Provisioning record exists but SCCM shows machine as "Not Provisioned"

idata · ‎12-01-2011

I have been in the process of implementing Out of Band Management in SCCM and am currently attempting to provision an existing machine in band. I've checked the machine and a provisioning record exists in Intel ME, yet SCCM still shows the machine as "Not Provisioned", and amtopmgr.log shows the following information:

>>>>>>>>>>>>>>>Provision task begin<<<<<<<<<<<<<<< SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:30 AM 10280 (0x2828)<p>

Provision target is indicated with SMS resource id. (MachineId = 26958 SKY-301-L02.tulsatech.org) SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:30 AM 10280 (0x2828)

Found valid basic machine property for machine id = 26958. SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:30 AM 10280 (0x2828)

Warning: Currently we don't support mutual auth. Change to TLS server auth mode. SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:30 AM 10280 (0x2828)

The provision mode for device SKY-301-L02.tulsatech.org is 1. SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:30 AM 10280 (0x2828)

Check target machine (version 7.1.13) is a SCCM support version. (TRUE) SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:30 AM 10280 (0x2828)

The IP addresses of the host SKY-301-L02.tulsatech.org are 10.5.3.178. SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:30 AM 10280 (0x2828)

Attempting to establish connection with target device using SOAP. SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:30 AM 10280 (0x2828)

Found matched certificate hash in current memory of provisioning certificate SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:30 AM 10280 (0x2828)

Create provisionHelper with (Hash: B9990B80C1DC48A66D5859A4E28E427F436BE05A) SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:30 AM 10280 (0x2828)

Set credential on provisionHelper... SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:30 AM 10280 (0x2828)

Try to use default factory account to connect target machine SKY-301-L02.tulsatech.org... SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:30 AM 10280 (0x2828)

AMT Provision Worker: 1 task(s) are sent to the task pool successfully. SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:30 AM 28256 (0x6E60)

STATMSG: ID=7203 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_AMT_OPERATION_MANAGER" SYS=TTCSMS01 SITE=TTC PID=12480 TID=28256 GMTDATE=Thu Dec 01 17:29:30.129 2011 ISTR0="1" ISTR1="0" ISTR2="0" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0 SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:30 AM 28256 (0x6E60)

AMT Provision Worker: Wait 20 seconds... SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:30 AM 28256 (0x6E60)

AMT Provision Worker: Wakes up to process instruction files SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:30 AM 28256 (0x6E60)

AMT Provision Worker: Wait 20 seconds... SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:30 AM 28256 (0x6E60)

NetworkAdmin.SetDomainName finished with HResult = 0x0, status = 0x0. SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:30 AM 26920 (0x6928)

Succeed to connect target machine SKY-301-L02.tulsatech.org and core version with 7.1.13 using default factory account. SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:30 AM 10280 (0x2828)

GeneralInfo.GetProvisioningState finished with HResult = 0x0, status = 0x0, clientError = 0. SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:31 AM 10280 (0x2828)

Get device provisioning state is In Provisioning SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:31 AM 10280 (0x2828)

SecurityAdministration.SetTLSCertificateWithKeyPair finished with HResult = 0x0, status = 0x0. SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:31 AM 26920 (0x6928)

Passed OTP check on AMT device SKY-301-L02.tulsatech.org. SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:31 AM 10280 (0x2828)

Machine SKY-301-L02.tulsatech.org will be added and published to AD and OU is LDAP://OU=Out of Band Management Controllers,DC=tulsatech,DC=org. SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:31 AM 10280 (0x2828)

Send request to AMT proxy component to add machine SKY-301-L02.tulsatech.org to AD. SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:31 AM 10280 (0x2828)

Successfully created instruction file for AMT proxy task: D:\SMS\inboxes\amtproxymgr.box SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:31 AM 10280 (0x2828)

Processing provision on AMT device SKY-301-L02.tulsatech.org... SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:31 AM 10280 (0x2828)

Found client certificate already being generated for AMT device SKY-301-L02.tulsatech.org. SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:31 AM 10280 (0x2828)

Start 1st stage provision on AMT device SKY-301-L02.tulsatech.org. (SOAP) SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:31 AM 10280 (0x2828)

SecurityAdministration.SetTlsServerAuthentication finished with HResult = 0x0, status = 0x0, clientError = 0. SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:32 AM 26920 (0x6928)

SecurityAdministration.ClearTLSCredentials finished with HResult = 0x0, status = 0x0, clientError = 0. SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:32 AM 10280 (0x2828)

SecurityAdministration.GetDigestRealm finished with HResult = 0x0, status = 0x0, clientError = 0. SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:33 AM 26920 (0x6928)

NetworkTime.GetLowAccuracyTimeSynch finished with HResult = 0x0, status = 0x0, clientError = 0. SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:33 AM 10280 (0x2828)

NetworkTime.SetHighAccuracyTimeSynch finished with HResult = 0x0, status = 0x0, clientError = 0. SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:33 AM 10280 (0x2828)

SecurityAdministration.SetAdminAclEntryEx finished with HResult = 0x0, status = 0x0, clientError = 0. SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:33 AM 26920 (0x6928)

Error: Failed to decrypt the input data. SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:33 AM 26920 (0x6928)

Error: Can't finish provision on AMT device SKY-301-L02.tulsatech.org with configuration code (126)! SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:33 AM 26920 (0x6928)

>>>>>>>>>>>>>>>Provision task end<<<<<<<<<<<<<<< SMS_AMT_OPERATION_MANAGER 12/1/2011 11:29:33 AM 26920 (0x6928)

The last two lines which state the errors are of particular interest to me, as I haven't been able to determine why they are caused. While doing some research I came across the following on the Intel vPro support forums:

Microsoft* ConfigMgr failed to provision and logged "failed to decrypt" error

PROBLEM

This error is produced when you attempt to provision from the Microsoft* Configuration Manager 2007 Central Site.

RESOLUTION

With Microsoft Configuration Manager 2007, you must provision Intel? AMT clients from the Primary Site. For more information on Microsoft* Configuration Manager 2007 site assignment, see the following Microsoft* TechNet article: http://technet.microsoft.com/en-us/library/bb681005.aspx About Client Site Assignment in Configuration M...

Adolfo_S_Intel2 · ‎12-06-2011

In this particular case, I can escalate this issue to the vPro support team, but in order for me to do so, I will need to ask you for the following information:

Your First / Last Name:

Your Phone Number:

Your Email Address:

After having that information, I will proceed to create a Service Ticket number and escalate it to the right vPro department.

[Editor's note: you can send the information from this community site in a private message to Aldolfo or use one of the support email addresses mailto:support_DOPD_SWE@intel.com support_DOPD_SWE@intel.com (this goes directly to our support staff). To send a private message, go to Your Stuff, choose Private Messages, then Compose Message. You can type in Adolfo_Intel in the To box.]

idata · ‎03-29-2012

I am also Experienceing the same exact issue.

What do you recommend