For those who have Provisioned Intel AMT Systems, you may wonder what takes place in the background. This article is for you! The process has often been covered at a high level, but here the technical details are provided. Hopefully this helps you understand the inner workings, and provide you information when troubleshooting Provisioning issues. And for those of you who are technically minded, it's also neat to know! This information was compiled working on issues and running through provisioning processes from Symantec Support.

Introduction

Provisioning Flow

• The console items in the Altiris Console under View > Solutions > Out of Band Management > Provisioning are not tied to the Altiris database like most of the rest of the Altiris Console. They connect through a virtual Website (AMTSCS under the Default Website of the SCS Server) to the IntelAMT database.
• Data from two databases (IntelAMT and Altiris) are used during the Provisioning process.

The following articles can assist if you need information on these:

• http://juice.altiris.com/article/1314/altiris-and-intel-reg-vpro-copy-technology-evaluators-guide
• Administrator's and Reference Guides: http://www.altiris.com/support/documentation look under Out of Band Management

1. The server is loaded with a security key or certificate. See the following two items for how these keys are loaded:
   1. For a PID PPS, either keys are randomly generated or imported into the IntelAMT database. Specifically they reside in the table csti_pid_map. Once created/imported, they are available for verifying authentication from an incoming provisioning request from AMT.
   2. For TLS-PKI (certificate-based Remote Configuration) a certificate is loaded onto the server. See this article for details: http://juice.altiris.com/article/4496/obtaining-and-applying-a-verisign-remote-configuration-certificate.
2. The clients need the matching keys loaded onto them. This is done differently depending on the type:
   1. For PID PPS the keys are set by one of the following methods: the OEM sets it, it's entered manually into the Intel ME, or inputted via a one-touch USB flash drive. The PID and PPS are written into the firmware to be used as the authentication credentials when it looks for a provisioning server.
   2. For Remote Configuration (TLS-PKI) at the factory predefined hashes are burned into the firmware for the following certificate vendors (more to come in subsequent versions of AMT). This means AMT already has authentication keys to begin the provisioning process direct from the factory.

• VeriSign
• Komodo
• GoDaddy

1. The client machine, once it has it's keys and has been connected to the network and power, uses one of two methods to find the Provisioning Server:
   1. The IP address of the server can be manually put into the Intel ME, including what port the SCS listener is configured for (default 9971). When this is done, the AMT client will transmit its Hello message directly to the IP Address and port.
   2. The client will transmit its message on port 9971 to the name of ‘ProvisionServer'. If Out of Band Management, Intel SCS, and DNS have been properly setup DNS will route the packet to the Notification Server.
2. The Notification Server is set to listen for AMT Provisioning traffic on port 9971, but can be configured to use a different port if so desired in the Altiris Console under View > Solutions > Out of Band Management > Configuration > Provisioning > Configuration Service Settings > General. The top options labeled: ‘Listen port:".|
   
3. When SCS, via the service AMTConfig (process AMTConfigWinService.exe) receives the incoming "hello" packet, it initiates an authentication request with the client to complete the authentication process, the beginning of which was stored in the packet. Once authentication completes successfully, the process moves on.
4. The service, AMTConfig, catches the incoming packet and logs the data in the IntelAMT database, in the table csti_amts. This table contains all the relevant data for this system's identity.
   
5. Once the system has been logged into the IntelAMT database, Intel SCS uses the database entries under csti_configuration to initiate what's known as the props script. This script is what will assist in the provisioning process. In Altiris case, it is oobprov.exe, located by default at C:\Program Files\Altiris\OOBSC\oobprov.exe. For an example of how Intel SCS knows about this, see this data snippet from the csti_configuration table:
   
