Struggling with getting a test client to provision. We are using our own provision server certificate from our Enterprise CA (Dev) amtopmgr.log AMT Discovery Worker: Wakes up to process instruction files SMS_AMT_OPERATION_MANAGER 19/07/2011 8:37:18 a.m. 2560 (0x0A00) AMT Discovery Worker: Reading Discovery Instruction C:\Program Files\Microsoft Configuration Manager\inboxes\amtopmgr.box\disc\{C7B611FF-9E7C-4599-899F-DEEE3FC92A56}.RDC... SMS_AMT_OPERATION_MANAGER 19/07/2011 8:37:18 a.m. 2560 (0x0A00) AMT Discovery Worker: Execute query exec AMT_GetThisSitesNetBiosNames NULL, 'GUID:95C4CB68-256F-4AC8-91FF-4D510ED9DDE8', 'DEV' SMS_AMT_OPERATION_MANAGER 19/07/2011 8:37:18 a.m. 2560 (0x0A00) AMT Discovery Worker: CSMSAMTDiscoveryWorker::RetrieveInfoFromResource - Found machine WL00012 (WL00012.devtranzrail.co.nz), ID: 254 - 10.160.193.11 from Resource GUID:95C4CB68-256F-4AC8-91FF-4D510ED9DDE8. SMS_AMT_OPERATION_MANAGER 19/07/2011 8:37:18 a.m. 2560 (0x0A00) AMT Discovery Worker: Execute query exec AMT_GetAMTMachineProperties 254 SMS_AMT_OPERATION_MANAGER 19/07/2011 8:37:18 a.m. 2560 (0x0A00) AMT Discovery Worker: Execute query exec AMT_GetProvAccounts SMS_AMT_OPERATION_MANAGER 19/07/2011 8:37:18 a.m. 2560 (0x0A00) AMT Discovery Worker: Finish reading discovery instruction C:\Program Files\Microsoft Configuration Manager\inboxes\amtopmgr.box\disc\{C7B611FF-9E7C-4599-899F-DEEE3FC92A56}.RDC SMS_AMT_OPERATION_MANAGER 19/07/2011 8:37:18 a.m. 2560 (0x0A00) AMT Discovery Worker: Parsed 1 instruction files SMS_AMT_OPERATION_MANAGER 19/07/2011 8:37:18 a.m. 2560 (0x0A00) AMT Discovery Worker: There are 1 tasks in pending list SMS_AMT_OPERATION_MANAGER 19/07/2011 8:37:18 a.m. 2560 (0x0A00) AMT Discovery Worker: Send task to completion port SMS_AMT_OPERATION_MANAGER 19/07/2011 8:37:18 a.m. 2560 (0x0A00) Auto-worker Thread Pool: Current size of the thread pool is 1 SMS_AMT_OPERATION_MANAGER 19/07/2011 8:37:18 a.m. 2560 (0x0A00) AMT Discovery Worker: 1 task(s) are sent to the task pool successfully. SMS_AMT_OPERATION_MANAGER 19/07/2011 8:37:18 a.m. 2560 (0x0A00) STATMSG: ID=7203 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_AMT_OPERATION_MANAGER" SYS=HOLLYWOOD-DEV SITE=DEV PID=1772 TID=2560 GMTDATE=Mon Jul 18 20:37:18.341 2011 ISTR0="1" ISTR1="0" ISTR2="0" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0 SMS_AMT_OPERATION_MANAGER 19/07/2011 8:37:18 a.m. 2560 (0x0A00) Auto-worker Thread Pool: Work thread 5072 started SMS_AMT_OPERATION_MANAGER 19/07/2011 8:37:18 a.m. 5072 (0x13D0) AMT Discovery Worker: Wait 20 