BIOS Settings, Updates, & Utilities - Newly tested updates & wiki-ized!
Posted by Michele Gartner Jul 24, 2008
Tell us about your vPro deployment* and receive something from our goody drawer! We have shirts, radios, backpacks, and more!
We want to hear about your unassisted activation. We are interested to know how many machines were involved in your deployment, which provisioning model you went with, and the implemented use cases. Contact Michele Gartner
with the details.
*Offer valid for individuals deploying vPro without the use of an IT outsource, system integrator, or Intel engineer on site.
Intel® AMT Reflector - New Release Posted w/Video Tutorial Too!
Posted by Timothy Duncan Jun 12, 2008
Wondering about the different types of provisioning models? A new matrix was just published that defines the three provisioning models: Basic, Standard, and Advanced.
This naming convention replaces the terms SMB and Enterprise modes. Why? SMB was confusing because it refers to Small-Medium Business - when in actuality, there are enterprise-sized companies that have activated in SMB/Basic mode and SMB-sized companies that have activated in Enterprise/Standard/Advanced mode. 
Check it out: Understanding Provisioning Models - Basic, Standard, & Advanced
In part 3 we covered troubleshooting common Provisioning Console issues. In part 4 we now focus on those components operating in the background during provisioning. With a functioning install and console, and when the issue appears to be server-related (In part 1 we covered troubleshooting the locale AMT system) now any issues seen must be evaluated on the server side. This article covers this process in a Problem - Cause - Solution format.
Introduction
The server components constitute a lot of ‘background' processes that support what is only seen as Altiris Console points. Much of what goes on in the background is invisible to the user save as a change in status. If setup correctly, machines simply provision. It's when they do not provision that a user should understand the server components so that proper troubleshooting can be accomplished. Note that this covers the symptoms of server-component problems. Some of the symptoms do overlap client-side issues, but in this process we are assuming we've confirmed that the client systems is functioning as expected. If you are unsure, see Part 1 of this article series.
Symptoms
The following symptoms are seen on the Server. Please note that some of the symptoms may appear to be both client and server related making it difficult to know where the issue lies. Use Part 1 in conjunction with this article if necessary in troubleshooting these issues.
No update to Intel AMT Systems Node - At times this node can abruptly appear stagnant with no new systems coming in and no provisioning taking place
No Systems Appearing - The Intel AMT Systems node may stay blank even after connecting systems in Setup Mode onto the Network.
FQDN Not Acquired - Once the SCS receives a hello message, it needs to acquire the FQDN, and if this fails the machine will remain in an unprovisioned state
No systems Provisioning - This can occur where systems show up in the system, but none of them provision
Properties Script Failed - This is a common error to be covered separately, though many of the above symptoms end up throwing this particular error
In addition to the symptoms, the following tools were used to troubleshoot the issues to find out which particular issue afflicted the Server:
AMT Logs
OOB Trace Loggging
Wireshark
See Part 1 in this article series on how to use these. These will be referenced in the below items.
No update to Intel AMT Systems Node
Problem
The typical symptom is an abrupt stop to updates on this node. For example if you have a number of provisioned systems, with systems added as systems are brought up on the network, and abruptly they stop updating or being added, this is indicative of this issue.
Tools:
AMT Logs - No updates to this log occur.
Cause
AMTConfig Service - The AMTConfig service has stopped, crashed, or is in a hung state. This isn't common in version 3.0 of SCS or higher.
Resolution
Check that the AMTConfig Service is running.
1. Go to Services Manager under Administrative Tools.
2. Check the Service named AMTConfig to make sure it is running.
3. If the service is not running, start it. If the service is running, try restarting it just in case it's in an hung state.
4. Once the service is up and running again (if this is the issue) provisioning should start occurring.
No Systems Appearing
Problem
The symptom is that no machines appear in the Intel AMT Systems list when the page is refreshed over a period of time when new systems are expected. The page ties directly into the IntelAMT database to populate the systems, so if the list isn't updating on the page, the list is also not updating in the database.
Tools:
AMT Logs - I. No entries found
II. No entries found
III. Invalid PID Map error
Wireshark - II. On the client the "Hello" packet is sent, but on the server it never arrives.
