Can't retrieve MEBx password using API

[tech_tc]

Hi All

Fairly new to this product and having some password reset issues.

I could'nt change the default 'admin' password as is wouldn't accept any other passwords after entering the default.

So decided to retrieve the MEBx passord using API. I can find the endpoint ID and the syntax seems straight forward to obtain password, but i get a 404 error when i run the GET command.

This is what i have so far.

https://my_ema_server/api/latest/amtCredentials/my_endpoint_ID/mebx

My user is a Tenant Administrator.

Any help would e appreciated.

[Victor_G_Intel]

Hello tech_tc,

Thank you for posting on the Intel® communities.

In order to understand your situation better we will require the information below:

What EMA version are you currently working with?

Was this endpoint provisioned with your current EMA instance or was it previously provisioned with a different EMA instance that is no longer in use?

Additionally, if you provisioned this endpoint with EMA you should be able to use the script below to get their password.

Intel® Endpoint Management Assistant (Intel® EMA) API Sample Scripts

https://www.intel.com/content/www/us/en/download/19693/intel-endpoint-management-assistant-intel-ema-api-sample-scripts.html 

PowerShell.exe -ExecutionPolicy Bypass -File Get-IntelEMAEndpointMEBXPassword.ps1 -emaServerURL <EMA FQDN> -hostname <CLIENT NAME>-Verbose

Examples:

PS> ./Get-IntelEMAEndpointMEBXPassword.ps1 -emaServerURL EMAServer.demo.com -hostname hostname -Verbose

C:\> PowerShell.exe -ExecutionPolicy Bypass -File Get-IntelEMAEndpointMEBXPassword.ps1 -emaServerURL EMAServer.demo.com -hostname hostname -Verbose

Best regards, 

Victor G.

Intel Technical Support Technician

[tech_tc]

HI Victor G

Thanks for your reply.

What EMA version are you currently working with? - I'm using Intel® EMA v1.11.1.0 version.

Was this endpoint provisioned with your current EMA instance or was it previously provisioned with a different EMA instance that is no longer in use? - Yes this was provisioned with my current newly built EMA instance, under a different AMT profile.

Additionally, if you provisioned this endpoint with EMA you should be able to use the script below to get their password. I'm just about to try the suggestions now and will report back to you shortly.

Regards

tech_tc

[tech_tc]

Hi Victor

Having an couple issues running powershell script. First it wasn't happy about SSL, so i've bypassed error by using -SkipCertificateCheck. But still get Invoke-WebRequest : A positional parameter cannot be found that accepts argument error.

Also changed the token request syntax to /latest/accessTokens/getUsingWindowsCredentials, so i could attempt obtain token. Any ideas?

See output below:

PS C:\stuff> PowerShell.exe -ExecutionPolicy Bypass -File Get-IntelEMAEndpointMEBXPassword.ps1 -emaServerURL emasrvname -hostname hostnamehere -Verbose
VERBOSE: Intel EMA Server: http://emasrvname_fqdn
VERBOSE: Attempting to retrieve token using normal credentials provided via prompt.
VERBOSE: REST Error Status:
PowerShell.exe : Invoke-WebRequest : A positional parameter cannot be found that accepts argument
At line:1 char:1
+ PowerShell.exe -ExecutionPolicy Bypass -File Get-IntelEMAEndpointMEBX ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (Invoke-WebReque...cepts argument :String) [], RemoteException
+ FullyQualifiedErrorId : NativeCommandError

'https://emasrvname_fqdn/api/latest/accessTokens/getUsingWindowsCredentials'.
At C:\stuff\Get-IntelEMAEndpointMEBXPassword.ps1:156 char:24
+ ... { $token = Invoke-WebRequest -Uri -SkipCertificateCheck $emaServerUR ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidArgument: (:) [Invoke-WebRequest], ParameterBindingException
+ FullyQualifiedErrorId :
PositionalParameterNotFound,Microsoft.PowerShell.Commands.InvokeWebRequestCommand

[Victor_G_Intel]

Hello tech_tc,

Thank you for your response.