6. On a busy SCS server you can look at Task Manager and see multiple instances of oobprov.exe running. The default settings allow 10 threads to work on provisioning requests at any given time. These threads will interface with the Altiris Database via the Altiris Agent on the local server system. In a standard setup the local system is also the Notification Server.
7. OOBPROV runs a SQL query to fetch the Fully Qualified Domain Name (FQDN) for the system it is to provision. The query is based off the following data points:
   1. UUID passed to it via Intel SCS, Source is as follows: Database: IntelAMT, Table: csti_amts, Data Source: "Hello" packet from AMT system, Values used: uuid
   2. Database: Altiris, Data-class: OOB Capability, Table: Inv_OOB_Capability, Data Source: Out of Band Discovery Task, Values used: _ResourceGuid - UUID
   3. Database: Altiris, Data-class: AeX AC Location, Table: Inv_AeX_AC_Location, Data Source: Basic Inventory Agent, whether from Basic Inventory function or Hardware Inventory from Inventory Solution, Values used: _ResourceGuid - Fully Qualified Domain Name
8. The Query accomplishes the following: It takes the UUID from csti_amts, uuid and looks for a match in Inv OOB Capability, uuid. If a match is made, it takes the _ResourceGuid from the same table and makes a match of the same columns name to AeX AC Location. With the match it then reads the values stored under Fully Qualified Domain Name (I'm not sure why they didn't just label this column FQDN...).
9. Next, oobprov.exe hands back the FQDN it's read from AeX AC Location, Fully Qualified Domain Name and passes it to SCS. SCS takes this value and inserts it into the IntelAMT database at csti_amts, fqdn for the matching resource.
10. Next, oobprov.exe fetches the automatic profile set within Out of Band Management Solution. This is done in the Altiris Console under View > Solutions > Out of Band Management > Configuration > Provisioning > Intel AMT Systems > Resource Synchronization. This policy needs to be enabled for this step to work, and a default profile configured and selected under the dropdown labeled ‘Intel AMT 2.0+ to profile:'.
11. The profile provides the operational data for management of the AMT system. After AMT accepts the profile, the Provisioning process is now complete. Before this step, AMT functionality is not available on this system, and after this step only properly authenticated functions will be able to use Intel vPro on the target provisioned systems.

Troubleshooting

• The "Hello" packets only transmit for 24 hours, on a back-off schedule, before stopping altogether. If the Server is unable to provision in that time, with IP refreshes becoming more frequent, the system can be in a limbo state. See this article for steps to rectify: http://juice.altiris.com/article/3612/using-intels-rct-tool-restart-amt-hello-packets-enterprise-provisioning
• IP Address changes, refreshes within DHCP during a system's build process can leave SCS with an out of date IP Address for a system that needs provisioning. Coupled with the preceding issue this can leave the system in an unprovisioned state, leaving no ability of the SCS to contact the system to finish the process.
• Remote Configuration certificate is not properly installed on the server, producing authentication failure messages in the AMT logs.
• Oobprov.exe is unable to fetch the FQDN. The AMT system needs the Altiris Agent installed, have sent Basic Inventory when it had a valid FQDN (for example a system in the process of being built might not have a valid FQDN yet), OOB Discovery Task downloaded and executed, and data populated into the OOB Capability data class from the task in order for oobprov.exe to be able to fetch the FQDN. Conversely you can use the option in Resource Synchronization labeled, ‘Use DNS IP resolution to find FQDN when assigning profiles'.

A good resource for troubleshooting issues can be found here:

• http://juice.altiris.com/book/3699/troubleshooting-altiris-manageability-toolkit-vpro-technology

Conclusion

Here are the latest issues posted to the wiki - check'em out!

• Using Intel(R) AMT wirelessly without user intervention

• Local Manageability Service (LMS) does not allow host VPN traffic when environment detection is not defined

• Unable to remove wireless profiles in Intel SCS

For those looking for a little extra help on System Center Configuration Manager, Microsoft has a great forum resources on a variety of System Center Configuration Manager topics...

Configuration Manager - General
General Discussion on the topics or features not already covered by one of the other forums for System Center Configuration Manager.

