Intel vPro Expert Center Blog

Tune in for SCS 5.0 ~ Listen live in 1 hour!

Kelsey_Witherow — Mon, 16 Jun 2008 15:27:58 GMT

TODAY: What’s coming in SCS next version? SCS 5.0 is just around the corner and the vPEC team has our guests Shai Kavas and Chaim Rand joining us. This version of SCS includes major usability and scalability improvements and contain some very exciting new features. Some of these cool features are results of feedbacks we got from our partners and… from YOU – our end customers. Wanna know more? Stay tuned to our show!

Date / Time: 6/16/2008 9:30 AM Call-in Number: (347) 326-9831
http://www.blogtalkradio.com/openport

Questions, comments, or concerns? Feel free to contact me.

Intel Setup and Configuration Service (SCS) - Deployment and Capacity Model White Paper

archagam — Tue, 27 May 2008 17:47:17 GMT

This SCS deployment and capacity planning white paper presents architectural and infrastructure guidance for deploying Intel setup and configuration service in various enterprise scenarios. The guidance is based on SCS 3.x extensive scalability testing done in Intel Enterprise Integration Lab.

You can download white paper and capacity model calculator from below links:

SCS 3 deployment white paper: http://communities.intel.com/servlet/JiveServlet/downloadBody/1636-102-1-1993/SCS3%20Deployment%20White%20Paper.pdf

SCS 3 capacity model calculator: http://communities.intel.com/servlet/JiveServlet/downloadBody/1637-102-1-1994/SCS3%20Capacity%20Model%20Calculator.xls

I am currently working on SCS 5 white paper. Any additional inputs will be comprehened in scs5 white paper. Appreciate all the inputs and comments that will help me in refining the content to make it more relevant for end user community.

thx

Anjaneya "Reddy" Chagam

New known issues and best practices posted! Topics are around SCS and the SMS Add-on.

michelegartner — Thu, 08 May 2008 16:50:40 GMT

New articles for you to take a look at this week. As always, let me know if you have a best practice or known issue that you want to share or have investigated!

Using international keyboards to create MEBx passwords via Setup and Configuration Service (SCS)

What is the Authorized column in SCS?

Do management workstations running the SMS console and SMS Add-on require patches as outlined in the documentation for the Intel(R) AMT Add-on for Microsoft SMS*?

New issues posted to the Known Issues/Best Practices wiki

michelegartner — Fri, 21 Mar 2008 19:55:11 GMT

How to procure and install a Verisign Cert for Remote Configuration on SCS

miroyer — Wed, 19 Mar 2008 19:27:37 GMT

Here are some high level steps that walk you through procuring a VeriSign certificate and configuring it for the Intel Setup and Configuration Service (SCS). Other certificate vendors like Go Daddy, Starfield, Comdo, etc will have different purchasing processes.

Purchase Verisign Certificate

Generate Certificate Signing Request (CSR) by following the instruction in the link, http://www.verisign.com/support/ssl-certificates-support/page_dev019431.html.
The Common Name (CN) needs to be the FQDN of the server you want to install this certificate on. (i.e. host name + domain name)
Enter ‘Intel(R) Client Setup Certificate' for Organization Unit (OU).
Complete all the steps. Visit VeriSign website, http://www.verisign.com/ssl/buy-ssl-certificates/ to start purchasing process. Select ‘Secure Site: SSL Certificates' under ‘Buy Individual SSL Certificates'.
Note: you could choose the other two, which are in more advanced level, depending on your need.
Enter all the information required and copy the CSR generated by the server
Complete all the steps and print out the order confirmation page for your record.
You will receive an email of Verisign automated order verification within few hours. You have only 24 hours, after receiving the email, to finish this process. Click the link in the email and go through the process. \\\\\\*Important:* If you cannot recognize the second phone number listed on the webpage, cancel the automated verification process and have them call you instead.

