Intel vPro® Platform
Intel Manageability Forum for Intel® EMA, AMT, SCS & Manageability Commander
Announcements
All support for Intel NUC 7 - 13 systems has transitioned to ASUS. Read latest update.
2812 Discussions

Intel EMA - AD IME records are not created although service account has full control

YasserA
Beginner
2,019 Views

Dears Sir/Madam,

 

Whilst trying to provision machines with the generated client files - we found that the AD IME accounts were not being created although the service account which is running intel EMA has full control rights to the AD OU specified in the Wired Profile.

 

Can you please help us troubleshoot?

 

Kindest regards

Yasser

0 Kudos
20 Replies
Victor_G_Intel
Moderator
1,974 Views

Hello YasserA,


Thank you so much for contacting Intel customer support,


To continue with your request can you please provide the information below:


  1. Please provide the exact EMA version that you are currently working with.
  2. What will be the AMT version(s) being used on the endpoints?
  3. We will require you to share some screenshots of the error you are seen on your end.
  4. Despite having this error with AD were you able to finish the provisioning of the endpoints?
  5. How many endpoints do you have in your current deployment and how many are you planning to deploy?
  6. Are the Endpoints on the same network as the EMA server or not?
  7. Is the EMA server installed on a physical server or on a virtual machine?
  8. Are you using a certificate? If yes, did you purchase it?


Best regards,


Victor G.

Intel Technical Support Technician


0 Kudos
YasserA
Beginner
1,963 Views

Dear Victor,

 

Thank you for responding - the information you've asked for is as follows:

  1. Please provide the exact EMA version that you are currently working with? 1.9.1.0
  2. What will be the AMT version(s) being used on the endpoints? A mixture - test machine has 16.1.25.2128
    And earlier AMT too
  3. We will require you to share some screenshots of the error you are seen on your end. The EMA client logs say: [2023-03-16 11:52:18.58 AM] \Agent\MeshManageability\agent\core\meshctrl.c:1137 Packet is not encrypted correctly or uses an old key. Last error: 0
  4. Despite having this error with AD were you able to finish the provisioning of the endpoints? Yes - Admin Control Mode seems to complete
  5. How many endpoints do you have in your current deployment and how many are you planning to deploy? We have around 5000 - many of them are All-In-One units.
  6. Are the Endpoints on the same network as the EMA server or not? They are on different subnets - we've managed with Intel SCS before.
  7. Is the EMA server installed on a physical server or on a virtual machine? A virtual server
  8. Are you using a certificate? If yes, did you purchase it? Yes, Sectigo, yes we purchased it.

Please let me know what further information you require?

0 Kudos
YasserA
Beginner
1,959 Views

Test machine model was Dell Optiplex 7400 All-In-One

Most features in AMT work - which is great - but the key feature we need does not work and that is turning machines on via vPro powershell:

 

Instead of getting the top result which we get via Intel SCS configured machine

 

Get-AMTPowerState -Credential $MyCred -TLS -ComputerName

Computer Name Power State ID Power State Description
------------- -------------- -----------------------
XXXXXXXXXXX 2 On (S0)


Get-AMTPowerState -Credential $MyCred -TLS -ComputerName

Computer Name Power State Description
------------- -----------------------
XXXXXXXXXXX Cannot connect

 

What i've noticed is that the AD IME account wasn't created in the specified AD OU which had full control rights given to the Intel EMA service account - and thought this may be a reason for the vPro Powershell to not work. Please do advise on next steps?

 

Kindest regards and many thanks

Yasser

0 Kudos
YasserA
Beginner
1,936 Views

My latest attempt on another client produced these results in the Intel EMA Client log files:


[2023-03-16 04:59:14.389 PM] \Agent\MeshManageability\agent\core\wincrypto.cpp:201 Failed trying to get Windows Cryptographic Context. Last error: -2146885628
[2023-03-16 04:59:14.389 PM] \Agent\MeshManageability\agent\core\wincrypto.cpp:213 Creating new EMA Agent root certificate. Last error: 0

0 Kudos
YasserA
Beginner
1,936 Views

Also - on the server side we get:

 

16/03/2023 17:00:08    01 : Applying wired 802.1X settings failed: (XXXXXXXXXXX ,22C9B919). Error = Certificate could not be added. Status code: INVALID_CERT.

 

16/03/2023 17:00:06    01 : Applying wired 802.1X settings: (XXXXXXXXXXX ,22C9B919).

0 Kudos
YasserA
Beginner
1,930 Views

Also - please note we manually insert the computer hostname and domain name into the MEBX for these tests.

0 Kudos
Victor_G_Intel
Moderator
1,930 Views

Hello YasserA,


Thank you for your response.


