CIRA not connected (50 machines)

[Jools86]

Intel EMA 1.10.1

We have 50 machines that are AMT provisioned by Intel EMA, but have "CIRA not connected" when you try and connect to them.

We have 150 machines that are AMT provisioned and have "CIRA connected" too. So 75% of our estate works, 25% doesn't.

Previously we had a machine that had this issue, and we entered the MEBx on the BIOS and added the ".COMPANYNAME.com" domain to the DNS field to fix.

We cannot do this for every machine we AMT provision via Intel EMA as we should be able to automate it. Why does this happen?

Our AMT Provisioning Profile looks like this, should it be different to prevent the above?

[Jools86]

On one of the machines, I de-provisioned and then re-provisioned and it fixed the issue. Will try with some others, however as AMT provisioning / de-provisioning cannot be scripted (RESTAPI), this is a tedious and manual process.

We need something automated.

FYI - Our AMT Profile

[MIGUEL_C_Intel]

Hello, Jools86,

I remember some endpoints had this no-connection issue, and after fixing the EMA configuration in the server and doing the unprovision, and then provisioning the issue was fixed.

It seems the provisioning in these endpoints is corrupted. 

Regards,

Miguel C.

Intel Customer Support Technician

[Jools86]

Hi Miguel,

I have a script which De-Provisions a machine and then restarts EMAagent service. This has successfully fixed the 3 machines, I will run on the rest tomorrow.

As an FYI: Our AMT provisioning profile / EP group configuration has not changed, and we have 150 machines that do not have this issue (with the same configuration).

Why does AMT Provisioning corrupt on these EndPoints, does this happen during the Provisioning process? (Manageability Server logs show successful provision - when I went back and searched them), or does it happen over time? i.e. say a month after AMT was provisioned, then CIRA not connected occurs?

We intend to rollout Intel EMA to another 2000 machines. 25% potential random corruption is scary (500 machines). 

[MIGUEL_C_Intel]

Hello, Jools86,

I will gladly review your EMA configuration and try to find the reason for the issue. Please share the logs from the Server and 1 or 2 endpoints. 

EMA logs from Server

[System drive]\Program File(x86)\Intel\Platform Manager\EmaLogs

EMA log from the endpoint

[System drive]\Program Files\Intel\EMA Agent\EMAagentlog

You mentioned the EMA agent file has not been changed, and the endpoints were working before.  

1- Have you tried to restart the EMA services in the endpoints? 

2- Are they using the same network card? No docking stations were added.

3- Please confirm if the PKI DNS suffix is configured on them. You can use the EMA Configuration Tool.

https://www.intel.com/content/www/us/en/download/19805/30485/intel-endpoint-management-assistant-configuration-tool-intel-ema-configuration-tool.html

Steps:

a- Open a command prompt (alternatively, you can run the tool from within Windows PowerShell*).

b- Navigate to the installation folder (default C:\Program Files (x86)\Intel\EMAConfigTool).

c- Run the command: EMAConfigTool.exe --verbose

Regards,

Miguel C.

Intel Customer Support Technician

[Jools86]

Restarting the service does not resolve, but the following does:

• De-Provision Endpoint programmatically (ACUConfig/MeshCMD) - using admin password
• Restart EMAAgent

How does this happen in the first place?

It looks like there is possible a bug in Intel EMA 1.10.1 where if you have Manageability Service enabled on both servers, but only configured on one (via Manageability Server Settings), the second disabled manageability server one de-provisions and provisions anyway.

I cleared out all my machines using the above fix, and 3 machines were corrupted the next day. I could see both Manageability servers trying to provision them at the same time and errors occurring even though only one had been enabled under Server Settings.

[MIGUEL_C_Intel]

Hello, Jools86,

Thank you for sharing your findings and troubleshooting. Do you mind posting some screenshots of the errors from the servers and a server log? We want to investigate the issue.

EMA logs from Server
[System drive]\Program File(x86)\Intel\Platform Manager\EmaLogs

Regards,
Miguel C.
Intel Customer Support Technician

[Jools86]

Hi Miguel,

Do you have an email I can send un-obfuscated screenshots (and the logs) to?

This is a public forum, so my company would not want me doing that.

What I can show until I have an email (or private FTP) to send the logs to is the (now halted) Manageability Service on our UK server doing provisioning until we had to HALT it on the 13th:

[MIGUEL_C_Intel]

Hello, Jools86,

I am going to send you an email; it will arrive soon.

Regards,

Miguel C.

Intel Customer Support Technician

[YasserA]

We are getting the same issue - whereby some machines state Cira not connected - a short time after they were connected - looking forward to finding out why this happens and how to prevent it. We are on 1.10.1 too. Thank you for bringing up this topic in the forums.

Kindest regards

Yasser

[Jools86]

Hi Yasser,

How many EMA Servers does your company have?

In our case 2. I enabled Manageability Service on both machines. That was our problem. to resolve I removed the service from one of the Servers user Platform manager.

To fix the broken machines, I then ran:

ACUConfig.exe Unconfigure /Full /Adminpassword P@ssw0rd
Restart-Service EMAAgent

where the Adminpassword is the one you have in your AMT profile.