Unable to connect to VPro on Dell Precision 3660

[VeeDub]

Hello,

I have used VPro for a number of years, so I am familiar with configuring the MEBx options.

I have recently deployed a Dell Precision 3660 which appears to have the same MEBx options as previous systems that I have configured (OptiPlex).

So, if MEBx configuration remains the same as before, the Precision appears to be configured correctly, but I am unable to connect using Mesh Commander.

I've had a look at some of the other posts in the forums, and it seems that for troubleshooting I should start with the Intel Configurator

I have a question about these notes

Can I install the Intel Configurator on any computer on the network or do I need to run this tool from the problematic computer (i.e. the Precision 3660)?

Thanks

VW

[VeeDub]

This link doesn't work

https://downloadcenter.intel.com/download/30340/Intel-Configurator

It takes me to the Home page?

[VeeDub]

Hello,

I found the software elsewhere.

Here is an extract from the xml file. On the face of it, I think AMT should be working, but it isn't.

<Capabilities>
<IsAMTSupported>True</IsAMTSupported>
<IsCILASupported>True</IsCILASupported>
<IsAMTKVMSupported>True</IsAMTKVMSupported>
<IsTLSSupported>True</IsTLSSupported>
<IsAntiTheftSupported>False</IsAntiTheftSupported>
<IsWirelessLANSupported>False</IsWirelessLANSupported>
<WiredLANExists>True</WiredLANExists>
<IsCCMSupported>True</IsCCMSupported>
<IsHBPSupported>True</IsHBPSupported>
<IsKVMEnabledInBIOS>True</IsKVMEnabledInBIOS>
<IsKVMSupportedInBIOS>True</IsKVMSupportedInBIOS>
<IsSOLSupportedInBIOS>True</IsSOLSupportedInBIOS>
<IsIDERSupportedInBIOS>True</IsIDERSupportedInBIOS>
<IsAMTEnabledInBIOS>True</IsAMTEnabledInBIOS>
<IsSOLEnabledInBIOS>True</IsSOLEnabledInBIOS>
<IsIDEREnabledInBIOS>True</IsIDEREnabledInBIOS>
<CRLStoreSize>1424</CRLStoreSize>
<RootCertificatesMaxSize>2500</RootCertificatesMaxSize>
<RootCertificatesMaxInstances>4</RootCertificatesMaxInstances>
<FQDNSuffixMaxEntries>4</FQDNSuffixMaxEntries>
<FQDNSuffixMaxLength>63</FQDNSuffixMaxLength>
<CertificateChainMaxSize>4100</CertificateChainMaxSize>
<SupportedCertificatesKeyLengths>
<SupportedCertificateKeyLength>2048</SupportedCertificateKeyLength>
<SupportedCertificateKeyLength>4096</SupportedCertificateKeyLength>
</SupportedCertificatesKeyLengths>
</Capabilities>
<ManagementSettings>
<AMTPKIDNSSuffix/>
<AMTConfigurationMode>Enterprise Mode</AMTConfigurationMode>
<AMTState>Post Provisioning</AMTState>
<IsAMTConfigured>True</IsAMTConfigured>
<AMTConfigurationState>PKI</AMTConfigurationState>
<IsZTCEnabled>True</IsZTCEnabled>
<EmbeddedHBCEnabled>False</EmbeddedHBCEnabled>

<IsMoveToInProvisionPossible>True</IsMoveToInProvisionPossible>
<AMTControlMode>Admin Control Mode</AMTControlMode>
<IsTLSEnabled>True</IsTLSEnabled>
<IsHWCryptoEnabled>True</IsHWCryptoEnabled>
<IsNetworkInterfaceEnabled>True</IsNetworkInterfaceEnabled>
<IsAMTFWUpdateEnabled>False</IsAMTFWUpdateEnabled>
<IsAMTEACEnabled>False</IsAMTEACEnabled>
<AMTDigestRealm>Digest:5006CD08A29D983F657B8631C1416228</AMTDigestRealm>
</ManagementSettings>

One setting that I have noticed is:

<IsTLSEnabled>True</IsTLSEnabled>

On all the existing systems, TLS is not enabled, so am wondering if it being enabled here might be the reason I'm having issues?

