vPro provisioning failing on new Optiplex 7070's

[THoob]

We received new Dell Optiplex 7070's and have been having issues trying to provision the new devices. When running the ACUConfig utility I get a code 78 error.

2019-11-18 16:05:24:(ERROR) : ACU Configurator, Category: Exit: ***********Exit with code 78. Details: Failed to put Intel(R) AMT into the "In Provision" state. The Start Configuration operation failed. Examine the Intel MEBX settings to make sure that remote configuration is enabled, or a TLS PSK pair is defined. AMT Status code - An internal error has occurred in the Intel(R) AMT device. This might indicate an interface error, or an application error.  

[THoob]

I am using the following command to provision:

.\ACUConfig.exe /Output File "C:\VPSA_Support\Logs\Intel_vPro_Provisioning.log" ConfigViaRCSOnly servername Profile3 /AbortOnFailure /AdminPassword admin /RCSBusyRetryCount 2

[THoob]

I know it still has the default pass because I can login to the MEBx and it immediately prompts for me to update the password.

I also know that AMT is enabled since BIOS > Manageability > Intel AMT Capability is set to enabled.

I have also tried reprovisioning an older Optiplex 7060 without issue.

I am running the latest 12.1.0.87.

[JoseH_Intel]

Hello THoob,

Thank you for joining the community

May I ask if you have TLS enabled on the 7070 system? AMT v12 is TLS 1.2 compatible only because of security reasons. Older systems AMTv11 and earlier are TLS 1.0 compatible so if this an existing integration you might get rejected because of TLS compatibility.

We will look forward for your updates

Jose A.

Intel Customer Support Technician

A Contingent Worker at Intel

[THoob]

I'm not sure how you check for this. Is it in the MEBx or in Windows?

[THoob]

I have also tested with my previous v12.0 acuconfig and have the same result of code 78. This makes me think it's more likely a computer issue rather than a problem with 12.1.

[JoseH_Intel]

Hello THoob,

Could be check on either of them. If you do more testing with a different computer let us know the outcome

Jose A.

Intel Customer Support Technician

A Contingent Worker at Intel

[THoob]

Ok, I have tested with a second Optiplex 7070 and I am having the same issue.

I remember a similar issue we had with our Micros 650 registers.

In that case I went into the MEBx, went into AMT Configuration, and enabled "Activate network access".

That worked on the Micros registers however even that is not fixing this issue.

I still get the same error, "Failed to put Intel(R) AMT into the "In Provision" state."

[THoob]

I have now tested with one of our Optiplex 7060's without issue.

I did a full unprovision in MEBx and then used the latest 12.1 acuconfig to reprovision.

It succeeded.

[THoob]

No, no, please don't mark this as answered. I haven't fixed anything yet. It's still broken. I tested the latest vPro on a known good Optiplex 7060. Those have always worked. However the provisioning still fails on the new Optiplex 7070's, both with 12.0 and 12.1 acuconfig.

[JoseH_Intel]

Hello THoob,

I apologize. I misunderstood and marked the thread as resolved. By any chance have you tried any alternate provisioning method other than the ACUconfig? Using the same ACUconfig it will allow you to create a bootable USB drive that should provision the system too. Accessing MEBx should let you to create a profile and provision too.

Jose A.

Intel Customer Support Technician

A Contingent Worker at Intel

[THoob · Accepted solution]

Ok, I have figured out my problem.

Short story:

The Intel Management Engine Driver was not installed.

Long story:

Last week we made a change to group policy that removed the option to check online for Windows updates. We were getting people circumventing our WSUS server and installing 1903. Within a few days we found that this setting was blocking the computers from contacting Microsoft servers at all, including for drivers. This meant a bunch of our newly provisioned computers, like Optiplex 7070's, were not able to install drivers because they had no source for drivers. We removed the policy change and newly provisioned computers were getting drivers again. However what compounded the problem was that I did my testing on a machine plugged into a jack that does not have internet access. I knew this, but at the time I was fairly certain that the computer did not need internet access to provision vPro which I still believe is accurate but what it did need was internet access to get the missing driver. Once I moved it back over to a jack with internet access it grabbed a driver and then I was able to provision vPro without issue.

Thank you for your time Jose!

This forum has always been very helpful for me.

-THoob