Quoting - Gael Holmes (Intel)
Yes... I closed the issue because Javier said he figured things out. He did post a blog detailing the issues he ran into which caused most of the problems.

Trevor - what too are you using to provision your system? SCS? or the SCS Lite tool? You have enabled the Redirection port, correct?

Hello,

Thanks for the responses, Gael and Lance.

I am using Microsoft System Center Configuration Manager 2007 SP1 to provision the AMT devices. I get the same error message connecting to both an AMT 3.2.1 device, and an AMT 5.0.1 device. Most of the other functions of the Intel AMT DTK Commander tool work just fine, but I have never been able to use the Serial-over-LAN feature of it.

I do have the IDE-R, Serial-over-LAN, and WebUI features enabled in my out-of-band service point configuration in SCCM. I can connect to the WebUI from the Windows 2003 site server that provisioned the device.

I am able to use the Microsoft SCCM OOBconsole utility to perform serial-over-LAN functions on the same AMT devices that are having an issue with the DTK Commander tool, so I know that the certificate verification is working as expected. This would appear to be some sort of issue with the implementation of the DTK Commander tool.

Trevor Sullivan
Systems Engineer
OfficeMax Corporation

Hello Tim and Gael,

Thank you for your responses. I will do my best to provide you the information necessary to determine the problem, although I will need some help in determining how to find out what you need to know, in some cases.

Version: I am using the ATM DTK Commander 0.6.8340.2 (pulled from the Details tab of the executable file's properties in Windows Explorer).
Provisioning Certificate: We use a Verisign standard SSL provisioning certificate to provision our AMT devices. It uses the OU verbage of "Intel Client Setup Certificate" rather than an OID (which costs a lot from a 3rd party).
Internal CA: We have a tiered domain structure, with an Windows 2003 Enterprise Root CA in the root domain, and our subordinate CA in the child domain. The ConfigMgr site servers also sit in the child domain.
AMT Web Server Template: We have configured the AMT Web Server Certificate template according to the Microsoft documentation, and it works great when using Serial-over-LAN with the Microsoft out-of-band console.

Can you tell me how to find out whether or not I'm using mutual authentication or not?

Thanks,

Trevor Sullivan
Systems Engineer
OfficeMax Corporation

Quoting - Tim Tool Guy Duncan (Intel)

Hi Trevor,
I'm the support guy for the Managabilty Commander Tool. Can you share some specifics with me so I can try and replicate here? To start, what version of Commander are you using? We posted a new version last week, but I don't recall any specific SOL fixes going into that one. Also, details on your certificate? Did you create the certificate, or is it something purchased (if so, what vendor & product). What level of certificate is it? Are you using mutual or server authentication? Certificate Authority vendor/version/configuration? Is all this on the same server or is it distributed? Anything else you can think of.I see you're seeing this issue regardless of AMT 3.x or 5.x so I'm sure I have the required hardware here.

Best regrards,
Tim
support_dopd_swe@intel.com

Gael,

I have our subordinate and root CA certificates installed in both the [machine-level] Trusted Root CA store, and the [machine-level] Intermediate CA store.

The subordinate and root Verisign certificates appear in their proper locations, the intermediate CA store, and trusted root CA store, respectively.

All of the above is in reference to the system running the Intel AMT DTK Commander tool. Is this the information you are seeking?

Trevor Sullivan
Systems Engineer
OfficeMax Corporation

Quoting - Gael Holmes (Intel) Hi Trevor,
Unlike server authentication where the Management Console has to prove who it is to Intel AMT, Mutual authentication is the case where the Management Console also requires Intel AMT to prove "who" it is. So instead of one certificate along with it's root certificate, both systems have the other's root cert in addition to their Certificate. Where all have you installed Certificates (and their associated Root Certificates?)

Hi Tim,

I submitted the information you requested to the e-mail address you requested. Keep in mind, that although I replicated the problem this morning again, it didn't log anything new to the exception log .... I'm not sure if this will help you or not.

Trevor Sullivan
Systems Engineer
OfficeMax Corporation

Quoting - Tim Tool Guy Duncan (Intel)

Hi Trevor,

I missed a critical request, please send me the exceptions.txt file(s) from the directory you launch Commander from - that will go a long way to getting us to an answer for you. Sorry about that. support_dopd_swe@intel.com

Quoting - Trevor Sullivan

Tim,

Because of completely separate problems around the Microsoft OOB Management Console included with Configuration Manager 2007 SP1, I am unable to get our support staff up and running with any real AMT use cases yet.

All in all, I wouldn't call this a "high" priority, but considering the vast array of issues we've been having over the past year or so, I would definitely like to get this fixed sooner rather than later. I've been working very hard (and closely with Intel) on getting Intel vPro functional in the OfficeMax IT environment, and have run into roadblock after roadblock. Many of these issues have been environmental, but a few of them have also been vendor interoperability challenges (Intel & Microsoft). The sooner I can get some real, functioning tools into the hands of our lower level support staff members, and get them trained on their usage, the sooner OfficeMax can start realizing the benefits of this awesome technology.

