Intel Communities : Thread List - Intel® vPro™ Expert Center

AMT Web UI - SCCM Provisioned

webadmin@intel.com — Wed, 25 Nov 2009 23:15:34 GMT

Hi all!

I am having difficulty obtaining access to the Web UI on an SCCM provisioned device. I can successfully reach the Web UI at https://FQDN:16993

When i try to login however, the AMT Accounts i specified in SCCM are not working. I found a post by Trevor at http://communities.intel.com/thread/3037 outlining a similar situation. I have tried logging into the web ui from the SCCM server without success. I have tried inputing the registry key required by the KB article but that did not work as well. I have confirmed that the Kerberos ticket IS issued however the ticket is issued to an SPN of HTTP/FQDN and not HTTP/FQDN:PORT. Is this correct?

example

HTTP/laptop.domain.com instead of HTTP/laptop.domain.com:16993

I have verified that the SPN's for the OOB object in AD (created during the provision process) contains SPN's for 16992,16993,16994,16995

I have included a network sniff below showing what is going on. Anybody experience this at all?

Kerberos TGS-REP
    Record Mark: 1460 bytes
        0... .... .... .... .... .... .... .... = Reserved: Not Set
        .000 0000 0000 0000 0000 0101 1011 0100 = Record Length: 1460
    Pvno: 5
    MSG Type: TGS-REP (13)
    Client Realm: DOMAIN.COM
    Client Name (Principal): amtadmin
        Name-type: Principal (1)
        Name: amtadmin
    Ticket
        Tkt-vno: 5
        Realm: DOMAIN.COM
       Server Name (Service and Instance): HTTP/laptop.domain.com
            Name-type: Service and Instance (2)
            Name: HTTP
            Name: laptop.domain.com
        enc-part rc4-hmac
    enc-part rc4-hmac

Internal Enterprise Root CA Cert Expiration

webadmin@intel.com — Fri, 20 Nov 2009 22:39:13 GMT

Hi all,

If we have setup an internal root ca and have been manually importing the hash into vPro ME, what happens when the cert expires...? All of our clients will be provisioned using an expired cert. What would be the process to add the renewed cert...would it have to be a manual process?

SCCM Certificates required for child sites?

webadmin@intel.com — Wed, 25 Nov 2009 20:18:20 GMT

Good Afternoon all,

I am attempting to configure Wake on Lan for a customer who has multiple sites. We have purchased a provisioning cert from GoDaddy for the Central site server which also sefrves as the OOB management point for the site. So far provisioning has hit a few bumps (I'll be posting seperately about that) but some machines are provisioning. The site architechture is pretty simple. There is a central site with a few secondary sites below it, and a primary site below the central site, which also has some secondary sites below it. My question is, do I need to purchase another cert for the OOB management point in the primary site below the central site? If not, do I just import the sert I have now into the primary servers store?

Any and all help is appreciated.

Thanks!

Unable to Provision Windows 7 via SCCM

webadmin@intel.com — Fri, 20 Nov 2009 21:57:28 GMT

Hi all,

We have a Server 2008 R1 with SCCM 2007 R2 SP2 w/ WS Trans Mgmt installed and configrued. All is well and he have multiple Windows XP SP3 systems running on Lenovo T400 AMT 4.1.3 firmware. The issue we are having is with Windows 7 clients. The status that is showing up in SCCM is "Not Supported" and the logs for provisioing are below. I have bolded the item i think is the culprit.

The only option available, aside from divorcing the client from the site, is to in-band provision this machine via the ConfigMgr Client Agent. The oobmgmt.log on the client contains only success messages with nothing to indicate any problem. The AMT, SOL / ME Drivers were all installed correctly on the Windows 7 machine. The hash is also verified below as being in the ME BIOS.

After much review, i stumbled upon a document from technet stating that In-Band Provisioning via the SCCM SP2 agent is NOT SUPPORTED for Windows 7. The article can be reached here (Scroll down to the section regarding Out of Band Management toward the bottom).

Is this true? Can Windows 7 clients NOT be in-band Provisioned???

Thanks!

AMTOPMGR.LOG on SCCM server

Attempting to establish connection with target device using SOAP.
Found matched certificate hash in current memory of provisioning certificate
Create provisionHelper with (Hash: 12F303BCFA0508DB7C6132137A03A44BBE020006)
Set credential on provisionHelper...
Try to use provisioning account to connect target machine laptop.domain.com...
AMT Provision Worker: Wakes up to process instruction files
AMT Provision Worker: Wait 20 seconds...
Server unexpectedly disconnected when TLS handshaking.
**** Error 0x995ac80 returned by ApplyControlToken
Fail to connect and get core version of machine laptop.domain.com using provisioning account #0.
AMT Provision Worker: Wakes up to process instruction files
AMT Provision Worker: Wait 20 seconds...

Zero Touch Configuration

webadmin@intel.com — Mon, 23 Nov 2009 14:23:08 GMT

I am using a Local Agent to set Conf Server FQDN (command is 0x04000034), but unable to do.

Then I set Conf Server FQDN manually through BIOS Extn, but Local Agent unable to get FQDN which is set through BIOS Extn.

Can anybody tell me how to set Configuration Server FQDN using Local Agent & HECI driver ?

Is there any command to add temporary root certificate hash entry ?

Also all commands which can be performed through HECI driver.

