Wireless Profile Synchronization feature is not working

[FFern4]

Hi

I am preparing an Intel EMA Demo lab for a big customer, and one of the features needed for the customer is to be able to manage Lanless devices when the OS is off.

As many employees as working at home, the easiest way to do that I think is to sync the Windows 10 WiFi networks with AMT

So, in EMA, in the AMT profile, at the Wifi Settings sections, I activate the option Synchronize with host platform WiFi profiles

The problem is that when I add a new WiFi Network in a PC, this network is not added as a new profile in AMT.

For example, one of the PC´s I am testing is a HP Elitebook x360 1030 G3.

Network adapter is a AC 8265. Driver version is 20.70.18.2

ME version is the following

MEBx Version 11.0.0.0010
FW Version 11.8.82.3838
LMS Version 2042.0.20.0
MEI Driver Version 2040.100.0.1029

When I add a new WiFi network in Windows, the Intel PROSet SW ask me if I want to synchronize this profile wint Intel AMT, but the new profile is not created properly in Intel AMT

If I use the WSMAN browser included with MeshCommander, the query CIM_WIFIEndPointSettings shows a new entry, but this entry is void. This is an example of the item created after adding a new WiFi profile.

Item #11:
    AuthenticationMethod = 1
    BSSType = 3
    ElementName = Endpoint User Settings
    EncryptionMethod = 1
    InstanceID =
    Priority = 0
    SSID =

If I create a WiFi profile in the intel AMT profile in Intel EMA, it is synchronized properly at the AMT devices.

I have tested other devices with different versions of Intel AMT, and none of them creates a new WiFi profile when a new WiFi network is added in Windows 10.

For example, a Hp Elitebook x360 1040 G6, with FW version 12.0.70 or an Intel NUC7-i5 with FW v11.8.81.3807

Could you please help me to troubleshoot this issue? It is important to have this feature working

Regards and thanks in advance

Fernando

[JoseH_Intel]

Hello FFern4,

Thank you for joining the Intel community

Did you provisioned these systems through wifi or using a LAN connection? Do you know if the systems you are testing were provisioned as Admin Control Mode? If you provisioned the systems over the wifi then they were set in Client Control Mode and some of the remote management features are limited. Please take a look at this EMA User Guide about the lan-less systems: https://www.intel.com/content/dam/support/us/en/documents/software/manageability-products/intel-ema-admin-and-usage-guide.pdf#page=12

I will look forward for your comments

Regards

Jose A.

Intel Customer Support Technician

[FFern4]

Hi Jose

All the devices have been provisioned in Admin Control Mode. A certificate has been uploaded to the Intel EMA Server.

Most of devices are Lanless PC´s, so they have been provisioned through WiFi. Inte NUC is provisioned using LAN interface, but the WiFi interface is also vPro. If a WiFi profile is manually created in the Intel AMT of Inte EMA, the profile is properly added to the AMT device (NUC or Lanless devices)

Regards

Fernando

[JoseH_Intel]

Hello FFern4,

When a device is provisioned through wifi it will be set in Client Control Mode even if a certificate is been used.

"For LAN-less endpoints, you must first manually update the endpoint's Intel MEBX to add the uploaded PKI certificate's DNS suffix in order for Intel EMA to bring the endpoint from Client Control Mode to Admin Control Mode. Otherwise the endpoint will remain in CCM"

So if trying to add the wifi profile remotely it won't allow you because the systems are still in CCM. Let me know if this somehow helps, otherwise I will proceed to engage our senior team

Regards

Jose A.

Intel Customer Support Technician

[FFern4]

Hi Jose

Thanks for your answer

PKI DNS suffix is configured in all the Lanless devices I am testing, so they are configured in Admin Control Mode.

So, this shoudn´t be the problem

Regards

Fernando 

[JoseH_Intel]

Hello FFern4,

Thank you for your feedback. Let me research on your issue with our senior team. I will get back to you as soon as I have updates.

Regards

Jose A.

Intel Customer Support Technician

[JoseH_Intel]

Hello FFern4,

Could you please try the following steps:

1. Update to the latest AMT driver. It does not look like you are on the latest one.
2. Please confirm that you have in fact enabled wireless profile sync in the EMA profile
3. Please review "C:\windows\syswow64\gms.log" to check if profiles are being synced. Also, attach to the case if you are still having issues, so we can review.

We will look forward to your updates

Regards

Jose A.