Certificate Installation and Exporting

You will receive the link of installation instruction in the email containing the certificate. Follow the instruction to complete installation
VeriSign will send you the SSL certificate via email. If the certificate is an attachment (Cert.cer), save the file to the hard drive. If the certificate is in the body of the email, create a .cer file (example: NewCertificate.cer) by copying and pasting the certificate text into a plain text editor such as Notepad or Vi. Please be sure to include the header and footer as well as the surrounding dashes. Do not use Microsoft Word or other word processing programs that may add characters. Confirm that there are no extra lines or spaces in the file.
Open the Internet Services Manager (IIS). Click Start > All Programs > Administrative Tools > Internet Information Services (IIS) Manager.
Under Web Sites, right-click your web site and select Properties.
Click the Directory Security tab.
Under Secure Communications, click Server Certificate.
The Web Site Certificate Wizard will open, click Next.
Choose Process the Pending Request and Install the Certificate, then click Next.
Important: The pending request must match the response file. If you deleted the pending request in error you must generate a new CSR and replace this certificate.
Select the location of the certificate response file, and then click Next.
Read the summary screen to be sure that you are processing the correct certificate and then click Next.
You see a confirmation screen.
After you read this information, click Next.
Go back to IIS Manager (Start > Programs > Administrative Tasks > IIS Manager)
Expand Web Sites and right click Default Web Site
Under Secure Communications, click View Certificate...
select Detail tab
Click Copy to file at right bottom of window, the Certificate Export wizard will pop up. (N)
choose Yes, export the private key (N)
mark Include all certificates in the certification path if possible (N)
give a password (can be weak password) and confirm (N)
Give location and file name for the resulting PFX. (N), Finish, Ok.
Close all windows.

Adding Cert To SCS

Install the certificate created above in the System Certificate Store on the platform where the SCS executes. Follow the following steps:

Open certificates (local computer) using the Microsoft Management Console (MMC). To add the certificates plug-in to the MMC,
Select file/add snap-in.
Select Add....
Select Certificates.
Select computer account; click Next.
Select Local computer; click Next.
Select Finish; Close; select Certificates and click OK.
In the console tree, click the logical store where the mmc will import the certificate.
On the Action menu, point to All Tasks and then click Import to start the Certificate Import Wizard.
Type the path and file name of the certificate to be imported or click Browse and navigate to the file. Select automatically select the certificate store based on the type of certificate.

Invoke the loadcert utility

Located at <install_root>:\Program files\Intel\AMTConfServer\Tools.
Double-click on loadcert.exe
Select the certificate that was just imported. The utility will report any problems in the certificates that it detects that would prevent using it as a ZTC certificate.

Matt Royer

Two ISV's managing the same client? Sure!

mprimros — Mon, 10 Mar 2008 21:18:41 GMT

The Brand Promise Validation team here at Intel came across an issue in the lab which many customers may also run into when they are trying to deploy AMT. The question was, how do I use two different ISVs to manage different aspects of my Enterprise configured AMT client fleet? Theoretically this isn't neccessarily a tough question. Based on how AMT was designed, so long as you have the same authentication and credentials setup between the different managment software, you should be able to access the AMT features. In practice, however, many management applications attempt to configure AMT in such a way that they have sole access by customizing the provisioning settings and then hide those settings away.

However, as I'm about to describe, with a little tweaking, you can force these applications to play nice together.

The main thing to remember anytime you are setting up AMT in enterprise mode is that the key to accessing AMT is having the correct certificates in place. For access that means having a Web Server based certificate template that will be used for TLS communication between the console and AMT. If you are also using PKI provisioning, you'll have to have a properly configured or purchased provisioning certificate in place (I won't be covering the details of PKI provisioning in this blog, but maybe in a future update). Lastly, for SMS and Altiris you'll also need a .pem certificate. Details on how to create a .pem certificate is included in both the Altiris help and Intel AMT Add-on for SMS documentation. A quick summary of a .PEM file certificate is taking each certificate in the chain starting at the top and concatinating those certificates into a single file. This file is used for secure TLS communication during SOL sessions.

