New EMA installation. Provisioning not working.

[JoeGuitar]

Hello.  First post here.  We have just set up and installed an EMA server with the latest version.

I was able to create Users and an Endpoint Group, but when I run the AMT Profile on the endpoint, it doesn't show up in the Endpoint Group.  I've tested this on a couple of different models (We are running Lenovo).

I'm looking for some basic first steps to troubleshoot this issue.  Any advice is greatly appreciated.

[Arun_Intel1]

Hi JoeGuitar,

Greetings!

We see that you have installed the latest EMA version and have created the endpoints, but the AMT provisioned is not seen on the endpoints.

Please refer to the EMA installation Guide given below :

https://www.intel.com/content/dam/support/us/en/documents/software/manageability-products/intel-ema-server-installation-and-maintenance-guide.pdf

If the issue still persists,

Please confirm the mode of configuration of EMA, the version of EMA and the AMT, and also kindly share the screen shots if any.

Best Regards

Arun_Intel

[JoeGuitar]

Hello Arun.  Thank you for the reply.  I will continue to look through the installation guide, but I believe the problem may go beyond what is listed there.

• The EMA version is v1.13.1.0
• The Activation method I am attempting to use is Host Based Provisioning  (we have certificates but that method does not show up as available for some reason)
• The AMT version on one of my test computers is 12.0.90 (ThinkCentre M920q - MT 10RR)

There are also some .NET errors in the event viewer on the server which may be an issue.  Perhaps you have some recommendations on that?  So far I have tried repairing .NET and repairing the EMA install to no avail. 

The errors are in the Application log, Source Application Error 1000 and .NET Runtime 1026.  Do you have any suggestions on how to troubleshoot this?  Thank you.

[Arun_Intel1]

Hello, JoeGuitar,

I hope you are doing well.

The EMA console is not showing the endpoints provisioned in Client Control Mode and you are receiving .Net errors from the event viewer.

Please share the EMA server logs. They show the provisioning details. In addition, please share the EMA installation log, it will provide the installation issues. Finally, please run the EMA configuration tool on the endpoint, it provides the provisioning status of the endpoint.

To better understand your environment, please share the information below:

Server OS version:

SQL version (SQL Enterprise or SQL) and year:

Location of both (physical or virtual), same server or not:

Did you install IIS on the server machine?

Location of the endpoints, same LAN of the server or they are remote.

Did you buy a vPRO Certificate chain with the Intel® OID number 2.16.840.1.113741.1.2.3?

1-EMA logs from the Server

Default Path:[System Drive]\Program File(x86)\Intel\Platform Manager\EmaLogs

Please send me the files without the date called:

EMAlog-Webserver.txt

EMAlog-Swarmserver.txt

EMAlog-Ajaxserver.txt

EMAlog-Manageabilityserver.txt

2-Installation log path:

<Installer Directory>/EMALog-Intel EMAInstaller.txt

3-Intel® EMA Configuration Tool (ECT)

https://www.intel.com/content/www/us/en/download/19805/30485/intel-endpoint-management-assistant-configuration-tool-intel-ema-configuration-tool.html

Installation:

Download and unzip the tool.

Double-click the .msi file and follow the prompts.

Run:

a-Open a command prompt as administrator (alternatively, you can run the tool from Windows PowerShell*).

b-Navigate to the installation folder (default C:\Program Files (x86)\Intel\EMAConfigTool).

c-Run the command: EMAConfigTool.exe --verbose

Please make sure the Server and endpoint (s) are using the latest OS, BIOS, and driver updates. This is an Intel® EMA suggestion for newer configurations.

If privacy is a concern, I can create a case and send an email. I look forward to hearing back from you. 

Best Regards

Arun_Intel

[Arun_Intel1]

Hi JoeGuitar,

Greetings!

This is a first follow up, please confirm if you were able to execute the plan of action, if yes, kindly share your obervation.

Best Regards

Arun_Intel

[JoeGuitar]

Hello Arun.  Sorry for my late reply.  First of all...  I REALLY appreciate this help!   I have been very busy with some other pressing issues.  Starting this week I am on vacation, returning on the 16th.

Even so, I may have some time to get this information to you before then.  Please be patient and I will get it all done asap.  I am looking forward to getting this resolved.  I should be able to take a few minutes to get this information posted over the next few days. 

Thank again, and I will post the info soon.

[Arun_Intel1]

Hi JoeGuitar,

Greetings!

Thanks for the update, we shall wait for your reply.

Best Regards

Arun_Intel

[JoeGuitar]

Hello Arun,

Here is the information I have so far.

EMA version : EMA_Install_Package_1.12.2.0.exe

Server OS version:

Windows Server 2022 21H@ Build 20348.2582

SQL version (SQL Enterprise or SQL) and year:

Microsoft Internet Information Services 10.0.20348.1

Location of both (physical or virtual), same server or not:

Both server and IIS are running on same VM

Did you install IIS on the server machine?

Yes, IIS is installed on the server VM

Location of the endpoints, same LAN of the server or they are remote.

Endpoints are on the same LAN

Did you buy a vPRO Certificate chain with the Intel® OID number 2.16.840.1.113741.1.2.3?

