Hi Musketier,
I'm going to assume you are using SCS as a deployment method for provisioning your headless systems. When you provision remotely, this will put AMT on the system you are running ACUConfig on in Admin Control Mode.
Please reference the SCS User Guide for remote configuration of your devices. Also reference the following site for remote certificate provisioning for AMT:
https://www.intel.com/content/www/us/en/remote-support/intel-vpro-certificates.html
Let me know by posting if you have more questions after looking through the document.
Regards,
Michael