The two management applicaitons we targetted for implementation was Altiris and SMS using the Intel AMT Add-on for SMS. The reason we targetted these apps is that we have inimate knowledge using these applications since they are used in our validation efforts and they both utilize the Intel SCS for provisioning.

Both Altiris and SMS systems should be in the same domain using the same certificate authority and have the same root certificate installed. While it is definately feasible that you could have the the two management applications in different child domains using wildcard certificates for authentication, this article doesn't cover that specific configuration.

I'm not going to go into the details of setting up Altiris and SMS or how to configure SCS for provisioning since it is assumed that if you are attempting to merge these ISVs so that they can manage AMT clients, then you should already know how to get the individual applications to work with AMT.

I started off by getting Altiris setup and configured using the built in SCS included in the OOB Management solution for Altiris. At this point I didn't have to do anything special in order to make sure that the SMS Add-on would work, I just setup Altiris as normal to manage AMT clients. Once setup, I verified that I could provision and manage my AMT clients.

Next step, on a different machine, I setup and configured SMS with the Intel AMT Add-on for SMS. I configured SMS to use it's own SQL server, however, there is no reason that you couldn't have it use the Altiris SQL server (setting up a separate instance) or a stand alone SQL server (again with a separate instance). For ease of configuration, however, I just used a separate SQL install on the same machine as SMS.

Once you have the SMSAMTUser_<sitecode> account created in active directory and have that account as well as whatever user accounts you want to use AMT via SMS added to the Intel(R) AMT groups (there are 3-5 of them depending on the version of the AMT Add-on you are using), you need to add the SMSAMTUser_<sidecode> to the Altiris SCS users list. On the Altiris system go to: View -> Configuration -> Solution Settings -> Platform Administration -> Out of Band Managment -> Provisioning -> Configuration Service Setings -> Users. Click the blue + to add a new user. Click the ... button. Select domain and type in the name query field SMSAMTUser and click Find. Select the SMSAMTUser_<sitecode> that is found in the results field and click OK. Under Role make sure Enterprise Administrator is selected. Click OK. This gives the service account for the Intel(r) AMT Add-on for SMS rights to view and modify the Altiris SCS.

On the SMS system, open up the Intel Add-on Settings dialogue box and configure it to use the Altiris Setup and Configuration Server. In order to find the URL that Altiris uses to connect to the SCS, On the Altiris machine, go to:

View -> Configuration -> Solution Settings -> Platform Administration -> Out of Band Managment -> Provisioning -> Configuration Service Setings -> Service Location.

If you have the Default URL set, you should have something like [/]<fqdn/AMTSCS. If you are using an alternative URL, copy that down. On the SMS machine, open up the Intel Add-on Settings and go to the Setup and Configuration tab. Select the Integrated Setup and Configuration radio button and type in the URL you copied down into the SCS Service URL box. Click the Set Profiles box and the AMT profiles that are setup in Altiris should pop up in a new window. Select the profiles you want to use in SMS (select all of them if you want all profiles to be able to be managed in SMS) and click OK. The list of supported profiles should now be populated with the profiles that are setup in Altiris.

Next step is to setup the .PEM certificate file that was used in Altiris for the Intel AMT Add-on for SMS. Copy the .PEM file used in Altiris to the SMS system. If you don't know where you .PEM file is located in Altiris, go to:

View -> Configuration -> Solution Settings -> Real-Time Console Infrastructure -> Configuration.

Click on the Intel(r) AMT Connection Settings tab. Under Redirection Security you should see a box next to the Trusted CA certifcate location. That box should have the path to the .PEM file. Once you have copied that file to your SMS system (doesn't matter where you put the .PEM file on your SMS box, so long as you remember where you put it) open up the Intel Add-on Settings dialogue and click on the Security tab. Check the Enable Intel(r) AMT secure Connection (TLS) box. In the CA Certificate Path put in the path to the location of the .PEM file that was copied onto the SMS system. Click Apply.

