Intel® Active Management Technology SDK Frequently Asked Questions (FAQs)

Submit New Article

November 24, 2008 11:00 PM PST


The following are questions most commonly asked by new Intel® AMT users/developers. Note that the term "Circuit Breaker" has been replaced with "System Defense" in current and future releases of the Software Developers Kit for Intel® AMT.

Questions
  1. The system is unresponsive and won't boot. What are the ways to resolve this?
  2. Difficulties building the Sample Code.
  3. The USB key will not boot on the Intel AMT system.
  4. What are the allowed network setup modes?
  5. Can you transfer the private key to the system wrapped by the ISV in their public key?
  6. Why are we getting the following error while trying to run the sample code? ISVS_RegisterApplication returns 4103 (0x1007)PTSDK_STATUS_NETWORK_ERROR.
  7. How can one discover an Intel AMT machine before a user goes into the Intel AMT configuration screen at boot-time and sets a new username/password from the default password?
  8. What is the preferred way of performing Setup and Configuration for Enterprise mode?
  9. Writing to the Intel AMT Storage (repeatedly): After a few successful writes, continuous write errors occurred for all subsequent writes. Reflashing the AMT memory did not help, but leaving the system on overnight did help. Why is this?
  10. Is there a way to determine if the user has correctly selected a valid floppy and CD boot drive and/or image file?
  11. Why are there events in the event log when running in an unprovisioned state?
  12. Emulator Warning: "Cannot add username: admin and password admin to OS user accounts."
  13. Whenever an SOL session is opened using the IMRGUI, 100% of the CPU resources are taken.
  14. Why does the SDK support an EOI WSDL if the emulator doesn't respond to it?
  15. Can one get the host UUID run before registration?
  16. Can I access my block by name later as a named block?
  17. Can blocks smaller than 4K be allocated? What about the scratchpad?
  18. Does one need to lock while reading? What happens if one does not lock?
  19. Will Intel be supplying a library or code to translate the PCI Vendor and Device ID values to human friendly strings?
  20. When an event filter is created, the FW returns a handle. When the handle is lost (system failure, etc.), how can a console recover the handle? Does the firmware clean up?
  21. Is the distribution of IMRSDK.DLL allowed with our product?
  22. What is the maximum size of the Intel AMT event log?
  23. How to set up authentication.
  24. When accessing the local storage on an Intel AMT 2.0 machine, there is a specification of the URL (e.g. http://localhost:16992/StorageService.) If the machine is in TLS mode, is it necessary to have the certificate on the local machine that's normally on the core server only?
  25. Is there a specific API that will indicate which version(s) of Intel AMT (1.0, 2.0, etc) that a device supports?
  26. Hello packets are sent only when OS is on.
  27. Will the flash update utility work remotely?
  28. What happens if the flash image update crashes in mid-update?
  29. Is it possible to recover the AMT ID/Password without re-programming the device?
  30. When working in DHCP and setting a block-all policy in System Defense, after a certain amount of time AMT will be inaccessible.
  31. Can an AMT application be developed using AMT SDK 3.0 on top of AMT 1.0 Firmware?
  32. Can an application compiled by AMT SDK 1.0 manage AMT Firmware 2.0 and later versions?
  33. What are the limitations of using Intel® AMT in a wireless environment?
  34. How can I tell whether or not an API can be executed locally (on the AMT Client) or remotely (from the management console via network access?)
  35. Does Intel® AMT support Windows* Vista?
  36. How can I make sense out of the AMT Event Log messages?
  37. Intel® AMT: Emulator, RDK, SDK, DTK - what are they for?
  38. What features do the various versions of AMT support?

