Intel Communities : Thread List - Microsoft Manageability

Issue with AMT provisioning with internal (subordinate) ca

webadmin@intel.com — Tue, 03 Nov 2009 12:54:38 GMT

Hello All,

I’m trying to verify if SCCM 2007 SP1 can provision and manage Intel vPro clients

if there are two Certification Authorities and AMT Provisioning certificate is issued by an Internal CA:

Note:

- I'm assuming that Intel supports this scenario

1) Root Enterprise CA

2) Subordinate Enterprise CA (this ca issues AMT Provisioning certificate and AMT Web Server Certificate)

Both ca are Windows Server 2003 Enterprise SP2 based.

This is my lab environments:

· 1 DC Windows Server 2003 SP2 based (this server is also Enterprise Subordinate CA)

· 1 Windows Server 2003 SP2 based (this server is also an Enterprise Root CA)

· 1 SCCM 2007 SP1 Windows Server 2008 SP2 x86 based

· 1 client Windows Vista SP2 Enterprise based (no sccm agent installed)

I would like to use out of band method.

Notes:

· SCCM request certificate to Enterprise Subordinate CA

· In Windows Client I’ve added Enterprise Root CA thumbprint

· Windows Vista client has been imported into SCCM 2007 using Import Out of Band Computer

SCCM 2007 can’t provision this computer.

I've found this message in SCCM amtopmg.log:

Description: A certificate is required to complete client authentication

In attachment there is an extract from amtopmgr.log

Has anybody any ideas ?

Thanks in advance.

Giovanni

AMT OU in AD is empty

webadmin@intel.com — Thu, 17 Sep 2009 06:27:01 GMT

Hello All,

we are experiencing the following problem:

we have MS SCCM 2007 SP1 R2 central site installed on windows 2008 SP2 enterprise with SQL Server 2008 Enterprise and using internal CA for our AMT machines. We have entered manually the certificate hash in the client machines.
What we experiencing is that we don't see any computer in the AMT OU in AD (it is empty!).
We have successfully provisioned some computers and we can stop and start them using SCCM, but we can't connect to them using the Out of band management console or through the web interface. We have granted full access to the AMT OU and all child objects as required according the documentation for the Primary Site servers group(we have followed Quick Start Install Guide for SCCM SP1 Rev1.9.1 ).
We have made also the required change in the registry according to the KB908209 (for the web based connection) and also tried to start the out of band management console from the central site, where the required patch KB960804 is installed.
A look in the amtopmgr.log give us no error, related to the AMT OU in the AD container. The error in the OOBConsole.log is the following:
==================================
GetAMTPowerState fail with result:0x80070035
==================================
When we tested the AMT technology in our test environment, we have in the AMT OU the computers which was provisioned.
So if anyone has a clue how can we solve this problem, please let us know.

Thanks in advance.

With best Regards
Kin

500 series switch

sam@itcomputer-solutions.com — Sun, 11 Oct 2009 23:35:45 GMT

HI,

I am trying to locate the origional version of LANDesk w/ Device view that Intel used to offer, if you can direct me to a copy it would be great.Have a client that refuses to upgrade from an old 510T switch but they lost the software disk that came with it in 1999.

Thanks, Sam

Lenovo M58P's Showing Detected

webadmin@intel.com — Mon, 21 Sep 2009 14:38:41 GMT

We are having difficulties provisioning Lenovo M58p workstations with AMT Firmware versions 5.0.2 and 5.0.3. The only way we have successfully provisioned an m58p is by resetting the MEBX from the BRIOS. We continually fail trying to provision via the SCCM agent. We have successfully provisioned other Lenovo models thorugh SCCM. Are there any known issues with M58p's or with firmware versions 5.0.x?

Vpro MSCCM Certificate Question

webadmin@intel.com — Tue, 15 Sep 2009 11:31:33 GMT

Hi,

I have Question about MSCCM and Vpro.

Is ti possible to create certificate with custom security settings in MS windows 2003 Standart edition Certification authority.

I want to start to use vpro features, but didn`t want to buy MS windows 2003 Enterprise edition to use Vpro functionality in MSCCM.

