Intel Communities: Message List

Re: Service Manager KVM Disconnect Error

webadmin@intel.com — Wed, 29 Sep 2010 20:28:30 GMT

Prior to invoking KVM from within Service Manager, the AMT client must be provisioned. Service Manager depends on System Center Configuration Manager 2007 SP2 to perform the AMT Client setup and configuration. Has the AMT client been provisioned by SCCM?

--Matt Royer

Re: Problem with AMT 2.6.6

webadmin@intel.com — Fri, 04 Jun 2010 01:12:39 GMT

Typically this is caused by the full certificate chain not being passed correctly during a SOL/IDER session within SCCM. I'm assuming you are using a tiered certificate authority infrastructure (root CA -> policy CA -> subordinate (issuing CA).

Try place a copy of the Subordinate Certificate Authority certificate in the Local Computer - "Trusted Root Certificate Authorities" of the server or workstation that the Out Of Band Management Console is run from.

http://communities.intel.com/docs/DOC-4153

--Matt Royer

Re: vPro and SCCM

webadmin@intel.com — Wed, 09 Apr 2008 18:03:49 GMT

Performing a network discovery only assess if a client is vPro capable. To provision the AMT client within SCCM SP1 you need to either use the Import Out of Band Wizard or initiate provisioning through the SCCM SP1 client agent.

To provision via the out of Band Import Wizard, please reference the following blog on the steps. http://communities.intel.com/community/openportit/vproexpert/blog/2008/02/11/using-sccm-sp1-import-out-of-band-computer-wizard-to-provision-a-vpro-client

To provision via the SCCM Client agent, first install the SCCM SP1 client on the client and then place that client in a collection that is configured with the provisioning policy. To set the provisioning policy, right-click a collection that contains computers to be provisioned in-band, click Modify Collection Settings, and select Out of Band. Select Enable automatic out of band management controller provisioning, and then click OK.

Matt Royer

Re: Problems with the provisioning of SCCM SP1

webadmin@intel.com — Wed, 03 Feb 2010 16:38:38 GMT

Sorry... I meant to specify the <ConfigMgrInstallationPath>\Logs\Amtproxymgr.log (not the AMTOpMgr.log). Actions around AD and CA request are tracked in more detail in the Amtproxymgr.log

It could be a trust issue since the server AD Object (machine object) that SCCM Site Server in running on is what is used to authenticate with the CA. Take a look in the Amtproxymgr.log to see if you can get a more specific error.

--Matt Royer

Re: Problems with the provisioning of SCCM SP1

webadmin@intel.com — Tue, 02 Feb 2010 18:25:03 GMT

This problem is usually caused by the SCCM Server AD Object not having proper permissions (Read, Enroll, and Autoenroll) on the AMT Web Server Certificate Template on your CA. Configuration Details found here: http://technet.microsoft.com/en-us/library/cc161804.aspx#BKMK_AMTwebserver

You can also find more details on what is causing the Certificate Request failure in the AMTOPMGR.log on the SCCM Site Server.

--Matt Royer

Re: Provisioning stopped after CA Rebuild

webadmin@intel.com — Thu, 08 Oct 2009 17:01:38 GMT

If they rebuilt the CA infrastructure... i would make sure the CA template that you are explecting to use is still there and you still have the appropriate permissions to that template.

--Matt Royer

Re: Provisioning stopped after CA Rebuild

webadmin@intel.com — Thu, 08 Oct 2009 15:02:47 GMT

Johnny,

The submit failure usually cased by... Not being able to find the Issuing CA or the SCCM Site Server not having sufficent permission to request the certificate. I would recommend checking the following...

Verify that you have created the Web Server Certificates template on your Certificate Authority and that your SCCM Primary Site Servers has the appropriate permission. SCCM SP1 Help File Article: "[Step-by-Step Example Deployment of the PKI Certificates Required for AMT and Out of Band Management|http://technet.microsoft.com/en-us/library/cc161804(TechNet.10).aspx]"; Section: "Preparing the Web Server Certificates for AMT-Based Computers".
Verify that you have configured the certificate template in the Out of Band Management Properties: General Tab. SCCM SP1 Help File Article: "[How to Configure AMT Provisioning|http://technet.microsoft.com/en-us/library/cc161966(TechNet.10).aspx]"; Section: "To configure the out of band management component for AMT provisioning"; Steps: 7-8.

--Matt Royer

Re: Vpro MSCCM Certificate Question

webadmin@intel.com — Wed, 23 Sep 2009 18:52:28 GMT

Unfortantly, SCCM requires the use of a MSFT Enterprise Certificate Authority; this is due to the dependancy on the Enterprise CA templates which are used in the SCCM Out of Band Service Point configuration. CA Templates are not supported on Windows Server 2003 standard edition.

--Matt Royer

Re: AMT OU in AD is empty

webadmin@intel.com — Sun, 20 Sep 2009 00:16:16 GMT

Kin,

The problem you are seeing with the out of band console and the amt web console is directly related to the lack of an AMT AD object in the OU. 95% of the time, this issue is directly related to the lack of SCCM Server Object permissions on the AD OU; however, from what you described below, your settings sound correct. During the provisioning process, what does the AMTProxyMgr.log on the primary site server (running the Out of Band Service Point Role) say?

--Matt Royer

Re: Using WMI to query AMT within

webadmin@intel.com — Sun, 20 Sep 2009 00:09:33 GMT

As noted by David, The SCCM will collect hardware information on if the client is AMT capable; however, it will have a dependency on the ME / Heci Driver being installed.

You may also want to take a look at the AMT Scan utility. You can run it as a SCCM Advertisement and it will record the AMT information in the registry. From there you will need to programmatically extract the information for some type of report.

In regards to your example...

An example would be, for a Lenovo M58p in an SCCM collection, use WMI to determine if AMT is turned off in the BIOS, and if it is turned off, push out an advertisement to turn it on, and then initiate provisioning.

... it is a little bit of cart before the horse. The AMT client needs to be provisioned before you can power on the AMT client or programically query power state.

You could run the following SCCM AMT Site Server Operation Script via and advertisement on your collection. Just create an advertisement that runs the following command...

cscript sccmamtmgnt.vbs /s:YourSccmSiteFQDN /c:SiteCode /a:discovery

... It will initiate a network interrogation on the desired client to depend if it vPro capable. If all goes well, it will determine that an AMT status of the client as "Not Provisioned". From there you can created a collection where AMTStatus=3 and set the policy to initiate "Automatic provisioning".

--Matt Royer