Intel Communities: Message List - OOB Management Console Connects to AMT-Based Computers but Does Not Display Information

Re: OOB Management Console Connects to AMT-Based Computers but Does Not Display Information

mamason@cbbank.com — Fri, 03 Oct 2008 20:54:48 GMT

Thank you for the response.

I have verified that the system account for the Primary site server does have full control to the OU where the AMT objects are being creating. No change in results.

Please let me know if there are additional items that I can do to resolve this issue.

Is there a support number that specializes in AMT provisioning and SCCM integration.

Re: OOB Management Console Connects to AMT-Based Computers but Does Not Display Information

webadmin@intel.com — Wed, 01 Oct 2008 01:35:16 GMT

Mamason,

Verify that the SCCM Primary Site Servers has been granted full control permissions on the out of band management OU. Reference SCCM SP1 Help File Article: "[How to Prepare Active Directory Domain Services for Out of Band Management|http://technet.microsoft.com/en-us/library/cc161814(TechNet.10).aspx]". You should also look in the AMT OU you specified and ensure that an object for the vPro client created after provisioning. Remember that SCCM server object needs to have full control over that OU and all child objects within the OU.

--Matt Royer

Re: OOB Management Console Connects to AMT-Based Computers but Does Not Display Information

mamason@cbbank.com — Wed, 24 Sep 2008 15:38:22 GMT

I am having similar issues to those experienced in this thread and need to ask for your assistance to find a resolution

The following is occurring in my environment

Running SCCM SP1 with OOB mgmt configured

Using Internal CA with PKI infrastructure

MachineA has been provisioned via SCCM for the AMT device (v3.2.1) Provisiong took place after applying the CA cert root hash on the AMT device.

In my SCCM console, I can use the power control to reboot, power on and power off the device successfully.

I am unable to use the OOB mgmt console. I have turned on verbose logging on the OOB console and have similar logs to the log previously posted.

There is an account for the AMT device in AD that was generated during the provisioning process

Certs appear to be working properly. My CA shows a cert requested from the SCCM oob server, issued to machinea.domain.com. The template used was SCCM AMT web server cert.

I did notice that in the AMT bios settings the hostname reads machinea not machinea.domain.com. When I attempt to change the host name to machinea.domain.com, I receive a rejected response.

Please let me know if and where I am overlooking the resolution. We are in the process of signing a PO for the purchase of 500 new HP DC7800P and need to confirm these machines are capable of integrating with SCCM completely

Thank you for your help in advance

Matt M

OOBconsole.log

6~~9/24/2008 7:54:07 AM~~ :GetAMTPowerState fail with result:0x80070035

1~~9/24/2008 7:54:11 AM~~ :User disconnect

1~~9/24/2008 7:54:11 AM~~ :Closing SOL terminal...

1~~9/24/2008 7:54:11 AM~~ :SOL terminal closed

1~~9/24/2008 7:54:11 AM~~ :status message Type:Audit, ID:0x000000004000765D, User:CBB\mamason, Machine:D6257B, Target:T6257T add to queue, waiting for report.

4~~9/24/2008 7:54:17 AM~~ :Executing WQL: 'SELECT * FROM SMS_Site WHERE ReportingSiteCode = '''

4~~9/24/2008 7:54:17 AM~~ :ResultObject: '2da39d8f-3f4d-46aa-994e-093b91d0f454'

4~~9/24/2008 7:54:17 AM~~ :Executing static method SMS_Identification.GetProviderVersion()

4~~9/24/2008 7:54:17 AM~~ :No method parameters specified

4~~9/24/2008 7:54:17 AM~~ :Executing static method SMS_SiteControlFile.GetSessionHandle()

4~~9/24/2008 7:54:17 AM~~ :No method parameters specified

4~~9/24/2008 7:54:17 AM~~ :SCF session handle {a0c4e582-d2c8-4e03-8499-b04ef9b09a4e} successfully aquired

4~~9/24/2008 7:54:17 AM~~ :Executing static method SMS_SiteControlFile.RefreshScf()