seconds... SMS_AMT_OPERATION_MANAGER 19/07/2011 8:37:18 a.m. 2560 (0x0A00) AMT Discovery Worker: Wakes up to process instruction files SMS_AMT_OPERATION_MANAGER 19/07/2011 8:37:18 a.m. 2560 (0x0A00) AMT Discovery Worker: Wait 20 seconds... SMS_AMT_OPERATION_MANAGER 19/07/2011 8:37:18 a.m. 2560 (0x0A00) AMT Discovery Worker: Wakes up to process instruction files SMS_AMT_OPERATION_MANAGER 19/07/2011 8:37:38 a.m. 2560 (0x0A00) AMT Discovery Worker: Wait 20 seconds... SMS_AMT_OPERATION_MANAGER 19/07/2011 8:37:38 a.m. 2560 (0x0A00) CAMTDiscoveryWSMan::DoConnectToAMTDevice: Failed to establish tcp session to 10.160.193.11:16993. SMS_AMT_OPERATION_MANAGER 19/07/2011 8:37:39 a.m. 5072 (0x13D0) AMT Discovery Worker: Wakes up to process instruction files SMS_AMT_OPERATION_MANAGER 19/07/2011 8:37:58 a.m. 2560 (0x0A00) AMT Discovery Worker: Wait 20 seconds... SMS_AMT_OPERATION_MANAGER 19/07/2011 8:37:58 a.m. 2560 (0x0A00) Server unexpectedly disconnected when TLS handshaking. SMS_AMT_OPERATION_MANAGER 19/07/2011 8:38:01 a.m. 5072 (0x13D0) **** Error 0x528b4ec returned by ApplyControlToken SMS_AMT_OPERATION_MANAGER 19/07/2011 8:38:01 a.m. 5072 (0x13D0) CSMSAMTDiscoveryTask::Execute - DDR written to C:\Program Files\Microsoft Configuration Manager\inboxes\auth\ddm.box SMS_AMT_OPERATION_MANAGER 19/07/2011 8:38:09 a.m. 5072 (0x13D0) Auto-worker Thread Pool: Succeed to run the task . Remove it from task list. SMS_AMT_OPERATION_MANAGER 19/07/2011 8:38:09 a.m. 5072 (0x13D0) I have added the Root CA hash to the MEBx in the bios The client says its provisioned oobmgmt.log ON SCHEDULE OOBMgmt 18/07/2011 4:21:32 p.m. 5648 (0x1610) BEGIN oobmgmt 18/07/2011 4:21:32 p.m. 5648 (0x1610) !! Device is already provisioned oobmgmt 18/07/2011 4:21:32 p.m. 5648 (0x1610) END oobmgmt 18/07/2011 4:21:32 p.m. 5648 (0x1610) ON SCHEDULE OOBMgmt 18/07/2011 5:21:32 p.m. 4348 (0x10FC) BEGIN oobmgmt 18/07/2011 5:21:32 p.m. 4348 (0x10FC) !! Device is already provisioned oobmgmt 18/07/2011 5:21:32 p.m. 4348 (0x10FC) END oobmgmt 18/07/2011 5:21:32 p.m. 4348 (0x10FC) ON SCHEDULE OOBMgmt 18/07/2011 6:21:32 p.m. 5104 (0x13F0) BEGIN oobmgmt 18/07/2011 6:21:32 p.m. 5104 (0x13F0) yet it does not appear in SCCM as a managable AMT Client CAMTDiscoveryWSMan::DoConnectToAMTDevice: Failed to establish tcp session to 10.160.193.11:16993. Server unexpectedly disconnected when TLS handshaking. **** Error 0x528b4ec returned by ApplyControlToken I have run the activate utility and it finishes with exit code 1 but no errors are scene. im at a loss as to where to go to from here.