 

Question Answer
1. The system is unresponsive and won't boot. What are the ways to resolve this?
  • Unplug power cord, wait 20 seconds and try to boot the system again.
  • DIMM 0 must be populated with memory for AMT to work. AMT firmware is uncompressed and run in DIMM 0.
2. Difficulties building the Sample Code.
  • Check the readme file for any special instructions.
  • The sample code currently will not build with Microsoft Visual Studio* 2005. Try loading Microsoft Visual Studio* 2003.
  • Make sure the Platform SDK is installed.
  • Run the makewsdl.bat file - this batch file creates files that are needed in the build process.
  • Make sure the necessary directories have been added to the project (see the User's Guide.)
3. The USB key will not boot on the Intel AMT system.
  • USB boot partition needs to be 256MB or smaller.
  • Need to format USB key to be DOS bootable.
4. What are the allowed network setup modes? Intel AMT supports DHCP and static IP. The Intel AMT network settings must coincide with the system network settings. This means that if the host has been set to work in DHCP, Intel AMT must be set to use DHCP as well. If host was set to use static IP, then Intel AMT must be set to use static IP. If this is not followed, the result will be unpredictable. NOTE: Apart from DHCP/ DHCP and static IP/ Static IP, there are no additional allowed configurations.
  • When using DHCP – Intel AMT hostname must be set to the same hostname as the host.
  • When using static IP – Intel AMT host name AND IP address must differ from the host IP and hostname.

