MBEx User Consent

[Joel_G_]

Hello to all,

I have a question that I hope you all can help me address. We are in the process of provisioning our workstations in my environment so that we can use the Intel KVM functionality. With that being said, we have several Dell workstations each running a different version of AMT firmware. The firmware on our workstations ranges from 7.1.2, 7.1.4, 8.0.4 and 8.1.0.

I need to find a way to disable the User Consent\User Opt-in for my workstations. Currently this setting is set to *KVM, I want to set this to *None in the MEBx settings. Can this particular MEBx setting be modified with a powershell script or vbscript that I can then deploy via SCCM 2012? I have tried reading several articles online to no avail. I need to disable this because the application we are using to establish a KVM session, will other wise ask for the User Consent code in order to display the screen. Sadly the application Bomgar, does not handle KVM sessions as well as VNC Plus and that is why I require to change these settings.

It seems like such a simple modification but for the life of me I cant find an automated way to deploy this modification. If in the event such script exist, will it work across all AMT versions? I thank you for your time and response.

Hopefully someone can shed some light.

Joel

[Gael_H_Intel]

Is your system provisioned in Client-Control mode, or in Admin-Control mode?  You cannot disable it in Client Control mode.  Here is some documentation on it which may or may not be helpful.

http://software.intel.com/sites/manageability/AMT_Implementation_and_Reference_Guide/default.htm?turl=WordDocuments%2Fuserconsent1.htm

[MPala11 · Accepted solution]

Hi Joel,

You can disable using winrm commands to disable user consent.

Use below command to check whether we can disable user-consent

winrm e http://intel.com/wbem/wscim/1/ips-schema/1/IPS_OptInService -r:http://ipaddress:16992/wsman -a:digest -u:admin -p:P@ssw0rd -encoding:utf-8

IPS_OptInService

    CanModifyOptInPolicy = 1

    CreationClassName = IPS_OptInService

    ElementName = Intel(r) AMT OptIn Service

    Name = Intel(r) AMT OptIn Service

    OptInCodeTimeout = 120

    OptInDisplayTimeout = 300

    OptInRequired = 1

    OptInState = 0

    SystemCreationClassName = CIM_ComputerSystem

    SystemName = Intel(r) AMT

If property CanModifyOptInPolicy = 1 means, we can modify the settings through below command

winrm put http://intel.com/wbem/wscim/1/ips-schema/1/IPS_OptInService @{OptInRequired="0"} -r:http://ipaddress:16992/wsman -a:digest -u:admin -p:P@ssw0rd -encoding:utf-8

IPS_OptInService

    CanModifyOptInPolicy = 1

    CreationClassName = IPS_OptInService

    ElementName = Intel(r) AMT OptIn Service

    Name = Intel(r) AMT OptIn Service

    OptInCodeTimeout = 120

    OptInDisplayTimeout = 300

    OptInRequired = 0

    OptInState = 0

    SystemCreationClassName = CIM_ComputerSystem

    SystemName = Intel(r) AMT

Thanks,

Mani

[Over]

Is possible change CanModifyOptInPolicy = 0 to CanModifyOptInPolicy = 1 remotely??? 

With telework I am trying to implement Intel AMT but I can't find a way to Admin mode without having to go to the office machine by machine enabling admin control mode.

thanks!!

[Joel_G_]

Gael Hofemeier (Intel) wrote:

Is your system provisioned in Client-Control mode, or in Admin-Control mode?  You cannot disable it in Client Control mode.  Here is some documentation on it which may or may not be helpful.

http://software.intel.com/sites/manageability/AMT_Implementation_and_Reference_Guide/default.htm?turl=WordDocuments%2Fuserconsent1.htm

Gael thanks for taking the time to respond to my post. Just so we are on the same page, please keep in mind that I am not using SCS to provision my workstations. I am just using SCCM 2012 RTM itself. I have looked all over SCCM and dont see anything that mentions Client Control mode or Admin Control mode.

However, if I reboot my provisioned workstation and press F12, going to the MEBx settings I can navigate to the User Consent option and change it to the value I want. I set it to *None in the User Opt in section and it commits my changes just fine with no issues. Does that mean I am in Admin-Control mode?

Lets pretend that SCCM 2012 is indeed provisioning my workstations in Admin Control mode, my next hurdle is how do I deploy the User Opt in configuration change to my workstations? Is such thing possible via Power Shell or a VBS script?

Thanks for your time..

[Gael_H_Intel]

Did you check out Manni's response?  Also, I have to admit, I do not know much about how SCCM works.

[Joel_G_]

Thanks Mani, I tried using that command and its working as expected. I thank you both for your time and effort helping me get this resolved. I now just need to find a way to deploy this with SCCM. In the end I am glad I have a work around solution.

Happy holidays to you both and thanks again!

Joel