C:\Temp\intel_vpro_technology_activator_utility_3.3>Activator.exe /s https://sccmfqdn/ /h /c Step Into: GetHostFQDN host Name is wl00012.somedomain.com Step Into: CheckAMT Connected to HECI driver, version: 7.0.0.1144 BIOS Version: 68SCF Ver. F.03 Intel AMT code versions: Flash: 7.1.3 Netstack: 7.1.3 AMTApps: 7.1.3 AMT: 7.1.3 Sku: 24584 VendorID: 8086 Build Number: 1053 Recovery Version: 7.1.3 Recovery Build Num: 1053 Legacy Mode: False Setup and Configuration: Completed Exit with code 1

Log into the MEBx on the client system and unprovision it manually. As long as you don't pull the CMOS battery, your root CA hash should still be embedded in the firmware. Are you running ConfigMgr SP2, by the way? If not, make sure you upgrade, as it contains important AMT-related hotfixes.If this post was helpful, please click the little "Vote as Helpful" button :) Trevor Sullivan http://trevorsullivan.net

Yep, we are running 2007 SP2 R3 I unprovissioend the machine and re added the hash to the MEBx Now im getting amtopmgr.log Start processing incoming hello message from 10.160.193.11:16994. SMS_AMT_OPERATION_MANAGER 20/07/2011 7:07:55 a.m. 2812 (0x0AFC) Incoming data is - Configuration version: PKI Configuration. SMS_AMT_OPERATION_MANAGER 20/07/2011 7:07:56 a.m. 2812 (0x0AFC) Count : 11 SMS_AMT_OPERATION_MANAGER 20/07/2011 7:07:56 a.m. 2812 (0x0AFC) UUID : DC5749DE-31CF-11E1-A3FF-A0087F194037 SMS_AMT_OPERATION_MANAGER 20/07/2011 7:07:56 a.m. 2812 (0x0AFC) Found matched hash from hello message with current provision certificate. (Hash: 2AD6B6B9C16146CF4F0703C8DC3955FCC50B58B6) SMS_AMT_OPERATION_MANAGER 20/07/2011 7:07:56 a.m. 2812 (0x0AFC) Warning: AMT device DC5749DE-31CF-11E1-A3FF-A0087F194037 is a SMS client. Reject hello message to provision. SMS_AMT_OPERATION_MANAGER 20/07/2011 7:07:56 a.m. 2812 (0x0AFC) Error: Failed to process hello message from 10.160.193.11:16994 SMS_AMT_OPERATION_MANAGER 20/07/2011 7:07:56 a.m. 2812 (0x0AFC) Waiting for incoming hello message from AMT devices... SMS_AMT_OPERATION_MANAGER 20/07/2011 7:07:56 a.m. 2812 (0x0AFC) client oobmgmt.log ON SCHEDULE OOBMgmt 20/07/2011 6:48:51 a.m. 1404 (0x057C) BEGIN oobmgmt 20/07/2011 6:48:51 a.m. 1404 (0x057C) Retrying to activate the device. oobmgmt 20/07/2011 6:48:51 a.m. 1404 (0x057C) Resending last OTP oobmgmt 20/07/2011 6:48:51 a.m. 1404 (0x057C) Upload provisioning data state message sent successfully. TopicType = STATE_TOPICTYPE_AMT_CLIENT_DATA_SYNCHRONIZE, OTPHash = 23FB067BB44B32120947062EF6C460BB680E5B3D, RetryCount = 3 oobmgmt 20/07/2011 6:48:51 a.m. 1404 (0x057C) Successfully activated the device. oobmgmt 20/07/2011 6:48:51 a.m. 1404 (0x057C) Upload manufacturing data state message sent successfully. TopicType = STATE_TOPICTYPE_AMT_CLIENT_DATA_SYNCHRONIZE, Root Certificate Hash = 2AD6B6B9C16146CF4F0703C8DC3955FCC50B58B6, AMT Core Version = 7.1.3 oobmgmt 20/07/2011 6:48:51 a.m. 1404 (0x057C) END oobmgmt 20/07/2011 6:48:51 a.m. 1404 (0x057C) It just will not provision inband.

Do you have reverse DNS working? Remember that having PTR records for all your clients is an absolute requirement for advanced provisioning of AMT. I'm a little surprised at seeing IP addresses in your logs, rather than clients' FQDNs.If this post was helpful, please click the little "Vote as Helpful" button :) Trevor Sullivan http://trevorsullivan.net

