Activation Blog

Remote Configuration Certificate Application Best Practices for Intel vPro Systems

joelsmith — Fri, 07 Nov 2008 22:35:26 GMT

Whether you are planning to implement a Vendor TLS Certificate in the future, or you are having trouble applying a certificate you've already obtained, this article walks through the best practices. The details include all the steps to properly install the right items and resolve issues we've encountered up until this point. This article applies to Out of Band Management Solution 6.2. Since certificates introduce tight encryption security, if the right items and steps are not in place or followed, it can break the ability of AMT systems to provision with Remote Configuration.

Introduction

Using Remote Configuration to Provision your Intel AMT vPro capable computers takes the work out of the progress. All 2.6, 3.0+ AMT systems come preconfigured to automatically use Remote Configuration to provision with a valid Provisioning Server. The hashes from vendors (AMT 3.0 includes Verisign, GoDaddy, Comodo) are already configured in the firmware, and upon connection to power and the network, will begin to send out requests for provisioning. Thus in this way the managed vPro systems are already prepared to be provisioned without any needed intervention by the IT staff.

The issues we see then arise from the server-side application of a certificate that matches the hashes already loaded. Obtaining and installing a vendor TLS Remote Configuration certificate needs to be done the right way so that authentication can succeed. Once in place, provisioning will roll forward without any further intervention. This article focuses on applying the server-side certificate so that provisioning can move forward automatically.

Obtaining a Remote Configuration Certificate

This subject has been covered previously. I wanted to lightly touch upon this as there is a vital step that should be taken so that if anything goes wrong we can correct it. First, the following article covers how to properly obtain a certificate:

http://juice.altiris.com/article/4496/obtaining-and-applying-a-verisign-remote-configuration-certificate

Note that part of obtaining a Remote Configuration is submitting the request from the Server you plan to install the certificate onto. This process creates the private key for the server-side certificate, and this piece will not be available until partway through the application of the crt (or cer) file obtained from the vendor. The specific step that provides the full key, both private and public, is when the certificate is exported after the initial import into a PFX format, checking the option to export the private key will give you a complete backup of the full certificate. If something happens, or if the application didn't go right, we'll need both, so it's essential to export this as soon as possible.

During the steps to install the certificate emphasis will be given on the step where the export should take place.

Installing the Certificate

I've condensed the steps required into the following list. This process works for all vendors once you've obtained a certificate. Note that these steps are provided to consolidate both recommended steps and documentation into one whole.

Go to Start > Run > type mmc > and click OK.
In the resulting console click under File and choose Add/Remove Snap-in...
Near the bottom of the resulting window click the Add button.
From the list that appears select Certificates and then click the Add button.
Leave the radial button selected on ‘My user account' and click Finish.
From the same list select Certificates again and click the Add button.
From the resulting window change the radial select to ‘Computer account' and click Next.
Leave the selection at ‘Local computer: (the computer this console is running on) and click Finish.
Click the Close button in the window offering you the list of available snap-ins.
At the original add/remove snap-in screen verify that you have two entries:
1. Certificates - Current User
2. Certificates (Local Computer)
Click OK.
Expand both trees in the left-hand pane within the console. You should see the full certificate stores.
Right-click on the Personal folder under the Current User certificate store and highlight ‘All Tasks' and click on ‘Import' in the pop-out menu.
Click Next on the Welcome page of the Certificate Import Wizard and click the Browse button.
Browse to the cer or crt file provided by the vendor, highlight it, and click Open.
Click Next, and leave the radial option on ‘Place all certificates in the following store', which should be set to ‘Personal'. Click Next.
Under the Completing section of the wizard, Click Finish. You should receive a pop-up .
NOTE! This is the vital step mentioned previously in the article. We will now export the certificate with both public and private keys, which will give us the full set and allow us to remove and reapply if necessary. In the MMC select the newly imported certificate > right-click > and choose All Tasks > Export...
Click Next on the Welcome screen. In the resulting list you should have an active option for ‘Personal Information Exchange - PKCS #12 (.PFX)'. If this option is not available there is a problem with the certificate and the private key is not accessible.
Follow the wizard, and ensure you select the option ‘Yes, export the private key'. When saving the file, it will prompt you to set a password to protect the private key (this is recommended for security reasons). The export should leave you a PFX file. Keep this in a safe place, and back it up just in case.
Next we need to import the full key into the Computer store. Start back in the MMC, under the Local Computer certificate store, right-click on the Personal folder, select All Tasks > Import...
Click Next on the Welcome screen and click the Browse button on the subsequent screen.
Browse to the newly exported PFX file. Note that you will need to change the ‘Files of type' to include the PFX format. Click Next.
The Password screen prompts for the password you set when you exported the key in step #20. Enter the password and click Next.
Choose or leave the select to ‘Place all certificates in the following store'. The value should be Personal. Click Next.
Click Finish on the end details page to complete the import.
Next, we need to load the certificate into Intel SCS so it can properly authenticate with the AMT systems requesting Remote Configuration. Browse to the following location: \Program Files\Intel\AMTConfServer\Tools.
Execute the file loadcert.exe.
Press Y and Enter.
A ‘Select Certificate' popup will appear. Select the name of the cer or crt file you received from the vendor and click OK. The window will disappear.
Now both Personal certificate stores and Intel SCS should have all the needed certificates to successfully work with Remote Configuration. However, we are not done as other steps may be needed.

