Several issues on the latest Intel vPro Technology Module for Windows PowerShell

[smaki]

Hello,

Now I'm trying the latest Intel vPro Technology Module for Windows PowerShell (v18.0.0.1).
I've only tried a few of the cmdlets so far, I've facing several issues. So, could you please investigate them?

#1. Get-AmtSetup
It doesn't work at all. Everytime an exception error occurred like as follows.

PS C:\Users\shin> Get-AmtSetup | Format-Table -AutoSize -Wrap

Status Reason
------ ------
Failed Exception calling "Discover" with "0" argument(s): "Cannot marshal field 'Password' of type
'CFG_GET_LOCAL_SYSETM_ACCOUNT_RESPONSE': There is no marshaling support for this type."

I tried it on the Meteor Lake platform (AMT 18.0.5). However, the problem occurred regardless of the AMT version. This seems to be the part that converts $$OsAdmin's password into a secure string.

#2. Get-AMTHardwareAsset

During retrieving hardware asset information, an exception error occurred on any platform like as follows.

PS C:\Users\shin> Get-AMTHardwareAsset -ComputerName:thinkpadl13.makky.org -Credential $amtCred | Format-Table -AutoSize -Wrap

Get-ChildItem : No route can be determined to reach the destination role defined by the WSAddressing To.
At C:\IntelvProModule_18.0.0.1\Bin\IntelVpro\Get-AMTHardwareAsset.ps1:123 char:6
+ Get-ChildItem $path | ForEach-Object {
+ ~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Get-ChildItem], WsmanSenderException
+ FullyQualifiedErrorId : Intel.Management.Wsman.WsmanSenderException,Microsoft.PowerShell.Commands.GetChildItemCommand

ComputerName PSParentPath Name Value
------------ ------------ ---- -----
thinkpadl13.makky.org IntelVpro\AmtSystem::\HardwareAssets\BIOS\Primary BIOS Version R15ET60W(1.41)
thinkpadl13.makky.org IntelVpro\AmtSystem::\HardwareAssets\BIOS\Primary BIOS ReleaseDate 2/5/20 24 12:00:00 AM
...

I believe the exception error is at retrieving processor information part. Other asset information seems to be retrieved successfully.

#3. Get-AMTPowerState with multiple platforms.
It works with individual platform, but when I used with multiple platforms, exception errors occurred as follows.

PS C:\Users\shin> Get-AMTPowerState -ComputerName:$clients2 -Credential $amtCred | Format-Table -AutoSize -Wrap

Add-Member : Cannot add a member with the name "Computer Name" because a member with that name already exists. To
overwrite the member anyway, add the Force parameter to your command.
At C:\IntelvProModule_18.0.0.1\Bin\IntelVpro\Get-AMTPowerState.ps1:150 char:13
+ ... $Obj | Add-Member -MemberType noteproperty -Name "Computer Name" ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (@{Computer Name...ion=Full Power}:PSObject) [Add-Member], InvalidOperationException
+ FullyQualifiedErrorId : MemberAlreadyExists,Microsoft.PowerShell.Commands.AddMemberCommand

Add-Member : Cannot add a member with the name "Power State ID" because a member with that name already exists. To
overwrite the member anyway, add the Force parameter to your command.
At C:\IntelvProModule_18.0.0.1\Bin\IntelVpro\Get-AMTPowerState.ps1:151 char:13
+ ... $Obj | Add-Member -MemberType noteproperty -Name "Power State ID ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (@{Computer Name...ion=Full Power}:PSObject) [Add-Member], InvalidOperationException
+ FullyQualifiedErrorId : MemberAlreadyExists,Microsoft.PowerShell.Commands.AddMemberCommand

Add-Member : Cannot add a member with the name "Power State Description" because a member with that name already
exists. To overwrite the member anyway, add the Force parameter to your command.
At C:\IntelvProModule_18.0.0.1\Bin\IntelVpro\Get-AMTPowerState.ps1:152 char:13
+ ... $Obj | Add-Member -MemberType noteproperty -Name "Power State De ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (@{Computer Name...ion=Full Power}:PSObject) [Add-Member], InvalidOperationException
+ FullyQualifiedErrorId : MemberAlreadyExists,Microsoft.PowerShell.Commands.AddMemberCommand