Unauthorized Network Card is Plugged In - Lenovo T400

webadmin@intel.com — Fri, 20 Nov 2009 01:21:25 GMT

Hi,

I have a Lenovo T400 x86 laptop with AMT version 4.1.3 that is fully configured and functional with SCCM and vPro. it is provisioned and all is well. However, when i restart the computer from within SCCM OOB, i am hit with a BIOS message

1802: Unauthorized network card is plugged in - Power off and remove the miniPCI network card.

And am unable to restart the computer locally even with CTRL-ALT-DEL. i need to fully power off..]]

Has anybody experienced this at all?

Intel Matrix Storage Console

webadmin@intel.com — Tue, 17 Nov 2009 18:27:31 GMT

I have a database server with RAID1 configuration, it is not monitored however I need to be notified via email if a drive reports any errors. Does this Intel Matrix Storage Console have this available? If not, what options do I have to get this requirement met? Is there an HDD monitoring system that can warn me if a Hard drive reports failures or problems?

Intel AMT Add-on for Microsoft SMS 2003???

webadmin@intel.com — Wed, 18 Nov 2009 07:37:02 GMT

Hi,

I'm looking for the "Intel® AMT Add-on for Microsoft SMS 2003" but Intel all the time is redirecting me to "IT Director" download?

Does any one know what have happened with that Add-on?

And most important, where I can find latest version of this Add-on?

Problem with s3000 ah motherboard

nisha_loveall@yahoo.com — Tue, 17 Nov 2009 17:42:02 GMT

I have Intel S3000AH Motherboard.It doesn't have inbuild audio and video card, so i brought one audio card and nvdia graphic card for it.But now i am getting some problem with video card as the one i have is not fit for it. so can you help me and tell me which video card is best for this motherboard. This motherboard support 16x video card or 8x video card.Thanks.

SCCM SP1, AMT and Omnino III provisioning problems

webadmin@intel.com — Tue, 17 Nov 2009 13:44:27 GMT

I'm trying to provision our Viglen Omnino III's (AMT 5.1) for Out-of-Band management with SCCM SP1. We're using an internal CA. I have created a setup.bin using the Manageability Director Tool, using the 'Remote Configuration' to create ad export the setup.bin to a usb key. After a lot of struggle the test client finally moved off the 'detected' status to 'unsupported'.

SCCM does recognize the hash key, and the Provision task does run. But it throws errors :

"Failed to send TLS client hello message to server with errorcode=0x2733." and "**** Error 0x19fb95c returned by ApplyControlToken" and "Fail to connect and get core version of machine amttest.xx.local using provisioning account #0.".

When I trigger a Management Controller Discovery, I get the following errors:

"CAMTDiscoveryWSMan::DoConnectToAMTDevice: Failed to establish tcp session to 192.168.0.11:16992." and "CAMTDiscoveryWSMan::DoConnectToAMTDevice: Failed to establish tcp session to 192.168.0.11:16993."

For the purpose of this exercise, I have removed the firewalls.

Pointing a browser to 192.168.0.11:16992 or 16993 results in a 'webpage cannot be displayed' message.

Any idea where I'm going wrong?

We are facing to the problem of LAN interface on Linux

webadmin@intel.com — Tue, 17 Nov 2009 10:53:48 GMT

Hi everbody,

My name is Michael from NTT Communications.

If you know someting information to my problem, please let me know.

Our project team developed a private firewall from Miracle Linux with custmising IPTables on the number of about 1700 NEC Express 5800 PC Server and FT Server last year.

We delivered this to the about 1700 points in Japan.

We have to controll LAN side interface (as eth0 on Linux) by scheduling application, so should be down LAN side interface at the time and after should be up LAN side interface at another time by requesting from user.

We use the 'ifconfig eth0 down/up' command for this task.

Someday, we scheduled all of firewalls as be downed eth0 at 2AM JST and upped eth0 at 6AM JST.

A Interface down process was going nomal on all of the firewalls but a interface up process was not going nomal on some firewalls.

So the 'ifconfig eth0 down' was performed good but the 'ifconfig eth0 up' was performed not good.

We seemed the eth0 interface is nomal starting up after performing the 'ifconfig eth0 up', because we could see good status (=Link is UP) from performing the 'ifconfg eth0' and 'ethtool eth0'.

But those firewall could got packets from eth0 but could not send only one packet.

We have been resolving this for few months, but we can not resolve this.

We found a difference in case of nomal and another as show bellow.

In case of normal:

We found 'Link become ready" messages after massaging "Link is not ready" at starting up eth0 interface in syslog.

In case of failure:

We could not found 'Link become ready" messages after massaging "Link is not ready" at starting up eth0 interface in syslog.

But we could found "Link become ready" after 19 days on untouched those environment.

Environment:

Hardware: NEC EXPRESS 110Rh-1

OS: Miracle Linux ver4 (Kernel 2.6.9-42.7AXsmp)

Ethernet Card: Intel PRO 57273L

e1000driver: Intel PRO/1000 Network Driver - version 7.6.12-NAPI

Hardware: EXPRESS 320Fb-LR

OS: Miracle Linux ver4 (Kernel 2.6.9-42.18AXsmp)

Ethernet Card: Intel PRO 57273L

e1000driver: Intel PRO/1000 Network Driver - version 7.2.9-NAPI