TrustFailure when using powershell module

[tapbaker]

Hi All,

I am new to intel vPro platform.

As a proof of concept, we configured an intel EMA server running v1.4 which we did not integrate into AD and did not configure any certificates for.

We deployed an agent config using TLS to a handful of devices and all was good.

I was able to power on/off devices from the console and I was able to use powershell to query powerstates via

Get-AMTPowerState -ComputerName $Computer -Username $Username -port 16993 -Password $Password

Sometimes this would work with just the hostname and sometimes I had to specify the FQN.

When EMA v1.5 came out we re-installed EMA server and integrated it into AD. Once again we did not do anything with certificates. We deployed the new agent config to a few hundred devices

In the console, I can see devices successfully provisioned and I can power on/off from the console.

Now, however, when I run PowerShell commands I get:

Exception calling "Get" with "0" argument(s): "TrustFailure"

I still have devices that have the old agent config that I can query the state on via powershell.

Is this "trust" issue because we have not deployed certificates?

Why are the old devices working?

Any suggestions on how to troubleshoot would be greatly appreciated.

[JoseH_Intel]

Hello tapbaker,

Thank you for joining the community.

I don't think this "Trust" error is related to a lack of certificate. It is possible that other "Get" commands produce similar Unauthorized/Trust error messages. 

The problem is a bug in the local Security Settings, the commands do not work if the following local policy is enabled:

System cryptography > Use FIPS compliant algorithms for encryption, hashing, and signing.

Change the setting to disabled, then reboot the system, after that the error will no longer appears.

This is a bug with the SDK on AMT versions 11.6.0.1102 or earlier.

Please give this a try and let me know the outcome.

Regards

Jose A.

Intel Customer Support Technician

[tapbaker]

Thanks for the reply,

Unfortunately the System cryptography > Use FIPS compliant algorithms for encryption, hashing, and signing. is already set to disabled.

Any other thoughts?

We are running on Server 2019

[JoseH_Intel]

Hello tapbaker,

Thank you the update. Please let me research on this. I will get back to you as soon as I have updates.

Regards

Jose A.

Intel Customer Support Technician

[JoseH_Intel]

Hello tapbaker,

Could you please provide screenshots of the messages when running the command, (if possible a video will be very useful). How many systems are having the issue and how many systems in total do you have?

Regards

Jose A.

Intel Customer Support Technician

[JoseH_Intel]

Hello tapbaker,

I am just following up to double-check if you were able to gather the requested information. Otherwise let us know if you require more time to accomplish this. I will try to reach you back on next Tuesday 9th. After that the thread will be automatically archived.

Regards

Jose A.

Intel Customer Support Technician

[JoseH_Intel]

Hello tapbaker,

We will proceed to mark this thread as closed. If you have further issues or questions just go ahead and submit a new topic.

Regards

Jose A.

Intel Customer Support Technician