Add-Member : Cannot add a member with the name "Power Saving State ID" because a member with that name already exists.
To overwrite the member anyway, add the Force parameter to your command.
At C:\IntelvProModule_18.0.0.1\Bin\IntelVpro\Get-AMTPowerState.ps1:153 char:13
+ ... $Obj | Add-Member -MemberType noteproperty -Name "Power Saving S ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (@{Computer Name...ion=Full Power}:PSObject) [Add-Member], InvalidOperationException
+ FullyQualifiedErrorId : MemberAlreadyExists,Microsoft.PowerShell.Commands.AddMemberCommand

Add-Member : Cannot add a member with the name "Power Saving State Description" because a member with that name already exists. To overwrite the member anyway, add the Force parameter to your command.
At C:\IntelvProModule_18.0.0.1\Bin\IntelVpro\Get-AMTPowerState.ps1:154 char:13
+ ... $Obj | Add-Member -MemberType noteproperty -Name "Power Saving S ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (@{Computer Name...ion=Full Power}:PSObject) [Add-Member], InvalidOperationException
+ FullyQualifiedErrorId : MemberAlreadyExists,Microsoft.PowerShell.Commands.AddMemberCommand

Computer Name Power State ID Power State Description Power Saving State ID Power Saving State Description
------------- -------------- ----------------------- --------------------- ------------------------------
thinkpadt14g2.makky.org 2 On (S0) 2 Full Power
thinkpadt14g2.makky.org 2 On (S0) 2 Full Power

It seems that those errors has occurred in the creation part of the data to be output. By the way,  Get-AMTFirmwareVersion works without problem.

PS C:\Users\shin> Get-AMTFirmwareVersion -ComputerName:$clients2 -Credential $amtCred |  Format-Table -AutoSize -Wrap

ComputerName Property Value
------------ -------- -----
thinkpadt14g2.makky.org AMT FW Core Version 15.0.47.2473
thinkpadl13.makky.org AMT FW Core Version 14.1.70.2228

#4. Get-AMTPowerState with older platform
This is lower priority issue. When I tried to get power state from very older platform, an error occurred.

PS C:\Users\shin> Get-AMTPowerState -ComputerName:thinkpadx240.makky.org -Credential $amtCred | Format-Table -AutoSize -Wrap

Computer Name Power State Description Reason
------------- ----------------------- ------
thinkpadx240.makky.org Cannot connect Exception calling "Enumerate" with "2" argument(s): "No route can be determined to reach the destination role defined by the WSAddressing To."

I looked through the Get-AMTPowerState.ps1 and found it tring to get power saving state by using CIM clss "IPS_PowerManagementService". But it is not implemented on older platform's firmware( < AMT 10.0).

Best regards,

smaki

[MIGUEL_C_Intel]

Hello, smaki,

Please confirm the latest OEM Management Engine driver is installed in the machine.  The command Get-AMTSetup should be run on the local system with administrator privileges.

In addition, confirm if the PowerShell and vPro Module installation met the requirements of the document:
Intel vPro® Technology Module for Microsoft* Windows* PowerShell* Installation and User Guide included in the zip file.
Path: IntelvProModule_18.0.0.1\Docs

Intel vPro® Technology Module for Windows* PowerShell
https://www.intel.com/content/www/us/en/download/704395/intel-vpro-technology-module-for-windows-powershell.html

Regards,
Miguel C.
Intel Customer Support Technician

[smaki]

Hi Miguel,

Thank you prompt response.

Yes, of cource I executed Get-AmtSetup with admin priviledge. Without admin priviledge, different message will come.

PS C:\Users\shin> Get-AmtSetup | Format-Table -AutoSize -Wrap

Status Reason
------ ------
Failed Exception calling "Enable" with "0" argument(s): "Attempted to perform an unauthorized operation."

And I believe the system meets requrements. Because another commandlet (i.e. Get-AMTFirmwareVersion) works locally without problem whether with admin priviledge or not. So, both MEI driver and LMS are working correctly.