That is the basicis of what needs to be done. Once you have discovered the AMT clients in SMS and they are populated in the collection, right click on All Systems and go to All Tasks -> Intel(r) AMT Tasks -> Discover Systems. Now when you right click on an AMT system and go to All Tasks -> Intel(r) AMT Tasks you should see the list of AMT functions you can perform such as Asset Identification Information, Power Control Operations, etc.

In order to get SOL/IDE-R to work and System Defense to work, you'll need to go into the Intel(r) Add-on Settings in SMS again and setup the location of the ISO images that will be used for IDE-R and the System Defense file that will be used to filter packets using Circuit Breaker. Creating the System Defense file is covered in the Intel(r) AMT Add-on for SMS documentation and will not be explained in detail here. The repository for the ISO images needs to be a network share and can either reside locally on the SMS system (still mapped to the network share location) or can reside in a central repository. If you want both Altiris and SMS to use the same set of images just use the same network path to the ISO images for both applications.

That's it. In my environment I'm able to manage AMT machines with either management application. The only slight gotcha (and this is more a security feature of AMT) is that if one management application is currently managing a client (ex. using SoL) then the other is unable to break in and use the client. The gotcha part of this is that neither management application gives a clear indication that the system is currently in use by another management application, the attempt to manage just fails with an authentication error.

5 New SCS articles on Known Issues/Best Practices wiki

michelegartner — Fri, 07 Mar 2008 17:48:50 GMT

SoL/IDER can’t be disabled on Lenovo* M55p

Will PKI-CH consistently support wildcard certificates across Intel(R) AMT versions?

Is SNMP Trap Service required for SCS?

Intel(R) AMT Active Directory error message

Organizational Unit Field in Configuration Parameters must be populated to complete provisioning

8 new issues posted to the Known Issues, Workarounds, and Best Practices wiki

michelegartner — Wed, 27 Feb 2008 20:20:39 GMT

Check'em out:

New items posted to Known Issues/Best Practices wiki

michelegartner — Fri, 08 Feb 2008 21:13:35 GMT

Here's the weekly update of issues posted to the Known Issues, Best Practices, and Workarounds wiki:

From iCSO SW Engineering – Intel® vPro™ Packet Decoder – The First of Many

tcduncan — Mon, 28 Jan 2008 17:11:15 GMT

Last month's post of the open source packet decoder is just the first of a strong list of tools planned by the team that brings you the Technology Test Utility. The iCSO software engineering team is charted with making utilities and applications available to the public that accelerate and simplify the adoption and activation of Intel vPro technology.

We will be maintaining these tools and look forward to your feedback, suggestions, and participation in making these tools the best they can be for you and the marketplace. Our commitment is to post new versions of each tool at least every other month and of course post earlier if issues are found that render the tool less than useful.

The next tool we will be posting is a Pre-Installation Utility intended to speed the first user experience and automate as much as possible the initial setup of the Intel® AMT(tm) Setup and Configuration (aka SCS) environment in enterprise mode. Coupled with post setup wizards it will enable users to provision devices with minimal effort and time.

We look forward to hearing your feedback on our efforts.

Intel's iCSO Software Engineering Team

Life in the Trenches: Planning A Real World Deployment of AMT

swood — Wed, 07 Nov 2007 19:10:00 GMT

As a network administrator for a small local government agency, I have been tasked to deploy Intel's Active Management Technology (AMT) into our network environment. Having sold our IT management on the benefits of vPro technology and how it can revolutionize our system management capabilities, I am ready to move forward and get AMT installed . In addition, today I learned that we will begin receiving brand spanking new HP systems in January that will have the latest greatest vPro technology aboard. I've got a few months to become an AMT expert and be ready for the new systems. Life is good!

