Error when trying to provision new Micros 650 registers

THoob · ‎03-19-2019

We recently started getting in our new Micros 650 registers and I have been trying to get them vPro provisioned. Unfortunately the ACUConfig utility is failing to provision them with the following error:

2019-03-14 12:59:41:(ERROR) : ACU Configurator, Category: Exit: ***********Exit with code 75. Details: Failed to complete remote configuration of this Intel(R) AMT device. Failed while calling  WS-Management call  GetAmtVersion (CIM_SoftwareIdentity.Get). Intel(R) AMT connection error  0xc000521f: An SSL error occurred. Verify the username and password, and the PSK or certificate settings, where applicable. Valid certificate for PKI configuration not found. Initial connection to the Intel(R) AMT device failed.  The SSL handshake failed because of an unsupported, unverified, or corrupt certificate. A TCP error occurred. Make sure that the destination settings are correct and that a network connection exists to the target.

THoob · ‎03-19-2019

To provide more details I am using the ACUConfig utility via a PowerShell script and it is deployed with SCCM. I have been using this script with great success on all of our Dell products. After some troubleshooting I have discovered a work around fix. There is an option in the MEBx called "Activate Network Access", once this is enabled I am able to provision the device with the ACUConfig as normal. I took a look at one of our Dell devices that had not been configured and it had the same option and it was also disabled, however I can provision it with ACUConfig without having to change the option and then the option gets enabled during provisioning.

Emeth_O_Intel · ‎03-20-2019

Hello Tyler, I am very glad to hear that you could find the work around and now those units are up and running. Thank you for the information and the feedback provided. Please let me know if you have any other question in order to assist you with the most accurate information. Best regards, Emeth O. Intel Customer Support Technician. Under Contract to Intel Corporation.

THoob · ‎03-20-2019

Sorry , the work around mentioned is only to get the first few out and in production.

I still need a solution to the error and failure to provision.

Emeth_O_Intel · ‎03-22-2019

Hello Tyler, Thank you so much for contacting us back. Could you please so kind and provide us how many units are still missing the provision? Also, please provide us the RCS log file of the system in order to very the information with more details. Best regards, Emeth O. Intel Customer Support Technician. Under Contract to Intel Corporation.

THoob · ‎03-22-2019

All of them still need to be provisioned.

There are about eight in the field and ten more on the way.

Here is the log from ACUConfig on the device.

2019-03-22 09:58:54:(INFO) : ACU Configurator , Category: HandleOutPut: Starting log 2019-03-22 09:58:54
2019-03-22 09:58:54:(INFO) : ACU Configurator, Category: : ACUConfig 12.0.0.129
2019-03-22 09:58:54:(INFO) : ACU Configurator, Category: -Unknown Operation-: VPSA327260.ad.ilstu.edu: Starting to configure AMT via RCS...
2019-03-22 09:58:56:(ERROR) : ACU Configurator , Category: Host Based Setup Discovery: Error: Host-based configuration is not currently available because the Local Manageability Service (LMS.exe) is not running on the system. 
2019-03-22 09:59:19:(INFO) : ACU Configurator , Category: Information message: Active certificate hashes have the following names: (0xc000005a)
2019-03-22 09:59:20:(INFO) : ACU Configurator , Category: Information message: Active certificate hashes have the following names: (0xc000005a)
2019-03-22 09:59:27:(INFO) : ACU Configurator , Category: WMI Access Layer: Success. (0) (retry set to = 2)
2019-03-22 09:59:27:(INFO) : ACU Configurator , Category: WMI Access Layer: Success. (0) (RCS not busy.)
2019-03-22 09:59:27:(INFO) : ACU Configurator , Category: WMI Access Layer: Success. (0) (RCS is currently handling = 0 threads)
2019-03-22 09:59:28:(ERROR) : ACU.dll, Category: Remote Configure: Aborting configuration.
2019-03-22 10:00:50:(ERROR) : ACU.dll, Category: Remote Configure: Failed to complete remote configuration of this Intel(R) AMT device. 
2019-03-22 10:00:50:(ERROR) : ACU Configurator, Category: Exit: ***********Exit with code 75. Details: Failed to complete remote configuration of this Intel(R) AMT device. Failed while calling  WS-Management call  GetAmtVersion (CIM_SoftwareIdentity.Get). Intel(R) AMT connection error  0xc000521f: An SSL error occurred. Verify the username and password, and the PSK or certificate settings, where applicable. Valid certificate for PKI configuration not found. Initial connection to the Intel(R) AMT device failed.  The SSL handshake failed because of an unsupported, unverified, or corrupt certificate. A TCP error occurred. Make sure that the destination settings are correct and that a network connection exists to the target.

Here is the RCS log from that time frame:

https://hastebin.com/ehasejimef.sql

Emeth_O_Intel · ‎03-23-2019

Hello Tyler, Thank you so much for the information provided. Let us review the logs and identify the root cause of the issue, as soon as possible I will get back to you in order to proceed with the next step. Regards, Emeth O. Intel Customer Support Technician. Under Contract to Intel Corporation.

