Proviniong vPro fails on some pcs

[tiweyop382]

Hello,

we have some problems with configuring vPro on some devices.
We have installed Intel® EMA v1.12.2.0 to use a certificate (digicert) to configure vPro in Admin mode.
We have 450+ endpoints in the console and almost 250 of them are working as expected (Provisioning complete and CIRA Connected).

The other 200+ endpoints have some problems and the provisioning doesn't work.
The majority of the hardware is DELL and some LENOVO, we don't have a particular model that doesn't work.
Often we have the same model with the same BIOS version, that on some pcs the provisioning works fine and on some pcs don't...

The EmaAgent.log reports the same thing over and over:

[2024-07-02 01:32:53.305 AM] \Agent\MeshManageability\agent\microstack\ILibAsyncSocket.c:428 internalSocket ERROR: 10035. Last error: 10035

What does it mean?
Do you need some other logs? Questions?

Thanks for your help
Best regards

[Suneesh]

Hello tiweyop382,

Greetings of the day.

Kindly share us the ECT logs.

Intel® EMA Configuration Tool (ECT):

https://www.intel.com/content/www/us/en/download/19805/30485/intel-endpoint-management-assistant-configuration-tool-intel-ema-configuration-tool.html

Installation:

Download and unzip the tool.

Double-click the .msi file and follow the prompts.

Run:

a-Open a command prompt as administrator (alternatively, you can run the tool from Windows PowerShell*).

b-Navigate to the installation folder (default C:\Program Files (x86)\Intel\EMAConfigTool).

c-Run the command: EMAConfigTool.exe --verbose

Regards,

Suneesh

[tiweyop382]

Hello Suneesh,

no problem, see attachment.

[Suneesh]

Hello tiweyop382,

Greetings!

We are currently checking with our internal team on this matter and will provide an update as soon as possible.

Regards,

Suneesh

[Suneesh]

Hello tiweyop382,

I hope this email finds you well.

To assist in resolving the issue you're experiencing, could you please perform the following steps on a non-working system to manually fix the PKI DNS suffix?

1. **Check the PKI DNS Suffix Setting:

  - Go to the non-working machine.

  - Navigate to **Managed Endpoints** in the Intel EMA interface.

  - Capture a screenshot of how the PKI DNS suffix is set.

2. **Verify Inband Agent Functionality:

  - Open the terminal (Command Prompt).

  - Execute the following command:

    ```

    ema>agent -swarmserver

    ```

  - The expected response should include port 8080.

  - If the inband agent is working correctly, the issue is likely related to the PKI DNS suffix configuration.

Could you please provide us with the screenshot of the PKI DNS suffix setting from the EMA interface and confirm the terminal command output? This will help us better understand the situation and provide a more accurate solution.

Thank you for your cooperation. We look forward to your response.

Best regards,

Suneesh

[tiweyop382]

Hello Suneesh,

I don't understand the first question, where can I found the PKI DNS suffix? On the Intel EMA console I don't see it...

And if that it's the problem, how can we set the PKI DNS suffix from remote (without enter in the BIOS Intel MEBx) ?

For the second question you can see the attachment, the pc is able to contact the swarmserver on port 8080

Regards

[vij1]

Hello tiweyop382,

Greetings!

We are currently checking with our internal team on this matter and will provide an update as soon as possible.

Regards,

[tiweyop382]

Hello vij1,

any news?

[tiweyop382]

Hello Suneesh, vij1,

any update on the matter?

Regards

[Suneesh]

Hello tiweyop382,

Greetings of the day.

Steps to Find the PKI DNS Suffix:

• Log in to the tenant admin portal.
• In the search bar, look for the following format:

1. https://FQDN.org
2. Example: https://vpro.abcservice.org:8080

• Click on the "Not Secure" label in the browser's address bar.
• You will then be able to see the PKI DNS suffix.

Regards,

Suneesh

[Suneesh]

Hello tiweyop382,

Thank you for contacting Intel.

This is the first follow-up regarding the issue you reported to us.

We wanted to inquire whether you had the opportunity to review the plan of action (POA) we provided.

Feel free to reply to this email, and we'll be more than happy to assist you further.

Regards,

Suneesh

[tiweyop382]

Hello Suneesh,

see the attachment for the PKI DNS suffix.

I still don't understand how to fix this parameter on a non-working machine.

Regards

[Suneesh]

Hello tiweyop382,

Greetings of the day.

Thank you for the update.

Please install the TLS certificate in IIS. Refer to the Intel EMA Server Installation Guide, section 1.4.8, for instructions on replacing the temporary web TLS certificate.

You can access the guide via the following link: Intel EMA Server Installation and Maintenance Guide

https://www.intel.com/content/dam/support/us/en/documents/software/manageability-products/intel-ema-server-installation-and-maintenance-guide.pdf#page=20

Use an SSL TLS certificate to validate and secure the website. You can use either a standard or vPro certificate.

Thank you for your cooperation.

Regards,

Suneesh

[Suneesh]

Hi tiweyop382,

I hope you're doing well. To avoid any delays in addressing your concerns and to ensure security when sharing logs, we have sent an email from the ticket. We look forward to your response to the email, so we can assist you further on the issue.

Regards,

Suneesh

[Suneesh]

Hi tiweyop382,

Thank you for contacting Intel.

This is the second follow-up regarding the reported issue. 

We're eager to ensure a swift resolution and would appreciate any updates or additional information you can provide.

Please feel free to respond to this email at your earliest convenience.

Regards,

Suneesh