- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Link Copied
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Tomhys,
Thank you for providing the detailed information regarding your environment and the challenges encountered after transitioning to systems running Intel® AMT version 16.1.30.
We understand that Intel Manageability Commander was previously used successfully for direct AMT access and that you are now experiencing increased complexity when using Intel® Endpoint Management Assistant (EMA) for a small-scale deployment.
Lightweight Alternative Option
For environments with a limited number of systems, a simpler approach may be more suitable.
MeshCommander, an open-source tool, provides basic AMT functionality such as:
- KVM access
- Power control
- Basic AMT management
This may serve as an alternative to EMA for small-scale deployments. Please note that MeshCommander is a third-party tool and is not officially supported by Intel.
Website:
https://www.meshcommander.com/
Continuing with Intel EMA
If you choose to proceed with Intel EMA, please note:
- Proper TLS certificate configuration is required for secure communication between EMA and Intel AMT using your internal Certificate Authority (CA).
- This will resolve the current SSL/TLS trust issue observed during provisioning.
Intel EMA uses port 8080 for communication between the server and endpoints via CIRA.
Please also note:
- Secure TLS connections are supported starting from AMT 16 (and AMT 15 with BIOS updates).
- Legacy ports 16992, 16994, and 623 are no longer supported in this mode.
- TLS communication should instead use port 16993.
We suggest running the following PowerShell commands on the system to validate connectivity:
Test-NetConnection localhost -Port 16992
Test-NetConnection localhost -Port 16993
Environmental Details Required:
To assist further, please provide the following details:
- OS version of the EMA Server
- SQL version
- Installation type (Physical or Virtual)
- Will EMA and SQL be on the same server?
- Authentication mode: Local, Azure AD, or Windows AD
- Intel® EMA version
- Location of endpoints (Local or Remote)
Endpoint Validation – EMA Configuration Tool
Please run the Intel® EMA Configuration Tool on the affected endpoint and share the output with us. This will provide detailed system information required for further analysis.
Intel® EMA Configuration Tool (ECT):
Installation:
- Download and unzip the tool
- Double-click the .msi file and follow the installation prompts
Execution:
a. Open Command Prompt as Administrator (or PowerShell)
b. Navigate to:
C:\Program Files (x86)\Intel\EMAConfigTool
c. Run the command:
EMAConfigTool.exe --verbose
Please share the requested information and command output so we can continue with targeted troubleshooting and resolution.
Best regards,
Vijay N
Intel Customer Support Technician
Intel® vPro™ Technology
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Vijay,
I was looking at the mesh commander, which is working great and would be sufficient for my need. But cybersec would prefer to use the official Intel application.
For your questions:
- OS version of the EMA Server - Win Server 2022 v 21H2
- SQL version - SQL Server 2019
- Installation type (Physical or Virtual) - Installed in HyperV virtual machine
- Will EMA and SQL be on the same server? - Yes they are on the same VM
- Authentication mode: Local, Azure AD, or Windows AD - Windows AD
- Intel® EMA version - v. 1.14.4.0
- Location of endpoints (Local or Remote) - They are in the same network, just in different VLAN, but routed together behind FW.
I will send the output from EMA ConfigToll in DM. In EMA for this system I see that we have it in Admin Control Mode and provisioning is completed.
We have AMT profile set as:
- General tab: Always use Intel AMT CIRA
- Power states: Any time system is connected
- Management interfaces: selected KVM, Web-based user interface, Remote platform Erase
- FQDN Source: Shared with host OS
- IP Address: Use a statis IP address from host
- Wifi: did not touch
- Wired 802.1X: did not touch
Setting in Endpoint Group:
Intel AMT Setup enabled
Selected AMT profile
Activation method: Host Based Provisioning (no other method is available for me)
And set my custom Admin password
Please let me know if there is some setting I should use differently for my use case.
I definitely have incorrect certificate settings.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I definitely have incorrect certificate settings, we have it in default. In all guides I tried to find its described to have certificate from public known CA. I dont know how to implement certificate from our own local CA.
Thank you
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Tomhys,
Thank you for sharing the details.
Based on the ECT logs, we noticed the following:
- Intel® Management Engine Driver Version
- The current version is 2406.5.5.0, which is outdated. Please update to the latest version using the link below:
- Intel® Management Engine Drivers for Windows 10* and Windows 11*
- PKI DNS Suffix Configuration
- The PKI DNS Suffix is currently set to THIS-MINE-DOMAIN.dom, which is incorrect. It should match your Fully Qualified Domain Name (FQDN), for example:
- example.hf.intel.com
For more details, please refer to:
PKI Certificate Verification Methods
To resolve this, the Intel EMA server must be configured with a certificate issued by your internal Certificate Authority (CA) and properly bound to IIS.
Required Action: Replace Default EMA Certificate with CA-Issued Certificate
Please follow the steps below to install and bind your internally signed certificate.
Part 1: Import CA Certificates using Microsoft Management Console (MMC)
- Obtain the following from your internal CA:
- Root CA certificate
- Intermediate CA certificate(s)
- Server certificate for EMA (FQDN-based)
- On the EMA server, open:
- Start → Run → MMC
- Navigate to:
- File → Add/Remove Snap-in
- Select Certificates → Add
- Choose Computer Account → Next → Finish
- Click OK
- Expand:
- Certificates (Local Computer)
- Import Root CA:
- Go to Trusted Root Certification Authorities → Certificates
- Right-click → All Tasks → Import
- Select your Root CA certificate file → Complete the wizard
- Import Intermediate CA:
- Go to Intermediate Certification Authorities → Certificates
- Right-click → All Tasks → Import
- Select your Intermediate CA certificate → Complete the wizard
Verify that both Root and Intermediate certificates appear correctly in their respective stores.
Part 2: Install the Server Certificate in IIS
- Open Internet Information Services (IIS) Manager
- Select the EMA server name
- Double-click Server Certificates
- Click Complete Certificate Request
- Browse and select the EMA server certificate
- Enter a friendly name (e.g., EMA-FQDN-2025)
- Click OK
The certificate should now appear in the Server Certificates list.
Part 3: Bind Certificate to EMA Website
- In IIS, expand Sites and select the site used by Intel EMA (typically Default Web Site)
- Click Bindings in the right panel
- Add or Edit HTTPS binding:
- Type: HTTPS
- IP Address: All Unassigned
- Port: 443
- SSL Certificate: Select the newly imported certificate
- Click OK to save
If intermediate certificates were installed after binding, please remove and re-add the HTTPS binding to rebuild the trust chain.
Best regards,
Vijay N
Intel Customer Support Technician
Intel® vPro™ Technology
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
I have updated the Intel ME with the version you provided.
I have put the FQDN of our EMA Server to the PKI DNS Configuration. If I understand correctly we need now to insert our root CA to the AMT on the specific machine ? I cant find any guide how to do this.
I have the personal and root cert on the certificate manager on said device. We dont have intermediate cert.
I imported it to IIS using the import function (complete cert request didnt work for me). Then I assigned it to the site.
The state now is that I have EMA with trusted certificate and I see the connection as secure.
The side effect is that now when I open the settings tab in Intel EMA I get "Internal Server Error. Please contact the administrator"
The same error i get when i open Provision Intel AMT window on the endpoint. Screenshots attached.
Thank you.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Tomhys,
I wanted to let you know that I’ll be sending you a private message shortly to request the file.
Please keep an eye out for it, and feel free to reach out if you have any questions or need clarification.
Thank you for your support!
Best regards,
Vijay N
Intel Customer Support Technician
intel.com/vPro
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page