Unprovisioning AMT clients via SCS

[adrianfreemantle]

Hi,

I just did a test in which I unprovisioned my HP DC7700 and Intel DQ965GF clients via the SCS Full UnProvisioning option. The clients unprovision correctly, however the problems start when trying to re-provision these clients. As the full unprovision is supposed to be a total reset I expected the clients to be re-provisionable by simply putting a correctly configured USB key into them and then restarting, this should then load the key pairs etc. and the client should re-enter its provisioning cycle.

The problem is that the Intel clients do noteven attempt to read the new keys and the HP system complains that the default password for the ME BIOS extension is incorrect.This is the same problem i have experienced before when trying to return the AMT settings to the factory settings through the BIOS options; I had hoped that unprovisioning with the SCS may be differant.

This is a serious problem and i need to know if there are any plans to fix this in the future. My current AMT firmware version is 2.1.4

[Ylian_S_Intel]

I never used SCS, but I have un-provisionned Intel AMT a bunch of times using my own tools. I was told many times that a "Full un-provision" will reset Intel AMT completely, but this is simply not true. For one, the MEBx password is still the same and does not reset to "admin". In fact, if you go in the BIOS and try to manually do a full un-provisioning, you will notice the same thing. The only way to fully reset Intel AMT is to switch the jumper or in some cases, remove the motherboard battery.

The other option you have is that, it's possible to create a USB key that will work with a password other than "admin". I don't know if SCS supports it, but Intel AMT Director will allow you to set a different password when creating the "setup.bin" file and I have tested it to work great.

As a side note, I have noticed that if you do a full un-provision from Enterprise to SMB mode, it's not possible to use AMT unless you go in the BIOS and switch is back to Enterprise. If anyone else notices this, please post it (not that anyone would want to do that really).

Hope this helps,
Ylian (Intel AMT Blog)