PS C:\Users\shin> Get-AMTFirmwareVersion localhost -Credential $amtCred | Format-Table -AutoSize -Wrap

ComputerName Property Value
------------ -------- -----
localhost AMT FW Core Version 18.0.5.2133

Get-AmtSetup commandlet doesn't use admin's credential but seems to use $$OsAdmin's credential instead.

Best regards,

smaki

[MIGUEL_C_Intel]

Hello, smaki,

Thank you for your reply with the answers to my questions.

Please send me the full model of the machines that you are testing and the current BIOS. I will replicate the issue.

Regards,

Miguel C.

Intel Customer Support Technician

[smaki]

Hi Miguel,

I have tried on several systems not only MTL platform as follows.

ThinkPad T14 Gen5 (Meteor Lake)

UEFI F/W : 1.05

CSME F/W : 18.0.5.2133

NUC13L3Kv5 (Raptor Lake)

UEFI F/W : L3RPLV57.0035.2023.1123.1751

CSME F/W : 16.1.25.2124

NUC12WSKv5 (Alder Lake)

UEFI F/W : WSADLV57.0092.2024.0202.1635

CSME F/W : 16.1.27.2176

ThinkPad T14 Gen2 (Tiger Lake)
UEFI F/W : 1.61
CSME F/W : 15.0.47.2473

ThinkPad L13 (Comet Lake)
UEFI F/W : 1.41
CSME F/W : 14.1.70.2228

ThinkPad T490 (Whiskey Lake)
UEFI F/W : 1.82
CSME F/W : 12.0.92.2145

Every system showed same error message.

BTW, is there any system which can execute Get-AMTSetup cmdlet? If yes, plese let me know which vendor / model.

Thank you,

smaki

[MIGUEL_C_Intel]

Hello, smaki,

Thank you for your reply with the PC models.  The PowerShell vPro Module is intended for test and development.  The support is limited, please allow me some time to set up a lab and test the scripts.

Regards,

Miguel C.

Intel Customer Support Technician

[MIGUEL_C_Intel]

Hello, smaki,

Thank you for holding to our answer.

Smaki, by chance have you tested the behavior of the scripts with the previous version of Intel vPro® Technology Module for Windows* PowerShell v16.0.7.1. We will appreciate the outcome of testing it. You can run both software versions in the endpoint. 

https://www.intel.com/content/www/us/en/download/704395/786183/intel-vpro-technology-module-for-windows-powershell.html

Please try with Meteor Lake and the previous CPU version.

Regarding the issue: "No route can be determined to reach the destination role defined by the WSAddressing To." Can you confirm if LMS is running?  We can verify that by running the Intel® EMA Configuration Tool (ECT) 

https://www.intel.com/content/www/us/en/download/19805/30485/intel-endpoint-management-assistant-configuration-tool-intel-ema-configuration-tool.html

or by using the PS script CSME-DiscoverySmbiosAdvanced available at Intel® Endpoint Management Assistant (Intel® EMA) API Sample Scripts.

https://www.intel.com/content/www/us/en/download/19693/30076/intel-endpoint-management-assistant-intel-ema-api-sample-scripts.html

Regards,

Miguel C.

Intel Customer Support Technician

[smaki]

Hi Miguel,

Before I show the result of v16.0.7.1,

1. Have you tried to reproduce any of these issues on your side? If yes, what were the results? Did everything work fine?
I also would like to know if these issues only occurs in my environment or not.

To properly understand the problem, I recommend trying to reproduce them.

2. >About the problem: "Unable to determine the route to reach the destination role defined in WSAddressing To." Can you check if LMS is running?
Why did you think so? The problem is not on local access, but on remote access. I don't think it matters whether LMS is running or not.

I tried v16.0.7.1 module as you showed with no luck as below.

#1. Get-AmtSetup
PS C:\Users\shin> Import-Module C:\IntelvProModule_16.0.7.1\Bin\IntelvPro\IntelvPro.psd1
PS C:\Users\shin> Get-AmtSetup | Format-Table -AutoSize -Wrap

Status Reason
------ ------
Failed Exception calling "Discover" with "0" argument(s): "Cannot marshal field 'Password' of type
'CFG_GET_LOCAL_SYSETM_ACCOUNT_RESPONSE': There is no marshaling support for this type."

I got the same error message as v18.0.0.1.

