"Access is Denied" when provisioning AMT clients using SCCM package

[JCall6]

Hi,

I've created a software package/wrapper script that will execute the ACUConfig.exe command line executable to provision a machine using SCCM 2007.  I've already granted the local SYSTEM account (which SCCM uses to execute packages on machines) access to WMI namepsace yet i'm getting errors on machines when i try to provision them using this package.  If I run the same script manually (using my own account), it works fine.  Here are some of the erros i'm receiving in the ACUConfig log file:

2013-06-06 18:36:41: Thread:6000(ERROR) : ACU Configurator , Category: ConnectServer Source: Src\WMIAccess.cpp : ConnectToNamespace Line: 118: A call to this function has failed - (0xc000278b) (Access is denied. -2147024891)

2013-06-06 18:36:41: Thread:6000(ERROR) : ACU.dll, Category: Remote Configure Source: Src\ActivatorDll.cpp : RemoteConfiguration Line: 3581: Failed to complete remote configuration of this Intel(R) AMT device.

2013-06-06 18:36:41: Thread:6000(ERROR) : ACU Configurator, Category: Exit Source: Src\ActivatorMain.cpp : wmain Line: 1096: ***********Exit with code 75. Details: Failed to complete remote configuration of this Intel(R) AMT device. Failed to authenticate with the RCS. A call to this function has failed - Access is denied.

 Any sugggestions?

Thanks,

J

[Gael_H_Intel]

Are you running as Administrator?

Also, what versions of AMT are you trying to provision.  I don't know a whole lot about SCCM so I'll have to do some digging around to see if I can help you.

http://blogs.bamits.com.au/2012/11/cannot-establish-handle-to-intelr.html?goback=%2Egna_1002367%2Egde_1002367_member_187573581

It looks like you found Blair's blogs.  :-)

[JCall6]

Blair's article is along the same lines except he's doing it in a task sequence as opposed to a a standard software package.  Unfortunately, his article is almost 6 months old so not sure how often he checks this or if he'll respond.

To answer your question, SCCM deploys software packages using the SYSTEM account so technically, it is running as Administrator already.  This account has also been given access to the WMI namespace so not sure what else I'm missing.

The versions range from 5.x through to 8.x.  I. This particular case, I believe it's 5.x.

Thanks!

[JCall6]

Hi,

I found the solution for this and it was actually covered in the Intel SCS 8 Deployment Guide on pg 55-56 (although it doesn't specifically call it out).  As SCCM uses the localsystem account to deploy software to doman machines, by adding <DOMAIN>\Domain Computers to the WMI security settings for Intel SCS components, it will then allow localsystem run the ACUConfig.exe on domain machines.  Make sure to add it to DCOM group too as per instructions on those pages.

Thansk for the assistance.

Regards,

Jim

[Gael_H_Intel]

I am glad you figured it out!