Reinstalling the Certificate

If you need to reinstall the certificate and have a PFX file, you can do so by opening both certificate stores (User and Local Computer) as outlined in the previous steps. Browse through the certificate stores and delete any instance of the vendor certificate. This will remove any associations and allow a clean application of the certificate to occur. Look for the following:

The name matching the name of the cer or crt file obtained from the vendor
The vendor's certificate (the entry will contain the vendor name).

NOTE: Be careful when removing vendor certificates as they may not be part of the Remote Configuration. The best example is Verisign, which may have many entries. If unsure, leave the certificate in place, or export it before deleting it so you can restore it if necessary.

Other Setup Requirements

The following items may be required, depending on the environment.

ProvisionServer

Each zone within DNS should have a ProvisionServer entry to ensure that Remote Configuration requests are properly routed. This will also help properly resolve names during the authentication process. To test, log onto a system on the subnet you're trying to conduct Remote Configuration from. Run a command prompt and use the following command:

ping ProvisionServer

We should see the responding IP Address by the IP Address of the Notification Server, or, if you've set it up this way, the Intel SCS Server conducting provisioning. Another test you can try is to run the following command:

nslookup ProvisionServer

We should get the data on the Notification Server's name.

DNS Zones

In a multiple domain structure this is especially important, but all environments need to have the right data in DNS to properly pass and authenticate in a TLS environment. The DNS Primary Zone should be set to the Domain path contained within the certificate. For example, if the certificate name is MyNSServer_My1Domain_local, the DNS Primary Zone should be My1Domain.local. Without this, authentication can fail as the FQDN is used during authentication, and if the name being transmitted across the wire doesn't match what's in the certificate, authentication will fail. Here is another example:

Certificate: MyNSServer_My1Domain_local.crt
DNS Primary lookup Zone: My1Domain.local

DHCP Option

Another Network related requirement may be DHCP Option 15. While I'm not sure why this has proven to be required in some environments and not others, creating this option has resolved failed authentication issues within Remote Configuration.

In DNS, create an entry for Option 15, with the value of the domain path. This will often be the same as what is located in the DNS Primary Zone. The following details are an example:

Certificate: MyNSServer_My1Domain_local.crt
DNS Primary lookup Zone: My1Domain.local
DHCP Option 15: My1Domain.local

Conclusion

Following the above procedure should allow remote configuration to occur without problems. Once in place, the configuration will move forward with automatically provisioning systems that support Remote Configuration.

The Mechanics of Provisioning with Out of Band Management 6.3

joelsmith — Mon, 11 Aug 2008 16:05:04 GMT

For those who have Provisioned Intel AMT Systems, you may wonder what takes place in the background. This article is for you! The process has often been covered at a high level, but here the technical details are provided. Hopefully this helps you understand the inner workings, and provide you information when troubleshooting Provisioning issues. And for those of you who are technically minded, it's also neat to know! This information was compiled working on issues and running through provisioning processes from Symantec Support.

Introduction

Often the Provisioning process for Intel vPro systems has been described as complex. This comes from the fact that the Provisioning process was designed with high security in mind. Since the initial release we have improved success rates by working with Intel to make the process more user friendly without compromising the high level of security. To this end this document will explain the process of Provisioning from a technical level, providing an unfiltered view of the process, also without compromising its security.

Provisioning Flow

The following process assumes that Altiris Out of Band Management and Intel SCS are install, configured, and ready to go. This process follows the flow of Provisioning and what data points, technologies, and methods are used. The level of details is meant to be a resource when working with Provisioning or troubleshooting Provisioning issues, so not all details are available for this process. Note the following points before moving through the process:

The console items in the Altiris Console under View > Solutions > Out of Band Management > Provisioning are not tied to the Altiris database like most of the rest of the Altiris Console. They connect through a virtual Website (AMTSCS under the Default Website of the SCS Server) to the IntelAMT database.
Data from two databases (IntelAMT and Altiris) are used during the Provisioning process.

The following articles can assist if you need information on these:

http://juice.altiris.com/article/1314/altiris-and-intel-reg-vpro-copy-technology-evaluators-guide
Administrator's and Reference Guides: http://www.altiris.com/support/documentation look under Out of Band Management

The server is loaded with a security key or certificate. See the following two items for how these keys are loaded:
1. For a PID PPS, either keys are randomly generated or imported into the IntelAMT database. Specifically they reside in the table csti_pid_map. Once created/imported, they are available for verifying authentication from an incoming provisioning request from AMT.
2. For TLS-PKI (certificate-based Remote Configuration) a certificate is loaded onto the server. See this article for details: http://juice.altiris.com/article/4496/obtaining-and-applying-a-verisign-remote-configuration-certificate.
The clients need the matching keys loaded onto them. This is done differently depending on the type:
1. For PID PPS the keys are set by one of the following methods: the OEM sets it, it's entered manually into the Intel ME, or inputted via a one-touch USB flash drive. The PID and PPS are written into the firmware to be used as the authentication credentials when it looks for a provisioning server.
2. For Remote Configuration (TLS-PKI) at the factory predefined hashes are burned into the firmware for the following certificate vendors (more to come in subsequent versions of AMT). This means AMT already has authentication keys to begin the provisioning process direct from the factory.