We will require the following log from the affected endpoint to continue with our investigation:

Intel® EMA Configuration Tool

https://www.intel.com/content/www/us/en/download/19805/intel-endpoint-management-assistant-configuration-tool-intel-ema-configuration-tool.html

Installation:

Double-click the .msi file and follow the prompts.

Run:

a- Open a command prompt as administrator.

b- Navigate to the installation folder (default C:\Program Files (x86)\Intel\EMAConfigTool).

c- Run the command: EMAConfigTool.exe -filename XXXX –verbose

Best regards,

Victor G.

Intel Technical Support Technician

[tech_tc]

Hi Victor G

I managed to get the output by running a slightly different command.

EMAConfigTool.exe --writexml –-verbose

see attached.

[Victor_G_Intel]

Hello tech_tc,

Thank you for your response.

Please allow us some time to review this information internally, and kindly wait for an update.

Once we have more information to share, we will reach out.

Regards,

Victor G.

Intel Technical Support Technician

[Victor_G_Intel]

Hello tech_tc,

Thank you for your patience.

It looks like the issue you are having is related to your FQDN, the API requires a true FQDN or at least one in the FQDN format (server.domain.com). After looking at the error closer we were able to replicate it on our end by modifying our domain to an illegitimate domain name (example: ema.vprodemo_fqdn )

Therefore, please check on your end if you are using a correctly formatted or real FQDN. If you still having problems after that or in case you are indeed using your FQDN correctly please provide it so we can continue our investigation.

Best regards,

Victor G.

Intel Technical Support Technician

[tech_tc]

Hi Victor G

The FQDN is defraamt02.frontier.local

I do still have the issue.

[Victor_G_Intel]

Hello tech_tc,

Thank you for your response.

We appreciate the information, we will get back to you as soon as possible.

Regards,

Victor G.

Intel Technical Support Technician

[MIGUEL_C_Intel]

Hello, tech_tc,

We hope you are doing well.

Do you mind sending us the exact commands you are using from scratch?  Only change the username and password.

Please download again Intel® Endpoint Management Assistant (Intel® EMA) API Sample Scripts v1.7.

https://www.intel.com/content/www/us/en/download/19693/intel-endpoint-management-assistant-intel-ema-api-sample-scripts.html

We look forward to hearing back from you.

Regards,

Miguel C.

Intel Customer Support Technician

[tech_tc]

Run the below to get access token from edge browser:

https://servername/api/v11/accessTokens/getUsingWindowsCredentials

Copy resulting XML data from the access_token property and paste into the 'Available Tokens' section under the 'Authorization' tab.

From within Postman, run the below GET command with the corresponding endpoint ID to retrieve the mebx password.

https://servername/api/latest/amtCredentials/1930189D2730C53E0155713980BF5457F081A25531F7C71D9E49CE06D93B48CD/mebx

I was not using powershell because that command sent to me by Hugo, couldnt work for me. As seen in earlier replies.

[Eduardo_B_Intel]

Hello tech_tc,

I wish you an excellent day, Sir.

I would like to know if there are additional questions or concerns in regards our previous message. I will monitor your case and follow up on the 15th. For anything else, let me know.

Regards,

Eduardo B

Intel Customer Support.

[Victor_G_Intel]

Hello tech_tc,

Thank you for your response.

Please bear in mind that we can only help you if you are using the API script that we provided, please make sure you re run it with the latest version of our API script and share it with us in your next response making sure it is in a txt format, the only thing we don’t need to see in the command is your username and password so you can change those, but everything else must be the exact same that you use on your end.

Best regards,

Victor G.

Intel Technical Support Technician

[tech_tc]

Hi Victor G

Ok, i'll run the powershell script again from the ema server itself and see if it makes any difference.

I'll post the errors here once done.

