New EMA deployment - unable to Remote Desktop to USRA boot image or Installed OS

ThomasTrain · ‎06-21-2025

I have a relatively newly deployed EMA using single server mode.

AMT Profile deployed with KVM, Web-Base User interface, Serial over LAN and IDE/USB Redirection (user consent, one click recovery and remote platform erase are unchecked)

Used an self managed PKI with the proper OID and manually added the root to MEB of the clients.

9 client devices HP 800 G9 - AMT successfully enrolled and confirmed configured in admin control mode. All hardwired ethernet on the same subnet and Ethernet switch as the server. All reside in the 192.168.102.0/24 subnet.

I'm having no end of issues. my clients intermittently will show "Intel® AMT is not reachable.".

When it does work, I can connect to the AMT but when I select the remote desktop option, all I see if a black screen. I have also confirmed in here that user consent is disabled. The only think that I can make work, sometimes, is from a powered off state, I can tell AMT to boot to BIOS and then I will see the screen.

However, when the OS is running, or if I attempt to boot to a known good boot image, all I see is a black screen.

I previously used AMT on much older hardware that was much more reliable and consistently worked.

Please Help?

__PRESENT

pujeeth · ‎06-23-2025

Hello ThomasTrain,

Greetings!!

Thank you for bringing the issue to our attention.

We understand that you have recently deployed Intel® EMA and are currently facing issues with remote KVM.

To help us better understand your environment and assist you effectively, we would request you to share the ECT logs.

Intel® EMA Configuration Tool (ECT) Logs:

Download the tool from the following link: Intel® EMA Configuration Tool
Installation:

Download and unzip the tool.
Double-click the .msi file and follow the installation prompts.

Run the Tool:
a. Open a command prompt as an administrator (or use Windows PowerShell*).
b. Navigate to the installation folder (default: C:\Program Files (x86)\Intel\EMAConfigTool).
c. Run the following command:
EMAConfigTool.exe --verbose

Additionally, provide a screenshot from Intel EMA general tab.

Regards,

Pujeeth

Intel Customer Support Technician

ThomasTrain · ‎06-23-2025

Hi Pujeeth,

Attached is the EMAConfigTool export from one of the systems named “CMCDL02-PC”. I’ve also attached the screenshot below.

Thanks,

ThomasTrain

pujeeth · ‎06-24-2025

Hello ThomasTrain,

Greetings!!

Thank you for sharing the ECT logs and the screenshot. Based on the screenshot, we observed that CIRA is not connected, and additionally, the ME firmware is not up to date.

We kindly request you to update the following driver on the endpoints to the latest version and let us know the status after the update:

Intel® Management Engine Drivers for Windows 10* and Windows 11*

https://www.intel.com/content/www/us/en/download/682431/intel-management-engine-drivers-for-windows-10-and-windows-11.html

Intel® Network Adapter Driver for Microsoft Windows 11*

https://www.intel.com/content/www/us/en/download/727998/intel-network-adapter-driver-for-microsoft-windows-11.html

Note: Once the drivers are updated, we kindly request you to reboot the endpoints and allow some time for CIRA to establish a connection.

Regards,

Pujeeth

Intel Customer Support Technician

ThomasTrain · ‎06-25-2025

I've been able to resolve the black screen on the remote control panel - it appears that AMT KVM requires a monitor to be connected - this really needs to be better documented as a requirement.

However, the next problem is that I'm unable to boot to an .iso image. This ISO image works perfectly on older versions of AMT that are not integrated with EMA.

The steps I'm taking:

the ISO has been added to EMA (validated the ISO exists in the storage location)
For the endpoint, on the general page, I select to mount an image and select the applicable ISO image.
Click to the hardware manageability tab, then remote desktop, choose connect and then finally power on the device using the 'power up' option.
1. I have also tried to General tab - boot to image option
2. I have also tried to remote desktop, power up to IDE-R image.

I've also accessed the system BIOS to turn off secure boot.

Any ideas?

ThomasTrain · ‎06-24-2025

CIRA is connected. but still having the same problem.

pujeeth · ‎06-25-2025

Hello ThomasTrain

Greetings!!

Glad to hear that blank screen issue has been resolved. For documentation about the blank screen issue in KVM, please find the section 8.0 troubleshooting, in the Intel EMA admin and usage guide link given below.

KVM shows a black screen When connected to Intel AMT KVM, a black screen is displayed if no physical monitor is plugged in. If the endpoint is headless, the Graphics Processing Unit (GPU) powers down if no requests are coming via the operating system.

In this case, when the endpoint is power cycled or booted to the BIOS, it detects no attached monitor and powers down the GPU,

which results in a black/blank screen.

link:https://www.intel.com/content/www/us/en/content-details/841791/intel-endpoint-management-assistant-intel-ema-administration-and-usage-guide.html#page=77

2) For the ISO image booting issue, please find the detailed and the reference section 6.4.9.1 (Pg 71 in the Intel EMA Admin guide below.

Use small images to the greatest extent possible, to prevent timeouts during endpoint reboot to a mounted image. Furthermore, if you plan to interact with the rebooted endpoint via KVM, the image you boot to must contain USB keyboard and mouse

drivers.

