Re-imaged computer getting "The realm value was used already" error message

[adrianne]

I'm trying to provision a computer that was re-imaged. I ran the merge-duplicate-nodes-v0.9.3.sql script provided in the link below. There's no longer a duplicate computer but this message keeps repeating in the logs, " The realm value was used already". 

Why Are Intel® Endpoint Management Assistant (Intel® EMA)...

[Arun_Intel1]

Hi adrianne,

Greetings!

We see that you are getting an error regards to the realm values being used, after reimaging, even after running the script to delete the duplicate endpoints,

May I know where are you seeing this error and please share the details asked below:

EMA version

Number of Endpoints

Is the endpoint with realm error within the domain or out of band

And please share the troubleshooting steps that you have already tried.

Best Regards

Arun_Intel

[adrianne]

EMA version is 1.13.1.0 and only one client is affected right now cause I'm only in the testing phase. 

[adrianne]

The computer is on the domain. What troubleshooting steps do you want me to do? I ran the duplicate script provided by Intel and it doesn't appear to have worked. We need an automated way to fix re-imaged computers. 

[Arun_Intel1]

Hi adrianne,

Please let us know if you are using self Signed certificate or the third party certificate for the TLS.

Best Regards

Arun_intel

[adrianne]

I'm using a GoDaddy certificate. Provisioning works perfectly fine for new computers, but this one did not work after re-imaging and having a duplicate in the endpoint manager. 

[Suneesh]

Hello Adrianne,

Good day.

We see that you have tested with the SQL script.

As an alternative, we can provide the API script: Remove-DuplicateEndpoints.ps1.

Intel_EMA_API_Sample_Scripts_v1_10\PowerShell\Example Scripts

https://www.intel.com/content/www/us/en/download/19693/30076/intel-endpoint-management-assistant-intel-ema-api-sample-scripts.html

Please run this API script and let us know the outcome.

Looking forward to your update.

Best Regards,

Suneesh_Intel

[adrianne]

Hi Suneesh,

That script did not work. I ran it after re-imaging again, and it deleted the record with the provisioning passwords. Now my endpoint show no passwords even though it was previously provisioned and CIRA shows as not connected. Its also not retrying the provisioning process. How do we fix this?

Thanks,
Adrianne

[Arun_Intel1]

Hi Adrianne,

Greetings!

Please share the ECT logs of the endpoint on which you are getting the realm error, so that we shall go ahead and check for few details and share our next plan of action.

Kindly find the steps to collect the ECT logs given below:

https://www.intel.com/content/www/us/en/download/19805/30485/intel-endpoint-management-assistant-configuration-tool-intel-ema-configuration-tool.html

Installation:

Download and unzip the tool.

Double-click the .msi file and follow the prompts.

Run:

a-Open a command prompt as administrator (alternatively, you can run the tool from Windows PowerShell*).

b-Navigate to the installation folder (default C:\Program Files (x86)\Intel\EMAConfigTool).

c-Run the command: EMAConfigTool.exe --verbose

Best Regards

Arun_Intel

[Arun_Intel1]

Hi Adrianne,

Greetings!

This is a gentle reminder to know if you were able to collect the details, which was required for further analysis.

Best Regards

Arun_intel

[Arun_Intel1]

Hi Adrianne,

Greetings!

Please feel free to contact us for any further query!

Best Regards

Arun_intel

[adrianne]

Sorry I was on PTO. Attached are the logs. I removed any sensitive information from them. 

[Arun_Intel1]

Hi Adrianne,

Greetings!

Thanks for sharing the ECT logs,

1. Please select "stop managing" of the endpoint, in the Intel EMA Console.
2. Fully unprovision the endpoint, through MEBx

1. Log into MEBx (default password = admin)
   1. For accessing MEBx, please refer to OEM guidance (Usually restart the laptop and press ctrl+P and if does not work please try ctrl+alt+F1)
   2. If first time logging in, the password change is required
2. Intel® AMT Configuration -> Remote Setup and Configuration -> TLS PKI -> PKI DNS Suffix
   1. If PKI DNS Suffix menu is not available, then AMT is currently configured
   2. Go back to Intel® AMT Configuration -> Unconfigure Network Access -> Full Unprovision

3.Then Re-provision the endpoint and then share your observation.