Intel Customer Support Technician 

[FFern4]

Hi

Find attached the gms.log file. It seems that WiFi profiles are incorporated to the ME, but they don´t appear in the network settings of the PC 

Find also attached the file CIM_WiFiEndpointSettings.txt. It shows the output of the WSMAN query CIM "CIM_WiFiEndpointSettings". It includes only the WiFi profile Pleiades. This profile appears because it has been configured in the Intel EMA AMT Profile for the group the PC has been assigned. See image below

You can see through the IMC integrated in Intel EMA, that only the WiFi Profile Pleiades is available in the network settings

I have just update the BIOS and ME engine to the last FW available version, 12.0.81. Other older devices with FW version 11.x have the same behaviour

I have removed some WiFi networks ("Cursos") and added again, but the WiFi Profile is not showed

You can see device is provisoned in admin mode

Don´t hesitate to contact me if you need any further information

Thanks in advance

Fernando Fernandez

[JoseH_Intel]

Hello FFern4,

Thank you very much for the logs provided. Please allow us a bit of time so we can analyze them and we will let you know soon.

Regards

Jose A.

Intel Customer Support Technician

[JoseH_Intel]

Hello FFern4,

Unfortunately, it doesn't look like our development team can root caused the wireless sync issue based on the error message in the log.

Could you please verify that you are not using 802.1x? 802.1x can't sync

Please go ahead and forget the network and see if reading it makes a difference.

Reduce password complexity and try. Test with something like P@ssw0rd to see if that makes a difference.

I will look forward to your updates

Regards

Jose A.

Intel Customer Support Technician

[FFern4]

Hi

I can confirm I am not using 802.1x networks

I have tested changind the password to a "simple" password, and the behaviour is the same: the wifi user profile is really created, but it is void. 

You can see  below the query of the wsman class "CIM_WiFiEndpointSettings". There is a item OK, it has been created by Intel EMA agent, and several items "void". Those items are added when I add a new WiFi network in Windows. It seems the system creates a WiFi profile, but the fields are not filled properly.

With the powershell SDK, using the class AMT_WiFiPortConfigurationService and the method DeleteAllUserProfiles(), those "void" profiles are deleted. So, it seems the problem is not that the profiles are not created, it is that they are created incorrectly 

Regards

[JoseH_Intel]

Hello FFern4,

Thanks you very much for the updates. Please let me research on this. I will get back to you soon.

Regards

Jose A.

Intel Customer Support Technician

[JoseH_Intel]

Hello FFern4,

After additional review, we found that pre-existing profiles are designed to sync automatically. However, if the expectation is that a new profile created in Windows will automatically be added to EMA then such functionality does not exist. EMA does not automatically pull windows wireless profiles and sync them. The new Windows profile must be created in EMA then it is able to automatically sync it if there are any changes.

Regards

Jose A.

Intel Customer Support Technician

[FFern4]

Hi Jose

I am pretty sure I have seen working this feature some years ago. In Windows 7, when I connected to a new WiFi network in Windows, a pop-up window appeared asking if I wanted to sync this WiFi network with AMT. The user profile was created with the proper information of the WiFi network.

As far I have verified now, the new AMT WiFi user profile is created, but it is created with no information

Anyway, the pre-existing profiles are not sync properly. All the user profiles are always void.

This feature is really needed now as many people are working at home, and it is not possible to ask them for the SSID and password of its home wifi networks. Even if it was possible, it would be really difficult to handle hundred or thousand of different wifi networks

Could it depend on the OEM? I have checked Intel NUC, HP and Lenovo PC´s (ME 11.x or greater) and all of them fails

What solution do you suggest?

Regards

Fernando

[JoseH_Intel]

Hello FFern4,

If you say you see this wifi profile autosync feature some years ago, probably you are referring to the previous Intel SCS software. EMA was released about 1 year ago and it takes advantage of the AMT features on the remote systems but the management console functionality is different.

If you look at the Intel SCS user guide page 111 it refers to the Wireless Profile Synchronization feature which is what you are probably remembering. https://www.intel.com/content/dam/support/us/en/documents/software/Intel_SCS_User_Guide.pdf#page=118

Regards

Jose A.

Intel Customer Support Technician

[FFern4]

Hi Jose

I think the Wireless Profile Synchronization is more a feature of AMT devices (Intel Management Engine and Proset Wireless SW) than Intel SCS.

There is a parameter in the AMT devices that allows to enable/disable the local Profile Synchronization. This parameter can be modified using the AMT SDK utilities, without Intel SCS

Class AMT_WiFiPortConfigurationService

Used in features: Wireless
Compatible with the following Intel AMT Releases: 4.0, 6.0, 6.1, 6.2, 7.0, 8.0, 8.1, 9.0, 9.5, 10.0, 11.0

localProfileSynchronizationEnabled

public uint32 localProfileSynchronizationEnabled

General Information:
Administrator's policy regarding enablement of local profile synchronization.Remote profile synchronization is always enabled.