4~~9/24/2008 7:54:17 AM~~ :Refresh of SCF successful

4~~9/24/2008 7:54:17 AM~~ :Initializer '{3F32691E-24B1-4b1e-9915-37B633F39392}', will no be run, unsupported application type

4~~9/24/2008 7:54:17 AM~~ :Executing static method SMS_StatusMessage.RaiseRawStatusMsg()

4~~9/24/2008 7:54:17 AM~~ :Success report status message Type:Audit, ID:0x000000004000765C, User:domain\user1, Machine:D6257B.

4~~9/24/2008 7:54:17 AM~~ :Executing static method SMS_StatusMessage.RaiseRawStatusMsg()

4~~9/24/2008 7:54:17 AM~~ :Success report status message Type:Audit, ID:0x0000000040007665, User:domain\user1, Machine:D6257B.

4~~9/24/2008 7:54:17 AM~~ :Executing static method SMS_StatusMessage.RaiseRawStatusMsg()

4~~9/24/2008 7:54:17 AM~~ :Success report status message Type:Audit, ID:0x000000004000765D, User:domain\user1, Machine:D6257B.

4~~9/24/2008 7:54:17 AM~~ :Executing static method SMS_SiteControlFile.ReleaseSessionHandle()

4~~9/24/2008 7:54:17 AM~~ :SCF session handle {a0c4e582-d2c8-4e03-8499-b04ef9b09a4e} has successfully released

4~~9/24/2008 7:54:17 AM~~ :IMR_RemoveClient with clientID=0 success.

1~~9/24/2008 7:54:17 AM~~ :IMR_RemoveAllClients success.

1~~9/24/2008 7:54:17 AM~~ :OOBConsole exit

GetAMTPowerState fail with result:0x80070035

Re: OOB Management Console Connects to AMT-Based Computers but Does Not Display Information

webadmin@intel.com — Tue, 02 Sep 2008 12:59:48 GMT

Hi Maras:

if you checked all permission is correctly, please make sure your vPro client FDQN and SCCM vPro name is same as DNS name. For example, you did not boot your OS and in BIOS, your host name in SCCM may be dell01.example.com, but your DNS show the machine is "mymachine.example.com" because DNS only remember your OS FDQN. Simple way is that you type "mymachin" into ME host name and reboot. It should work.

Thanks!

Bill

Re: OOB Management Console Connects to AMT-Based Computers but Does Not Display Information

webadmin@intel.com — Wed, 27 Aug 2008 04:56:59 GMT

Bill,

Unlike Bare Metal provisioning within SCCM where you need to provide the Hostname, FQDN, and UUID of the vPro client you are trying to provision and then awaiting a matching UUID hello packet from the vPro Client to initiate the provisioning... Agent Based provisioning pulls the required information (Hostname, FQDN, etc) from the OS and passes that to the Out of Band Service point to provision the vPro Client along with the One Time Password (extra security message used only for provisioning).

--Matt Royer

Re: OOB Management Console Connects to AMT-Based Computers but Does Not Display Information

webadmin@intel.com — Tue, 26 Aug 2008 09:31:57 GMT

*Hi Matt: *

One question for in-band provision on vPro machine with SCCM SP1: I saw <<**+ Intel vPro Out of Band Management Quick Start Install Guide>> in the web. It should be written by you. The In-band provision is a little different with OOB which I did in lab and SCCM help. If I follow the guide and do nothing on AMT ME and only turn-on AMT. Do I provision AMT in SCCMSP1 through SCCM Agent with inband provisioning if I only turn on AMT, but I don't type CA HASH, SCCM FDQN, SCCM server IP in AMT ME? Does SCCM agnet write CA HASH, SCCM server IP and FDQN information into ME when SCCM make inBand provisioning with vPro machine?+*

Thanks!