Configuration Manager - Announcements
General Announcements for System Center Configuration Manager Forums

Configuration Manager - Admin Console
Discussion on the Admin Console for System Center Configuration Manager

Configuration Manager - Asset Intelligence
Discussion on the Asset Intelligence feature for System Center Configuration Manager

Configuration Manager - Backup and Recovery
Discussions on Backup and Recovery for System Center Configuration Manager Sites

Configuration Manager - Desired Configuration Management
Discussion on the Desired Configuration Management feature for System Center Configuration Manager

Configuration Manager - Documentation
Discussion on the Help and Documentation for System Center Configuration Manager

Configuration Manager - Internet Clients and Native ModeDiscussion on the Internet Based Clients and running sites in Native Mode, certificate and SSL issues for System Center Configuration Manager

Configuration Manager - Inventory
Discussion on the Inventory feature for System Center Configuration Manager

Configuration Manager - Operating System Deployment
Discussion on the Operating System Deployment feature for System Center Configuration Manager

Configuration Manager - SDK
Discussion on the Software Development kit for System Center Configuration Manager

Configuration Manager - Setup/Deployment
Discussion on the Setup and Deployment of Clients and Servers for System Center Configuration Manager

Configuration Manager - Software Distribution
Discussion on the Software Distribution feature for System Center Configuration Manager

Configuration Manager - Software Updates Management
Discussion on the Software Updates Management feature for System Center Configuration Manager

In part 2 we introduced the Server components used in Provisioning, including some key items to be aware of. In this installment we'll cover troubleshooting the server components in a symptom - cause - resolution format. The methodology should also allow help you understand how these components work for further troubleshooting efforts, or for simply understanding how the data is moving through the Provisioning process. This specific article covers the Console and the common errors that can appear.

Introduction

Symptoms

• Provisioning Console Access Forbidden - Generally this is a 403 error on most of the Altiris Console Provisioning Nodes
• Provisioning Console Connection Closed - All the Provisioning Nodes show an error that the underlining connection was closed
• Provisioning Console User Not Authorized - This error relates to the access rights to the actual Provision Nodes, and can happen even if a user is an Altiris Administrator
• Provisioning Console Timeouts - We've seen timeouts occur in the console, when accessing the Intel AMT Systems list

Provisioning Console Access Forbidden

Problem

Cause

Resolution

1. On the Notification Server where Intel SCS is installed, open up IIS Manager.
2. Browse down into the Default Web Site and select AMTSCS.
3. Right-click on AMTSCS and choose Properties.
4. Select the Directory Security tab.
5. Click the Edit button under the Secure communications section.
6. Uncheck the box labeled ‘Require secure channel (SSL).
7. Click OK.
8. Click Apply and then OK.

Provisioning Console Connection Closed

Problem

The problem can also be seen when using the Test functionality on the DNS Configuration node. It may show a failed to obtain IP message.

Cause

Resolution

LMHOSTS or HOSTS files - We can update one or both of these files to contain the FQDN we're using to try and translate the IP Address. The difficult part is finding out what Altiris is attempting to connect to. Use the process below to find out what it is looking for:

1. See Part 1 concerning the use of OOB trace logging and Debug View.
2. Enable trace logging in OOB and launch dbgview.exe.
3. Try to access the console and produce the error.
4. Stop trace logging.
5. This is the difficult part. Normally I scan through the log looking for the host name of the server. Usually this shows up as part of an FQDN. One example of this is Altiris called Servername.domain, which did not respond, but Servername.domain.com was a valid name.
6. Do a Search for the Host Name of the system (Not FQDN as it may not be using the valid one). For example, MyServer.
7. Once complete, access the file named lmhosts (no extension). Place a line in the file with the Server IP Address and invalid name:
   • 10.10.10.1 Servername.domain
8. Whatever invalid name was located in step 5, the above sequence can be used to give the computer the correct IP Address resolution. This resolves the issue. However there may be other steps needed. If this doesn't resolve the issue, continue to step 8.
9. Access the Service Location node in the Provisioning Console.
10. Change the option to ‘Alternate URL:'.
11. Specify a new location changing the name to one that resolves, for example:
    • Previous URL: http://Servername.domain:80/AMTSCS
    • Fixed URL: http://Servername.domain.com:80/AMTSCS
12. Click Apply to save the changes.