DNS reverse lookup zone is inplace and updating correctly. I built a 2nd test desktop with vPro and it also fails to provision. oobmgmt.log BEGIN oobmgmt 20/07/2011 2:42:30 p.m. 1456 (0x05B0) Retrying to activate the device. oobmgmt 20/07/2011 2:42:30 p.m. 1456 (0x05B0) New OTP generated oobmgmt 20/07/2011 2:42:32 p.m. 1456 (0x05B0) Upload provisioning data state message sent successfully. TopicType = STATE_TOPICTYPE_AMT_CLIENT_DATA_SYNCHRONIZE, OTPHash = C397AA8870D7CA65BA29733F0ACE70D5585346E3, RetryCount = 0 oobmgmt 20/07/2011 2:42:32 p.m. 1456 (0x05B0) Raising event: [SMS_CodePage(850), SMS_LocaleID(5129)] instance of SMS_OOBMgmt_StartConfig_Success { ClientID = "GUID:D1BCED4E-094B-403C-8A1D-1BB858AF236E"; ConfigurationStartTime = "2011-07-20 14:42:32"; DateTime = "20110720024232.708000+000"; MachineName = "WD20078"; ProcessID = 1900; SiteCode = "DEV"; ThreadID = 1456; }; oobmgmt 20/07/2011 2:42:32 p.m. 1456 (0x05B0) Successfully activated the device. oobmgmt 20/07/2011 2:42:32 p.m. 1456 (0x05B0) Upload manufacturing data state message sent successfully. TopicType = STATE_TOPICTYPE_AMT_CLIENT_DATA_SYNCHRONIZE, Root Certificate Hash = 2AD6B6B9C16146CF4F0703C8DC3955FCC50B58B6, AMT Core Version = 5.0.2 oobmgmt 20/07/2011 2:42:32 p.m. 1456 (0x05B0) END oobmgmt 20/07/2011 2:42:32 p.m. 1456 (0x05B0) amtopmgr.log Start processing incoming hello message from 10.160.193.10:16994. SMS_AMT_OPERATION_MANAGER 20/07/2011 2:44:27 p.m. 2792 (0x0AE8) Incoming data is - Configuration version: PKI Configuration. SMS_AMT_OPERATION_MANAGER 20/07/2011 2:44:27 p.m. 2792 (0x0AE8) Count : 1 SMS_AMT_OPERATION_MANAGER 20/07/2011 2:44:27 p.m. 2792 (0x0AE8) UUID : 63641A80-1026-11DE-AA81-B427BD5C6BDE SMS_AMT_OPERATION_MANAGER 20/07/2011 2:44:27 p.m. 2792 (0x0AE8) Found matched hash from hello message with current provision certificate. (Hash: 2AD6B6B9C16146CF4F0703C8DC3955FCC50B58B6) SMS_AMT_OPERATION_MANAGER 20/07/2011 2:44:27 p.m. 2792 (0x0AE8) Warning: AMT device 63641A80-1026-11DE-AA81-B427BD5C6BDE is a SMS client. Reject hello message to provision. SMS_AMT_OPERATION_MANAGER 20/07/2011 2:44:27 p.m. 2792 (0x0AE8) Error: Failed to process hello message from 10.160.193.10:16994 SMS_AMT_OPERATION_MANAGER 20/07/2011 2:44:27 p.m. 2792 (0x0AE8) Waiting for incoming hello message from AMT devices... SMS_AMT_OPERATION_MANAGER 20/07/2011 2:44:27 p.m. 2792 (0x0AE8) No objects are being created in the OU for Out of Band Mangement Controllers Certs are inplace (followed the online training on intels web site http://www.vproexpert.com/sccm_vpro/module_04/module_04.html) to verify my config. Permissions are inplace on the to allow the SCCM Server to create objectects and all child objects It cant be this hard to get VPro to work

If only I could share with you the pains I've been through .... talking to people at Microsoft, Intel, Dell, etc. Anyway, the OU object creation happens later on -- I wouldn't expect them to be created at this point. Next question: Have you configured the customized MEBx password in the OOB component configuration on the SCCM primary site? Also, FYI, your latest log appears to be at least partially successful -- check your AMTproxymgr.log around the same time for more information.If this post was helpful, please click the little "Vote as Helpful" button :) Trevor Sullivan http://trevorsullivan.net

Im using a DEV internal Enterprize CA, which means i have to add the Hash into the MEBx for the CA's root cert to so the cert chain works. This appears to be working OK as it errors out if i dont add the Hash into MEBx on the clients im trying to configure in the lab. What it looks like is the SCCM client just will not provision the client in band... One client is a new HP 8460p AMT Core Version = 7.1.3 and the other is a older lenovo M58 desktop AMT Core Version = 5.0.2 ...