VeriSign
Komodo
GoDaddy

The client machine, once it has it's keys and has been connected to the network and power, uses one of two methods to find the Provisioning Server:
1. The IP address of the server can be manually put into the Intel ME, including what port the SCS listener is configured for (default 9971). When this is done, the AMT client will transmit its Hello message directly to the IP Address and port.
2. The client will transmit its message on port 9971 to the name of ‘ProvisionServer'. If Out of Band Management, Intel SCS, and DNS have been properly setup DNS will route the packet to the Notification Server.
The Notification Server is set to listen for AMT Provisioning traffic on port 9971, but can be configured to use a different port if so desired in the Altiris Console under View > Solutions > Out of Band Management > Configuration > Provisioning > Configuration Service Settings > General. The top options labeled: ‘Listen port:".|
When SCS, via the service AMTConfig (process AMTConfigWinService.exe) receives the incoming "hello" packet, it initiates an authentication request with the client to complete the authentication process, the beginning of which was stored in the packet. Once authentication completes successfully, the process moves on.
The service, AMTConfig, catches the incoming packet and logs the data in the IntelAMT database, in the table csti_amts. This table contains all the relevant data for this system's identity.
Once the system has been logged into the IntelAMT database, Intel SCS uses the database entries under csti_configuration to initiate what's known as the props script. This script is what will assist in the provisioning process. In Altiris case, it is oobprov.exe, located by default at C:\Program Files\Altiris\OOBSC\oobprov.exe. For an example of how Intel SCS knows about this, see this data snippet from the csti_configuration table:
On a busy SCS server you can look at Task Manager and see multiple instances of oobprov.exe running. The default settings allow 10 threads to work on provisioning requests at any given time. These threads will interface with the Altiris Database via the Altiris Agent on the local server system. In a standard setup the local system is also the Notification Server.
OOBPROV runs a SQL query to fetch the Fully Qualified Domain Name (FQDN) for the system it is to provision. The query is based off the following data points:
1. UUID passed to it via Intel SCS, Source is as follows: Database: IntelAMT, Table: csti_amts, Data Source: "Hello" packet from AMT system, Values used: uuid
2. Database: Altiris, Data-class: OOB Capability, Table: Inv_OOB_Capability, Data Source: Out of Band Discovery Task, Values used: _ResourceGuid - UUID
3. Database: Altiris, Data-class: AeX AC Location, Table: Inv_AeX_AC_Location, Data Source: Basic Inventory Agent, whether from Basic Inventory function or Hardware Inventory from Inventory Solution, Values used: _ResourceGuid - Fully Qualified Domain Name
The Query accomplishes the following: It takes the UUID from csti_amts, uuid and looks for a match in Inv OOB Capability, uuid. If a match is made, it takes the _ResourceGuid from the same table and makes a match of the same columns name to AeX AC Location. With the match it then reads the values stored under Fully Qualified Domain Name (I'm not sure why they didn't just label this column FQDN...).
Next, oobprov.exe hands back the FQDN it's read from AeX AC Location, Fully Qualified Domain Name and passes it to SCS. SCS takes this value and inserts it into the IntelAMT database at csti_amts, fqdn for the matching resource.
Next, oobprov.exe fetches the automatic profile set within Out of Band Management Solution. This is done in the Altiris Console under View > Solutions > Out of Band Management > Configuration > Provisioning > Intel AMT Systems > Resource Synchronization. This policy needs to be enabled for this step to work, and a default profile configured and selected under the dropdown labeled ‘Intel AMT 2.0+ to profile:'.
The profile provides the operational data for management of the AMT system. After AMT accepts the profile, the Provisioning process is now complete. Before this step, AMT functionality is not available on this system, and after this step only properly authenticated functions will be able to use Intel vPro on the target provisioned systems.

Troubleshooting

The following items can be considered break points for this process. If you've done provisioning you may have run into the symptoms produced by the following items. These are compiled as common areas of trouble in this process.

The "Hello" packets only transmit for 24 hours, on a back-off schedule, before stopping altogether. If the Server is unable to provision in that time, with IP refreshes becoming more frequent, the system can be in a limbo state. See this article for steps to rectify: http://juice.altiris.com/article/3612/using-intels-rct-tool-restart-amt-hello-packets-enterprise-provisioning
IP Address changes, refreshes within DHCP during a system's build process can leave SCS with an out of date IP Address for a system that needs provisioning. Coupled with the preceding issue this can leave the system in an unprovisioned state, leaving no ability of the SCS to contact the system to finish the process.
Remote Configuration certificate is not properly installed on the server, producing authentication failure messages in the AMT logs.
Oobprov.exe is unable to fetch the FQDN. The AMT system needs the Altiris Agent installed, have sent Basic Inventory when it had a valid FQDN (for example a system in the process of being built might not have a valid FQDN yet), OOB Discovery Task downloaded and executed, and data populated into the OOB Capability data class from the task in order for oobprov.exe to be able to fetch the FQDN. Conversely you can use the option in Resource Synchronization labeled, ‘Use DNS IP resolution to find FQDN when assigning profiles'.

A good resource for troubleshooting issues can be found here:

http://juice.altiris.com/book/3699/troubleshooting-altiris-manageability-toolkit-vpro-technology

Conclusion

Knowing the underline mechanisms can help when troubleshooting or even when planning your environment. While not all details are provided here, the most essential are.