Power Operations Fail on a Provisioned Computer

webadmin@intel.com — Wed, 29 Jul 2009 09:33:13 GMT

Hi experts,

I have a vPro client computer with AMT 4.0. It was importeed successfully via the Import OOB Computers wizard, and after sending a "Hello- packet" it became provisioned. (The SCCM GUI displays AMT Status: Provisioned).

But when I try to perform power operations on this machine, they always fail with the following lines in the log:

AMT Operation Worker: Send task amt4.domaindemo.com to completion port 7/29/2009 10:59:29 AM 2176 (0x0880)
Auto-worker Thread Pool: Current size of the thread pool is 1 7/29/2009 10:59:29 AM 2176 (0x0880)
AMT Operation Worker: 1 task(s) are sent to the task pool successfully. 7/29/2009 10:59:29 AM 2176 (0x0880)
STATMSG: ID=7203 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_AMT_OPERATION_MANAGER" SYS=COMP SITE=JR1 PID=1744 TID=2176 GMTDATE=Wed Jul 29 08:59:29.890 2009 ISTR0="1" ISTR1="0" ISTR2="0" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0 7/29/2009 10:59:29 AM 2176 (0x0880)
AMT Operation Worker: Wait 20 seconds... 7/29/2009 10:59:29 AM 2176 (0x0880)
AMT Operation Worker: Wakes up to process instruction files 7/29/2009 10:59:29 AM 2176 (0x0880)
AMT Operation Worker: Wait 20 seconds... 7/29/2009 10:59:29 AM 2176 (0x0880)
AMT Operation Worker: Wakes up to process instruction files 7/29/2009 10:59:29 AM 2176 (0x0880)
AMT Operation Worker: Wait 20 seconds... 7/29/2009 10:59:29 AM 2176 (0x0880)
Auto-worker Thread Pool: Work thread 3884 started 7/29/2009 10:59:29 AM 3884 (0x0F2C)
session params : https://amt4.domaindemo.com:16993 , 11001 7/29/2009 10:59:29 AM 3884 (0x0F2C)
ERROR: Invoke(invoke) failed: 80020009argNum = 0 7/29/2009 10:59:31 AM 3884 (0x0F2C)
Description: A security error occurred 7/29/2009 10:59:31 AM 3884 (0x0F2C)
Error: Failed to Invoke CIM_BootConfigSetting::ChangeBootOrder_INPUT action. 7/29/2009 10:59:31 AM 3884 (0x0F2C)
AMT Operation Worker: AMT machine amt4.domaindemo.com can't be waken up. Error code: 0x80072F8F 7/29/2009 10:59:31 AM 3884 (0x0F2C)
Auto-worker Thread Pool: Warning, Failed to run task this time. Will retry(1) it 7/29/2009 10:59:31 AM 3884 (0x0F2C)

I've try to access this machine via Web - UI (https:\\amt4.domaindemo.com:16993) and the Security Alert says that the certificate is valid. Despite that, I get a "Page not found - Web browser access to AMT is disabled on this computer, or the page in the address bar is unavailable" page!!

What should I do???

Thank you all in advance - I hope you have a quick answer, this issue is quite urgent for me.

-Achinoam.

Power Operations Fail for Provisioned Machine

webadmin@intel.com — Wed, 29 Jul 2009 09:09:30 GMT

Hi experts,

Now I'm trying to deal with a vPro with AMT 4.0 machine.

I imported it successfully with the "Import OOB Computers" wizard, and it became provisioned after sending a "Hello packet".

(In SCCM GUI the AMT Status in Provisioned).

But when I try to perform power operations on this machine - I don't succeed, with the following lines in the log:

