Quantcast
Channel: Intel Communities: Message List - Intel® vPro™ Platform
Viewing all 1770 articles
Browse latest View live
↧

Re: Trouble using Agent Presence

January 15, 2018, 6:59 am
$
0
0

Def-Logix_Developer,

  1. with 7th Gen Intel Core vPro intel introduced requirement for OEM BIOS to include USB provisioning setting and its factory default value shall be set to Disabled.
    With previous Gen Intel Core vPro it was OEM discretionary decision to include such option or not. HP BIOS in vPro systems had it since I can remember (ie. all 11 years of Intel vPro technology history).
    With recent BIOS'es some OEM also introduced other MEBx FW controls like MEBx menu access or MEBx entry key sequence prompt visibility.
    You may also like to check Intel® vPro™ Use Case Reference Design - Local Setup and Configuration Using a USB Flash https://downloadcenter.intel.com/download/20979
    you will need USBFile.exe utility from Intel AMT SDK  from http://software.intel.com/en-us/articles/download-the-latest-intel-amt-software-development-kit-sdk

    Please check those OEM BIOS options to enable USB provisioning support and/or MEBx menu entry/prompt.
    Please note also that HP BIOS on notebooks use F6 key as alternative entry to MEBx BIOS menu.

  2. If your PC is already configured (any mode) USB provision attempts will be rejected -with MEBx message about "...Configuration flow error, system is already provisioned".
    You have to fully un-provision Intel AMT first and then use USB to provision it again to Admin Control Mode.
    You can unprovision Intel AMT :
    • from MEBx - via Unconfigure Network Access> Full Unprovision  MEBx menu option. See http://h10032.www1.hp.com/ctg/Manual/c03975296 HP MEBX/AMT user guide.
      If first configuration was done to Client Control Mode - MEBx password may still be factory default "admin" and you will have to define strong (8-32 + 4 of 4) new MEBx Password first. Please remember this new MEBx Password as you need to use it as current MEBx password when creating USB configuration file.
      NOTE- MEBx keyboard layout is always US one regardless of actual physical keys layout.
    • via Intel Configurator -ACU utility (from Intel SCS Configurator folder) running it as local administrator  with following command ACUConfig.exe Unconfigure /Full
      or ACUWizard GUI executed as local administrator.
      Note -if system will be configured into Admin Control Mode - you will have to know current AMT Digest Administrator password and use following command
      ACUConfig.exe Unconfigure /AdminPassword <your current AMT Admin password>  /Full

      Note! -both above AMT un-configuration methods do not change/reset current MEBx password
    • reset Intel AMT to full factory defaults via PC board jumper or BIOS setting, or by pressing power button for specified time - it is OEM dependent!
      For HP there is Unconfigure AMT option in HP BIOS. Full Intel AMT reset to factory defaults is performed during next POST /reboot.
      Note- Intel AMT reset to full factory defaults resets also MEBx Password to its fectory default value ("admin" or other  custom one if pre-configured at OEM factory).

  3. There is also ACUConfig.exe MoveToACM<Intel SCS -RCS server FQDN or IP> /AdminPassword <your current AMT Digest Administrator password>
     command that allows to "upgrade" Intel AMT from Client to Admin Control mode but it requires more complex environment (Intel SCS RCS server, AMT Provisioning certificate, DHCP server and Intel AMT enabled  LAN interface in your vPro systems).
    If you asked about USB Provision I assume it is too complex for your needs (so far).

rgds

Dariusz Wittek
Intel  EMEA Biz Client Technical Sales Specialist

↧
Search

Re: NTEL-SA-00075 Detection does not detect status in registry

January 16, 2018, 4:45 pm
$
0
0

Hi NickPifer86,

I apologize for asking you to do this.  I would for you but I do not have your contact information.  Would like to get the log file that is created when you run the tool....the .htm file created in the directory you run the tool from, however, I do not know your comfort level of posting that file on a public forum, so if you are uncomfortable, would you mind opening a ticket on our support site here:

https://www.intel.com/content/www/us/en/support/contact-support.html#@17

You can send me a personal message to let me know your ticket number...

Regards,
Michael

↧
↧

Re: Missing Boot Options on AMT WebUI

January 17, 2018, 2:07 pm
$
0
0

Hi Musketier...Sending an e-mail to you.

Regards,
Michael

↧

Automating Intel AMT MEBx Configuration

January 18, 2018, 7:38 pm
$
0
0

Hi All,

 

Currently we have a scenario,

To prevent the Intel AMT attacks, we are following the below manual steps on the machines.

 

1. Login to MEBx with default password "admin" by pressing Ctrl-P during system boot.

2. Change the password to standard password.

3. Disabling "Manageability Feature Selection" under Intel AMT configuration.

 

And it is not feasible to mitigate thousands of machines manually, could any one help me to whether we can create any kind of script or utility tool to automate this steps.

We are using Microsoft System Center Configuration Manager, so we can deploy the script remotely to all machines.

 

Appreciate any help on this.

