3 Replies Latest reply on Dec 2, 2015 3:16 AM by dariusz.wittek@intel.com

    SCS usb configuration problem.

    olswes

      I am trying to configure the Intel AMT via USB.  When I try to write the file to the USB drive it gives me an error that the it cannot make the USB file the first on the disk.  It has done this with three different USB drives.   How can fix this?

        • 1. Re: SCS usb configuration problem.
          dariusz.wittek@intel.com

          What is exact ACUConfig.exe command and parameters you use to create USB setup,bin file? (replace your real MEBx passwords with ex. "P@ssw0rd").

           

          USB Configuration requires FAT 16 or FAT 32 USB removable drive with single partition. It doesn't have to be (shall not) bootable.

           

          Some USB drives emulate HDD or may have extra/hidden partition.

          ACUConfig will generate setup.bin file to NTFS  USB drive (just checked it) but Intel® MEBx FW that recognizes and reads setup.bin file will not suport other filesystems than FAT 16/32.

           

          rgds

          darek

          • 2. Re: SCS usb configuration problem.
            Rajiv123

            Hi Dariusz

             

            I configured the amt using Setup.bin via USB. After that AMT is activated only when again logged into AMT and selecting the Activate Network Access.

             

            Is that any way i can activate the amt without again logging into AMT. The ip and power settings are configured as i had entered in the configurator. As I am using Linux Version ACUConfig, I have three commands.

             

            I need to automate the AMT Configuration without logging manually into AMT Setup. Any help would be appreciated thank you !!!

             

             

            Regards,

            Rajiv

            • 3. Re: SCS usb configuration problem.
              dariusz.wittek@intel.com

              Rajiv,

              USB local Configuration of Intel® AMT works for Intel AMT 6.0 or newer.

               

              if you use USBFile.exe /?  you will get all its switches explained.

               

               

              Use followingUSBFile.exe switches to create local configurtion setup.bin file (you were missing -conf 1 most probably) that will configure AMT into Admin Control Mode.

               

               

              USBfile.exe -create setup.bin <current MEBx password (if unconfigured yet it shall be admin)> <your new MEBx Password> -amt -consume 0 -conf 1 -userConsentOption 0 -userConsentPolicy 1 -v 3 -redir 7 -kvm 1 -scramble

               

              -amt switch turns on Intel AMT  Manageability feature ON  if its factory default state was off (you may skip it)

              - consume 0 -non consumable record -may be used on many systems

              -conf 1 - configure Intel AMT locally from USB -this is piece you have been missing

              -userConsentOption 0 - switches off User Consent option (1 will turn it on for KVM only)

              -userConsentPolicy 1 - allows AMT admin (Digest or Kerberos) users to change User Consent code setting remotely / 0 locks User Consent Code policy in its current state

              -v 3 - version of the file format with KVM settings  (for AMT 6 or newer)

              -redir 7  -turns on SOL/IDER

              -kvm 1 - turns on KVM feature

              -scramble -scrambles setup.bin file to be not readable by humans -BUT this is not an encryption (not possible) of the file.

               

              you can check your generated file content with USBfile.exe -view setup.bin

               

               

              USB local Configuration  configures exactly the same Intel AMT settings that manual Configuration via MEBx BIOS module can configure (USB local Configuration is actually done by the same MEBx BIOS FW) and it doesn't configure: Intel aMT WiFi, TLS/MTLS, Kerberos/AD integration, additional digest accounts.

               

              USB Local Configuration uses Shared Password Model -so remote Intel AMT access it possible with default Digest AMT Administrator account only (admin), and its new password = your new MEBx Password as configured by USB local Configuration.
              But since then those two passwords: MEBx Password & default Digest AMT Administrator password  can be changed independently.

               

              Once system is configured with USB Local Configuration  it can be reconfigured (AMT settings can be changed) remotely over LAN Only from Intel SCS -RCS service or locally with HBC (re-)Configuration with additional Intel AMT settings.

               

              you just have to use ACUConfig with additional switch /AdminPassword <our new MEBx Password>

               

               

              Regards

              darek