Best Regards

Arun_intel

[adrianne]

Hi Arun,

I know how to unprovision a computer. This does not solve my problem and why I posted this question. How do I fix a duplicate computer after reimaging? Are you saying that the scripts provided by Intel don't work? Is there another way to automate this fix or will it always be a problem with a manual fix required? We reimage computers constantly so we'd like a way to automatically fix this. I cannot move forward with using Intel EMA at my company until we have answers on these issues.  

Thanks,
Adrianne

[Arun_Intel1]

Hi Adrianne,

Greetings!

Thanks for providing us the insight!

We would like to inform you that Intel encourages the customer to unprovision the endpoints before re-imaging them as the official procedure. Alternatively, customers can use the API script; if this option does not comply with the requirements, we would suggest the SQL query.

 As a test, we would suggest you to unprovision the endpoint from MEBx and reprovision the machine.

 Then, re-image the machine and finally test the API script.

Best Regards

Arun_intel

[adrianne]

 "As a test, we would suggest you to unprovision the endpoint from MEBx and reprovision the machine.

 Then, re-image the machine and finally test the API script."

I've already done this as requested previously in this thread. It did not work. Neither the API script or SQL script worked. Both scripts resulted in the computer duplicates being merged, but provisioning the computer then fails. The only fix is to manually unprovision the computer. If there are no other ways to fix this we will probably not be able to use Intel EMA.

[pujeeth]

Hi Adrianne,

Greeting's!

This is the first follow-up regarding the issue you reported to us.

We wanted to inquire whether you had the opportunity to review the plan of action (POA) we provided.

Feel free to reply to this email, and we'll be more than happy to assist you further.

Regards,

Pujeeth

Intel Customer Support Technician

intel.com/vPro

[pujeeth]

Hi Adrianne,

Greeting's!

The API and SQL scripts have been tested and they work. To better understand the issue, please do the following troubleshooting and send us the logs.

First, Stop managing a known duplicate endpoint from the EMA console (erase all the lines related to the same endpoint).

Uninstall the EMA agent file. (Open the Intel® EMA Agent Installer tool and hit the Uninstall icon).

Restart the endpoint, access MEBx and do a Full Un-provision.

Make sure, the BIOS and the Management Engine driver is up to date.

Add the AMT Certificate domain in the PKI DNS suffix field.

Install from scratch a new EMA Agent file (Admin Control Mode).

Restart the endpoint, wait for about 3 to 4 minutes.

Run the Intel® Endpoint Configuration Tool (ECT) and send us the log.

Then, return to the EMA server.

Gather the EMA server logs.

EMA logs from the Server

Default Path:[System Drive]\Program File(x86)\Intel\Platform Manager\EmaLogs

Please send us the files without the date called:

EMAlog-Webserver.txt

EMAlog-Swarmserver.txt

EMAlog-Ajaxserver.txt

EMAlog-Manageabilityserver.txt

Finally, reinstall the OS and send us an screenshot of what you see from the EMA console (duplicate lines of the same endpoint).

Regards,

pujeeth

Intel Customer Support Technician

Intel.com/vPro

[pujeeth]

Hi Adrianne,

Greeting's!

This is the first follow-up regarding the issue you reported to us.

We wanted to inquire whether you had the opportunity to review the plan of action (POA) we provided.

Feel free to reply to this email, and we'll be more than happy to assist you further.

Regards,

Pujeeth

Intel Customer Support Technician

intel.com/vPro

[pujeeth]

Hi Adrianne,

Greeting's!

This is the second follow-up regarding the issue you reported to us.

We wanted to inquire whether you had the opportunity to review the plan of action (POA) we provided.

Feel free to reply to this email, and we'll be more than happy to assist you further.

Regards,

Pujeeth

Intel Customer Support Technician

intel.com/vPro