Intel® Business Client Software Development
Support for Intel® vPro™ software development and technologies associated with Intel vPro platforms.

"Access is Denied" when provisioning AMT clients using SCCM package

JCall6
Beginner
1,400 Views

Hi,

I've created a software package/wrapper script that will execute the ACUConfig.exe command line executable to provision a machine using SCCM 2007.  I've already granted the local SYSTEM account (which SCCM uses to execute packages on machines) access to WMI namepsace yet i'm getting errors on machines when i try to provision them using this package.  If I run the same script manually (using my own account), it works fine.  Here are some of the erros i'm receiving in the ACUConfig log file:

2013-06-06 18:36:41: Thread:6000(ERROR) : ACU Configurator , Category: ConnectServer Source: Src\WMIAccess.cpp : ConnectToNamespace Line: 118: A call to this function has failed - (0xc000278b) (Access is denied. -2147024891)

2013-06-06 18:36:41: Thread:6000(ERROR) : ACU.dll, Category: Remote Configure Source: Src\ActivatorDll.cpp : RemoteConfiguration Line: 3581: Failed to complete remote configuration of this Intel(R) AMT device.

2013-06-06 18:36:41: Thread:6000(ERROR) : ACU Configurator, Category: Exit Source: Src\ActivatorMain.cpp : wmain Line: 1096: ***********Exit with code 75. Details: Failed to complete remote configuration of this Intel(R) AMT device. Failed to authenticate with the RCS. A call to this function has failed - Access is denied.

 Any sugggestions?

Thanks,

J

 

 

0 Kudos
4 Replies
Gael_H_Intel
Moderator
1,400 Views

Are you running as Administrator?

Also, what versions of AMT are you trying to provision.  I don't know a whole lot about SCCM so I'll have to do some digging around to see if I can help you.

http://blogs.bamits.com.au/2012/11/cannot-establish-handle-to-intelr.html?goback=%2Egna_1002367%2Egde_1002367_member_187573581

It looks like you found Blair's blogs.  :-)

0 Kudos
JCall6
Beginner
1,400 Views

Blair's article is along the same lines except he's doing it in a task sequence as opposed to a a standard software package.  Unfortunately, his article is almost 6 months old so not sure how often he checks this or if he'll respond.

To answer your question, SCCM deploys software packages using the SYSTEM account so technically, it is running as Administrator already.  This account has also been given access to the WMI namespace so not sure what else I'm missing.

The versions range from 5.x through to 8.x.  I. This particular case, I believe it's 5.x.

Thanks!

0 Kudos
JCall6
Beginner
1,400 Views

Hi,

I found the solution for this and it was actually covered in the Intel SCS 8 Deployment Guide on pg 55-56 (although it doesn't specifically call it out).  As SCCM uses the localsystem account to deploy software to doman machines, by adding <DOMAIN>\Domain Computers to the WMI security settings for Intel SCS components, it will then allow localsystem run the ACUConfig.exe on domain machines.  Make sure to add it to DCOM group too as per instructions on those pages.

Thansk for the assistance.

Regards,

Jim

0 Kudos
Gael_H_Intel
Moderator
1,400 Views

I am glad you figured it out!

0 Kudos
Reply