Intel EMA Provisioning: "Packet is not encrypted correctly or uses an old key. Last error: 0"

[Jools86]

I am seeing the error on the EMAAgent log for a machine that has just had EMA Agent installed:

"Packet is not encrypted correctly or uses an old key. Last error: 0"

Our installation process is as follows:

• Install IME drivers + Configure LMS service to Automatic
• Reboot
• De-Provision AMT (if provisioned)
• Reboot
• Install EMA Agent
  • Then we sometimes see the error.

"Packet is not encrypted correctly or uses an old key. Last error: 0"

We haven't fully deployed EMA to our estate, but the fact I saw this error during my testing is worrying me.

Why exactly does this error happen? If AMT is de-provisioned this error makes sense as the AMT chip should be welcoming the EMA provisioning???

[Jools86]

Here is an example.

As you can see - AMT is de-provisioned:

But EMA struggles to provision.

[JoseH_Intel]

Hello Jools86,

Welcome back to the Intel community.

You say this is somehow a random error not happening on all the provisioned systems.

Can you tell what is the version of AMT running on the systems where you see this particular error?

Are you using a provisioning certificate? Which provider?

Jose A.

Intel Customer Support Technician

[Jools86]

HI Jose,

I got past this error (dont know how), but machine not provisioning https://community.intel.com/t5/Intel-vPro-Platform/AMT-provisioning-keeps-failing/td-p/1434923, so something wrong with AMT on device.

We are using a DigiCert certificate (which is unchanged and provisions other machines) and have successfully provisioned this machine before

The AMT version of the machine is: 12.0.90.2072:

Please see my other post (for where I am now) https://community.intel.com/t5/Intel-vPro-Platform/AMT-provisioning-keeps-failing/td-p/1434923 for where I am now with this machine, after resetting AMT chip in BIOS multiple times.

Regards,

Julian

[SergioS_Intel]

Hello Jools86,

We will continue working on the provisioning issue under this thread.

Can you please let us know if you are getting any error messages? 

Are you getting this issue on several systems? if so how many?

Can you please confirm what EMA version are you running?

We will be looking forward to your updates.

Best regards,

Sergio S.

Intel Customer Support Technician

[Jools86]

Can you please let us know if you are getting any error messages? 

The ones I have screenshotted in this forum

Are you getting this issue on several systems? if so how many?

Just 1 PC

Can you please confirm what EMA version are you running?

[JoseH_Intel]

Hello Jools86,

There is a newer version of EMA available to download. Version 1.9 could be worth trying

https://www.intel.com/content/www/us/en/download/19449/intel-endpoint-management-assistant-intel-ema.html

Could you confirm if this system is a Dell Precision 3630 Tower? Did it provision successfully before? Have you performed any recent changes in this system like updating BIOS, hardware changes, OS reimaging?

Regards

Jose A.

Intel Customer Support Technician

[Jools86]

Thanks Jose, I will try it. This looks interesting:

[JoseH_Intel]

Hello Jools86,

I am just following up to double-check if you were able to get some progress with the EMA v1.9 installation. Otherwise let us know if you require more time to accomplish this.

Regards

Jose A.

Intel Customer Support Technician

[JoseH_Intel]

Hello Jools86,

We will proceed to mark this thread as closed. If you have further issues or questions just go ahead and submit a new topic.

Regards

Jose A.

Intel Customer Support Technician

[Jools86]

I managed to successfully upgrade to Intel EMA 1.9. All machines provisioning fine, but this problem machine still has the same error:

[Jools86 · Accepted solution]

 Hi all,

If anyone else gets this issue, I managed to fix it.

1. Open up PC - Pull out CMOS battery (it was a DELL precision 3630)
2. Wait 20 minutes
3. Go into MEBx (BIOS) set new default password
4. Turn machine on
5. Machine then successfully provisioned AMT agent

[YasserA]

Surely this is not feasible for Optiplex AIO machines? we can't just pull out the CMOS battery of hundreds of AIO computers - is there another method? There must be - surely?