Provisioning Console User Not Authorized

Problem

• Current User can't view this page.
• Current user can't change settings on this page.

Cause

Resolution

1. Log into the Altiris Console as the Notification Server Application Identity, or the user used to manually install Intel SCS (one of these will usually be the authorized user).
2. Access the Altiris Console under View > Solutions > Out of Band Management > Configuration > Provisioning > Configuration Service Settings > Users.
3. Note the users who already have rights.
4. Click the blue + icon to add a user.
5. Click the ... browse icon to see a typical Notification Server Domain user and groups search window.
6. Add a group or user and click OK.
7. Under the Role: give Enterprise Administrator rights unless you want to limit which nodes are operable.
8. Click OK to complete adding the user.

1. Log onto the Notification Server directly (or with the /console switch if you're using Remote Desktop) with the NS Application Identity.
2. In Add/Remove Programs, locate ‘Intel® Active Management Technology Setup and Configuration Service and remove it.
3. On the Notification Server, browse to +install_path+\Program Files\Altiris\Notification Server\NSCap\Bin\Win32\X86\OOB\IntelSCS\.
4. Launch the file AMTConfServer.exe and walk through the install. Be sure to use the Application Identity as the credentials for SCS.
5. When prompted for the database credentials, if permissible use the Application Identity.
6. Once completed log into the Altiris Console with the Notification Server Application Identity, then move back to step 1 of the previous sequence to add other users as necessary.

Provisioning Console Timeouts

Problem

Cause

A refresh after the timeout error often loads the page just fine. This suggests the loading the page gets into a loop or hung state, instead of a true processing timeout issue.

Resolution

1. Remote Consoles - We've seen remote consoles perform better than having the console loaded directly on the Notification Server
2. Refresh - Normally the timeouts occur without loading any of the frames within the page. If you click on the link or hit the refresh for the Intel AMT Systems page and no frames load within a minute, refresh the page. Often when the page is refreshed it then loads correctly, even quickly.

Conclusion

Today we offer the USB Key Provisioning Utility (UKPU) focused on one-touch provisioning and the Intel® AMT Reflector which offers a unique implimentation allowing an Intel® AMT client to access/manage some Intel® AMT functionality locally via the OS without entering the management engine directly (usually via BIOS).

Click here to learn more about Intel® AMT Reflector or here to download directly.

Click here to learn more about USB Key Provisioning Utility (UKPU) or here to download it directly.

Tell us what you think!
DOPD SW Engineering Team

Depending on your companies requirements (i.e. security, infrastructure, biz process) Activation can mean many things. If your security requirements are such Activation can simply mean enabling AMT in the BIOS in SMB mode. If your requirements are more stringent it can mean enabling AMT to prepare for Remote Configuration (Zero Touch), or, if you are still doing it the "old" way, then you are either manually (YUKE!) applying the PID/PPS combo or using the USB methodology. Great, but is this Activation? What about the other pieces to the device lifecycle i.e. break/fix, reuse, EOL where you have to manage the certificate? Intel IT, along with help from our friends in other Intel orgs are developing a programmatic script to aid in managing the systems as they move through the lifecycle. But is this Activation? How about how you use AMT? What business processes need to be changed to gain the full benefit of the cost savings from AMT?

Activation, as defined by Webster's Dictionary, is to make active or more active, or to set up or formally institute with the necessary personnel and equipment. What this means to AMT is that you need to map out all aspects of the full use of AMT but measure it based on each step of the way to get a clear picture of where you are. In other words, define your total market (system in the environment that are AMT capable); how many have AMT enabled in the BIOS (in prep for RC); how many are fully provisioned; how far have you tested your full lifecycle; do you have your console strategy in place; how have you defined your use cases; are you using it? Each step is making AMT more active. How far have you gone? How do you define Activation?

Note: As the Intel IT and product groups validate the new provisioing script we will post additional information. It effectively removes the ambiguity in provisioing lifecycle; managing from intial provision to break / fix. More to come.