#2. Get-AMTHardwareAsset
PS C:\Users\shin> Get-AMTHardwareAsset -ComputerName:thinkpadl13.makky.org -Credential $amtCred | Format-Table -AutoSize -Wrap
Get-ChildItem : No route can be determined to reach the destination role defined by the WSAddressing To.
At C:\IntelvProModule_16.0.7.1\Bin\IntelvPro\Get-AMTHardwareAsset.ps1:123 char:6
+ Get-ChildItem $path | ForEach-Object {
+ ~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Get-ChildItem], WsmanSenderException
+ FullyQualifiedErrorId : Intel.Management.Wsman.WsmanSenderException,Microsoft.PowerShell.Commands.GetChildItemCo
mmand

ComputerName PSParentPath Name Value
------------ ------------ ---- -----
thinkpadl13.makky.org IntelvPro\AmtSystem::\HardwareAssets\BIOS\Primary BIOS Version R15ET6
0W
(1.41
)
thinkpadl13.makky.org IntelvPro\AmtSystem::\HardwareAssets\BIOS\Primary BIOS ReleaseDate 2/5/20
24 12:
00:00
AM
thinkpadl13.makky.org IntelvPro\AmtSystem::\HardwareAssets\BIOS\Primary BIOS Manufacturer LENOVO
...

I got the same error message as v18.0.0.1.

#3. Get-AMTPowerState with multiple platforms.
PS C:\Users\shin> Get-AMTPowerState -ComputerName:$clients2 -Credential $amtCred | Format-Table -AutoSize -Wrap
Add-Member : Cannot add a member with the name "Computer Name" because a member with that name already exists. To
overwrite the member anyway, add the Force parameter to your command.
At C:\IntelvProModule_16.0.7.1\Bin\IntelvPro\Get-AMTPowerState.ps1:150 char:13
+ ... $Obj | Add-Member -MemberType noteproperty -Name "Computer Name" ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (@{Computer Name...n=Power Saving}:PSObject) [Add-Member], InvalidOper
ationException
+ FullyQualifiedErrorId : MemberAlreadyExists,Microsoft.PowerShell.Commands.AddMemberCommand

Add-Member : Cannot add a member with the name "Power State ID" because a member with that name already exists. To
overwrite the member anyway, add the Force parameter to your command.
At C:\IntelvProModule_16.0.7.1\Bin\IntelvPro\Get-AMTPowerState.ps1:151 char:13
+ ... $Obj | Add-Member -MemberType noteproperty -Name "Power State ID ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (@{Computer Name...n=Power Saving}:PSObject) [Add-Member], InvalidOper
ationException
+ FullyQualifiedErrorId : MemberAlreadyExists,Microsoft.PowerShell.Commands.AddMemberCommand

Add-Member : Cannot add a member with the name "Power State Description" because a member with that name already
exists. To overwrite the member anyway, add the Force parameter to your command.
At C:\IntelvProModule_16.0.7.1\Bin\IntelvPro\Get-AMTPowerState.ps1:152 char:13
+ ... $Obj | Add-Member -MemberType noteproperty -Name "Power State De ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (@{Computer Name...n=Power Saving}:PSObject) [Add-Member], InvalidOper
ationException
+ FullyQualifiedErrorId : MemberAlreadyExists,Microsoft.PowerShell.Commands.AddMemberCommand

Add-Member : Cannot add a member with the name "Power Saving State ID" because a member with that name already exists.
To overwrite the member anyway, add the Force parameter to your command.
At C:\IntelvProModule_16.0.7.1\Bin\IntelvPro\Get-AMTPowerState.ps1:153 char:13
+ ... $Obj | Add-Member -MemberType noteproperty -Name "Power Saving S ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (@{Computer Name...n=Power Saving}:PSObject) [Add-Member], InvalidOper
ationException
+ FullyQualifiedErrorId : MemberAlreadyExists,Microsoft.PowerShell.Commands.AddMemberCommand