BIOS & AMT Settings - Quick Primer on AMT location in the BIOS

josh.hilliker — Fri, 25 Jul 2008 18:58:25 GMT

Nick & I got together this week and evaluated a few platforms for their AMT settings in the BIOS. In this video, Nick explains how to get into each BIOS and where the options for AMT are ( or for that case where they are NOT ).

Here are a few screen shots of two of the platforms. We are also going to publish out a matrix of the systems with drivers, bios settings that Frank has been working on.. stay tuned for the link.

Intel® AMT Reflector - New Release Posted w/Video Tutorial Too!

tcduncan — Thu, 12 Jun 2008 15:56:27 GMT

Intel® AMT Reflector is a software tool designed to allow local management of Intel® AMT Mangement Engine functionality from the local operating system. Removing the need to reboot to verify and change the Intel® AMT host computer name or un-provision Intel® AMT on the computer. This functionality improves debug and factory operations in activating and building Intel® AMT based client environments. This release completes DOPD SW Engineering's original functionality plan for the tool and is therefore marked as a production level release.

This release has the following updates from the Beta release:

· Added a timestamp to Intel® AMT events in the logs generated by the client-side applications.
· Fixed the XML logfile format so that it will be properly recognized by external applications that support the XML file format.
· Fixed the issue where some commands may not succeed on the first call for some Intel(R) AMT systems.
· Fixed the "Browse" button functionality in the Intel(R) AMT Reflector Server configuration window.
· The Intel® AMT Reflector Server now logs the client FQDN for each event.
· Removed the View Log window from the Intel® AMT Reflector Client application.
· Improved the error handling of the Intel® AMT Reflector Client application.

Download the tool here

Here's a 5 minute video overview of the tool's capabilities (Click here to view video on YouTube) :

Microsoft's System Center Configuration Manager Forums

miroyer — Mon, 21 Apr 2008 21:45:11 GMT

For those looking for a little extra help on System Center Configuration Manager, Microsoft has a great forum resources on a variety of System Center Configuration Manager topics...

Configuration Manager - General
General Discussion on the topics or features not already covered by one of the other forums for System Center Configuration Manager.

Configuration Manager - Announcements
General Announcements for System Center Configuration Manager Forums

Configuration Manager - Admin Console
Discussion on the Admin Console for System Center Configuration Manager

Configuration Manager - Asset Intelligence
Discussion on the Asset Intelligence feature for System Center Configuration Manager

Configuration Manager - Backup and Recovery
Discussions on Backup and Recovery for System Center Configuration Manager Sites

Configuration Manager - Desired Configuration Management
Discussion on the Desired Configuration Management feature for System Center Configuration Manager

Configuration Manager - Documentation
Discussion on the Help and Documentation for System Center Configuration Manager

Configuration Manager - Internet Clients and Native ModeDiscussion on the Internet Based Clients and running sites in Native Mode, certificate and SSL issues for System Center Configuration Manager

Configuration Manager - Inventory
Discussion on the Inventory feature for System Center Configuration Manager

Configuration Manager - Operating System Deployment
Discussion on the Operating System Deployment feature for System Center Configuration Manager

Configuration Manager - SDK
Discussion on the Software Development kit for System Center Configuration Manager

Configuration Manager - Setup/Deployment
Discussion on the Setup and Deployment of Clients and Servers for System Center Configuration Manager

Configuration Manager - Software Distribution
Discussion on the Software Distribution feature for System Center Configuration Manager

Configuration Manager - Software Updates Management
Discussion on the Software Updates Management feature for System Center Configuration Manager

Matt Royer

Troubleshooting the Altiris Manageability Toolkit for vPro Technology - Part 4 - Provisioning Server Troubleshooting

joelsmith — Wed, 19 Mar 2008 20:51:48 GMT

In part 3 we covered troubleshooting common Provisioning Console issues. In part 4 we now focus on those components operating in the background during provisioning. With a functioning install and console, and when the issue appears to be server-related (In part 1 we covered troubleshooting the locale AMT system) now any issues seen must be evaluated on the server side. This article covers this process in a Problem - Cause - Solution format.

Introduction

The server components constitute a lot of ‘background' processes that support what is only seen as Altiris Console points. Much of what goes on in the background is invisible to the user save as a change in status. If setup correctly, machines simply provision. It's when they do not provision that a user should understand the server components so that proper troubleshooting can be accomplished. Note that this covers the symptoms of server-component problems. Some of the symptoms do overlap client-side issues, but in this process we are assuming we've confirmed that the client systems is functioning as expected. If you are unsure, see Part 1 of this article series.

Symptoms

The following symptoms are seen on the Server. Please note that some of the symptoms may appear to be both client and server related making it difficult to know where the issue lies. Use Part 1 in conjunction with this article if necessary in troubleshooting these issues.

