Intel AMT setup status: pending, not provisioned

[VolTwins]

I have Intel EMA v1.12.2.0 installed on the server
Some computers in my environment have a processor with vPro technology, so I would like to configure Intel AMT.

After adding the computer to EMA, I can connect to it, but the CIRA status is "Not Connected" and the Intel AMT setup status is "Pending Activation"

When I enter Provision Intel AMT it looks like this:

screen1.png

I tried to install "Intel-SA-00075 Detection Tool" on the client's computer, but I receive the following information:

"This system is not vulnerable; the ME SKU is not affected"

screen2.png
screen3.png

I also tried installing "Intel® Setup and Configuration Software (Intel® SCS)" but I guess this software is no longer available

Intel Management Engine - the Intel chipset driver is necessary to run Intel AMT on the workstation, but I don't really know where to download it from

Please help me how to configure Intel AMT

[IntelSupport]

Hello VolTwins,

Greetings!

Before we proceed, could you please provide the following information:

1. OS version of the server

2. SQL version

3. Location of both (physical or virtual)

4. Will they be on the same server machine?

5. Authentication mode: Local, Azure AD, or Windows AD

6. Number of endpoints to be provisioned

7. Location of endpoints: local or remote

Thank you for your assistance.

Best regards,

Arun_Intel

[IntelSupport]

Hello VolTwins,

Greetings!

Just a gentle follow up, about the details asked on the previous note.

Best regards,

Arun_Intel

[VolTwins]

Hello Arun_Intel

Sorry for delay, I am sending information below:

1. Windows server 2019

2. SQL Server 2017 - 14.0.1000.169 (X64)

3. Physical

4. No, I have a server on which Intel EMA is installed and a physical computer on which I would like to configure it

5. Windows AD

6. 1

7. Remote

Best regards!

[Arun_Intel1]

Hello VolTwins,

Greetings!

Thanks for sharing the details asked, we would request you to check upon the article given below for the relevant scenario and share your observation.

https://www.intel.com/content/www/us/en/support/articles/000059019/software/manageability-products.html

Please feel to share your observation, once you have followed the POA.

Best Regards

Arun_Intel

[VolTwins]

Hello @Arun_Intel1 

On my computer, where I want to configure Intel EMA, after downloading the "Intel EMA configuration tool" and entering the --verbose command, I received:

*** SMBIOS Information ***
AMT Supported: True
AMT Enabled: True
SMBIOS ME SKU: Intel(R) Full AMT Manageability
SMBIOS ME Version: 16.1.27.2176
KVM Supported: True
SOL Supported: True
USB-R supported in BIOS: True
RSE Supported: True

*** ME Information ***
Version: 16.1.27.2176
SKU: Intel(R) Full AMT Manageability
State: Not Provisioned
Control Mode: None
Driver Installed: True
Driver Version: 2406.5.5.0
PKI DNS Suffix: Not Found
LMS State: Running
LMS Version: 2406.5.5.0
MicroLMS State: NotPresent
EHBC Enabled: False

*** ME Capabilities ***
AMT in Enterprise Mode: True
TLS Enabled: False
HW Crypto Enabled: True
Current Provisioning state: PRE_PROVISIONING_STATE
NetworkInterface Enabled: True
SOL Enabled: True
IDER Enabled: True
FWUpdate Enabled: False
LinkIsUp state: False
KVM Enabled: False
RSE Enabled: True

*** CIRA Information ***
CIRA Server: Not Found
CIRA Connection Status: NOT_CONNECTED
CIRA Connection Trigger: USER_INITIATED

*** ME Wired Network Information ***
Wired Interface Enabled: True
Link Status: Down
IP Address: 0.0.0.0
MAC Address: AC:91:A1:23:5A:36
DHCP Enabled: True
DHCP Mode: Active
DNS Suffix (from OS): Not Found

*** ME Wireless Network Information ***
Wireless Interface Enabled: False
Link Status: Down
IP Address: 0.0.0.0
MAC Address: Information Unavailable
DHCP Enabled: True
DHCP Mode: Unknown

The computer meets the requirements and I know that the computer does not see CIRA Server, my question is what do I need to do now to fix it?

Best regards

[Arun_Intel1]

Hi Voltwins,

Greetings!

Thanks for sharing the details, we are working on this issue and will keep you posted once we have an update.

Best Regards

Arun_Intel

[Arun_Intel1]

Hi Voltwins,

Greetings!

Please let us know if you are operating the EMA in ACM or CCM.

And please share the screen shot of the tenant admin, as shown below in the attachment.

And once done, we would recommend you to try the same setup in the Client Control Mode and share your observation meanwhile.

Best Regards

Arun_Intel

[VolTwins]

Hello @Arun_Intel1 

Intel AMT profile: CCM

In the attachment I am sending a photo of the current status of the computer

Best regards

[vij1]

Hi Voltwins,

Thank you for the confirmation. We recommend you try the same setup in Client Control Mode (CCM) and share your observations in the meantime.

Regards,

Vijay N.

[Arun_Intel1]

Hi Voltwins,

Greetings!

We see that you are in the CCM already which is seen in the screen shot shared, and the issue is seen on the CCM mode as well.