Please provide the following to continue:


1-Discovery logs from one of the affected endpoints:


  • Download and unzip the Intel® Configurator v12.2
  • https://downloadcenter.intel.com/download/30340/Intel-Configurator
  • Open the unzipped folder, open the Configurator folder and run ACUConfigInstaller.msi
  • Open a Command Prompt window as an Administrator.
  • Go to drive C: \Program Files (x86) \Intel \SCS ACUConfig, and
  • Run the command: Acuconfig.exe /verbose /output console systemdiscovery
  • The discovery log file will be created in the same location the software ACUConfig was installed.
  •  Default location: C:\Program Files (x86)\Intel\SCS ACUConfig


2-EMA logs from Server:


[System drive]\Program File(x86)\Intel\Platform Manager\EmaLogs


3-EMA log from one of the affected endpoints:


[System drive]\Program Files\Intel\EMA Agent\EMAagentlog


4-Could you please let us know the type of cryptographic version the Certificate is using? If you are unsure, please go to the EMA server, open the Manage Computer Certificates>Personal Store>Open the EMA Certificate, and review the cryptographic version. AMT 14 and later requires SHA256 Certificates; previous AMT versions worked with SHA1. To further validate the information you find, please send us screenshots of the EMA certificate, (send screenshots from all 3 tabs: General, Details, and Certificate Path).


Best regards,


Victor G.

Intel Technical Support Technician


0 Kudos
YasserA
Beginner
1,843 Views

Dear Victor,

 

I have attached the logs and screenshots requested.

 

We are using SHA256 certificates.

 

I look forward to hearing from you!

 

Many thanks for your support.

 

Kindest regards

 

Yasser

0 Kudos
Victor_G_Intel
Moderator
1,827 Views

Hello YasserA,


Thank you so much for your response.


Please try to use our API Sample Scripts below to see if you are able to wake up the endpoints.


Intel® Endpoint Management Assistant (Intel® EMA) API Sample Scripts


https://www.intel.com/content/www/us/en/download/19693/intel-endpoint-management-assistant-intel-ema-api-sample-scripts.html


Notes: The power shell example script you want to take into consideration is the following one: Set-IntelEMAEndpointPowerState which sends a specified power command to an endpoint.


You can use the article below as an example of what you are trying to achieve.


How to Reboot the System with the Powershell API (Application Programming Interface) on Intel® EMA?


https://www.intel.com/content/www/us/en/support/articles/000088376/software/manageability-products.html


Best regards,


Victor G.

Intel Technical Support Technician  


0 Kudos
YasserA
Beginner
1,823 Views

Dear Victor,

 

Thank you for your quick response - this is what we get:

 

PS D:\> PowerShell.exe -ExecutionPolicy Bypass -File Set-IntelEMAEndpointPowerState.ps1 -emaServerURL XXXXXXXXXXXXXXXXXX -hostname XXXXXXXXXXXX -powerState PowerOn -Verbose
VERBOSE: Intel EMA Server: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
VERBOSE: API path to call: /api/latest/endpointOOBOperations/Single/PowerOn
VERBOSE: Attempting to retrieve token using normal credentials provided via prompt.
VERBOSE: POST with -1-byte payload
VERBOSE: REST Error Status: 400 Bad Request
Invoke-WebRequest : {"error":"unsupported_grant_type","error_description":"Standard OAuth authorization grant is
disabled. Please use GET /accessTokens/getUsingWindowsCredentials URI instead."}
At D:\Set-IntelEMAEndpointPowerState.ps1:186 char:24
+ ... { $token = Invoke-WebRequest -Uri "$emaServerURL/api/token" -UseBasi ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebExc
eption
+ FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand

 

Can you please help?

 

Kindest regards

 

Yasser

0 Kudos
Victor_G_Intel
Moderator
1,806 Views

Hello YasserA,


Thank you for posting on the Intel® communities.


Please let me review this information internally, and kindly wait for an update.


Once we have more information to share, we will post it on this thread.


Regards,


Victor G.

Intel Technical Support Technician


0 Kudos
Victor_G_Intel
Moderator
1,747 Views

Hello YasserA,


Thank you so much for your patience.


According to the information provided, we believe you are missing the username and password in your PowerShell command. It needs to look like this:


PowerShell.exe -ExecutionPolicy Bypass -File Set-IntelEMAEndpointPowerState.ps1 -emaServerURL XXXXXXXXXXXXXXXXXX -hostname XXXXXXXXXXXX -emaUsername TenantADMIN@city.ac.uk -emaPassword PASSWORD-powerState PowerOn -VerbosePSE


Best regards,


Victor G.

Intel Technical Support Technician  


0 Kudos
YasserA
Beginner
1,731 Views

Dear Victor,

 

I've tried the command you've suggested and got the following result -see below:

The emaUsername is a tenant admin.

Could this be related to the fact that when provisioning  the machines - there were no AD accounts created?

 

The Sectigo AMT certificate runs out on the 18th April 2023 - it'd be nice to get a positive result before that.