No update to Intel AMT Systems Node - At times this node can abruptly appear stagnant with no new systems coming in and no provisioning taking place
No Systems Appearing - The Intel AMT Systems node may stay blank even after connecting systems in Setup Mode onto the Network.
FQDN Not Acquired - Once the SCS receives a hello message, it needs to acquire the FQDN, and if this fails the machine will remain in an unprovisioned state
No systems Provisioning - This can occur where systems show up in the system, but none of them provision
Properties Script Failed - This is a common error to be covered separately, though many of the above symptoms end up throwing this particular error

In addition to the symptoms, the following tools were used to troubleshoot the issues to find out which particular issue afflicted the Server:

AMT Logs
OOB Trace Loggging
Wireshark

See Part 1 in this article series on how to use these. These will be referenced in the below items.

No update to Intel AMT Systems Node

Problem

The typical symptom is an abrupt stop to updates on this node. For example if you have a number of provisioned systems, with systems added as systems are brought up on the network, and abruptly they stop updating or being added, this is indicative of this issue.

Tools:

AMT Logs - No updates to this log occur.

Cause

AMTConfig Service - The AMTConfig service has stopped, crashed, or is in a hung state. This isn't common in version 3.0 of SCS or higher.

Resolution

Check that the AMTConfig Service is running.

1. Go to Services Manager under Administrative Tools.
2. Check the Service named AMTConfig to make sure it is running.
3. If the service is not running, start it. If the service is running, try restarting it just in case it's in an hung state.
4. Once the service is up and running again (if this is the issue) provisioning should start occurring.

No Systems Appearing

Problem

The symptom is that no machines appear in the Intel AMT Systems list when the page is refreshed over a period of time when new systems are expected. The page ties directly into the IntelAMT database to populate the systems, so if the list isn't updating on the page, the list is also not updating in the database.

Tools:

AMT Logs - I. No entries found

II. No entries found

III. Invalid PID Map error

Wireshark - II. On the client the "Hello" packet is sent, but on the server it never arrives.

Cause

The causes vary. See below for known causes for this issue:

I. AMTConfig Service - The AMTConfig service has stopped, crashed, or is in a hung state. This isn't common in version 3.0 of SCS or higher.
II. "Hello" packets - The routing of "hello" packets is not configured correctly, so clients can't reach the Provision Server.
III. PID rejected - The PID provided in the "Hello" packet is not contained as a valid security key in the IntelAMT database. This is only seen in the AMT Log found in the Provisioning Console under Logs, selecting the ‘Log' icon.

Resolution

See the steps to follow for the above causes.

I. AMTConfig Service
- 1. See the resolution to the section No update to Intel AMT Systems Node.
II. "Hello" Packets
- 1. In the Provisioning console go to the DNS Configuration node. Does the ‘Test' button allow Provisionserver to resolve back to the IP of the Notification Server?
- 2. If yes, go to the segment of the network the client is on and try to ping the name ‘Provisionserver'. Does the IP resolve?
- 3. If answer to either question above is NO, a CNAME record needs to be created on each DNS Server to route to the IP address of the Notification Server.
III. PID rejected
- 1. In the Provisioning Console go to the Security Keys node under the Configuration Service Settings. The list of unused PID and PPS combinations are listed.
- 2. In the IntelAMT database, within the csti_pid_map table all used and unused security keys are listed. The ones with a value ‘True' in the ‘Used' column will not show up in the console.
- 3. Either import the keys if the OEM placed the AMT systems in TLS-PSK Setup Mode through the import button in the Security Keys page, or manually enter the PID PPS.

FQDN Not Acquired

Problem

One or more Intel AMT Systems are registering in Intel SCS, but they never show an FQDN and never move out of the ‘Unprovisioned' status. In the AMT Log often these systems show the error ‘Properties Script Failed' (note that the cause of this error can be many, and this issue is but one of them).

NOTE! If no system is provisioning the issue may not be FQDN related. See No Systems Provisioning in this article for more information.

Tools:

AMT Logs - Properties Script Failed messages

OOB Trace - Unable to locate FQDN (Fully Qualified Domain Name) entries

Cause

Intel SCS calls the Out of Band Provisioning or Properties script oobprov.exe to do a number of things. The first thing it does is obtain an FQDN for the machine needing provisioning. If it fails to obtain an FQDN Provisioning will fail and the computer will remain in an unprovisioned state until oobprov.exe can successfully locate the FQDN.

Resolution

To find the FQDN, oobprov.exe runs through a number of checks. The suggested method is to have the Altiris Agent installed and have run the OOB Discovery Task (located in the Altiris Console under View > Solutions > Out of Band Management > Configuration > Out of Band Discovery > Out of Band Discovery). This populates the Altiris database so it has both an FQDN in the AeX AC Location data class and the UUID in the Inv_OOB_Capability data class. If this data is not available, another option is to check DNS resolution as a method. In the Altiris Console look under the Resource Synchronization node, within the Intel AMT Systems folder. As shown below, this option enables oobprov.exe to use DNS IP resolution as a method.

NOTE the warning found directly below the checkbox: Warning! Using DNS for IP to FQDN resolution might lead to incorrect profile mapping. Make sure your DHCP server is configured correctly to give update the DNS server for dynamic addresses.

No systems Provisioning

Problem

Systems are added regularly to the Intel AMT Systems node, but they never provision. This includes never getting an FQDN (see the above section for more information), though the cause may not be the inability of oobprove.exe to obtain the FQDN.

Tools:

AMT Logs - Provisioning Script Failed messages

OOB Trace - No references to oobprov.exe

Cause

If not an FQDN mapping issue, this issue stems from a timeout value in the IntelAMT database being set to 0. In the IntelAMT database, in the table csti_configuration, under the column Props_script_timeout if the value is 0 IntelSCS will timeout before it even has a chance to call oobprov.exe.