One recommended method for endpoint reboot to a mounted image is to use a two part image. First, boot the endpoint to a small image that allows you to bring up the endpoint on your network. Then use that image to access more content from the endpoint.

NOTE

There is a current known issue with Intel AMT booting some UDF formatted images via USBR. Sometimes UDF formatted images may not boot or may not boot fully. We recommend using CDFS formatted images until this issue is resolved.

Link:

https://www.intel.com/content/www/us/en/content-details/841791/intel-endpoint-management-assistant-intel-ema-administration-and-usage-guide.html#page=71

Regards,

Pujeeth

Intel Customer Support Technician

ThomasTrain · ‎06-30-2025

I am still having a problem with two specific systems that are connected to EMA and show as provisioned in admin mode but CIRA will not connect.

I have other systems that are connected with CIRA.

What are my next steps to troubleshoot these two systems?

pujeeth · ‎06-30-2025

Hello ThomasTrain

Greetings!!

Regarding the system where CIRA is not getting connected, we would request you to perform the following steps to help resolve the issue:

1.Update the following drivers:

Intel® Management Engine Drivers for Windows 10 and Windows 11**

https://www.intel.com/content/www/us/en/download/682431/intel-management-engine-drivers-for-windows-10-and-windows-11.html

Intel® Network Adapter Driver for Microsoft Windows 11*

https://www.intel.com/content/www/us/en/download/727998/intel-network-adapter-driver-for-microsoft-windows-11.html

2.If the issue persists after updating the drivers, kindly proceed with the following:

Uninstall the agent files from the affected system where CIRA shows as Not Connected.
Fully unprovision the system from MEBx.
Once unprovisioned, copy the agent files from a working system (where CIRA is successfully connected).
Provision the affected system again using the copied agent files.

Once these steps are completed, please share your findings with us so we can assist you further.

Regards

Pujeeth

Intel Customer Support Technician

ThomasTrain · ‎06-30-2025

Sadly, I have already done those steps. No change.

CMCDL01-PC was fully uninstalled, reset MBx back to unconfirmed - added certificate back to MBx with USB stick, then reinstalled the EMAAgent of the exact same working config of the other systems.

CMCDL02-PC on the other hand I basically left along as a control sample.

Neither are connecting to CIRA.

If I use the Intel Manageability and Security Status tool to try to force a CIRA connection using the 'fast call for help' link, I eventually get an error that it cannot contact the server.

For completeness, I'm including the screenshot and EMAConfig report of a working system as well.

pujeeth · ‎07-01-2025

Hello ThomasTrain,

Greetings!!

Thank you for sharing the ECT logs, upon checking the logs shared we see that the PKI DNS Suffix of the working endpoints is helpdesk.commoditymarketing.com, however the PKI DNS Suffix of the non working endpoints says amtvpro.commoditymarketing.com which seems to be the issue.

Hence we would request you to update the PKI DNS Suffix manually in the MEBx to helpdesk.commoditymarketing.com.

Please find the steps to update the PKI DNS suffix in the MEBx through the article link given below.

How to Provision a LAN-Less Endpoint with Intel® EMA?

https://www.intel.com/content/www/us/en/support/articles/000058945/software/manageability-products.html

Regards,

Pujeeth

Intel Customer Support Technician

ThomasTrain · ‎07-01-2025

This wasn't performed on the other systems - why it is required here? wouldn't the provisioning via the EMAAgent into admin mode have configured that already?

pujeeth · ‎07-01-2025

Hello ThomasTrain,

We completely understand your concern regarding the difference in provisioning behavior across systems. Typically, there are two modes of provisioning: Remote Provisioning (using EMAAgent) and Manual Provisioning (via MEBx).

While remote provisioning is usually sufficient, there are instances where it may not complete successfully due to system-specific configurations or network conditions. In such cases, we kindly request you to perform manual provisioning through the MEBx interface as a fallback method.

Once you've had a chance to try the manual provisioning, please do share your findings with us with new ECT logs

Regards

Pujeeth

Intel Customer Support Technician

pujeeth · ‎07-08-2025

Hello ThomasTrain,

Greetings!!

This is the first follow-up regarding the issue you reported to us.

We wanted to inquire whether you had the opportunity to review the plan of action we provided.

Regards,

Pujeeth

Intel Customer Support Technician

ThomasTrain · ‎07-08-2025

yes - we identified root cause.

It appears that changing the name of the CIRA system is not supported, even though changing the name is allowed in the Server configuration pages of EMA.

Once I changed the ajax and manageability FQDN address names back to helpdesk.commoditymarketing.com, then it started working.

we had two names associated to this single IP address: helpdesk.commoditymarketing.com and amtvpro.commoditymarketing.com. Both were set as A records in DNS and both resolve to 192.168.102.18.

Everything worked when we update those names from the helpdesk.commoditymarketing.com name to the amtvpro.commoditymarketing.com name except being able to connect to CIRA.

pujeeth · ‎07-08-2025

Hello ThomasTrain,

Greetings!

Thank you for the update. We are glad to hear that the issue has been resolved.

We will proceed with closing the thread. If you need further assistance regarding this issue, please reply to this forum. We will either reopen this thread or create a new one to assist you further.

Regards,

Pujeeth

Intel Customer Support Technician