We shall share the work around shortly.

Best Regards

Arun_Intel

[Arun_Intel1]

Hello Voltwins,

Greetings!

We see that the EMA Agent files has not been provisioned on the endpoints, we would request you to download the EMA Agent files (Both the Policy and the .exe file and paste it on the Endpoints,

Or you may also use the Microsoft Intune to provision the EMA Agent files, the steps are as given below :

provision Intel EMA agent through the Microsoft Intune,

Please follow the steps shared below for the same, (Note : As we are not an Intune Experts though, we have done some homework and have shared the steps given below)

Title Field: "Steps to Deploy Intel EMA Agent Profiles via Microsoft Intune"

Summary Field: "Guide on deploying Intel EMA Agent using Microsoft Intune, including preparation, packaging, and installation steps."

Validation Status Field: WIP (Work in Progress) - The solution has been drafted based on known procedures but has not yet been validated through repeated customer engagements.

Description Field: Customers attempting to deploy the Intel EMA Agent through Microsoft Intune may need to follow a series of steps involving downloading the agent file, preparing it with the Win32 Content Prep Tool, and configuring the deployment within the Intune admin console.

Resolution Field:

1.     Log into the Intel EMA server via web interface.

a.     Log in using a Tenant Admin or Endpoint Group Creator account

2.     Download the Intel EMA agent and profile files.

a.     From the navigation bar at left, select Endpoint Groups

b.     Click the down-arrow next to the target endpoint group

c.      Select Create Agent Files.

d.     Click Download for the Windows 64-bit Service agent file.

e.     Click Download for the Agent policy file, then click Done.

4.     Use the Win32 Content Prep Tool to create a .intunewin file.

a.     Refer to the Microsoft's "Prepare a Win32 app to be uploaded to Microsoft Intune"

5.     Upload the .intunewin file to Microsoft Intune.

a.     See Microsoft's "Getting started with your Microsoft Intune deployment"

6.     Configure the new Windows application in Intune for deployment.

Additional Information Field:

·       Ensure that the Intel EMA server is properly set up before beginning the deployment process.

·       Maintain the same file names when organizing the Intel EMA agent and policy files.

·       The install and uninstall commands provided are to be used within the Intune deployment process.

Related Articles Field:

·       Intel® Endpoint Management Assistant (Intel® EMA) Administration and Usage Guide

·       Support Tip - Understanding the flow behind deployment, delivery, and processing of a Win32 application through Intune

·       Get started with Microsoft Intune

Keywords: Intel EMA, Microsoft Intune, deployment, .intunewin, Win32 Content Prep Tool, Intune admin console, endpoint management

Products: Intel Endpoint Management Assistant (EMA)

Publishing Notes: Initial draft based on standard deployment procedures. To be updated with customer feedback and validation.

Please share your observation once done.

Best Regards

Arun_Intel

[VolTwins]

Hello @Arun_Intel1 

I sent a photo of the current configuration and the EMA agent is installed on the target computer, I can connect to it and, with permission, I can use the computer to which I am connecting via EMA. Everything works correctly and EMA is installed not using Intune, but is installed from GPO, this does not change the fact that the installation is successful and everything works, but CIRA / AMT does not work, as I explained above and as I sent the configuration photos. I am asking for further help.

Best regards

[Arun_Intel1]

Hi Voltwins,

Greetings,

We see that the EMA Agents have not been provisioned through the Microsoft Intune, but through the GPO, and the EMA Agents has been successfully Provisioned,

As you have mentioned that there is a picture, but we are unable to see the one that you are referring to, kindly share the picture that you are referring.

Best Regards

Arun_Intel

[VolTwins]

Hello @Arun_Intel1 

I am referring to this photo:

When the computer is turned on, every function works, only Intel AMT setup status is still "pending activation" and I cannot use CIRA, so I do not need to install the EMA agent again.

Best regards

[Arun_Intel1]

Hi Voltwins,

Greetings!

Please follow the steps given below to Active or Provisioned.

1. Access BIOS/UEFI Settings:

• Reboot the system and enter the BIOS/UEFI settings. Ensure that Intel® AMT is enabled and review the settings to make sure they are correct.

1. Use Intel® Management Engine BIOS Extension (MEBx):

• During the system boot process, access the Intel® MEBx settings (usually by pressing Ctrl + P). This is where you will find options to configure and provision Intel® AMT.

1. Configure Network Settings:

• Set up the network settings in the MEBx interface to ensure that the AMT system can communicate with your management console. This includes configuring the IP address, DNS settings, and other network parameters.

1. Set Up Security Credentials:

• Enter the required security credentials, such as passwords for AMT access. This might include setting up a user ID and password for remote management.

1. Provisioning:

• Use provisioning tools to finalize the setup. This could be done manually or through automated methods. Tools like Intel® Setup and Configuration Software (SCS) can be used for automated provisioning.

1. Verify Activation:

• After completing the configuration, check if the Intel® AMT status has changed from "pending activation" to "active" or "provisioned."

Best Regards

Arun_Intel

[Arun_Intel1]

Hello Voltwins,

Greetings,

Please confirm if you were able to execute the plan of action share, if yes, kindly share your observation.

Best Regards

Arun_Intel