Cause
The causes vary. See below for known causes for this issue:
I. AMTConfig Service - The AMTConfig service has stopped, crashed, or is in a hung state. This isn't common in version 3.0 of SCS or higher.
II. "Hello" packets - The routing of "hello" packets is not configured correctly, so clients can't reach the Provision Server.
III. PID rejected - The PID provided in the "Hello" packet is not contained as a valid security key in the IntelAMT database. This is only seen in the AMT Log found in the Provisioning Console under Logs, selecting the ‘Log' icon.
Resolution
See the steps to follow for the above causes.
I. AMTConfig Service
1. See the resolution to the section No update to Intel AMT Systems Node.
II. "Hello" Packets
1. In the Provisioning console go to the DNS Configuration node. Does the ‘Test' button allow Provisionserver to resolve back to the IP of the Notification Server?
2. If yes, go to the segment of the network the client is on and try to ping the name ‘Provisionserver'. Does the IP resolve?
3. If answer to either question above is NO, a CNAME record needs to be created on each DNS Server to route to the IP address of the Notification Server.
III. PID rejected
1. In the Provisioning Console go to the Security Keys node under the Configuration Service Settings. The list of unused PID and PPS combinations are listed.
2. In the IntelAMT database, within the csti_pid_map table all used and unused security keys are listed. The ones with a value ‘True' in the ‘Used' column will not show up in the console.
3. Either import the keys if the OEM placed the AMT systems in TLS-PSK Setup Mode through the import button in the Security Keys page, or manually enter the PID PPS.
FQDN Not Acquired
Problem
One or more Intel AMT Systems are registering in Intel SCS, but they never show an FQDN and never move out of the ‘Unprovisioned' status. In the AMT Log often these systems show the error ‘Properties Script Failed' (note that the cause of this error can be many, and this issue is but one of them).
NOTE! If no system is provisioning the issue may not be FQDN related. See No Systems Provisioning in this article for more information.
Tools:
AMT Logs - Properties Script Failed messages
OOB Trace - Unable to locate FQDN (Fully Qualified Domain Name) entries
Cause
Intel SCS calls the Out of Band Provisioning or Properties script oobprov.exe to do a number of things. The first thing it does is obtain an FQDN for the machine needing provisioning. If it fails to obtain an FQDN Provisioning will fail and the computer will remain in an unprovisioned state until oobprov.exe can successfully locate the FQDN.
Resolution
To find the FQDN, oobprov.exe runs through a number of checks. The suggested method is to have the Altiris Agent installed and have run the OOB Discovery Task (located in the Altiris Console under View > Solutions > Out of Band Management > Configuration > Out of Band Discovery > Out of Band Discovery). This populates the Altiris database so it has both an FQDN in the AeX AC Location data class and the UUID in the Inv_OOB_Capability data class. If this data is not available, another option is to check DNS resolution as a method. In the Altiris Console look under the Resource Synchronization node, within the Intel AMT Systems folder. As shown below, this option enables oobprov.exe to use DNS IP resolution as a method.
NOTE the warning found directly below the checkbox: Warning! Using DNS for IP to FQDN resolution might lead to incorrect profile mapping. Make sure your DHCP server is configured correctly to give update the DNS server for dynamic addresses.
No systems Provisioning
Problem
Systems are added regularly to the Intel AMT Systems node, but they never provision. This includes never getting an FQDN (see the above section for more information), though the cause may not be the inability of oobprove.exe to obtain the FQDN.
Tools:
AMT Logs - Provisioning Script Failed messages
OOB Trace - No references to oobprov.exe
Cause
If not an FQDN mapping issue, this issue stems from a timeout value in the IntelAMT database being set to 0. In the IntelAMT database, in the table csti_configuration, under the column Props_script_timeout if the value is 0 IntelSCS will timeout before it even has a chance to call oobprov.exe.
Resolution
Normally only one row exists in this table. The following SQL query will properly update this value to the default level. The default is 180 and should be set.
USE IntelAMT
UPDATE csti_configuration
SET props_script_timeout = 180
WHERE use_props_script = 'True'
Execute the script within SQL Query Analyzer or SQL Enterprise Studio to update the value.