Emeth_O_Intel · ‎03-27-2019

Hi Tyler, I would like to ask you some details about it: Have you restart the RCS Server Service? Have you checked that the certificate is installed in the network authority use? Have you checked that the certificate chain is not showing any red X? Regards, Emeth O. Intel Customer Support Technician. Under Contract to Intel Corporation.

THoob · ‎03-29-2019

Sorry for the delayed response.

I decided to use this opportunity to reconfigure our RCSServer service to use the Network Service account. It was using my personal admin account which was only meant to be temporary. Now that I have it back up and working I tried the Micros 650 again but I am still having the issue. I think it may just be a security feature of the device. Unless you have anything else for me to try I think we are just going to have to manually change the setting once for each device. Having made these changes I am experiencing a new issue but I will make a separate post for that.

Emeth_O_Intel · ‎03-30-2019

Hello, Thank you so much for the information provided. I would like to make sure some details about the system information of the "Oracle MICROS Workstation 650 Model" Could you please so kind and provide to me the system info of this unit? In order to make sure that AMT is totally comparable with it. On the other hand, is this the first time that you try to provision this unit or did you previously successfully configured it ? Which security feature do you consider that is blocking the provision? No problem, if you would like to bring your question to this post will not be a problem. I will be more than happy to assist you. I will be waiting your outcome in order to proceed with the next step. Regards, Emeth O. Intel Customer Support Technician. Under Contract to Intel Corporation.

Emeth_O_Intel · ‎04-04-2019

Hello Tyler, I would like to know if you still have the issue or if you have any other questions in order to assist you with. If so, please do not hesitate and let me know and I will be more than happy to assist you. Regards, Emeth O. Intel Customer Support Technician. Under Contract to Intel Corporation.

THoob · ‎04-05-2019

So I was able to work through the above issue. While working through it I changed the account that the RCSServer service runs on. I have setup an AD service account called VPSASAITvPro. I can now provision unprovisioned devices just fine. The new issue is that when provisioning an already provisioned computer with the ACUconfig utility it fails with a new error. I have tried it with all three account running under RCSServer and get the same result. I have tried to check Kerberos logs on both the server and workstation by enabling it in registry but get nothing from either. Since it's already provisioned and fails it just stays with the provision it has but the down side is the AD computer object gets deleted and does not get recreated.

2019-04-05 13:43:21:(INFO) : ACU Configurator , Category: HandleOutPut: Starting log 2019-04-05 13:43:21
2019-04-05 13:43:21:(INFO) : ACU Configurator, Category: : ACUConfig 12.0.0.129
2019-04-05 13:43:21:(INFO) : ACU Configurator, Category: -Unknown Operation-: VPSA809239.ad.ilstu.edu: Starting to configure AMT via RCS...
2019-04-05 13:43:24:(ERROR) : ACU Configurator , Category: Host Based Setup Discovery: Error: Host-based configuration is not currently available because the Local Manageability Service (LMS.exe) is not running on the system. 
2019-04-05 13:43:30:(INFO) : ACU Configurator , Category: WMI Access Layer: Success. (0) (retry set to = 2)
2019-04-05 13:43:30:(INFO) : ACU Configurator , Category: WMI Access Layer: Success. (0) (RCS not busy.)
2019-04-05 13:43:30:(INFO) : ACU Configurator , Category: WMI Access Layer: Success. (0) (RCS is currently handling = 0 threads)
2019-04-05 13:43:45:(ERROR) : ACU Configurator, Category: Exit: ***********Exit with code 75. Details: Failed to complete remote configuration of this Intel(R) AMT device. Final status of Intel(R) AMT is unknown because a failure occurred when configuring the system.  Intel(R) AMT operation failed.  Error while configuring Kerberos settings. Failed while calling  WS-Management call  SetKerberosSettings (AMT_KerberosSettingData.Get). Intel(R) AMT error  0x1: AMT Status code - An internal error has occurred in the Intel(R) AMT device. This might indicate an interface error, or an application error.

Emeth_O_Intel · ‎04-08-2019

Hi, Thank you so much for the information provided. Let us analize those logs and proceed with the next step. Please provide us time and as soon as possible we will get back to you. Regards, Emeth O. Intel Customer Support Technician. Under Contract to Intel Corporation.

Emeth_O_Intel · ‎04-10-2019

Hello Tyler, Could you please so kind and confirm if the account that RCSServer service runs as, make sure the remote configuration certificate is in the certificate store of the new account “VPSASAITvPro”. Please, let me know the outcome in order to double check the information. Emeth O. Intel Customer Support Technician. Under Contract to Intel Corporation.

THoob · ‎04-10-2019

Yes, the VPSASAITvPro account has two certificates. The GoDaddy cert and what I assume is a locally generated cert.

Emeth_O_Intel · ‎04-11-2019

Hello, Ok, no problem. Could you please so kind and provide us the RCs log file in order to have a better understanding of this situation? Regards, Emeth O. Intel Customer Support Technician. Under Contract to Intel Corporation.

THoob · ‎04-11-2019

I have attached the log.

This is a fresh restart of the service followed by configuring an unconfigured computer and then trying to configure it again.

It provisions fine the first time then fails the second time.

https://hastebin.com/ewuvexusij.rb