I am awaiting a response from another IT colleague.  having said that, 3 certs were provided:

1. DigiCertCA.crt

2. rdmtema_vancouver_ca.crt

3. TrustedRoot.crt

1-EMA logs from the Server

Default Path:[System Drive]\Program File(x86)\Intel\Platform Manager\EmaLogs

Please send me the files without the date called:

EMAlog-Webserver.txt

EMAlog-Swarmserver.txt

EMAlog-Ajaxserver.txt

EMAlog-Manageabilityserver.txt

Log files are attached

2-Installation log path:

<Installer Directory>/EMALog-Intel EMAInstaller.txt

C:\Ema Install Package 1.13.1.0

3-Intel® EMA Configuration Tool (ECT)

https://www.intel.com/content/www/us/en/download/19805/30485/intel-endpoint-management-assistant-configuration-tool-intel-ema-configuration-tool.html

Installation:

Download and unzip the tool.

Double-click the .msi file and follow the prompts.

Run:

a-Open a command prompt as administrator (alternatively, you can run the tool from Windows PowerShell*).

b-Navigate to the installation folder (default C:\Program Files (x86)\Intel\EMAConfigTool).

c-Run the command: EMAConfigTool.exe --verbose

Tool was run and file attached

Please make sure the Server and endpoint (s) are using the latest OS, BIOS, and driver updates. This is an Intel® EMA suggestion for newer configurations.

All endpoints using the latest BIOS and driver updates.  Endpoints are running Windows 10 Version 22H2 OS build 19045.4651

[vij1]

Hello JoeGuitar,

Thank you for your reply and for providing the EMA server logs.

Upon review, it appears that the ECT logs provided belong to the server. We kindly request that you share the ECT logs from one of the endpoints.

Additionally, after further reviewing the case, we noticed that some information is still pending:

Are you using SQL Enterprise or SQL Express? Please note that Intel® EMA supports SQL 2017 or higher.

For more details, you can refer to section 1.3.3 of the Database in the Intel® EMA Server Installation and Maintenance Guide.

https://www.intel.com/content/dam/support/us/en/documents/software/manageability-products/intel-ema-server-installation-and-maintenance-guide.pdf

Looking forward to your response.

Regards,

Vijay N.

[JoeGuitar]

Hi Vijay,

The reason I provided the logs from the server is because that is what Arun asked me for.  (see that post from 07-31-2024 03:03 PM)

The SQL version we are using is SQL 2019 Enterprise.

If you need logs from an endpoint please indicate which log files and where they are located and I will upload them.

Thanks,

Joe

[JoeGuitar]

Hello Vijay,

I have run the ECT again on an endpoint and the attached was the output.  I hope this helps.

Thanks,

Joe

[vij1]

Hello JoeGuitar,

I am following up on the case and wanted to inquire whether you had the opportunity to review the plan of action (POA) we provided.

Feel free to reply to this email, and we'll be more than happy to assist you further.

Regards,

Vijay N.

[Arun_Intel1]

Hello JoeGuitar,

Greetings!

I am following up on the case and wanted to inquire whether you had the opportunity to review the plan of action (POA) we provided.

Feel free to reply to this email, and we'll be more than happy to assist you further.

If there is no reply from your end, we shall go ahead get this case closed at the end of the day.

Best Regards,

Arun_Intel

[JoeGuitar]

Hi Arun.  I was out of the office for a couple of weeks.  Back now.  Please do not close the case.  We don't have a resolution yet.

[Arun_Intel1]

Hello JoeGuitar,

Greetings!

Could you send us a new set of EMA Server logs?

They are located at [System Drive]\Program File(x86)\Intel\Platform Manager\EmaLogs

Please send me the files without the date.

EMAlog-Webserver.txt

EMAlog-Swarmserver.txt

EMAlog-Ajaxserver.txt

EMAlog-Manageabilityserver.txt

Best Regards

Arun_Intel

[JoeGuitar]

.

[Arun_Intel1]

Hi JoeGuitar,

Greetings!

Hi CU,

Thank you for sharing the ECT and EMA Server logs.

EMA Server logs came almost empty and noticed from the ECT the certificate chain is SHA256.

Do you mind creating a new installation of EMA? Please install IIS (Microsoft Internet Information Services) and the SQL 2019 Enterprise before installing EMA.

Create the Endpoint group in Client Control Mode, we want to confirm the connection between the endpoint and the server first. Then, we can continue with the Admin CM provisioning with the vPRO Certificate chain. This Cert chain is different from standard SSL/TLS certs. It is SHA256 and has the unique OID number 2.16.840.1.113741.1.2.3.

You can buy it from our Authorized vendors:

https://www.intel.com/content/www/us/en/architecture-and-technology/vpro/active-management-technology/implementation.html (go to the bottom of the page).

If you are trying to provision the endpoints remotely, the FQDN of the EMA server (same as the Certificate chain domain) needs to match the domain of your company DHCP option 15. If not, the domain of the Cert chain needs to be included manually in the PKI DNS suffix field of every endpoint.

Best Regards

Arun_Intel

[JoeGuitar]

Thanks Arun.  I will give that a try.  For now, can you please delete all of the attachments I have uploaded?

Thanks again

Joe

[Arun_Intel1]

Hello JoeGuitar,

Greetings!

Sure, we have deleted the logs, meanwhile we can create a new case and continue the conversation on email. if yes kindly acknowledge so that we can create a new case and share the case id so that we can continue the conversation through the email.

Best Regards

Arun_Intel

[JoeGuitar]

Hi Arun.  For now please close this case.  I will open a new case in future if necessary.

I will also be getting some help from an Intel rep here in Canada this week so we should be okay for now.  Thanks again.

[Arun_Intel1]

Hello JoeGuitar,

Sure, we shall go ahead and get this case closed.

Please reach out to us for any further assistance, we are more than happy to assist you!

Best Regards

Arun_Intel