Bill

Re: OOB Management Console Connects to AMT-Based Computers but Does Not Display Information

webadmin@intel.com — Thu, 14 Aug 2008 01:47:07 GMT

During the provisioning process, a certificate will be generated for each vPro client. To check to see if a certificate was issued, connect to your issuing Certificate Authority (the CA that you configured to issue the certificates via Certificate Template) and expand "Issued Certificates"; you should see your certificate in the list. Open the certificate by double clicking on it and verify that the "Issue To" is set listed as the FQDN of the vPro Client.

Are you able to perform collection based power control? Can you right click on the vpro client in the collection and select "out of band management" -> power control and use power on/off/restart on the vpro client. If you you're your certificate is most likely set up correctly. Then you should check to ensure you the AMT Object was created properly in the OU; to verify, open up the OU container and see if the object was created. It is also imperative you have the appropriate permissions created in the OU and the permissions were applied to that and the child objects. Check out the SP1 Help File Article: "How to Prepare Active Directory Domain Services for Out of Band Management" on the proper configuration.

--Matt Royer

Re: OOB Management Console Connects to AMT-Based Computers but Does Not Display Information

webadmin@intel.com — Wed, 13 Aug 2008 19:43:06 GMT

Hi Miroyer,

I checked the permissions and are OK.

How to check whether CA issued the certification to AMT client?

Is necessary to generate and install a certificate for each client AMT?

Tks,

Maras

Re: OOB Management Console Connects to AMT-Based Computers but Does Not Display Information

webadmin@intel.com — Tue, 12 Aug 2008 22:11:49 GMT

Maras,

Can you provide your error messages you are seeing in <ConfigMgrInstallationPath>\Logs\amtopmgr.log and <ConfigMgrInstallationPath>\AdminUI\AdminUILog\Oobconsole.log.

If you are not able to perform collection based power or connect via the Out Of Band Console, there is a high potential that you certificate was not created problem. On your issuing CA, make sure you see a certificate for the vPro client and that the FQDN that the certificate was issued to is the FQDN of the vPro Client.

http://communities.intel.com/openport/docs/DOC-1627

Symptom: SCCM provisions a vPro Client successfully, but you are not able to invoke Collection power control operations or the Out of Band Console (does not connect)

Potential Root cause(s):

The current user logged on to the SCCM Console does not have sufficient right to perform the desired operation.

Verify that the user you are logged on with is listed or in a Kerberos group that is listed in the AMT User Account list. SCCM SP1 Help File Article: "[How to Configure AMT Settings and AMT User Accounts|http://technet.microsoft.com/en-us/library/cc161918(TechNet.10).aspx]"; Section: "To configure AMT settings and AMT User Accounts".

SCCM was unable to request or issue a Web Server Certificate on behalf of the vPro client during provision or the Web Server Certificates was issued to a different FQDN then the vPro Client.

Verify that you have created the Web Server Certificates template on your Certificate Authority and that your SCCM Primary Site Servers has the appropriate permission. SCCM SP1 Help File Article: "[Step-by-Step Example Deployment of the PKI Certificates Required for AMT and Out of Band Management|http://technet.microsoft.com/en-us/library/cc161804(TechNet.10).aspx]"; Section: "Preparing the Web Server Certificates for AMT-Based Computers".
Verify that you have configured the certificate template in the Out of Band Management Properties: General Tab. SCCM SP1 Help File Article: "[How to Configure AMT Provisioning|http://technet.microsoft.com/en-us/library/cc161966(TechNet.10).aspx]"; Section: "To configure the out of band management component for AMT provisioning"; Steps: 7-8.

Re: OOB Management Console Connects to AMT-Based Computers but Does Not Display Information

webadmin@intel.com — Tue, 12 Aug 2008 20:19:45 GMT

I have the same problem!

I have a vPro lab with SCCM SP1 and a Dell Optiplex 755 client, with 3.2.1 MEBx version, the client is provisioned without SCCM agent, but when y try to power on,off,restart nothing happens!

The OOB console try to connect but appears as disconnected.

Were you able to resolve it?

Help me, please?

Tks.