Resolution

Normally only one row exists in this table. The following SQL query will properly update this value to the default level. The default is 180 and should be set.

USE IntelAMT

UPDATE csti_configuration

SET props_script_timeout = 180

WHERE use_props_script = 'True'

Execute the script within SQL Query Analyzer or SQL Enterprise Studio to update the value.

Properties Script Failed

Problem

This message can mean a number of things, including the symptoms described in the preceding two section. This message can continually appear into the AMT logs as provisioning is attempted over and over.

Cause

The causes of this issue vary. The basic explanation is that when oobprov.exe is called, if it returns anything other than success, the resulting error message in the AMT logs is ‘Properties Script Failed'.

Resolution

See the above two sections for the symptoms No Systems Provisioning and FQDN Not Acquired, but for additional information see the following article:

http://juice.altiris.com/article/2982/troubleshooting-properties-script-failed-out-band-management-solution

Conclusion

This concludes the troubleshooting section for the Provisioning process. For the most common issues, the resolutions and steps presented in the first four parts of this series will resolve them. I also hope the methodology here helps explain how the background processes are working. In the next parts of this series we'll cover troubleshooting issues with the management components after systems have been successfully provisioned.

Troubleshooting the Altiris Manageability Toolkit for vPro Technology - Part 3 - Provisioning Console Troubleshooting

joelsmith — Tue, 18 Mar 2008 16:05:26 GMT

In part 2 we introduced the Server components used in Provisioning, including some key items to be aware of. In this installment we'll cover troubleshooting the server components in a symptom - cause - resolution format. The methodology should also allow help you understand how these components work for further troubleshooting efforts, or for simply understanding how the data is moving through the Provisioning process. This specific article covers the Console and the common errors that can appear.

Introduction

Once the server components are installed, and the AMT systems are in a correct Setup Mode, one must access the Provisioning Console to manage the Provisioning process. This console is located in the Altiris Console under View > Solutions > Out of Band Management > Configuration > Provisioning. This part of the series covers errors in the console, specifically to common errors scene after the installation has taken place. These errors can also surface due to environmental changes in the infrastructure.

Symptoms

This section lists all the symptoms covered in this article. Use this list to guide you if you are working on a specific issue.

Provisioning Console Access Forbidden - Generally this is a 403 error on most of the Altiris Console Provisioning Nodes
Provisioning Console Connection Closed - All the Provisioning Nodes show an error that the underlining connection was closed
Provisioning Console User Not Authorized - This error relates to the access rights to the actual Provision Nodes, and can happen even if a user is an Altiris Administrator
Provisioning Console Timeouts - We've seen timeouts occur in the console, when accessing the Intel AMT Systems list

Provisioning Console Access Forbidden

Problem

When accessing the Provisioning Console, the following error is thrown:
The request failed with HTTP status 403: Forbidden

Cause

When installing Intel SCS, the manual install defaults to HTTPS, using TLS for secure communication. If the environment is not setup for TLS/HTTPS, the Altiris Provisioning Console will be unable to authenticate to Intel SCS, throwing this error.

Resolution

On the Notification Server where Intel SCS is installed, open up IIS Manager.
Browse down into the Default Web Site and select AMTSCS.
Right-click on AMTSCS and choose Properties.
Select the Directory Security tab.
Click the Edit button under the Secure communications section.
Uncheck the box labeled ‘Require secure channel (SSL).
Click OK.
Click Apply and then OK.

Provisioning Console Connection Closed

Problem

The error ‘The Host Name cannot be resolved', or ‘ the remote connection was closed' appear when accessing the Provisioning Console.

The problem can also be seen when using the Test functionality on the DNS Configuration node. It may show a failed to obtain IP message.

Cause

When our Console tries to resolve the name to the Intel SCS Server (even when Altiris and SCS are on the same server) it fails and one of these errors are thrown. The difference can be in the perceived FQDN for the Server. Altiris is attempting to acquire the right IP address so it can communicate with SCS.

Resolution

There are two ways to fix this if a reinstallation does not correctly set the SCS identity within Altiris.

LMHOSTS or HOSTS files - We can update one or both of these files to contain the FQDN we're using to try and translate the IP Address. The difficult part is finding out what Altiris is attempting to connect to. Use the process below to find out what it is looking for:

See Part 1 concerning the use of OOB trace logging and Debug View.
Enable trace logging in OOB and launch dbgview.exe.
Try to access the console and produce the error.
Stop trace logging.
This is the difficult part. Normally I scan through the log looking for the host name of the server. Usually this shows up as part of an FQDN. One example of this is Altiris called Servername.domain, which did not respond, but Servername.domain.com was a valid name.
Do a Search for the Host Name of the system (Not FQDN as it may not be using the valid one). For example, MyServer.
Once complete, access the file named lmhosts (no extension). Place a line in the file with the Server IP Address and invalid name:
- 10.10.10.1 Servername.domain
Whatever invalid name was located in step 5, the above sequence can be used to give the computer the correct IP Address resolution. This resolves the issue. However there may be other steps needed. If this doesn't resolve the issue, continue to step 8.
Access the Service Location node in the Provisioning Console.
Change the option to ‘Alternate URL:'.
Specify a new location changing the name to one that resolves, for example:
- Previous URL: http://Servername.domain:80/AMTSCS
- Fixed URL: http://Servername.domain.com:80/AMTSCS
Click Apply to save the changes.