Where To Start

The first thing I did after learning about vPro and AMT was to visit the Intel vPro Expert Center web site. There I found a great variety of resources to help me with my deployment. This is a good site to get help and guidance. The only problem I have with the site is that there's no link to download the AMT docs or software. You'll want to get your hands on the Intel Active Management Technology Setup and Configuration Service (SCS) - Installation and User Manual. You can get this document as well as the software from http://softwarecommunity.intel.com/articles/eng/1025.htm. Since SCS is the foundation and support structure of everything that goes on in the AMT and vPro world, this was the most logical place to start.

In addition, since I plan on integrating SCS with my existing SMS 2003 infrastructure, I also downloaded the Intel Active Management Technology Add-on for Microsoft SMS 2003 - Installation and User's Guide. Getting this was a bit of a challenge so stay with me on this one. I had to navigate to another good link you'll want to keep and refer to, The Intel Management Developer Community. From here I searched for "SMS 2003" and found the link to the SMS 2003 Add-on document. For non-developers like me, this site can appear to be not exactly what we do everyday, but hang in there, this site has a lot of info too. Now I had the documents I needed. They created the basis on which I would start to plan and deploy AMT into my network.

Read, read, read

The first thing I did after printing the documents was to read them over several times so I could get the gist of just how all the pieces played together. Then I read them again. After the first pass, it all looked pretty daunting and difficult, but after reading many of the sections over, it all started to come together and make sense. Read. Read. Read.

Time to lay things out

Ok, now I had a pretty good idea of what everything did and why, it was time to make sure I had everything I needed to make the pieces work together. I began to try and lay out what I needed to have to make AMT work.

Servers - I need to decide where to install SCS. I had a recently rebuilt Windows 2003 R2 server available that also had SQL 2005 on it. Plenty of disk space and horsepower. This was good. We were using this server to host our Help Desk application and it didn't appear to be over taxed in any way. The hardware and base OS part was taken care of. The server happened to be in our central office which was also a benefit. Our office is put together in a spoke and wheel configuration with all outer offices connecting to the central office over fast network connections. This would be good when we start to provision systems from outer office locations.

Active Directory - SCS / AMT relies on and utilizes Active Directory quite a bit. Our Active Directory is at Windows 2003 R2 level so I'm good to go. Also, as a Domain Admin, I have the ability to make any changes necessary to Active Directory.

Security - AMT supports Transport Layer Security (TLS) for secure communications between AMT devices and management console applications. TLS is optional for AMT, however we wanted to make all our communications as secure as possible so we're going for a full TLS implementation. This requires certificates and fortunately we have a Microsoft Certificate Authority server in our network that will make things easy to manage.

Database - SCS stores all its information in a database. We're going to use the existing SQL 2005 database on the server we're going to install SCS on.

AMT Device Location - Where were the new systems coming into and who was handling them? In the past when new systems came in, our Help Desk techs were very efficient in imaging them and deploying them right out the door. I need to make sure that everyone in our Help Desk group was tuned into what we were trying to do. We'll need to have a meeting to discuss what's going to happen after they plug in a system to the network for the first time.

Now that I've gotten my infrastructure laid out, it's time to start installing software. Yeah!

Next time I'll detail the steps I took in actually installing SCS into my network. As always, any comments and suggestions are warmly welcomed.

Have you tried the new USBFile.exe?

Terry Cutler — Sat, 27 Oct 2007 14:58:00 GMT

Take a look at the latest resource article posted at http://communities.intel.com/docs/DOC-1210

Use the file to generate custom setup.bin files for AMT 2.1, AMT 2.5, and AMT 3.0 systems.

Part 3: Handling common provisioning, configuration, and Intel SCS errors

Terry Cutler — Wed, 24 Oct 2007 16:15:00 GMT

This is the third and final part of this series (at least for now). The previous two posts include Basics and Common Intel SCS errors

BEFORE GOING ANY FURTHER - PLEASE READ AND ENSURE THE FOLLOWING
At this point, you have ensured the infrastructure is setup correctly and have attempted to troubleshoot the common Intel SCS errors as listed in the SCSconsole log file. Intel vPro systems are being recognized and listed in the SCSconsole. However, strange or unexpected behavior continues to occur - whether during provisioning, maintenance, or other activities. If Intel SCS has been included in a system management console or a provisioning script provider with whom you are working - AND - further debug analysis is needed, the following points may help. The debug log output may be one of the datapoints requested to replicate and remediate issues.