Difference between AMT 1.0 and AMT 2.0 (vPro): In AMT 1.0 when working in DHCP mode, Intel AMT will automatically capture the hostname that the host OS is using. For vPro systems this is not the case, and the host name has to be configured explicitly.
5. Can you transfer the private key to the system wrapped by the ISV in their public key? No
6. Why are we getting the following error while trying to run the sample code? ISVS_RegisterApplication returns 4103 (0x1007)PTSDK_STATUS_NETWORK_ERROR. Check to see if the Admin password has expired. If so, reset the admin user's password.
7. How can one discover an Intel AMT machine before a user goes into the Intel AMT configuration screen at boot-time and sets a new username/password from the default password?
  • AMT must be configured in order to be discovered.
  • The first step requires manual intervention (by an IT admin) to change the default userid/password to another user id and a strong password combination. Until that is done, the Intel AMT device will refuse connection attempts.
  • The system can also be setup and configured to run in Small Business Mode. (See Small Business Mode User Guide.)
8. What is the preferred way of performing Setup and Configuration for Enterprise mode? Use the Intel SCS (Setup and Configuration Service) application which is available for public download via the Intel® Software Network Manageability community.
9. Writing to the Intel AMT Storage (repeatedly): After a few successful writes, continuous write errors occurred for all subsequent writes. Reflashing the AMT memory did not help, but leaving the system on overnight did help. Why is this? Flash write limits may have been exceeded. Optimize writes to see if this resolves the problem. Flash wear out protection is enforced by AMT to avoid permanent damage to flash by malware. Once the limit is exceeded, there is a time limit (40 minutes) that must be satisfied in order to write again.
10. Is there a way to determine if the user has correctly selected a valid floppy and CD boot drive and/or image file? There isn't any way from Intel AMT to determine this
11. Why are there events in the event log when running in an unprovisioned state? There are default filters defined even in the unprovisioned state.
12. Emulator Warning: "Cannot add username: admin and password admin to OS user accounts."
  • The emulator is trying to add a user account to the machine with default credentials - username: admin, password: admin. If these do not meet credential restrictions set on the machine, they will have to be changed in the configuration file under the "Intel AMT Emulator\EmulatorCore" directory.
  • The emulator has not been validated on non-English Windows XP versions. If you run into problems with running the emulator on such OS, please change the “Language for non-Unicode programs” setting in Regional and Language Options to English (United States) as a workaround.
13. Whenever an SOL session is opened using the IMRGUI, 100% of the CPU resources are taken. For HyperTerminal to be working properly, IMRGUI is required. Check things like if Windows* firewall has been disabled or is blocking communication. IMRGUI should then start working once HyperTerminal is working properly.
14. Why does the SDK support an EOI WSDL if the emulator doesn't respond to it? It's provided for communicating with the actual H/W.
15. Can one get the host UUID run before registration? Yes, the ISVS_GetHostUUID API call can be used after library initialization and before registration. It's one of a very few calls that can be used prior to registration.
16. Can I access my block by name later as a named block? Yes
17. Can blocks smaller than 4K be allocated? What about the scratchpad? No
18. Does one need to lock while reading? What happens if one does not lock? To ensure the data is consistent, lock before performing reads. If a lock is not done before reading you may get inconsistencies in data, partially from before and partial from after a write that has taken place may result.
19. Will Intel be supplying a library or code to translate the PCI Vendor and Device ID values to human friendly strings? No, there are no plans to add this functionality to the library. In the meantime, ISVs can go to standard sources to get PCI string tables, e.g., pciids.sourceforge.net*.
20. When an event filter is created, the FW returns a handle. When the handle is lost (system failure, etc.), how can a console recover the handle? Does the firmware clean up? Event handles live forever, but they can be recovered An application can use the SDK CircuitBreakerService interface to enumerate the filters and determine which filters belong to it. To do this, use the EnumerateEventFilters method to return an EventFilterHandleArrayType that lists the filter handles. A loop that applies GetEventFilter SOAP function to each handle can then be created to get the properties of each filter which allows the application to determine which filters are of interest..
21. Is the distribution of IMRSDK.DLL allowed with our product? Yes
22. What is the maximum size of the Intel AMT event log? The maximum number of event log entries is 390.
23. How to set up authentication? To establish a SOAP over HTTPS connection (i.e., TLS authentication), all that needs to be done is specify the proper endpoint. https://<hostname>:16993 Windows* security mechanisms will be employed to perform the proper certificate checking to establish the encrypted session. Once the encrypted session is established, the credentials are then passed to perform the userid authentication. This means there will be no change to any code except to when a specification of the new endpoint is needed.
24. When accessing the local storage on an Intel AMT 2.0 machine, there is a specification of the URL (e.g. http://localhost:16992/StorageService.) If the machine is in TLS mode, is it necessary to have the certificate on the local machine that's normally on the core server only? Yes, please keep in mind one would then be specifying the URL as https://localhost:16993/StorageService. Remember that TLS mode is defined on an interface level. This means that one can configure the Intel AMT 2.0 device to utilize TLS communications on the network (remote) interface and utilize non-TLS communications on the local interface.
25. Is there a specific API that will indicate which version(s) of Intel AMT (1.0, 2.0, etc) that a device supports? Yes, the function that will be called is: GeneralInfoService::GetCodeVersions
26. Hello packets are sent only when OS is on. This is probably because Intel AMT is active only in S0 state. A configuration of the platform power policies in order to have Intel AMT communicate when the system is in Sx state (when the OS is not up) will have to be undertaken. See the MEBx screens and also the SetPowerSavingOptions() API.
27. Will the flash update utility work remotely? The flash update utility only works remotely. This is a security features of Intel® Active Management Technology (Intel® AMT).
28. What happens if the flash image update crashes in mid-update? There isn't an issue re-flashing the device if there is a flash write error. There is no dependency between corrupt data and the ability to re-flash the device with a good image
29. Is it possible to recover the AMT ID/Password without re-programming the device? No - the password is not recoverable (this is a security feature.)
30. When working in DHCP and setting a block-all policy in System Defense, after a certain amount of time AMT will be inaccessible. Root Cause:
  1. Every few minutes the ARP cache on a system is cleared.
  2. When in DHCP mode, when OS is up, AMT will not answer ARP requests because it relies on the OS to do so
  3. Because of the block-all policy – OS will not receive or be able to answer ARP requests
  4. Therefore – after the cache is cleared, MC will not be able to reach the AMT system due to ARP requests not being answered.

Workaround
When defining a block-all policy, make sure to define 2 extra filters.
  1. Pass Tx filter on Ethernet header for 0x806 (ARP)
  2. Pass Rx filter on Ethernet header for 0x806 (ARP)
  3. Make sure these filters are part of the policy.