The SCCM client isn't responsible for provisioning AMT. What the SCCM client does is contact the AMT firmware using the HECI driver, and activate it for provisioning (it's closed off for provisioning until being explicitly activated for security reasons). The AMT firmware returns a One-Time Password (OTP) to the SCCM client, which forwards it to the SCCM out of band (OOB) service point role on-demand. Once the SCCM OOB service point has the OTP, it attempts a remote connection to <ClientFQDN>:16993 for provisioning using the Remote MEBx account configured in the OOB component configuration OR the default remote MEBx password of "admin." The root CA hash is checked, and then provisioning ought to begin. So, to my previous question ... did you configure the remote MEBx account in the OOB component configuration on the SCCM primary site?If this post was helpful, please click the little "Vote as Helpful" button :) Trevor Sullivan http://trevorsullivan.net

Yes it is configured. Im rebuilding both clients after unprovisioneing MEBx (reseting it to factory) and entring in our HASH. will see what state they are in tomorrow morning., This is only 2 of out of 36 models we are retaining.....

Are you resetting the MEBx to factory by pulling the CMOS battery? I'd give that a shot, and then login to the MEBx and add your root CA hash again (guessing this is what you're already doing) ... can't tell you how many times I did that back a couple years ago. Also, just FYI, rather than waiting, you can force the SCCM client to initiate the provisioning process using a PowerShell script I wrote a couple years back. Here's a link: http://communities.intel.com/community/openportit/vproexpert/blog/2009/02/16/powershell-enabling-auto-provisioning-on-sccm-clientIf this post was helpful, please click the little "Vote as Helpful" button :) Trevor Sullivan http://trevorsullivan.net

Slight improvement this morning. Both Lab machines are showing AMT Status "Not Provisioned" and the AMT version 7.1.3 & 5.0.2 the collection is enabled for Automatic OOB Provisioning. But the inbound agent provisioning never starts (scheduled 1/h) its like im missing a hotfix or something...

I gave up on PKI and tried PSK to see if i could get one of them to provision that way. Fail! Incoming data is - Configuration version: PSK Configuration. SMS_AMT_OPERATION_MANAGER 21/07/2011 2:31:04 p.m. 2620 (0x0A3C) Count : 2 SMS_AMT_OPERATION_MANAGER 21/07/2011 2:31:04 p.m. 2620 (0x0A3C) UUID : 63641A80-1026-11DE-AA81-B427BD5C6BDE SMS_AMT_OPERATION_MANAGER 21/07/2011 2:31:04 p.m. 2620 (0x0A3C) PID : 4444-4444 SMS_AMT_OPERATION_MANAGER 21/07/2011 2:31:04 p.m. 2620 (0x0A3C) AMT Provision Worker: Wakes up to process instruction files SMS_AMT_OPERATION_MANAGER 21/07/2011 2:31:04 p.m. 2636 (0x0A4C) Generate bare metal provision task for AMT device 63641A80-1026-11DE-AA81-B427BD5C6BDE. SMS_AMT_OPERATION_MANAGER 21/07/2011 2:31:04 p.m. 2620 (0x0A3C) Incoming instruction file C:\Program Files\Microsoft Configuration Manager\inboxes\amtopmgr.box\prov\{C611177E-9416-4B34-A34F-2DBE423B8E43}.PRV to Provision Worker. SMS_AMT_OPERATION_MANAGER 21/07/2011 2:31:04 p.m. 2636 (0x0A4C) Found one 'Bare-Metal Provision' task with type 'Machine Resource' and target ID '262' and IP address '178307338'. SMS_AMT_OPERATION_MANAGER 21/07/2011 2:31:04 p.m. 2636 (0x0A4C) Error: Target machine 262 with SMS ID GUID:D1BCED4E-094B-403C-8A1D-1BB858AF236E is NOT an AMT capable machine. SMS_AMT_OPERATION_MANAGER 21/07/2011 2:31:04 p.m. 2636 (0x0A4C) Error: Target machine 262 with SMS ID GUID:D1BCED4E-094B-403C-8A1D-1BB858AF236E is NOT an AMT capable machine Yet it is listed in SCCM AMT Verion 5.0.2

what encryption level is your internal CA set to? If your CA is set to use higher than 2048bits, it will fail the provision. I had exactly the same issue, even though my certificate templates were set to 2048, the root CA was at 4096bits.

