This is the second in a three part blog post.  The first article

covers the Basics

and the final article discusses

creating an SCS debug log

 

Handling common Intel® SCS errors

With the SCS event log set to verbose mode, not only will successful provisioning events show but also warnings and errors if you are having difficulty in provisioning or configuring an Intel® vPro™ client. When a successful provisioning process occurs, you will see a sequence of Intel AMT properties being set followed by the statement "Commit Changes". Once this occurs, the target system is configured and ready to send\receive AMT webservice calls.

 

However, if this does not occur, refer to the following list of common errors with guidelines on how to interpret and resolve.

 

  • Error 102 - Intel AMT device is already provisioned - This indicates that the IntelAMT database has the target system identified as provisioned. If the target system was manually unprovisioned via the local MEBx, than manually delete\remove the entry from the provisioning console. From a provisioning security perspective, this error may also indicate an attempt to replay a provisioning sequence. The ProvisionServer with Intel® SCS running will reject additional requests if the system is already listed as Provisioned.

 

  • Error 103 - Request is already in the queue - This is really a status or awareness indicator. Provisioning and maintenance requests are queued within the IntelAMT database and processed by Intel® SCS servers. In larger implementations, multiple Intel® SCS servers can be configured to process requests within a single IntelAMT database queue.  The queue includes immediate and delayed requests. Thus if a request is already delayed, this error will be generated. Similarly, if the request is being processed or handled by the poller, a competing request will generate this message.

 

  • Error 137 - Another process currently working on AMT - The target AMT device has a preceding request that has not completed. For example, if a partial un-provision request has not completed and a reprovision request is sent, this will generate the error. Reasons for the previously queued request not completing might including connectivity, difference of provisioning state, and so forth. If the error is persistent for a target AMT device\system and connectivity to the target system is available - try executing a management function if the system is in a configured state. (e.g. Remote inventory, remote power on\off, etc). If unsuccessful, the target system may be in an unsupported state. A manual process of partial unprovision may be required. Removing the assigned profile at the provisioning console should occur also.

 

  • Error 139 - Failed to update Kerberos Password with Kerberos Integration is disabled on server - Intel® SCS has the ability to integrate with Microsoft Active Directory for Kerberos based authentication. Check to ensure schema extensions have been applied and proper authentication to the Kerberos server (e.g. Microsoft Active Directory) is in place.

 

  • Error 407 - Batch exit code 0xfffff - This is a -1 return caused between a provisioning script and the SCS instance. Incomplete Intel® AMT profile, missing provisioning/configuration data, or other console configurations will likely cause this error.  Check with the provider of the provisioning script - whether system management vendor or other. If the error is persistent afterwards, refer to the SCS debug log creation in the next article and contact support of the script provider.

 

  • Error 602 - Exception in clock sync worker - Clock synchronization is important in Kerberos environments, since the authentication process has a time stamp dependency. This error is benign in non-Kerberos authentication environments. It refers to a SOAP call failure - thus further environment and infrastructure investigation may be needed for future environmental considerations.

 

  • Error 913 - No rows found in get UuidMap - For provisioning to occur, the UUID and the FQDN of the target vPro system are mapped together. The provisioning script utilized may attempt to utilize WMI, reverse DNS, previously stored asset data or client agents to obtain this data.  Check with the provisioning script provider.

 

  • Cannot contact back AMT with IP:xxx.xxx.xxx.xxx Exception - The recorded IP address from the hello packet sequence is not responding to requests. If the target system sends a new hello packet with an updated IP address, Intel SCS will update the queue entry. This error commonly occurs when the system has been connected, an IP address and DNS resolution have occurred, hello packet was sent, and then the system was disconnected from the network prior to the ProvisionServer response. A common scenario is pre-staging a system before sending to the intended location.

 

If the suggestions above are not helping, and a deeper investigation of Intel® SCS is needed - a debug log can be created. Please refer to part 3