This will make sure that the host will answer ARP requests.
31. Can an AMT application be developed using AMT SDK 3.0 on top of AMT 1.0 Firmware? Yes, as long as the application is aware of the FW version of the end units and does not try to perform AMT 3.0 operations on AMT 1.0. Differences between the different versions are generally called out in the SDK documentation and also, the network interface guide lists APIs supported only by the newer versions of AMT. Additionally, many AMT 1.0 APIs have been deprecated in the EventMgr, NetworkAdmin, and SecruityAdmin realms. There is a section in the current SDK highlighting the list.
32. Can an application compiled by AMT SDK 1.0 manage AMT Firmware 2.0 and later versions? Yes. There is one caveat though – setup and configuration changed drastically between 1.0 and 2.0+, so make sure you know how to configure the AMT 2.0+ systems to comply to AMT 1.0 configuration. Additionally, there is an AMT 1.0 Compatibility mode that should be set in the MEBx screen under the Provisioning Model.
33. What are the limitations of using Intel® AMT in a wireless environment? Here is a high-level list detailing Wireless Interoperability. For more information please take a look at this whitepaper: http://download.intel.com/business/business-pc/technical_white_paper.pdf
  • There is no host wireless connection in link-sensitive flows (i.e. redirection use-cases); therefore, local agents will not be able to connect unless there is a LAN connection.
  • The wireless management interface is not available in state Sx. If the machine is rebooted during a link sensitive flow, the machine will stay in S0.
  • Static IP is not supported on the wireless management interface.
  • The wireless management interface may not be enabled by default depending on which setup and configuration tool is being used (even if valid wireless profiles are configured in the Management Engine and Intel AMT is enabled.)
  • If there are multiple management interfaces, wired and wireless management interfaces can not be on the same subnet concurrently.
  • 802.1x profiles are applied independently on wired and wireless.
34. How can I tell whether or not an API can be executed locally (on the AMT Client) or remotely (from the management console via network access?) You can determine this by finding the API in the Network Interface Guide (one of the documents in the Intel® AMT SDK.) Each API has an entry called “Default Interface Access Permissions” followed by a box that specifies Local Access and Network Access Permissions. Note that these permissions cannot be changed.
35. Does Intel® AMT support Windows* Vista? Intel AMT supports Windows Vista starting with AMT 2.1.
36. How can I make sense out of the AMT Event Log messages? There is a conversion in the IPMI (Intelligent Platform Management Interface) Specification that takes the event data number and turns it into text. You can get the IPMI Specifications at the following link: http://www.intel.com/design/servers/ipmi/spec.htm.
37. Intel® AMT: Emulator, RDK, SDK, DTK - what are they for? These are all tools that can be used when experimenting with or writing applications for Intel® AMT. Here are some brief descriptions and when to use them:

RDK: Reference Design Kit - This is an AMT "solution" written in Java on Linux provided to help developers implement Intel® AMT. It is very much like the DTK, only it is based on older versions of Intel® AMT. This tool is no longer being updated or maintained. Use it only as an example to get started in a Java environment.

DTK: Developer's Tool Kit - This is also a "solution" written in C# on Windows. Since the Source Code is also available, it can also be used as "example code." This tool is also currently being updated and maintained. Use this to get a great idea of how Intel® AMT works and a lot of us also use it to verify if a certain feature is working.

SDK: Software Development Kit - Provides sample code and all the APIs needed for implementing Intel® AMT. Both the RDK and the DTK use the APIs provided in the SDK. Use the most recent release of the SDK to integrate Intel® AMT into your application.

EMULATOR: Please don't use this. It was created to provide an opportunity to exercise Intel® AMT API calls pre-hardware. It is based on much older versions of Intel® AMT and has not been updated to include representation of current hardware. It will not be included in future revisions of the SDK.
38. What features do the various versions of AMT support?
Version of Intel® AMT (2.1 – 3.0) at a Glance
New with AMT 2.1 Intel® AMT 2.2 New with AMT 2.5 New with AMT 3.0
Intel AMT Wake on LAN
TLS_PSK_WITH_NULL_SHA cipher support for setup & configuration process		 Remote Configuration*
VLAN settings for Intel AMT network interfaces*		 Wireless Configuration*
Endpoint Access Control (EAC)*
802.1x*
Power Packages*
Environment Detection*		 WS-Management interface*
System Defense Heuristics*
VLAN settings for Intel AMT network interfaces*
EventLogReader realm*
Remote Configuration*
New in AMT 2.1 * Not Supported in 2.5 * Not supported in 2.1 * Not supported in 2.5