topic Re: Intel AMT: Configuration task sequence failing in Intel vPro® Platform

Intel AMT: Configuration task sequence failing

idata — Thu, 14 Jul 2016 07:25:27 GMT

Hi All,

So I have gone through the steps to get the SCCM 2012 Add On configured. I had some issues with getting http://blog.arkwright.com.au/2016/07/intel-scs-task-sequences-not-working.html Intel AMT: Discovery working, but I've resolved that now and now I am trying to run the Intel AMT: Configuration Task Sequence. I'm having a lot of issues with this one and it seems to be failing on me. I was hoping that someone here has had some experience with this and can assist?

I've attached my SMSTS.log file which is coming up with a few errors when I'm trying to run the script. I'm seeing errors about DNS, FQDNs, Event IDs about incorrect usernames and passwords etc (screenshot attached for that one)

Basically I've been looking into this one for a while now and I'm banging my head against the desk. How does one get this to work? I've not really seen anything online which has a solution for this.

Re: Intel AMT: Configuration task sequence failing

TKrem1 — Thu, 04 Aug 2016 11:10:53 GMT

Hi,

some little questions about your setup.

What Version of the Intel SCS Tool are you using?

Do you use a selfsigned certificate for the Provisioning server or a go daddy or verisign?

Does the Account, you are trying to provision with, have local admin rights?

And last but not least SCCM 2012 or 2012 R2?

We got the provisioning via Tasksequenz running after some problems.

Basically we use an exported Provisioning XML and an altered Configuration.bat that runs under the Service account we use to run the SCSServer-Service.

If you like a detailed explanation, please let me know.

Re: Intel AMT: Configuration task sequence failing

Dariusz_W_Intel — Mon, 08 Aug 2016 08:28:59 GMT

FYI:

they are using Intel SCS 11 - it is visible in the log by "ACUConfig 11.0.0.214"

and it is Host Based Configuration attempt - you can spot it from using Configure.bat with .XML file (AMT settings are there \AvantgardeLabAMTProfile.xml" and "***** Start ClientControlConfiguration ******"

Re: Intel AMT: Configuration task sequence failing

Dariusz_W_Intel — Mon, 08 Aug 2016 08:57:17 GMT

Hi,

your system is already configured in Admin Control mode - see in the log "Current Control Mode: 2 (Admin)"

Probably it was configured manually (via MEBx interface, or USB local configuration).

and you are attempting to change (re-configure) AMT configuration using Host Based Configuration method from settings in XML file.

In Admin Control Mode changes to AMT settings require authentication to AMT with digest or Kerberos credentials of AMT administrator account.

If Client Control Mode (with mandatory User Consent Code usage) is your aim - I suggest to fully unprovision AMT from BIOS or by disconnecting CMOS RTC battery or from MEBx (if you know MEBx Password configured previously).

Then re-run task sequence and it shall work fine.

But if your aim is to keep Admin Control Mode and just reload other AMT settings you have to either:

make account running ACUConfig.exe (with SCCM task sequence it is Computer Account) the AMT Kerberos administrator first (not possible with manual/USB configuration used to get into Admin Control mode)
modify Configure.bat to add Current AMT digest administrator password by adding /AdminPassword at the end of ACUConfig command.

Current AMT admin password in case of manual MEBx/USB configuration is new MEBx password that has been configured via MEBx or creating USB setup.bin file.

For improved security I also suggest to define new AMT digest administrator password in XML profile file -MEBx/USB defined one will be replaced with this password.

I suggest to create duplicate of Configure.bat and duplicate of task sequence.

Anyway having RCS service runinng and doing all configuration is much more elegant way to manage AMT settings.

rgds

Dariusz Wittek

Intel EMEA Biz Client Solution Architect