 

Thanks in advance,

RV

↧

Re: Automating Intel AMT MEBx Configuration

January 19, 2018, 5:57 am
$
0
0

I too would like to script a password change from admin to something more secure. Is this possible? We have been trying for a while to find a solution with no success. There does not seem to be a link anywhere to anyone successfully changing the insecure "admin" password by any type of script or automated process. Anyone have any info? We don't want to change 30k laptops manually.

Thanks for the help!

 

Phil

↧
↧

Re: Disabling AMT

January 19, 2018, 6:13 am
$
0
0

Question on this solution. If we do this, what is to stop someone from re-enabling it using the default admin password?

If that is a risk, then how can we change the default admin password in a script as well?

 

Thanks!

↧

Re: Researchers Found Another Major Security Flaw in Intel CPUs

January 19, 2018, 2:45 pm
$
0
0

Hi Surlycanuck,

When security issues are discovered, Intel works closely to address the issues with our direct cloud service customers and the cloud service customers of OEM's such as Lenovo, Dell and HP.

We have been in direct contact with Digital Ocean and are working to ensure that their systems are secure.

Let us know if you have additional questions on this topic.

↧

How can we change the AMT default password from admin by script?

January 22, 2018, 4:53 am
$
0
0

Good morning,

We need to change the AMT password on 40k machines in SCCM from admin to something secure. How can we do this? I cant seem to find a way to make this work in a script. Someone must have done this, I cant imagine the answer is to do each system manually.

 

Thanks!

 

Phil

↧
Search

AMT vulnerability

January 23, 2018, 7:25 am
$
0
0

I am looking to find some concrete information on what steps will need to be taken in order to mitigate the AMT vulnerability (CVE-2017-5689) in our environment and would appreciate any help/information that can be provided.

 

  1. We have never provisioned Intel AMT. Does this mean we are not vulnerable, or does the existence of AMT in the BIOS automatically make a device vulnerable to exploit?
  2. I do see the UNS and LMS services running on well over a hundred devices in our environment. Does any potential exploit target these services? Will simply disabling these services mitigate any vulnerability?
  3. We have many devices that I am sure have AMT that appear not to have these services even installed. Are they vulnerable?

 

My goal is to not have to update the BIOS on 1500 or more systems, especially since we have never made use of AMT. If I can simply disable services on devices by script within Windows, and ignore devices that don't have the services, that is the ideal outcome.

 

Thank you for any help provided.

 

 

Sean

↧
↧

Re: AMT vulnerability

January 24, 2018, 7:08 am
$
0
0

As an update to this request for information, I found that even after running the mitigation tool against a device and taking the following three steps, unprovision (which it reported that it was never provisioned, as it should), disable client remote capabilities, and disable LMS services, and then re-running the discovery the device is still being reported as vulnerable. Is the mitigation tool not intelligent enough to determine that mitigation steps have been taken, or is there still a problem?

 

Again, thank you for any assistance.

 

 

Sean

↧

Re: Disabling AMT

January 25, 2018, 4:46 pm
$
0
0

Hi Phil,
If someone has:
1.  Physical access to the system
2.  Is knowledgeable enough to access MEBx
3.  MEBx password is set to default and has not been changed.
then they would be able to re-enable AMT using the default admin password.

There are three ways to change the digest admin default password (in order of simple to complex):
1.  Physically on the system, accessing MEBx and changing password.
2.  Configuration via USB Key, which begins in section 1.4.2 of the SCS User Guide - Physical access to the system is required for this method.
3.  Remote Configuration (best solution if you have many systems or if they are remote but are on your domain).  More details begin at section 1.4.4 of the SCS User Guide.

There is no other method for changing the default admin password.

The SCS User Guide can be accessed at this link:
https://www.intel.com/content/dam/support/us/en/documents/software/Intel_SCS_User_Guide.pdf

Information on certificates needed for remote configuration can be accessed at this link:
https://www.intel.com/content/www/us/en/remote-support/intel-vpro-certificates.html

Intel recommends following best security practices.  Please find document at this link:
ttps://www.intel.com/content/dam/support/us/en/documents/technologies/Intel_AMT_Security_Best_Practices_QA.pdf

Question 6 is most appropriate for your question.

Regards,
Michael A
 

↧

Re: How can we change the AMT default password from admin by script?

January 25, 2018, 5:00 pm
$
0
0

Hi Phil,

I had responded to your previous post under "Disabling AMT":
https://communities.intel.com/thread/119990

Now I have a little more detail as far as the number of systems you are needing to address.  Neither the first or second options will work for you.  The only option will be remote configuration.

Have you already provisioned your systems?

Also, now that you have this open, I'll go ahead and close out the other one and we can proceed on this case to keep things organized.

Regards,
Michael
 

↧

Re: How can we change the AMT default password from admin by script?

January 26, 2018, 6:07 am
$
0
0

Thank you very much for your help.

To answer your question - no we have not provisioned AMT. Currently we do not use it.  We would just like to protect ourselves from any potential abuse of the default "admin" password.

 

Thanks,

 

Phil

↧
↧

Re: How can we change the AMT default password from admin by script?