Thanks

[tech_tc]

Hi Victor G

'Invoke-WebRequest' error, 'Could not establish trust relationship for the SSL/TLS secure
channel'.

PS C:\stuff\Intel_EMA_API_Sample_Scripts_v1_7\PowerShell\Example Scripts> ./Get-IntelEMAEndpointMEBXPassword.ps1 -emaServerURL defraamt02.frontier.local -hostname LEN10-R90WTXRW -Verbose
VERBOSE: Intel EMA Server: https://defraamt02.frontier.local
VERBOSE: Attempting to retrieve token using normal credentials provided via prompt.
VERBOSE: POST https://defraamt02.frontier.local/api/token with -1-byte payload
VERBOSE: REST Error Status:
Invoke-WebRequest : The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure
channel.
At C:\stuff\Intel_EMA_API_Sample_Scripts_v1_7\PowerShell\Example Scripts\Get-IntelEMAEndpointMEBXPassword.ps1:156 char:24
+ ... { $token = Invoke-WebRequest -Uri "$emaServerURL/api/token" -UseBasi ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebExcept
ion
+ FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand

[Victor_G_Intel]

Hello tech_tc,

Thank you for your response.

We will review your output internally, and we will reach out as soon as possible.

Regards,

Victor G.

Intel Technical Support Technician

[Victor_G_Intel]

Hello tech_tc,

Thank you for waiting.

Based on our investigation the ”Could not establish trust relationship for the SSL/TLS secure channel” is indicating that the EMA Web Site is not protected with a trusted and secured SSL certificate. The EMA Web Site must be secured in order to use the EMA API’s. There are a few examples attached to this message.

Best regards,

Victor G.

Intel Technical Support Technician

[tech_tc]

Hi Victor G

I've sorted the cert issue.

re-ran script and recieve an 'An unexpected error occurred on a send'.

PS C:\stuff\Intel_EMA_API_Sample_Scripts_v1_7\PowerShell\Example Scripts> ./Get-IntelEMAEndpointMEBXPassword.ps1 -emaServerURL defraamt02.frontier.local -hostname LEN10-R90WTXRW -Verbose
VERBOSE: Intel EMA Server: https://defraamt02.frontier.local
VERBOSE: Attempting to retrieve token using normal credentials provided via prompt.
VERBOSE: POST https://defraamt02.frontier.local/api/token with -1-byte payload
VERBOSE: REST Error Status:
Invoke-WebRequest : The underlying connection was closed: An unexpected error occurred on a send.
At C:\stuff\Intel_EMA_API_Sample_Scripts_v1_7\PowerShell\Example Scripts\Get-IntelEMAEndpointMEBXPassword.ps1:156 char:24
+ ... { $token = Invoke-WebRequest -Uri "$emaServerURL/api/token" -UseBasi ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebExcept
ion
+ FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand

[Victor_G_Intel]

Hello tech_tc,

Thank you for your response.

The “An unexpected error occurred on a send” output that you received is a PowerShell issue commonly related to TLS; therefore, is not a problem either with EMA, AMT, or our API. Working on this type of issue is out of our scope of support; consequently, our strongest recommendation is to work on this issue directly with Microsoft, you can find some pointers in the link below which will route you to Microsoft’s tech forum.

https://techcommunity.microsoft.com/t5/forums/searchpage/tab/message?advanced=false&allow_punctuation=false&q=An%20unexpected%20error%20occurred%20on%20a%20send

Note: Links to third-party sites and references to third-party trademarks are provided for convenience and illustrative purposes only. Unless explicitly stated, Intel® is not responsible for the contents of such links, and no third-party endorsement of Intel or any of its products is implied.

Best regards,

Victor G.

Intel Technical Support Technician

[Victor_G_Intel]

Hello  tech_tc,

We hope this message finds you well.

Do you have any updates for this thread?

Best regards,

Victor G.

Intel Technical Support Technician