Before we go on - please note that these steps require modifications to the Microsoft Windows Registry on the system labeled as "ProvisionServer". That system will be running the AMTconfig service. Enabling the debug logging features will require root drive access and space to capture and store the log outputs. The logs will be stored at the root of C:

Ready to create an Intel SCS debug log?
SCS debug logging is off by default. If enabling for troubleshooting purposes, be sure to disable when done troubleshooting. The following steps will require a new registry key and string value to be added. Once these changes have been made - restart the AMTconfig service. At most, two log files will appear on the root of c: drive. The first is scs_win_server.log the second is scs_server.log. The second commonly appears only after errors have occurred.

Create the following registry key on the service's machine:

HKEY_LOCAL_MACHINE\SOFTWARE\INTEL\AMTConfServer\Log with string value "LogLevel"="V"

Click on the following image to view the entire image

Logging levels can be set to 'V' for verbose, 'W' for warnings and errors, 'E' for only errors.

Once the debug log capture is complete, remove the LogLevel entry from the registry and restart the AMTconfig service.

This concludes the three part Intel SCS troubleshooting. If the community is experiencing additional events or has additional questions - please comment\reply.

Part 2: Handling common provisioning, configuration, and Intel SCS errors

Terry Cutler — Wed, 24 Oct 2007 15:58:00 GMT

This is the second in a three part blog post. The first article covers the Basics and the final article discusses creating an SCS debug log

Handling common Intel® SCS errors
With the SCS event log set to verbose mode, not only will successful provisioning events show but also warnings and errors if you are having difficulty in provisioning or configuring an Intel® vPro™ client. When a successful provisioning process occurs, you will see a sequence of Intel AMT properties being set followed by the statement "Commit Changes". Once this occurs, the target system is configured and ready to send\receive AMT webservice calls.

However, if this does not occur, refer to the following list of common errors with guidelines on how to interpret and resolve.

Error 102 - Intel AMT device is already provisioned - This indicates that the IntelAMT database has the target system identified as provisioned. If the target system was manually unprovisioned via the local MEBx, than manually delete\remove the entry from the provisioning console. From a provisioning security perspective, this error may also indicate an attempt to replay a provisioning sequence. The ProvisionServer with Intel® SCS running will reject additional requests if the system is already listed as Provisioned.

Error 103 - Request is already in the queue - This is really a status or awareness indicator. Provisioning and maintenance requests are queued within the IntelAMT database and processed by Intel® SCS servers. In larger implementations, multiple Intel® SCS servers can be configured to process requests within a single IntelAMT database queue. The queue includes immediate and delayed requests. Thus if a request is already delayed, this error will be generated. Similarly, if the request is being processed or handled by the poller, a competing request will generate this message.

Error 137 - Another process currently working on AMT - The target AMT device has a preceding request that has not completed. For example, if a partial un-provision request has not completed and a reprovision request is sent, this will generate the error. Reasons for the previously queued request not completing might including connectivity, difference of provisioning state, and so forth. If the error is persistent for a target AMT device\system and connectivity to the target system is available - try executing a management function if the system is in a configured state. (e.g. Remote inventory, remote power on\off, etc). If unsuccessful, the target system may be in an unsupported state. A manual process of partial unprovision may be required. Removing the assigned profile at the provisioning console should occur also.

Error 139 - Failed to update Kerberos Password with Kerberos Integration is disabled on server - Intel® SCS has the ability to integrate with Microsoft Active Directory for Kerberos based authentication. Check to ensure schema extensions have been applied and proper authentication to the Kerberos server (e.g. Microsoft Active Directory) is in place.