 

Thank you for your help so far - please advise what to do to proceed/progress?

 

Kindest regards

 

Yasser

 

.\Set-IntelEMAEndpointPowerStateTest.ps1 -emaServerURL nsq1057ap.enterprise.internal.city.ac.uk -hostname NSQEGM08A18 -emaUsername a_yassera@enterprise.internal.city.ac.uk -emaPassword ******** -powerState PowerOn -Verbose PSE

VERBOSE: Intel EMA Server: https://nsq1057ap.enterprise.internal.city.ac.uk
VERBOSE: API path to call: /api/PSE/endpointOOBOperations/Single/PowerOn
VERBOSE: Attempting to retrieve token using normal credentials provided in parameters:
a_yassera@enterprise.internal.city.ac.uk
VERBOSE: POST with -1-byte payload
VERBOSE: REST Error Status: 400 Bad Request
Invoke-WebRequest : {"error":"unsupported_grant_type","error_description":"Standard OAuth authorization grant is
disabled. Please use GET /accessTokens/getUsingWindowsCredentials URI instead."}
At C:\users\saqi\Desktop\Set-IntelEMAEndpointPowerStateTest.ps1:186 char:24
+ ... { $token = Invoke-WebRequest -Uri "$emaServerURL/api/token" -UseBasi ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebExc
eption
+ FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand

0 Kudos
Victor_G_Intel
Moderator
1,718 Views

Hello YasserA,


Thank you for your response.


We will investigate further on our end and once we have more information to share, we will post it on this thread.


Regards,


Victor G.

Intel Technical Support Technician


0 Kudos
Victor_G_Intel
Moderator
1,703 Views

Hello YasserA,


Thank you so much for your patience.


We apologize If you are using AD you will want to use the useADAuth flag in the API command, not an EMA user. It is spelled out in the example scripts in the API tool kit.


Additionally, regarding the certificate, you will want to work with Sectigo on how to update your AMT certificate once it expires. Once you have received the PFX file from Sectigo it is really easy to import via the EMA console. If you eventually need help with that we can assist you with importing the cert into EMA. 


Best regards,


Victor G.

Intel Technical Support Technician  


0 Kudos
YasserA
Beginner
1,688 Views

Dear Victor,

 

Thank you for that update!

 

I'm trying this line with the useADAuth flag and with a powershell window which is run-as the tenant admin account - but still have issues (see below):

Can you please advise?

 

Kindest regards

 

Yasser

 

 

PS D:\> .\Set-IntelEMAEndpointPowerState.ps1 -emaServerURL nsq1057ap.enterprise.internal.city.ac.uk -hostname NSQEGM08A18 -useADAuth -powerState PowerOn -Verbose PSE

VERBOSE: Intel EMA Server: https://nsq1057ap.enterprise.internal.city.ac.uk
VERBOSE: API path to call: /api/PSE/endpointOOBOperations/Single/PowerOn
VERBOSE: Attempting to retrieve token using Windows credentials of logged in user.
VERBOSE: GET with 0-byte payload
404 - File or directory not found.
Server Error

404 - File or directory not found.
The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.

At D:\Set-IntelEMAEndpointPowerState.ps1:155 char:21
+ throw $error
+ ~~~~~~~~~~~~
+ CategoryInfo : OperationStopped: (System.Collections.ArrayList:ArrayList) [], RuntimeException
+ FullyQualifiedErrorId :
404 - File or directory not found.
Server Error

404 - File or directory not found.
The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.

0 Kudos
Victor_G_Intel
Moderator
1,677 Views

Hello YasserA,


We appreciate your response.


Please let us review the command's output and its syntax and we will get back to your shortly.


Regards,


Victor G.

Intel Technical Support Technician


0 Kudos
Victor_G_Intel
Moderator
1,623 Views

Hello YasserA,


Thank you for your patience.


After checking the syntax of your command, we were able to replicate the error you were having, please proceed to remove the word PSE after verbose and it should work. Please keep us updated in case it doesn’t.


Example:


PS D:\> .\Set-IntelEMAEndpointPowerState.ps1 -emaServerURL nsq1057ap.enterprise.internal.city.ac.uk -hostname NSQEGM08A18 -useADAuth -powerState PowerOn -Verbose


Best regards,


Victor G.

Intel Technical Support Technician


0 Kudos
Victor_G_Intel
Moderator
1,534 Views

Hello YasserA,


Were you able to check the previous post?  


Please let me know if you need further assistance.  

 

Regards,


Victor G. 

Intel Technical Support Technician  


0 Kudos
Victor_G_Intel
Moderator
1,473 Views

Hello YasserA,


We have not heard back from you.


If you need any additional information, please submit a new question as this thread will no longer be monitored.


Regards,


Victor G.

Intel Technical Support Technician


0 Kudos
Reply