Changing Intel AMT Password gives RCS Errors

[EBitt]

Hello! I've been trying to track down a solution to this for a while now, so I'm hoping the experts here may be able to help out.

I'm encountering an error when trying to configure the AMT password from Windows using ACUConfig. I am not using RCS, and the only reason I want to change the password is for security reasons. Right now I have no other configurations I am trying to make. I've even tried just making a new profile to ensure I am not changing any of the other settings except for the password, and I still get this error.

I created the profile using ACUWizard.

The command I'm running:

ACUConfig.exe ConfigAMT "profile.xml" /DecryptionPassword "Password"

The errors I am getting:

ACU Configurator , Category: ConfigAMT failed: A call to this function has failed - (0xc000278b) (Connection to the Remote Configuration Service is necessary, but the RCSParameters tag is missing in the profile. (RCSAddress))

ACU Configurator, Category: Exit: ***********Exit with code 68. Details: Invalid parameter was found. (RCSAddress)

Thanks.

[Dariusz_W_Intel]

Evonne,

Is your HW Intel AMT6.1 or lower or you did not installed Intel LMS SW (complete Intel ME SW)?

If so -you tried so called Unified Configuration on system that can't do Host Based Configuration, so ACU Configurator is trying to start Remote Configuration from RCS server but RCS address was not provided in the profile neither in the ACU Configurator script.

But first you need to decide which password are you trying to change?

1. Intel AMT Digest Administrator - remote"admin" user password - this can be changed with both Host Based Configuration (locally from Host OS level) and Remote Configuration (over AMT Wired LAN from RCS server).
2. Local MEBx password - that is protecting local access to AMT basic settings from MEBx BIOS module interface that is accessible locally during POST only.Only Remote Configuration (or USB Local Configuration) can change it. Host Based Configuration does NOT change it by design.

Note1: Host Based Configuration is supported by Intel AMT 7 or newer (for Lenovo, Dell and Intel Desktop MBs - it is supported from AMT 6.2) AND requires both Intel MEI driver AND

Intel(R) Management and Security Application Local Management Service (LMS) to be installed.

Use full Intel ME SW package that is provided by your HW OEM (MS Windows 8.x /10 include Intel MEI Driver only).

Note2. Remote Configuration is supported by all Intel AMT versions but require Wired AMT LAN interface & LAN network PLUS DHCP server with DHCP Option 15 set to your public domain name and special RCFG certificate to be purchased from one of 15 CA that have their root cert hashes embeded in default Intel ME FW.

See other blog reference

If you have LAN network - all other Remote Configuration requirements are met by latest McAfee ePO Deep Command (if you have ePO and DC) see https://community.mcafee.com/community/business/epo/deepcommand/blog/2015/11/12/epo-deep-command-v24-quick-amt-activation-without-intel-rcs ePO Deep Command: ePO Deep Command 2.4 - Quick ... | McAfee Communities

Assuming you want the easiest way AND you have Intel AMT 7.x or newer system (or 6.2 for selected OEMs) AND you are going to change Intel AMT Digest Administrator password you need HBC:

1. Install full Intel ME SW package - prefered from your HW OEM website, you can also try https://downloadcenter.intel.com/search?keyword=Management+engine+driver https://downloadcenter.intel.com/search?keyword=Management+engine+driver ME SW shall match AMT FW version for AMT 6.x, 7.x but for AMT 8 or newer please use the latest ME SW version available (10 or 11) Make sure you selected to install LMS as well
2. Create your AMT profile using ACUWizard application (you have done it already)
3. then perform your ACUConfig.exe script.

If you like to change MEBx Password as well - you will have to use Remote Configuration or USB Local Configuration.

rgds

darek