know there should be a simple answer to this, but I don't know how to diagnose or review logs to find it.

Ideas?

Re: vPro Ports for VPN

webadmin@intel.com — Thu, 20 Jan 2011 16:34:41 GMT

We found the answer.

Open Intel vPro technology related network ports on routers and firewalls:
- 80 & 443 – Web Port
- 88 & 464 – Kerberos Port
- 389 (UDP) – LDAP Port
- 445 – Microsoft DS Port
- 2002 – CIRA Port
- 9971 – Provisioning Port
- 16992 through 16995 - OOB Management Ports

Re: vPro Ports for VPN

webadmin@intel.com — Mon, 17 Jan 2011 23:19:43 GMT

Thanks for a reply Steve, but I'm not trying KVM. All I want is for my end users to access the WebUI on each of the internal desktops. This way they can turn off, on or reboot their systems.

vPro Ports for VPN

webadmin@intel.com — Mon, 17 Jan 2011 15:25:46 GMT

Greetings,

I'm trying to find all of the ports we need to set on VPN to allow WEBUI access to a users computer.

so far, this is what we have set and configured.

80 Standard HTTP Port (Web UI)

443 Standard HTTPS Port (Web UI in SSL mode)

16992 SOAP commands in SMB mode *

16993 SOAP commands in TLS/Enterprise mode **

16994 IDE-Redirection in SMB mode *

16995 IDE-Redirection in TLS/Enterprise mode **

Problem: Able to see the login screen, however, unable to authenticate. I added the reg fix and it works if we open all ports. but once we restrict to the ports listed above, the login screen will not authenticate.

James

Re: WebUI not accepting password

webadmin@intel.com — Tue, 30 Nov 2010 17:02:17 GMT

Dan, I agree with you 100%. However, the time I'm have left at this client is not allowing me the time to create this. But, I'm glad you noted that on this thread.

Thanks,

James

Re: WebUI not accepting password

webadmin@intel.com — Mon, 29 Nov 2010 17:09:56 GMT

I'm thinking of just issueing rights through the SCCM AMT Components section to allow all users to use WEBUI. That way, they can turn on their machiens while at home when they need to RDP in. Also, the helpdesk can get the machine name and turn on, off or reboot the systems.

Re: WebUI not accepting password

webadmin@intel.com — Wed, 24 Nov 2010 19:23:24 GMT

Guys, the registry mod worked. I guess I need to write a script to deploy to everyone. People at home will need this to wake up their machine after they VPN into the network during the late hours. I did find that in the 6.0 release of the demo enviroment, Intel has included a PowerShell GUI for similiar commands. How do you guys have the helpdesk manage power on's or reboots when trying to work on a workstation?

THANK YOU!

I'm going to put it here, just in case someone needs it.

About the OOB Management Console from SCCM, at best I would rate it a 3 on a 1-5 scale. It's sporadic in what I've seen and it seems the Serial connection to the BIOS is "ok" but nothing I would recommend.

http://support.microsoft.com/kb/908209

After you install the hotfix, you must add the FEATURE_INCLUDE_PORT_IN_SPN_KB908209 registry key, and then set its DWORD value to iexplore.exe. To do this, follow these steps.

For 32-bit computers

Click Start, click Run, type regedit, and then click OK.
In the left pane, locate and then click the following registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl

On the Edit menu, point to New, and then click Key.
Type FEATURE_INCLUDE_PORT_IN_SPN_KB908209, and then press ENTER.
On the Edit menu, point to New, and then click DWORD Value.
Type iexplore.exe, and then press ENTER.
On the Edit menu, click Modify.
Type 1 in the Value data box, and then click OK.
Exit Registry Editor.

For 64-bit computers

Click Start, click Run, type regedit, and then click OK.
In the left pane, locate and then click the following registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl

On the Edit menu, point to New, and then click Key.
Type FEATURE_INCLUDE_PORT_IN_SPN_KB908209, and then press ENTER.
On the Edit menu, point to New, and then click DWORD Value.
Type iexplore.exe, and then press ENTER.
On the Edit menu, click Modify.
Type 1 in the Value data box, and then click OK.
Exit Registry Editor.

WebUI not accepting password

webadmin@intel.com — Tue, 23 Nov 2010 22:12:22 GMT

I have deployed SCCM SP2 with R3 and setup/configured OOB for AMT. I've successfully provisioned several computers and I'm trying to figure out how to get into the WebUI. In SCCM I've configured in OOB Management Settings/AMT Settings tab, a domain group and a domain user. I've tried a user within the group and no luck. I've tried the domain user and no luck. Any reason?

Re: How do I reset AMT chip on Dell laptops?

webadmin@intel.com — Mon, 22 Nov 2010 17:23:05 GMT

For both, you will remove the Coin Battery. I left it out for 5 minutes and everything was reset.

e4310

Removing the Coin-cell Battery

http://support.dell.com/support/edocs/systems/late4310/en/sm/TD_CoinCell.htm

e6410

Removing the Coin-cell Battery

http://support.dell.com/support/edocs/systems/late6410/en/SM/TD_Coin_Batt.htm