CA root cert public key is RSA 2048 bits.

I thought i'd try the other test machine as it had a new version of AMT and set it to use PSK however it also gets rebored in the amtopmgr log as NOT an AMT capable machine. Start processing incoming hello message from 10.160.193.11:16994. SMS_AMT_OPERATION_MANAGER 22/07/2011 7:55:17 a.m. 4292 (0x10C4) Incoming data is - Configuration version: PSK Configuration. SMS_AMT_OPERATION_MANAGER 22/07/2011 7:55:17 a.m. 4292 (0x10C4) Count : 0 SMS_AMT_OPERATION_MANAGER 22/07/2011 7:55:17 a.m. 4292 (0x10C4) UUID : DC5749DE-31CF-11E1-A3FF-A0087F194037 SMS_AMT_OPERATION_MANAGER 22/07/2011 7:55:17 a.m. 4292 (0x10C4) PID : 4444-4444 SMS_AMT_OPERATION_MANAGER 22/07/2011 7:55:17 a.m. 4292 (0x10C4) AMT Provision Worker: Wakes up to process instruction files SMS_AMT_OPERATION_MANAGER 22/07/2011 7:55:17 a.m. 4056 (0x0FD8) Generate bare metal provision task for AMT device DC5749DE-31CF-11E1-A3FF-A0087F194037. SMS_AMT_OPERATION_MANAGER 22/07/2011 7:55:17 a.m. 4292 (0x10C4) Successfully processed incoming hello message from 10.160.193.11:16994. SMS_AMT_OPERATION_MANAGER 22/07/2011 7:55:17 a.m. 4292 (0x10C4) Incoming instruction file C:\Program Files\Microsoft Configuration Manager\inboxes\amtopmgr.box\prov\{19C40543-AE0D-4AF2-9082-1DFA321B75CA}.PRV to Provision Worker. SMS_AMT_OPERATION_MANAGER 22/07/2011 7:55:17 a.m. 4056 (0x0FD8) Found one 'Bare-Metal Provision' task with type 'Machine Resource' and target ID '261' and IP address '178307339'. SMS_AMT_OPERATION_MANAGER 22/07/2011 7:55:17 a.m. 4056 (0x0FD8) Error: Target machine 261 with SMS ID GUID:7ECEBF01-734C-4288-BD46-C17110782BC3 is NOT an AMT capable machine. SMS_AMT_OPERATION_MANAGER 22/07/2011 7:55:17 a.m. 4056 (0x0FD8) this is Retarded.. as its listed in SCCM with version 7.1.3 SCCM Object Properties AMT Full Version 7.1.3 AMT Status = 2 AMT 3 Compatible <null>

I have similar issue - and I notice you did not get a final answer, so any help would be appreciated. Ours is set to PKI - we bought provision cert - GoDaddy - 2048, so it's not too long, but we did our own Web cert, but it also is 2048 or less. I am just trying to get ONE system to provision! Ran the intel 'activator' - it shows v 7.x for the AMT, but exits with code 1. Only additional thing I did, since nobody could answer for certain - I went ahead and "set a mebx password" for the admin account. Nobody could really say for sure is that needed or not needed? (setting the mebx admin password in advance)? When I did NOT set it, I could not get them to auto-provision. Now that I've set it, they still won't autoprovision; and I can't get them to semi-manually [LOL] provision either. This is C-R-A-Z-Y. Step Into: CheckAMT Connected to HECI driver, version: 7.0.0.1144 BIOS Version: A11 Intel AMT code versions: Flash: 7.1.20 Netstack: 7.1.20 AMTApps: 7.1.20 AMT: 7.1.20 Sku: 24592 VendorID: 8086 Build Number: 1119 Recovery Version: 7.1.20 Recovery Build Num: 1119 Legacy Mode: False Setup and Configuration: Completed Exit with code 1 It is a brand new Dell Optiplex 790 with HECI & AMT pieces, Windows 7 Pro, 32-bit and SCCM 2007 R3 client. Please help! (We help less-fortunate folks find affordable housing, and our budget is over-extended already, so we cannot place any support calls - ugh!)tnjman