The difficult part in this process is locating what Altiris believe the name of the Intel SCS Server is. Since Altiris and SCS are not integrated, they do not have a mechanism that shows if they are on the same server or not. This is why this issue surfaced.

Provisioning Console User Not Authorized

Problem

After installation or after credential changes the typical error structure appears with the message:

Current User can't view this page.
Current user can't change settings on this page.

Note that the error does not have the Red error typically associated with other console errors.

Cause

After installation only the user who conducted the Intel SCS install has rights to the console nodes. Until other users are added, only this user (usually the Notification Server Application identity) has rights to these nodes. Notification Server role and scope security does not apply to the populating of the data to the right of these nodes (although it does control access to actually showing the nodes themselves in the left-hand tree).

Resolution

Follow these steps to give the necessary users rights to the Provision Console nodes:

Log into the Altiris Console as the Notification Server Application Identity, or the user used to manually install Intel SCS (one of these will usually be the authorized user).
Access the Altiris Console under View > Solutions > Out of Band Management > Configuration > Provisioning > Configuration Service Settings > Users.
Note the users who already have rights.
Click the blue + icon to add a user.
Click the ... browse icon to see a typical Notification Server Domain user and groups search window.
Add a group or user and click OK.
Under the Role: give Enterprise Administrator rights unless you want to limit which nodes are operable.
Click OK to complete adding the user.

If no user can access these nodes, the Intel SCS installation needs to be run again under the correct user. Run through these steps to complete this:

Log onto the Notification Server directly (or with the /console switch if you're using Remote Desktop) with the NS Application Identity.
In Add/Remove Programs, locate ‘Intel® Active Management Technology Setup and Configuration Service and remove it.
On the Notification Server, browse to +install_path+\Program Files\Altiris\Notification Server\NSCap\Bin\Win32\X86\OOB\IntelSCS\.
Launch the file AMTConfServer.exe and walk through the install. Be sure to use the Application Identity as the credentials for SCS.
When prompted for the database credentials, if permissible use the Application Identity.
Once completed log into the Altiris Console with the Notification Server Application Identity, then move back to step 1 of the previous sequence to add other users as necessary.

Provisioning Console Timeouts

Problem

Even in small environments we've seen timeouts on the Intel AMT Systems node, and much less frequently on the other nodes. The timeout throws a .NET error and the page is replaced by a timeout error.

Cause

The cause is not known at this time. The timeouts do not seem to occur always at particularly busy times for the Notification Server, so it is difficult to know what causes them. When there are plenty of resources available the timeouts generally do not occur, though if the server is extremely busy it doesn't always occur. It appears to be caused by varying factors.

A refresh after the timeout error often loads the page just fine. This suggests the loading the page gets into a loop or hung state, instead of a true processing timeout issue.

Resolution

No full resolution is known at this time, but a few items can help minimize the impact of the issue.

Remote Consoles - We've seen remote consoles perform better than having the console loaded directly on the Notification Server
Refresh - Normally the timeouts occur without loading any of the frames within the page. If you click on the link or hit the refresh for the Intel AMT Systems page and no frames load within a minute, refresh the page. Often when the page is refreshed it then loads correctly, even quickly.

Conclusion

Once the console has been restored, the Provisioning process can be configured and initiated. Because of the all or nothing nature of most of these issues, they must be overcome before even being able to properly setup and configure Intel SCS for the Provisioning process. The above resolutions cover the methods used to resolve these issues at multiple sites.

USB Key Provisioning Utility - One-Touch Provisioning Tool - Binary & Source Now Available.

tcduncan — Mon, 17 Mar 2008 22:28:01 GMT

The USB Key Provisioning Utility (UKPU) tool is designed to create a valid USB key for provisioning Intel® AMT Systems. The UKPU tool prepares a USB Flash drive, copies the requested setup.bin to the drive, and also verifies that the setup.bin is saved using the proper procedures necessary to ensure that it is detected by Intel® AMT.

The tool has a 'repair' mode that allows you to take an existing USB Key and reconstruct it to ensure the setup.bin is visible to Intel® AMT. In addition, you can set up a USB Key using any renamed setup.bin file on your computer, and the tool will automatically ensure it is renamed to 'setup.bin' when setting up the key.

Here's a 3 minute video overview of the tool's capabilities (Click here to view video on YouTube):

Both binary only & open source licensed source versions available at the download site.

DOPD SW Engineering Team

Two New Tools Aim To Ease Activation

tcduncan — Sat, 08 Mar 2008 02:07:04 GMT

Today we offer the USB Key Provisioning Utility (UKPU) focused on one-touch provisioning and the Intel® AMT Reflector which offers a unique implimentation allowing an Intel® AMT client to access/manage some Intel® AMT functionality locally via the OS without entering the management engine directly (usually via BIOS).

Click here to learn more about Intel® AMT Reflector or here to download directly.

Click here to learn more about USB Key Provisioning Utility (UKPU) or here to download it directly.