Product Specific Usage:
Additional Notes:
1) 'localProfileSynchronizationEnabled' is only supported in Intel AMT Release 6.0 and later releases.

Qualifiers:
-------------
ValueMap={0, 1..2, 3, 4..}
Values={Local synchronization disabled, Vendor Reserved, Unrestricted synchronization, Reserved}

In the Intel AMT Implementation and reference guide you can also find:

User profiles are created by the PC user on the host system or are defined there by an IT script or installation procedure. When a user takes an action to synchronize the current profile with Intel AMT, the wireless driver transfers the profile and Intel AMT saves it as a user profile.

•   IT/Admin profiles  are defined by an IT administrator for use inside the enterprise.

•   User profiles are wireless profiles that are typically set by the end user while connecting to wireless network.

•   Releases before 6.0 (2.5/6 and 4.x) support a maximum of 16 profiles.

In the other hand, it is easy to find searching in Google, questions about how disable the "annoying Intel Active Management Technology Profile Synchronization prompt". You can see below the kind of pop-up window that asked about the wifi profile synch. I am pretty sure that people had not an Intel SCS installed and working, they just had AMT provisioned in the PC. This feature is related to the AMT device more than SCS

Anyway, when you configure an AMT profile in EMA, in the WiFi item, you can select the option Synchronize with host platform WiFi profiles.  What does it mean? It is not for activating the synchronization between the AMT wifi profiles and the windows wifi networks?

Regards

Fernando

[FFern4]

Hi Jose

One more thing: I have been searching in my records, and I have found  documention about a webinar about Intel EMA. It is said that Wifi Profiles are synced to Intel AMT when new WiFi networks are joined in the OS

Regards

Fernando

[JoseH_Intel]

Hello FFern4,

Thank you for the comprehensive feedback. By any chance do you have the whole pdf document or URL so we can access it and check? In the image attached it only says AMT so it is difficult to correlate it with EMA.

Either way I will confirm the info provided with our senior team

Regards

Jose A.

Intel Customer Support Technician

[FFern4]

Hi Jose

The image is an screenshot obtained from the curse

"The Intel vPro® Platform Presents Manageability: An Introduction to Intel® Endpoint Management Assistant (Intel® EMA)", at 14:18

You can see it is a training course from the Intel Partner University

Regards

Fernando

[JoseH_Intel]

Hello FFern4,

Could you tell if you have ever ran Proset on these systems or if you are now? There have been some sightings now where Proset is causing issues with the Windows driver. We will need to remove Proset artifacts from the registry if there is any history of that SW on the system.

Also, do you have any idea of how often you are expecting the syncing to occur? AMT only has 16 profiles whereas Windows has some 100 profiles. AMT uses the latest 16 profiles and evicts ones older than that, if you are trying to sync more than 16 profiles then we may be seeing a natural limitation of AMT.

I will look forward to your updates

Jose A.

Intel Customer Support Technician

[FFern4]

Hi Jose

I have the latest driver version available, 22.50.1.1

According to the following Intel support web page

Do I Need to Install Intel® PROSet/Wireless Software on a...

Starting with release version 20.120 on Windows® 10, a driver-only installation package is provided on Download Center.

and

Your wireless adapter doesn't require the Intel® PROSet/Wireless Software on Windows® 10. As such, we don't recommend installing the Intel® PROSet/Wireless Software on Windows® 10 unless you meet the criteria outlined in the exceptions below.

and

• "Profile Sync" optional functionality (only applicable with Intel® vPro™ systems).

is one of the exceptions

We recommend that you get the Intel® PROSet/Wireless Software from your system manufacturer, however, you may also get the Intel® PROSet/Wireless Software from the IT Administrator Download.

If you go to the download URL, there is no Intel proset app available for Windows 10. The latest download available for Proset, WiFi_21.40.5 Proset SW, is only for Windows 7 and Windows 8.1. You cannot install it on Windows 10

For Windows 10, I only find drivers available for downloading. I don´t know if the drivers have any proset feature included or not

Related about how often I am expecting the syncing to occur, I am testing with just a few WiFi networks. I have deleted all the known WiFi networks, and just added 2-3  WiFi networks to Windows 10.

As I commented before, If I query the wsman class "CIM_WiFiEndpointSettings", new items are created in the PC, but they are void. It seems the comunication between Windows 10 and the AMT engine is not working fine, and the configuration  parameters of the WiFi profiles are not properly passed to the AMT Management Engine

Regards

Fernando