Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Joel_G_
Beginner
729 Views

MBEx User Consent

Jump to solution

Hello to all,

I have a question that I hope you all can help me address. We are in the process of provisioning our workstations in my environment so that we can use the Intel KVM functionality. With that being said, we have several Dell workstations each running a different version of AMT firmware. The firmware on our workstations ranges from 7.1.2, 7.1.4, 8.0.4 and 8.1.0.

I need to find a way to disable the User Consent\User Opt-in for my workstations. Currently this setting is set to *KVM, I want to set this to *None in the MEBx settings. Can this particular MEBx setting be modified with a powershell script or vbscript that I can then deploy via SCCM 2012? I have tried reading several articles online to no avail. I need to disable this because the application we are using to establish a KVM session, will other wise ask for the User Consent code in order to display the screen. Sadly the application Bomgar, does not handle KVM sessions as well as VNC Plus and that is why I require to change these settings.

It seems like such a simple modification but for the life of me I cant find an automated way to deploy this modification. If in the event such script exist, will it work across all AMT versions? I thank you for your time and response.

Hopefully someone can shed some light.

Joel

0 Kudos
1 Solution
MPala11
New Contributor II
729 Views

Hi Joel,

You can disable using winrm commands to disable user consent.

Use below command to check whether we can disable user-consent

winrm e http://intel.com/wbem/wscim/1/ips-schema/1/IPS_OptInService -r:http://ipaddress:16992/wsman -a:digest -u:admin -p:P@ssw0rd -encoding:utf-8

IPS_OptInService

    CanModifyOptInPolicy = 1

    CreationClassName = IPS_OptInService

    ElementName = Intel(r) AMT OptIn Service

    Name = Intel(r) AMT OptIn Service

    OptInCodeTimeout = 120

    OptInDisplayTimeout = 300

    OptInRequired = 1

    OptInState = 0

    SystemCreationClassName = CIM_ComputerSystem

    SystemName = Intel(r) AMT

If property CanModifyOptInPolicy = 1 means, we can modify the settings through below command

winrm put http://intel.com/wbem/wscim/1/ips-schema/1/IPS_OptInService @{OptInRequired="0"} -r:http://ipaddress:16992/wsman -a:digest -u:admin -p:P@ssw0rd -encoding:utf-8

IPS_OptInService

    CanModifyOptInPolicy = 1

    CreationClassName = IPS_OptInService

    ElementName = Intel(r) AMT OptIn Service

    Name = Intel(r) AMT OptIn Service

    OptInCodeTimeout = 120

    OptInDisplayTimeout = 300

    OptInRequired = 0

    OptInState = 0

    SystemCreationClassName = CIM_ComputerSystem

    SystemName = Intel(r) AMT

 

Thanks,

Mani

View solution in original post

6 Replies
Gael_H_Intel
Moderator
729 Views

Is your system provisioned in Client-Control mode, or in Admin-Control mode?  You cannot disable it in Client Control mode.  Here is some documentation on it which may or may not be helpful.

http://software.intel.com/sites/manageability/AMT_Implementation_and_Reference_Guide/default.htm?tur...

MPala11
New Contributor II
730 Views

Hi Joel,

You can disable using winrm commands to disable user consent.

Use below command to check whether we can disable user-consent

winrm e http://intel.com/wbem/wscim/1/ips-schema/1/IPS_OptInService -r:http://ipaddress:16992/wsman -a:digest -u:admin -p:P@ssw0rd -encoding:utf-8

IPS_OptInService

    CanModifyOptInPolicy = 1

    CreationClassName = IPS_OptInService

    ElementName = Intel(r) AMT OptIn Service

    Name = Intel(r) AMT OptIn Service

    OptInCodeTimeout = 120

    OptInDisplayTimeout = 300

    OptInRequired = 1

    OptInState = 0

    SystemCreationClassName = CIM_ComputerSystem

    SystemName = Intel(r) AMT

If property CanModifyOptInPolicy = 1 means, we can modify the settings through below command

winrm put http://intel.com/wbem/wscim/1/ips-schema/1/IPS_OptInService @{OptInRequired="0"} -r:http://ipaddress:16992/wsman -a:digest -u:admin -p:P@ssw0rd -encoding:utf-8

IPS_OptInService

    CanModifyOptInPolicy = 1

    CreationClassName = IPS_OptInService

    ElementName = Intel(r) AMT OptIn Service

    Name = Intel(r) AMT OptIn Service

    OptInCodeTimeout = 120

    OptInDisplayTimeout = 300

    OptInRequired = 0

    OptInState = 0

    SystemCreationClassName = CIM_ComputerSystem

    SystemName = Intel(r) AMT

 

Thanks,

Mani

View solution in original post

Over
Beginner
82 Views

Is possible change CanModifyOptInPolicy = 0 to CanModifyOptInPolicy = 1 remotely??? 

 

With telework I am trying to implement Intel AMT but I can't find a way to Admin mode without having to go to the office machine by machine enabling admin control mode.

 

thanks!!

Joel_G_
Beginner
729 Views

Gael Hofemeier (Intel) wrote:

Is your system provisioned in Client-Control mode, or in Admin-Control mode?  You cannot disable it in Client Control mode.  Here is some documentation on it which may or may not be helpful.

http://software.intel.com/sites/manageability/AMT_Implementation_and_Reference_Guide/default.htm?tur...

Gael thanks for taking the time to respond to my post. Just so we are on the same page, please keep in mind that I am not using SCS to provision my workstations. I am just using SCCM 2012 RTM itself. I have looked all over SCCM and dont see anything that mentions Client Control mode or Admin Control mode.

However, if I reboot my provisioned workstation and press F12, going to the MEBx settings I can navigate to the User Consent option and change it to the value I want. I set it to *None in the User Opt in section and it commits my changes just fine with no issues. Does that mean I am in Admin-Control mode?

Lets pretend that SCCM 2012 is indeed provisioning my workstations in Admin Control mode, my next hurdle is how do I deploy the User Opt in configuration change to my workstations? Is such thing possible via Power Shell or a VBS script?

Thanks for your time..

Gael_H_Intel
Moderator
729 Views

Did you check out Manni's response?  Also, I have to admit, I do not know much about how SCCM works.

Joel_G_
Beginner
729 Views

Thanks Mani, I tried using that command and its working as expected. I thank you both for your time and effort helping me get this resolved. I now just need to find a way to deploy this with SCCM. In the end I am glad I have a work around solution.

Happy holidays to you both and thanks again!

Joel

Reply