Error 407 - Batch exit code 0xfffff - This is a -1 return caused between a provisioning script and the SCS instance. Incomplete Intel® AMT profile, missing provisioning/configuration data, or other console configurations will likely cause this error. Check with the provider of the provisioning script - whether system management vendor or other. If the error is persistent afterwards, refer to the SCS debug log creation in the next article and contact support of the script provider.

Error 602 - Exception in clock sync worker - Clock synchronization is important in Kerberos environments, since the authentication process has a time stamp dependency. This error is benign in non-Kerberos authentication environments. It refers to a SOAP call failure - thus further environment and infrastructure investigation may be needed for future environmental considerations.

Error 913 - No rows found in get UuidMap - For provisioning to occur, the UUID and the FQDN of the target vPro system are mapped together. The provisioning script utilized may attempt to utilize WMI, reverse DNS, previously stored asset data or client agents to obtain this data. Check with the provisioning script provider.

Cannot contact back AMT with IP:xxx.xxx.xxx.xxx Exception - The recorded IP address from the hello packet sequence is not responding to requests. If the target system sends a new hello packet with an updated IP address, Intel SCS will update the queue entry. This error commonly occurs when the system has been connected, an IP address and DNS resolution have occurred, hello packet was sent, and then the system was disconnected from the network prior to the ProvisionServer response. A common scenario is pre-staging a system before sending to the intended location.

If the suggestions above are not helping, and a deeper investigation of Intel® SCS is needed - a debug log can be created. Please refer to part 3

Part 1: Handling common provisioning, configuration, and Intel SCS errors

Terry Cutler — Wed, 24 Oct 2007 15:49:00 GMT

This blog is divided into 3 sections - understanding the basics, addressing common Intel SCS errors, and how to generate an Intel SCS debug log.

If only solutions were perfect, errors resolved automatically, and tuning was never required nor needed. Then again, that's what many of us get paid to do and handle. The intent here is to focus on common Intel® vPro™ configuration and provisioning errors with Intel Setup and Configuration Services (SCS). More importantly, the article intent is to provide some insight on the correction needed or tasks to handle common errors.

The Basics
Deploying Intel® vPro™ enabled solutions presents many working parts. In a lab environment - these "always" work well. In a production environment, determining the cause of an error could be difficult. Generally speaking, to isolate the scenario take into consideration the management console, the vPro configuration services (e.g. Intel® SCS), the OEM firmware and drivers, and the infrastructure. The lab environment comes in handy to isolate components and aspects, especially when so many variables are present.

In stepping through each item, consider the following basic points:

OEM hardware and drivers - Check the update page for the latest BIOS and Firmware on the platform. The BIOS update will often include the Intel® AMT firmware. The drivers to be checked are mentioned Management Engine Interface (MEI), Local Management Service (LMS), Serial over LAN (SoL), and User Notification Service (UNS). NOTE: UNS applies to AMT 3.0 and higher versions.

Intel® SCS version - Don't know what version if running? Check the AMTconfig service properties or version listed in the SCSconsole. More on SCS and AMT versions here. Version 3.2 is the latest. If running version 1.x, an update to version 3.x is recommended. Check first with preferred system management vendor on supported setups, upgrade paths, and so forth.

Infrastructure - Ensure a ProvisionServer DNS record exists for the target DNS domain, and that this pointer record resolves to the server running AMTconfig (e.g. Intel SCS). Ensure proper resolution of the DNS entry for the FQDN of ProvisionServer (e.g. ProvisionServer.company.com)

Verbose Logging for SCS events - Within the SCSconsole, access the Change the Log Level to "Verbose" mode. This will log all informational, warning, and error messages and events in the SCS log. This is good to see when a hello packet is received, when the ProvisionServer attempts to provision the target system, and so forth. When changing this setting, you may also want to decrease the log retention level to a few days or shorter timeframe than the default value. Depending on the number of systems managed or attempting to provision, setting the log level to "verbose" may rapidly grow the size of the IntelAMT database.

Image of SCSconsole and setting logging to verbose mode

Image of SCSconsole viewing log events in verbose mode