AMT Operation Worker: Send task amt4.domaindemo.com to completion port 7/29/2009 10:59:29 AM 2176 (0x0880)
Auto-worker Thread Pool: Current size of the thread pool is 1 7/29/2009 10:59:29 AM 2176 (0x0880)
AMT Operation Worker: 1 task(s) are sent to the task pool successfully. 7/29/2009 10:59:29 AM 2176 (0x0880)
STATMSG: ID=7203 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_AMT_OPERATION_MANAGER" SYS=JE-DEV-MS0 SITE=JR1 PID=1744 TID=2176 GMTDATE=Wed Jul 29 08:59:29.890 2009 ISTR0="1" ISTR1="0" ISTR2="0" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0 7/29/2009 10:59:29 AM 2176 (0x0880)
AMT Operation Worker: Wait 20 seconds... 7/29/2009 10:59:29 AM 2176 (0x0880)
AMT Operation Worker: Wakes up to process instruction files 7/29/2009 10:59:29 AM 2176 (0x0880)
AMT Operation Worker: Wait 20 seconds... 7/29/2009 10:59:29 AM 2176 (0x0880)
AMT Operation Worker: Wakes up to process instruction files 7/29/2009 10:59:29 AM 2176 (0x0880)
AMT Operation Worker: Wait 20 seconds... 7/29/2009 10:59:29 AM 2176 (0x0880)
Auto-worker Thread Pool: Work thread 3884 started 7/29/2009 10:59:29 AM 3884 (0x0F2C)
session params : https://amt4.domaindemo.com:16993 , 11001 7/29/2009 10:59:29 AM 3884 (0x0F2C)
ERROR: Invoke(invoke) failed: 80020009argNum = 0 7/29/2009 10:59:31 AM 3884 (0x0F2C)
Description: A security error occurred 7/29/2009 10:59:31 AM 3884 (0x0F2C)
Error: Failed to Invoke CIM_BootConfigSetting::ChangeBootOrder_INPUT action. 7/29/2009 10:59:31 AM 3884 (0x0F2C)
AMT Operation Worker: AMT machine amt4.domaindemo.com can't be waken up. Error code: 0x80072F8F 7/29/2009 10:59:31 AM 3884 (0x0F2C)
Auto-worker Thread Pool: Warning, Failed to run task this time. Will retry(1) it 7/29/2009 10:59:31 AM 3884 (0x0F2C)

I've tried to access it via Web - UI, the Security Alert message shows that the certificate is valid, but then I get the page - Web Not Found!!

What can be the reason? The provisioning process succeeded!!

Thank you all in advance - I'll be happy to get a quick answer, this issue is quite urgent for me.

-Achinoam

commu

webadmin@intel.com — Thu, 02 Jul 2009 07:06:30 GMT

community

Intel AMT Provisioning Error

webadmin@intel.com — Wed, 20 May 2009 12:36:52 GMT

Hello All,

we are trying to test Intel AMT technology with SCCM 2007 R2. The current version on the Lenovo machine M58, which we are using for testing is the following:

-----------------------------------------------------------------------------------------

Intel(R) MEInfo Win Version: 2.5.0.1032

BIOS Version: 5CKT48AUS

Intel(R) AMT code versions:
        Flash:                       5.1.0
        Netstack:                    5.1.0
        Apps:                        5.1.0
        Intel(R) AMT:                5.1.0
        Sku:                         18462
        VendorID:                    8086
        Build Number:                1167
        Recovery Version:            5.1.0
        Recovery Build Num:          1167
        Legacy Mode:                 False

Link status:                 Link up
Cryptography fuse:           Enabled
Flash protection:            Enabled
Last reset reason:           Power up
Setup and Configuration:     Not started
BIOS Mode:                   Post Boot

Error: The operation failed due to an internal error.
FWU Override Counter:        Always
FWU Override Qualifier:      Always
FW on Flash Desc Override:   Disable
Kedron Driver Version:       Not Available
Kedron HW Version:           Not Available
UNS Version:                 5.0.5.1102
LMS Version:                 5.0.6.1102
HECI Version:                5.0.1.1055

-----------------------------------------------------------------------------------------

We are using internal CA and have entered manually the thumbprint of our Root Test CA. We have tried with different passwords and we are sure that they are the same on both place SCCM and MEBx, but when we are trying to provision the machine we receive the following message:

-----------------------------------------------------------------------------------------

