Intel SCS - ACUConfig Exit with code 32 AD object deletion failed when unregister device

[Horgster]

Hi All!

Have discovered that ACUConfig.exe returns exit code 32 - "AD Object deletion failed" during unregistration of an Intel AMT device. 

The AD Intel AMT machine object is actually deleted by Intel SCS server who has full control of the OU, but ACUConfig.exe reports this as an false positive error. 

I am running this command to unregister the device:
ACUConfig.exe UnConfigure /AdminPassword <password> /RCSAddress <SCS Server FQDN> /WMIUser <username> /WMIUserPassword <password>

ACUConfig Error code is:
ADInterfaceNamespace::ADInterfaceInternal::DeleteADObject Line: 817: An Active Directory interface internal error occurred. Active directory function DeleteDSObject failed with error -2147024891 (Access is denied.: LDAP Provider: 00000005: SecErr: DSID-0315274B, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0).CN=GM-L02-W0011,OU=AMT Computers,DC=domain, dc=com

RCS Server reports:
RCS_RemoteConfigurationService::Unconfigure Line: 893: Finishing Unconfigure for UUID:6ABF14E2-22B9-11E8-8085-FB94F8A63E00, With returned status: Success.

Do we have an bug in ACUConfig.exe here?

This will cause that SCCM OS Deployment will fail due to this false / positive error and we must configure SCCM to accept exit 32 code as success. Exit code 32 is also used on other error situation so this is not an god solution.

Please assist and help!

[IntelSupport]

Hello Horgster,

Thank you for posting your question on this Intel® Community.

If a script defined to run before an unconfiguration operation fails, the unconfiguration operation is canceled. Scripts defined to run after configuration, reconfiguration, maintenance, and unconfiguration operations only run if the operation is successful (or completes with warnings). By default, if the script fails, Intel SCS does not make any changes to the Intel AMT settings set by the operation that ran before the script.

To better assist you, please allow us to review the logs provided. I will update this thread soon.

Wanner G.

Intel Customer Support Technician

[MichaelA_Intel]

Hi Horgster,

In the SCS User Guide:

https://www.intel.com/content/dam/support/us/en/documents/software/Intel_SCS_User_Guide.pdf

In the ACUConfig line, you will want to include the /ADOU <ADOU path> and the /DeleteADObjectViaRCS switches.

As with the Exit Code 32, this is informational only.

We believe that possibly the reason this exit code is generated is that there will be two attempts done by RCS to delete the AD object in the OU. Initially, if the user account running ACUConfig does not have the appropriate permissions to delete the object in the OU, RCS (which will have access) will remove the object but through this exit code.

One way to determine if this is in fact going on would be to find another system to unregister and run ACUConfig with an account that has access to delete objects from the OU.

Regards,

Michael

[Horgster]

Hi @MichaelA_Intel 

Thanks for your kind answer.

 /ADOU <ADOU path> and the /DeleteADObjectViaRCS switches simply don't work as RCSServer then failes to delete the AD object.

Deletion of the AD objects only works if ACUConfig.exe UnConfigure /AdminPassword <password> /RCSAddress <SCS Server FQDN> /WMIUser <username> /WMIUserPassword <password>

So, I just accept that ACUConfig returns exit code 32.

Regards
Horgster

[IntelSupport]

Hello Horgster,

Thank you for your feedback. It is highly appreciated.

Please allow us to review it. We will update this thread soon.

Wanner G.

Intel Customer Support Technician