Trouble using Agent Presence

JHall9 · ‎01-12-2018

system

HP ProDesk 600 G3 SFF

ram: 4gb

OS: Windows 10 Pro ver. 1709

build 16299.125

AMT release 11.6.12.1201

Two issues

1) unable to use manual or usb key configuration to set admin mode

2) unable to set expiration action on host machine when using agent presence

background

Have used SCS software to configure for client control mode.

Used AMT SDK HLAPI software samples to remotely create agent, display agent info, detect

when agent is running, stopped, expired. Used local samples 1 and 2 to start and stop/expire.

Additionally tested power changes: power on, power off successfully.

When trying to call SetExpirationActionOnAgentPresenceWatchDog function, fails at

SetExpirationAction (message simply says failed to set expiration action).

Does this require admin configuration as opposed to client control?

Would like to have Admin Control Mode, so have been attempting to set configuration using

usb key, albeit unsuccessfully. Setting up of the usb works using the SCS software, but

nothing happens when booting, (no prompt for whether to provision) no configuration

happens when booting with the usb plugged in.

When booting and pressing CTRL-P, no entry to MEBX menu. There is a ME setup in the BIOS

menu, but no options for changing the AMT configuration.

Dariusz_W_Intel · ‎01-15-2018

Def-Logix_Developer,

with 7th Gen Intel Core vPro intel introduced requirement for OEM BIOS to include USB provisioning setting and its factory default value shall be set to Disabled.

With previous Gen Intel Core vPro it was OEM discretionary decision to include such option or not. HP BIOS in vPro systems had it since I can remember (ie. all 11 years of Intel vPro technology history).

With recent BIOS'es some OEM also introduced other MEBx FW controls like MEBx menu access or MEBx entry key sequence prompt visibility.

You may also like to check Intel® vPro™ Use Case Reference Design - Local Setup and Configuration Using a USB Flash https://downloadcenter.intel.com/download/20979 https://downloadcenter.intel.com/download/20979

you will need USBFile.exe utility from Intel AMT SDK from http://software.intel.com/en-us/articles/download-the-latest-intel-amt-software-development-kit-sdk http://software.intel.com/en-us/articles/download-the-latest-intel-amt-software-development-kit-sdk

Please check those OEM BIOS options to enable USB provisioning support and/or MEBx menu entry/prompt.

Please note also that HP BIOS on notebooks use F6 key as alternative entry to MEBx BIOS menu.
If your PC is already configured (any mode) USB provision attempts will be rejected -with MEBx message about "...Configuration flow error, system is already provisioned".

You have to fully un-provision Intel AMT first and then use USB to provision it again to Admin Control Mode.

You can unprovision Intel AMT :
- from MEBx - via Unconfigure Network Access > Full Unprovision MEBx menu option. See http://h10032.www1.hp.com/ctg/Manual/c03975296 http://h10032.www1.hp.com/ctg/Manual/c03975296 HP MEBX/AMT user guide.
  
  If first configuration was done to Client Control Mode - MEBx password may still be factory default "admin" and you will have to define strong (8-32 + 4 of 4) new MEBx Password first. Please remember this new MEBx Password as you need to use it as current MEBx password when creating USB configuration file.
  
  NOTE- MEBx keyboard layout is always US one regardless of actual physical keys layout.
- via Intel Configurator -ACU utility (from Intel SCS Configurator folder) running it as local administrator with following command ACUConfig.exe Unconfigure /Full or ACUWizard GUI executed as local administrator.
  
  Note -if system will be configured into Admin Control Mode - you will have to know current AMT Digest Administrator password and use following command
  
  ACUConfig.exe Unconfigure /AdminPassword /Full
  
  Note! -both above AMT un-configuration methods do not change/reset current MEBx password
- reset Intel AMT to full factory defaults via PC board jumper or BIOS setting, or by pressing power button for specified time - it is OEM dependent!
  
  For HP there is Unconfigure AMT option in HP BIOS. Full Intel AMT reset to factory defaults is performed during next POST /reboot.
  
  Note- Intel AMT reset to full factory defaults resets also MEBx Password to its fectory default value ("admin" or other custom one if pre-configured at OEM factory).
There is also ACUConfig.exe MoveToACM /AdminPassword command that allows to "upgrade" Intel AMT from Client to Admin Control mode but it requires more complex environment (Intel SCS RCS server, AMT Provisioning certificate, DHCP server and Intel AMT enabled LAN interface in your vPro systems).

If you asked about USB Provision I assume it is too complex for your needs (so far).

rgds

Dariusz Wittek

Intel EMEA Biz Client Technical Sales Specialist