Properties Script Failed
Problem
This message can mean a number of things, including the symptoms described in the preceding two section. This message can continually appear into the AMT logs as provisioning is attempted over and over.
Cause
The causes of this issue vary. The basic explanation is that when oobprov.exe is called, if it returns anything other than success, the resulting error message in the AMT logs is ‘Properties Script Failed'.
Resolution
See the above two sections for the symptoms No Systems Provisioning and FQDN Not Acquired, but for additional information see the following article:
Conclusion
This concludes the troubleshooting section for the Provisioning process. For the most common issues, the resolutions and steps presented in the first four parts of this series will resolve them. I also hope the methodology here helps explain how the background processes are working. In the next parts of this series we'll cover troubleshooting issues with the management components after systems have been successfully provisioned.
In part 2 we introduced the Server components used in Provisioning, including some key items to be aware of. In this installment we'll cover troubleshooting the server components in a symptom - cause - resolution format. The methodology should also allow help you understand how these components work for further troubleshooting efforts, or for simply understanding how the data is moving through the Provisioning process. This specific article covers the Console and the common errors that can appear.
Introduction
Once the server components are installed, and the AMT systems are in a correct Setup Mode, one must access the Provisioning Console to manage the Provisioning process. This console is located in the Altiris Console under View > Solutions > Out of Band Management > Configuration > Provisioning. This part of the series covers errors in the console, specifically to common errors scene after the installation has taken place. These errors can also surface due to environmental changes in the infrastructure.
Symptoms
This section lists all the symptoms covered in this article. Use this list to guide you if you are working on a specific issue.
Provisioning Console Access Forbidden - Generally this is a 403 error on most of the Altiris Console Provisioning Nodes
Provisioning Console Connection Closed - All the Provisioning Nodes show an error that the underlining connection was closed
Provisioning Console User Not Authorized - This error relates to the access rights to the actual Provision Nodes, and can happen even if a user is an Altiris Administrator
Provisioning Console Timeouts - We've seen timeouts occur in the console, when accessing the Intel AMT Systems list
Provisioning Console Access Forbidden
Problem
When accessing the Provisioning Console, the following error is thrown:
The request failed with HTTP status 403: Forbidden
Cause
When installing Intel SCS, the manual install defaults to HTTPS, using TLS for secure communication. If the environment is not setup for TLS/HTTPS, the Altiris Provisioning Console will be unable to authenticate to Intel SCS, throwing this error.
Resolution
On the Notification Server where Intel SCS is installed, open up IIS Manager.
Browse down into the Default Web Site and select AMTSCS.
Right-click on AMTSCS and choose Properties.
Select the Directory Security tab.
Click the Edit button under the Secure communications section.
Uncheck the box labeled ‘Require secure channel (SSL).
Click OK.
Click Apply and then OK.
Provisioning Console Connection Closed
Problem
The error ‘The Host Name cannot be resolved', or ‘ the remote connection was closed' appear when accessing the Provisioning Console.
The problem can also be seen when using the Test functionality on the DNS Configuration node. It may show a failed to obtain IP message.
Cause
When our Console tries to resolve the name to the Intel SCS Server (even when Altiris and SCS are on the same server) it fails and one of these errors are thrown. The difference can be in the perceived FQDN for the Server. Altiris is attempting to acquire the right IP address so it can communicate with SCS.
Resolution
There are two ways to fix this if a reinstallation does not correctly set the SCS identity within Altiris.
LMHOSTS or HOSTS files - We can update one or both of these files to contain the FQDN we're using to try and translate the IP Address. The difficult part is finding out what Altiris is attempting to connect to. Use the process below to find out what it is looking for:
See Part 1 concerning the use of OOB trace logging and Debug View.
Enable trace logging in OOB and launch dbgview.exe.
Try to access the console and produce the error.
Stop trace logging.
This is the difficult part. Normally I scan through the log looking for the host name of the server. Usually this shows up as part of an FQDN. One example of this is Altiris called Servername.domain, which did not respond, but Servername.domain.com was a valid name.