Appreciate suggestions.

Thanks

VW

[Victor_G_Intel]

Hello VeeDub,

Thank you for posting on the Intel® communities.

We understand based on your request that you are using Mesh Commander and you are having problems connecting an endpoint; however, we need to inform you that we don’t provide any support for that tool on any of our channels. If you like to receive assistance with it feel free to use the link below.

Contact Information

https://www.meshcommander.com/contact-information     

Regards,

Victor G.

Intel Technical Support Technician  

[VeeDub]

Hello Victor,

Thanks for letting me know re Mesh Commander.

I don't normally use Mesh Commander myself, but it was what Dell were willing to support.

Can you advise what software you do support for Remote Console / Remote Control?

VW

[VeeDub]

Hello,

I have done some more research.

It seems that the supported application for Out-of-band management is Intel EMA.

The EMA user guide is 71 pages and there is a lot of material to digest.

I'm hoping that someone may be able to outline key steps based on the following scenario:

- I'm happy to setup AMT on the workstation manually (which I have already done, I'd like to confirm what are the key config steps in case I have missed any).

- I am familiar with setting up MBEx in a non-TLS environment, so any changes from that process, is what would be useful to understand.

- I'm happy to use Client Control Mode, at least initially, and then I'll investigate the PKI certificate process once I have managed to get CCM working.

Thanks

VW

[VeeDub]

Hello,

So it seems that the Intel tool to connect to VPro is Intel Manageability Commander.

I have installed Intel MC.

Intel MC can connect to my existing non-TLS VPro systems.

Intel MC cannot connect to this Precision.

Screenshot of error attached.

Appreciate suggestions on how to troubleshoot.

Thanks

VW

[Cully1910]

Hey Man

Hoping you see this. I am dealing with the same exact issue on our new Dell Percision 3660's. After going through basic troubleshooting, I found the notice from Intel on how they are deprecating the use of non-TLS for AMT. I can did confirm that we are not using TLS. Not all of our 3660's are impacted but they will be once either the IME driver or BIOS get's updated. I still am not sure which one breaks it - Its either a combo of both, or the BIOS. Like yourself I found that the new supported method of configuring AMT is using EMA. How have you made out with this? Would you be able to provide any pointers? I am going into this pretty new to AMT. I did locate that long brutal 71 page guide which I am slowly getting through. 

Thanks for any help here

[VeeDub]

Hello Cully1910,

I wasted a lot of time on this.

Intel doco on the changes that they have made recently is not the best.

The solution ended up being pretty easy once I figured it out.

Switch to using MeshCommander, it makes the TLS pretty painless.

One thing that perhaps you can help me out with.

Our Precision 3660 has an Nvidia card installed (i.e. we're not using the onboard video), this seems to have stuffed the Remote Control / Desktop of the VPro (we can connect, but don't get any video).

I assume that this is because we're using the Nvidia card. If you're using the onboard video, if you can confirm whether the Remote Control works properly, that would be useful to know.
Thanks
VW

[Cully1910]

Hey VeeDub

Thanks for responding. We actually use the dedicated NVidida cards for our 3660 builds so looks like we will be in the same boat as you. Once I get AMT reconfigured, happy to test using the onboard card.

So just to confirm, you ditched the idea of using Intel EMA (which they are pushing really hard as reccomended best practice), and re-configured your AMT using Mesh-Commander? Is that still supported by them? The way our current AMT presence was built was using ACUConfig.EXE, and then that gets deployed with its respective XML file via Dell KACE.

Do you have any specific resources that you used to setup Mesh Commander? 

[VeeDub]

Hello,

I have no idea if what I have done is supported by Intel.

If you have a look at the Mesh Commander forums, you will find a post from me in there.

Regards,

VW