Add-Member : Cannot add a member with the name "Power Saving State Description" because a member with that name
already exists. To overwrite the member anyway, add the Force parameter to your command.
At C:\IntelvProModule_16.0.7.1\Bin\IntelvPro\Get-AMTPowerState.ps1:154 char:13
+ ... $Obj | Add-Member -MemberType noteproperty -Name "Power Saving S ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (@{Computer Name...n=Power Saving}:PSObject) [Add-Member], InvalidOper
ationException
+ FullyQualifiedErrorId : MemberAlreadyExists,Microsoft.PowerShell.Commands.AddMemberCommand

Computer Name Power State ID Power State Description Power Saving State ID Power Saving State Description
------------- -------------- ----------------------- --------------------- ------------------------------
thinkpadt14g2.makky.org 2 On (S0) 3 Power Saving
thinkpadt14g2.makky.org 2 On (S0) 3 Power Saving

I got the same error message as v18.0.0.1.

#4. Get-AMTPowerState with older platform
PS C:\Users\shin> Get-AMTPowerState -ComputerName:thinkpadx240.makky.org -Credential $amtCred | Format-Table -AutoSize -Wrap

Computer Name Power State Description Reason
------------- ----------------------- ------
thinkpadx240.makky.org Cannot connect Exception calling "Enumerate" with "2" argument(s): "No route can be
determined to reach the destination role defined by the WSAddressing
To."

I got the same error message as v18.0.0.1.

Please try to reproduce it anyway.

Best regards,
smaki

[MIGUEL_C_Intel]

Hello, smaki,

We were unable to replicate it.

Regards,

Miguel C.

Intel Customer Support Technician

[smaki]

Hello Miguel,

Would you show me the result of following command?

 PS C:\Users\shin> Get-AmtSetup | Format-Table -AutoSize -Wrap 

I've tried on some vPro PCs, but never seen successful message.

Thank you,

smaki

[mseszeny]

“No route can be determined to reach the destination…”
This sounds like AMT isn’t available. Can you go to the web interface on the remote system https://ENDPOINT_IP:16993 ? You can also check the port with PS test-netconnection or telnet (if the services is added). Doesn’t sound like 16993 is responding, or 16992 (non-TLS) on older (AMT 14 and prior) platforms.

"Cannot marshal field 'Password' of type…”
This error sounds related to how you are pulling the password from $amtCred, Have you tried just calling the username and password directly from the CLI or script first for testing purposes? Simplify things as much as possible and add back in the layers of sophistication you require. This may be something simple like a syntax error that is tripping you up.  Just a thought to get you pointed in the right direction.

[smaki]

Hello mseszeny,

Thank you for your comment.

>“No route can be determined to reach the destination…”
>This sounds like AMT isn’t available. Can you go to the web interface on the remote system https://ENDPOINT_IP:16993 ? You can also

>check the port with PS test-netconnection or telnet (if the services is added). Doesn’t sound like 16993 is responding, or 16992 (non->TLS) on older (AMT 14 and prior) platforms.

Of cource, I confirmed WebUI access without trouble, at first.

And another commandlet (ex. Get-AMTFirmwareVersion) worked fine. So, I believe AMT on each systems are working correctly. 

>"Cannot marshal field 'Password' of type…”
>This error sounds related to how you are pulling the password from $amtCred, Have you tried just calling the username and password

>directly from the CLI or script first for testing purposes? Simplify things as much as possible and add back in the layers of >sophistication you require. This may be something simple like a syntax error that is tripping you up. Just a thought to get you pointed in

>the right direction.

1. The error message came out when I used Get-AMTSetup cmdlet which doesn't require credential input. Because it is a local command and it uses local account ($$OsAdmin) instead of supplied credential information though it required admin priviledge.

2. On the same session, some of other commandlets work fine with the credential object ($amtCred). And in case of Get-AMTPowerState, password parameter was rejected like below.

PS C:\Users\shin> Get-AMTPowerState -ComputerName thinkpadl13.makky.org -Username admin -Password P@ssw0rd | Format-Table -AutoSize -Wrap

Computer Name Power state Description Reason
------------- ----------------------- ------
Exception Thrown Cannot convert argument "pass", with value: "P@ssw0rd", for "SetCredentials" to
type "System.Security.SecureString": "Cannot convert the "P@ssw0rd" value of
type "System.String" to type "System.Security.SecureString"."

So, I decided to use credential object instead of username/password.

smaki