Do a Search for the Host Name of the system (Not FQDN as it may not be using the valid one). For example, MyServer.
Once complete, access the file named lmhosts (no extension). Place a line in the file with the Server IP Address and invalid name:
10.10.10.1 Servername.domain
Whatever invalid name was located in step 5, the above sequence can be used to give the computer the correct IP Address resolution. This resolves the issue. However there may be other steps needed. If this doesn't resolve the issue, continue to step 8.
Access the Service Location node in the Provisioning Console.
Change the option to ‘Alternate URL:'.
Specify a new location changing the name to one that resolves, for example:
Previous URL: http://Servername.domain:80/AMTSCS
Fixed URL: http://Servername.domain.com:80/AMTSCS
Click Apply to save the changes.
The difficult part in this process is locating what Altiris believe the name of the Intel SCS Server is. Since Altiris and SCS are not integrated, they do not have a mechanism that shows if they are on the same server or not. This is why this issue surfaced.
Provisioning Console User Not Authorized
Problem
After installation or after credential changes the typical error structure appears with the message:
Current User can't view this page.
Current user can't change settings on this page.
Note that the error does not have the Red error typically associated with other console errors.
Cause
After installation only the user who conducted the Intel SCS install has rights to the console nodes. Until other users are added, only this user (usually the Notification Server Application identity) has rights to these nodes. Notification Server role and scope security does not apply to the populating of the data to the right of these nodes (although it does control access to actually showing the nodes themselves in the left-hand tree).
Resolution
Follow these steps to give the necessary users rights to the Provision Console nodes:
Log into the Altiris Console as the Notification Server Application Identity, or the user used to manually install Intel SCS (one of these will usually be the authorized user).
Access the Altiris Console under View > Solutions > Out of Band Management > Configuration > Provisioning > Configuration Service Settings > Users.
Note the users who already have rights.
Click the blue + icon to add a user.
Click the ... browse icon to see a typical Notification Server Domain user and groups search window.
Add a group or user and click OK.
Under the Role: give Enterprise Administrator rights unless you want to limit which nodes are operable.
Click OK to complete adding the user.
If no user can access these nodes, the Intel SCS installation needs to be run again under the correct user. Run through these steps to complete this:
Log onto the Notification Server directly (or with the /console switch if you're using Remote Desktop) with the NS Application Identity.
In Add/Remove Programs, locate ‘Intel® Active Management Technology Setup and Configuration Service and remove it.
On the Notification Server, browse to install_path\Program Files\Altiris\Notification Server\NSCap\Bin\Win32\X86\OOB\IntelSCS\.
Launch the file AMTConfServer.exe and walk through the install. Be sure to use the Application Identity as the credentials for SCS.
When prompted for the database credentials, if permissible use the Application Identity.
Once completed log into the Altiris Console with the Notification Server Application Identity, then move back to step 1 of the previous sequence to add other users as necessary.
Provisioning Console Timeouts
Problem
Even in small environments we've seen timeouts on the Intel AMT Systems node, and much less frequently on the other nodes. The timeout throws a .NET error and the page is replaced by a timeout error.
Cause
The cause is not known at this time. The timeouts do not seem to occur always at particularly busy times for the Notification Server, so it is difficult to know what causes them. When there are plenty of resources available the timeouts generally do not occur, though if the server is extremely busy it doesn't always occur. It appears to be caused by varying factors.
A refresh after the timeout error often loads the page just fine. This suggests the loading the page gets into a loop or hung state, instead of a true processing timeout issue.
Resolution
No full resolution is known at this time, but a few items can help minimize the impact of the issue.
Remote Consoles - We've seen remote consoles perform better than having the console loaded directly on the Notification Server
Refresh - Normally the timeouts occur without loading any of the frames within the page. If you click on the link or hit the refresh for the Intel AMT Systems page and no frames load within a minute, refresh the page. Often when the page is refreshed it then loads correctly, even quickly.
Conclusion
Once the console has been restored, the Provisioning process can be configured and initiated. Because of the all or nothing nature of most of these issues, they must be overcome before even being able to properly setup and configure Intel SCS for the Provisioning process. The above resolutions cover the methods used to resolve these issues at multiple sites.