1 Reply Latest reply on Jan 15, 2018 7:59 AM by dariusz.wittek@intel.com

    Trouble using Agent Presence

    Def-Logix_Developer

      system

        HP ProDesk 600 G3 SFF

        ram: 4gb

        OS: Windows 10 Pro ver. 1709

         build 16299.125

       

      AMT release 11.6.12.1201

       

      Two issues

      1) unable to use manual or usb key configuration to set admin mode

      2) unable to set expiration action on host machine when using agent presence

       

      background

      Have used SCS software to configure for client control mode.

      Used AMT SDK HLAPI software samples to remotely create agent, display agent info, detect

      when agent is running, stopped, expired. Used local samples 1 and 2 to start and stop/expire.

      Additionally tested power changes: power on, power off successfully.

       

      When trying to call SetExpirationActionOnAgentPresenceWatchDog function, fails at

      SetExpirationAction (message simply says failed to set expiration action).

      Does this require admin configuration as opposed to client control?

       

      Would like to have Admin Control Mode, so have been attempting to set configuration using

      usb key, albeit unsuccessfully. Setting up of the usb works using the SCS software, but

      nothing happens when booting, (no prompt for whether to provision) no configuration

      happens when booting with the usb plugged in.

      When booting and pressing CTRL-P, no entry to MEBX menu. There is a ME setup in the BIOS

      menu, but no options for changing the AMT configuration.

        • 1. Re: Trouble using Agent Presence
          dariusz.wittek@intel.com

          Def-Logix_Developer,

          1. with 7th Gen Intel Core vPro intel introduced requirement for OEM BIOS to include USB provisioning setting and its factory default value shall be set to Disabled.
            With previous Gen Intel Core vPro it was OEM discretionary decision to include such option or not. HP BIOS in vPro systems had it since I can remember (ie. all 11 years of Intel vPro technology history).
            With recent BIOS'es some OEM also introduced other MEBx FW controls like MEBx menu access or MEBx entry key sequence prompt visibility.
            You may also like to check Intel® vPro™ Use Case Reference Design - Local Setup and Configuration Using a USB Flash https://downloadcenter.intel.com/download/20979
            you will need USBFile.exe utility from Intel AMT SDK  from http://software.intel.com/en-us/articles/download-the-latest-intel-amt-software-development-kit-sdk

            Please check those OEM BIOS options to enable USB provisioning support and/or MEBx menu entry/prompt.
            Please note also that HP BIOS on notebooks use F6 key as alternative entry to MEBx BIOS menu.

          2. If your PC is already configured (any mode) USB provision attempts will be rejected -with MEBx message about "...Configuration flow error, system is already provisioned".
            You have to fully un-provision Intel AMT first and then use USB to provision it again to Admin Control Mode.
            You can unprovision Intel AMT :
            • from MEBx - via Unconfigure Network Access > Full Unprovision  MEBx menu option. See http://h10032.www1.hp.com/ctg/Manual/c03975296 HP MEBX/AMT user guide.
              If first configuration was done to Client Control Mode - MEBx password may still be factory default "admin" and you will have to define strong (8-32 + 4 of 4) new MEBx Password first. Please remember this new MEBx Password as you need to use it as current MEBx password when creating USB configuration file.
              NOTE- MEBx keyboard layout is always US one regardless of actual physical keys layout.
            • via Intel Configurator -ACU utility (from Intel SCS Configurator folder) running it as local administrator  with following command ACUConfig.exe Unconfigure /Full
              or ACUWizard GUI executed as local administrator.
              Note -if system will be configured into Admin Control Mode - you will have to know current AMT Digest Administrator password and use following command
              ACUConfig.exe Unconfigure /AdminPassword <your current AMT Admin password>  /Full

              Note! -both above AMT un-configuration methods do not change/reset current MEBx password
            • reset Intel AMT to full factory defaults via PC board jumper or BIOS setting, or by pressing power button for specified time - it is OEM dependent!
              For HP there is Unconfigure AMT option in HP BIOS. Full Intel AMT reset to factory defaults is performed during next POST /reboot.
              Note- Intel AMT reset to full factory defaults resets also MEBx Password to its fectory default value ("admin" or other  custom one if pre-configured at OEM factory).

          3. There is also ACUConfig.exe MoveToACM <Intel SCS -RCS server FQDN or IP> /AdminPassword <your current AMT Digest Administrator password>
            command that allows to "upgrade" Intel AMT from Client to Admin Control mode but it requires more complex environment (Intel SCS RCS server, AMT Provisioning certificate, DHCP server and Intel AMT enabled  LAN interface in your vPro systems).
            If you asked about USB Provision I assume it is too complex for your needs (so far).

          rgds

          Dariusz Wittek
          Intel  EMEA Biz Client Technical Sales Specialist