>>>>>>>>>>>>>>>Provision task begin<<<<<<<<<<<<<<<
Provision target is indicated with SMS resource id. (MachineId = 9 <machine FQDN>)
Found valid basic machine property for machine id = 9.
Warning: Currently we don't support mutual auth. Change to TLS server auth mode.
The provision mode for device <machine FQDN> is 1.
Attempting to establish connection with target device using SOAP.
Found matched certificate hash in current memory of provisioning certificate
Create provisionHelper with (Hash: 7FE17D626D37ACF378A39A93194C4842F80DDE4E)
Set credential on provisionHelper...
Try to use provisioning account to connect target machine <machine FQDN>...
Fail to connect and get core version of machine <machine FQDN> using provisioning account #0.
Try to use default factory account to connect target machine <machine FQDN>...
Fail to connect and get core version of machine <machine FQDN> using default factory account.
Try to use provisioned account (random generated password) to connect target machine <machine FQDN>...
Fail to connect and get core version of machine <machine FQDN> using provisioned account (random generated password).
Error: Device internal error. Check Schannel, provision certificate, network configuration, device. (MachineId = 9)
Error: Can NOT establish connection with target device. (MachineId = 9)
>>>>>>>>>>>>>>>Provision task end<<<<<<<<<<<<<<<

-----------------------------------------------------------------------------------------

We have posted this error and on the following MS forum:

http://social.technet.microsoft.com/Forums/en-US/configmgrgeneral/thread/46a5cf28-0891-4cf7-a895-c8cf46aaa28c

According to discussions there we have prepared a DHCP server with options 6 and 15 and have checked the DNS server for the forward (A) and reverse (PTR) DNS records for the client and ConfigMgr site server. The certificate templates we have prepared according to the following MS guide: http://technet.microsoft.com/en-us/library/cc161804.aspx

So what we are doing wrong. Can anyone help us in order to solve this problem.

Thanks in advance.

SOL giving the client monitor a black screen.

webadmin@intel.com — Mon, 22 Jun 2009 05:03:59 GMT

The provisioned machine are not able to execute any function from the Out of Band Management Console, when I run any SOL command the monitor will just show a white cursor on the screen. The power control for out of band management are working fine. Below are the screenshots for my problem, does anyone have any idea what causing this?

When execute any command from here the system will reboot and the system just freezed. The monitor gives a black screen with a cursor on it.

This is the monitor after the command were executed from the console.

Trouble provisioning vPro machines

webadmin@intel.com — Fri, 19 Jun 2009 09:26:22 GMT

I am having trouble provisioning vPro machines, on my SCCM on all system column for AMT Status states as "Detected" after done the Alll system > Out of Band Management > Discover Management Controllers, none of the vpro's are discovered for provisioning, below is the error log from amtopmgr.log. Could someone please help me solving this matter.

session params : http://vPro-1.systemcenter.org:16992 , 111001 SMS_AMT_OPERATION_MANAGER 6/19/2009 4:11:54 PM 3768 (0x0EB8)

Error 0x80090304 returned by InitializeSecurityContext during follow up TLS handshaking with server. SMS_AMT_OPERATION_MANAGER 6/19/2009 4:11:54 PM 5156 (0x1424)

**** Error 0x7efb970 returned by ApplyControlToken SMS_AMT_OPERATION_MANAGER 6/19/2009 4:11:54 PM 5156 (0x1424)

Here is another part of the log:

Incoming Connection from 172.16.3.127:16994. SMS_AMT_OPERATION_MANAGER 6/19/2009 4:15:08 PM 2728 (0x0AA8)
Incoming data is - Configuration version: PKI Configuration. SMS_AMT_OPERATION_MANAGER 6/19/2009 4:15:08 PM 2728 (0x0AA8)
Count : 12 SMS_AMT_OPERATION_MANAGER 6/19/2009 4:15:08 PM 2728 (0x0AA8)
UUID : 4C4C4544-0034-3210-804C-B4C04F593153 SMS_AMT_OPERATION_MANAGER 6/19/2009 4:15:08 PM 2728 (0x0AA8)
Found matched hash from hello message with current provision certificate. (Hash: 6B15F75250275596BE3188A0969FA91942B8FEF5) SMS_AMT_OPERATION_MANAGER 6/19/2009 4:15:08 PM 2728 (0x0AA8)
Error: AMT device 4C4C4544-0034-3210-804C-B4C04F593153 has not been imported to sms. Can not finish provisioning. SMS_AMT_OPERATION_MANAGER 6/19/2009 4:15:08 PM 2728 (0x0AA8)
Waiting for incoming hello message from AMT devices... SMS_AMT_OPERATION_MANAGER 6/19/2009 4:15:08 PM 2728 (0x0AA8)