January 26, 2018, 11:38 am
$
0
0

Hi Phil,

Based on your posts on other threads, you have a significant number of vPro clients.  The most effective/efficient solution would be to use the remote configuration method.  I understand that you do not use AMT, but this is the only way to change the default admin password.  You have a case associated with this forum post that I own.  If you would like to set up a meeting to discuss an implementation strategy and assistance with getting this going, just let me know and I can set something up.

Regards,
Michael

↧

Re: Automating Intel AMT MEBx Configuration

January 26, 2018, 12:23 pm
$
0
0

Hi RV,

The only method for your situation of changing the MEBx password on thousands of machines is to perform a remote configuration and within the profile, changing the MEBx password and pushing out to the clients.  Please take a look at forum post:

https://communities.intel.com/thread/119990

I believe all the information you need to get started is there.  There is a case # associated with this post, so if you require assistance, let me know and I can set up a meeting.

Regards,
Michael

↧
Search

Re: AMT vulnerability

January 26, 2018, 12:42 pm
$
0
0

Hi Sean,

My understanding from your post is that your goal is to not have to update the BIOS on 1500+ systems and that you have run the detection and mitigation tool for Intel SA-00075.  While performing the mitigation steps will help, your systems will still be considered vulnerable (even when re-running the tool against mitigated systems) until the firmware update for SA-00075 has been applied.

I could not tell from your post if you use a central management tool in your environment, like SCCM.  There are methods for performing queries of your environment to determine systems that are vulnerable and then create a task to update the firmware.

Referencing one post that might be helpful:
https://communities.intel.com/thread/120105

Please let me know if there is anything further I can assist with.

Regards,
Michael A




https://downloadcenter.intel.com/download/26755

↧

Boot Configuration

January 28, 2018, 10:33 am
$
0
0

Have a server dropped off and it has boot up issues. Could someone send me to a link or something that tells me what the setup process is for booting up a Precision T5400 with two hard drives. Raid? not Raid? In bios the sata hard drives are not present. Do I configure them as RAID? I just need to be pointed in the right direction. Thanks anyone

↧
↧

Re: Disabling AMT

January 29, 2018, 10:23 am
$
0
0

I have looked at your pdf link. It seems the 1.4.4 section you referenced says

 

"To use this method, the Intel AMT device must have at least one active hash

certificate defined in the Intel MEBX. If the manufacturer does this before he sends the computer out, then you

can configure these computers remotely."

 

So the next question is, what if the manufacturers did not configure this?  Does that mean that we can not do it remotely?

 

Thanks,

 

Phil

↧

Re: Disabling AMT

January 30, 2018, 10:31 am
$
0
0

Hi Phil,

For remote configuration, a specific AMT certificate from one of the certificate authorities is required.  As mentioned in the previous post, there is only one way to perform a remote configuration where the MEBx password can be changed, which is the aforementioned method.  You will be unable to perform this change remotely without one.

Regards,
Michael

↧

Re: Boot Configuration

February 1, 2018, 11:00 am
$
0
0

Hello Geaux2u,

I understand that you need assistance to setup the booting process of your Dell* Precision T5400.

Regarding that, I would strongly recommend you to contact Dell for further assistance since they are the manufacturers of the system that you are trying to setup. They know the way that it has to be set up properly.


Regards,
David V

↧
Viewing all 1770 articles
Browse latest View live
Search

Latest Images

7 clever tricks Primark does to keep you walking & buying more than you need...

7 clever tricks Primark does to keep you walking & buying more than you need...

July 20, 2025, 5:14 am
Art for Everyone! Autism advocacy, local stories, and indigenous pride in one...

Art for Everyone! Autism advocacy, local stories, and indigenous pride in one...

July 20, 2025, 5:06 am
Paintings of English Downs 2

Paintings of English Downs 2

July 20, 2025, 4:30 am
How Kerala Women Rescued a Dying Forest and Turned It Into a Safe Haven for...

How Kerala Women Rescued a Dying Forest and Turned It Into a Safe Haven for...

July 20, 2025, 3:30 am
Met Eireann warns of heavy rain & spot flooding for DAYS before big...

Met Eireann warns of heavy rain & spot flooding for DAYS before big...

July 20, 2025, 1:14 am
Who is Kevin Lerena’s wife Geraldine?

Who is Kevin Lerena’s wife Geraldine?

July 20, 2025, 12:57 am
Man stabs woman, baby to death inside Queens home, police say

Man stabs woman, baby to death inside Queens home, police say

July 19, 2025, 11:00 pm
Ang papel ni whistleblower Julie Patidongan sa kaso ng mga nawawalang sabungero

Ang papel ni whistleblower Julie Patidongan sa kaso ng mga nawawalang sabungero

July 19, 2025, 9:45 pm
Telangana Human Rights Commission (TGHRC) seeks report from revenue dept on...

Telangana Human Rights Commission (TGHRC) seeks report from revenue dept on...

July 19, 2025, 7:29 pm
Crisis-hit NHS fat cats raking in MASSIVE salaries as frontline services cry...

Crisis-hit NHS fat cats raking in MASSIVE salaries as frontline services cry...

July 19, 2025, 2:11 pm
<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>