Tell us what you think!
DOPD SW Engineering Team

SCS Setup Wizard Now Available for Evaluation

tcduncan — Thu, 28 Feb 2008 21:15:41 GMT

Available for download and use is the SCS Setup Wizard, a tool designed to automate the installation of the Intel® Setup and Configuration Service (SCS) along with the third party pre-requisite components automatically. This is a pre-release alpha level project that will be updated soon. It requires a fresh install of Windows Server 2003 and un-provisioned Intel® AMT clients.

Background -

The Intel Setup and Configuration Service for Intel® Active Management Technology (Intel® AMT) is a free toolset that simplifies the preparation of hardware that supports Intel AMT for remote administration.

Intel SCS automates the process of populating Intel AMT managed platforms with the usernames, passwords, and network parameters that enable the platforms to be administered remotely.

The automation of these activates provide an efficient means of implementing Intel AMT hardware for enterprise customers.

The Intel SCS service works with other services in order to provide a secure setup and configuration infrastructure for Intel AMT devices.

To successfully take advantage of the functionality that the Intel SCS service can provide, all of the other needed services must be correctly installed and configured. These services include:

Microsoft SQL* Server
Internet Information Services (IIS) 6.0
Microsoft Certificate Authority
Active Directory

Installing and configuring all of the services needed to utilize the Intel SCS can take an experienced user 2+ hours to complete. Using the automation provided by the SCS Setup Wizard, this process can take less than 30 minutes.

SCS setup Wizard Performs the following functions -

Install/configure MS SQL Server 2005 Express* Edition and MS SQL Server Management Studio Express
Install/configure Internet Information Services (IIS) 6.0
Install/configure MS Certificate Authority*
Install/configure Active Directory Services
Install certificate for IIS
Install certificate for Intel AMT Client
Install/configure Intel SCS service

Download here:
http://downloadcenter.intel.com/detail_desc.aspx?ProductID=2557&DwnldID=15532&agr=N

DOPD Software Engineering Team

Define Activation...

Dave McCray — Mon, 25 Feb 2008 18:01:24 GMT

Depending on your companies requirements (i.e. security, infrastructure, biz process) Activation can mean many things. If your security requirements are such Activation can simply mean enabling AMT in the BIOS in SMB mode. If your requirements are more stringent it can mean enabling AMT to prepare for Remote Configuration (Zero Touch), or, if you are still doing it the "old" way, then you are either manually (YUKE!) applying the PID/PPS combo or using the USB methodology. Great, but is this Activation? What about the other pieces to the device lifecycle i.e. break/fix, reuse, EOL where you have to manage the certificate? Intel IT, along with help from our friends in other Intel orgs are developing a programmatic script to aid in managing the systems as they move through the lifecycle. But is this Activation? How about how you use AMT? What business processes need to be changed to gain the full benefit of the cost savings from AMT?

Activation, as defined by Webster's Dictionary, is to make active or more active, or to set up or formally institute with the necessary personnel and equipment. What this means to AMT is that you need to map out all aspects of the full use of AMT but measure it based on each step of the way to get a clear picture of where you are. In other words, define your total market (system in the environment that are AMT capable); how many have AMT enabled in the BIOS (in prep for RC); how many are fully provisioned; how far have you tested your full lifecycle; do you have your console strategy in place; how have you defined your use cases; are you using it? Each step is making AMT more active. How far have you gone? How do you define Activation?

Note: As the Intel IT and product groups validate the new provisioing script we will post additional information. It effectively removes the ambiguity in provisioing lifecycle; managing from intial provision to break / fix. More to come.

Activation Blog

Remote Configuration Certificate Application Best Practices for Intel vPro Systems

Introduction

Obtaining a Remote Configuration Certificate

Installing the Certificate

Reinstalling the Certificate

Other Setup Requirements

ProvisionServer

DNS Zones

DHCP Option

Conclusion

The Mechanics of Provisioning with Out of Band Management 6.3

Introduction

Provisioning Flow

Troubleshooting

Conclusion

BIOS & AMT Settings - Quick Primer on AMT location in the BIOS

More issues posted to the Known Issues, Best Practices wiki!

Intel® AMT Reflector - New Release Posted w/Video Tutorial Too!

Microsoft's System Center Configuration Manager Forums

Troubleshooting the Altiris Manageability Toolkit for vPro Technology - Part 4 - Provisioning Server Troubleshooting

Introduction

Symptoms

No update to Intel AMT Systems Node

Problem

Cause

Resolution

No Systems Appearing

Problem

Cause

Resolution

FQDN Not Acquired

Problem

Cause

Resolution

No systems Provisioning

Problem

Cause

Resolution

Properties Script Failed

Problem

Cause

Resolution

Conclusion

Troubleshooting the Altiris Manageability Toolkit for vPro Technology - Part 3 - Provisioning Console Troubleshooting

Introduction

Symptoms

Provisioning Console Access Forbidden

Problem

Cause

Resolution

Provisioning Console Connection Closed

Problem

Cause

Resolution

Provisioning Console User Not Authorized

Problem

Cause

Resolution

Provisioning Console Timeouts

Problem

Cause

Resolution

Conclusion

USB Key Provisioning Utility - One-Touch Provisioning Tool - Binary & Source Now Available.

Two New Tools Aim To Ease Activation

SCS Setup Wizard Now Available for Evaluation

Define Activation...