If you want more information on the OOBconsole issue I'm having, please check out this thread on the vPro Expert Center discussion forum. I submitted a ticket to Microsoft Premiere Support just this morning about the issue. I apparently will not be getting any feedback until next week on it, as one of two primary AMT/ConfigMgr support representatives at Microsoft, who I've worked with in the past, will not be back in the office until then.

Thanks for hearing me out, and sorry if this sounds like I'm complaining. I've just been through a lot. :)

FYI, I am currently using the "Manageability Developer Tool Kit - v. 0.6.08337.2" (pulled from the release notes). I will attempt to install and use the newest version to see if that resolves the problem. Thanks for the recommendation.

Trevor Sullivan
Systems Engineer
OfficeMax Corporation

Quoting - Tim Tool Guy Duncan (Intel)

We did fix an issue anot so long agofor a sub-CA problem. So giving the latest 06.9037 http://software.intel.com/en-us/articles/code-samples-license-2/?target=http://software.intel.com/file/10854
build a try might just do the trick. I'll keep digging on this end until I hear you've got it working. I do need to ask how critical this failure is to you. If a fix is required we will need to prioritize this work against other "opportunities." ...td

Gael,

I tried the latest version of the Intel AMT DTK that you linked to, and it still exhibits the same error during Serial-over-LAN sessions.

Trevor Sullivan
Systems Engineer
OfficeMax Corporation

Gael,

I'm not running any firewall software on my laptop, and I haven't gotten any blocking notifications from my anti-virus software.

And yes, because the ConfigMgr OOBconsole works, I would imagine that there isn't anything being blocked. Each utility should be using the same TCP ports to contact the AMT device (16995 for SoL, and 16993 for TLS communications).

Edit: I did send the log file to Tim earlier today, BTW.

Trevor Sullivan
Systems Engineer
OfficeMax Corporation

Quoting - Gael Holmes (Intel)
Thanks for the quick response - I think you'll have to get Tim the log file. Just out of curiosity, do you have something that might be blocking some of the messages going back and forth? Do you have a sniffer going during cases where it works and where it doesn't?Sometimes anti-virus programs and firewalls cause problems if they are not set up correctly - but I suspect if that was the problem you would not have success with SOL/IDE-r using any tool.

Hmmmm I thought I had posted back here earlier to say that I uninstalled the old AMT DTK and installed the new DTK and am still receiving the exact same behavior running the Commander against an AMT 5.0 system.

Is there anything else you would like from me?

Do you have a lab environment where you can easily provision an AMT device with a similar configuration to mine, using Configuration Manager, and see if you can replicate the issue?

Trevor Sullivan
Systems Engineer
OfficeMax Corporation

Hello,

It seems that the error is occurring in the ExSOLOpenTCPSession method in AmtRedirectorWrapper.cs. The call to IMR_SOLOpenTCPSession on line 661 returns IMRResult.IMR_RES_TLS_CONNECTION_FAILED and assigns the value to a variable named "r".

I'm not sure if it matter at all, but the IntPtr variable data has value 98034960 just prior to the call to Marshal.FreeHGlobal(Data).

Any ideas with that added info?

Trevor Sullivan
Systems Engineer
OfficeMax Corporation

Alright, well the IMR_SOLOpenTCPSession method is defined in the unmanaged imrsdk.dll library. Unfortunately I don't believe I have visibility into this source code, so my troubleshooting will probably end here.

[DllImport("imrsdk.dll")]
static extern IMRResult IMR_SOLOpenTCPSession(uint clientId, byte[] loginparams, IntPtr touts, IntPtr loopback);

----

Hmmmm, I see that there is a n imrsdk.ini file in the same folder as imrsdk.dll. Looking inside this file, there is a parameter called Debug_Level. Can I set this to a non-zero value to enable logging? What values would be valid?

Trevor Sullivan
Systems Engineer
OfficeMax Corporation

Now this is interesting ... so, because the ConfigMgr OOB console works, and the DTK Commander doesn't, and also because I have isolated the problem to a call into imrsdk.dll, I had a suspicion that the there was possibly a difference between the version of imrsdk.dll included with ConfigMgr versus the one included in the AMT DTK tools & source.

I just cross-checked the versions of imrsdk.dll in the ConfigMgr console i386 subfolder, and the version included with the DTK source, and here is what I found:

ConfigMgr (imrsdk.dll)
------------------------------
File Version: 1.0.1.54
Product Version: 1.0.1
Date Modified: 4/8/2008 6:27 PM
Copyright: Copyright (c) 2000-2006 Intel Corporation

AMT DTK (imrsdk.dll)
----------------------------
File Version: 1.1.2.0
Product Version: 1.1.2
Date Modified: 2/19/2009 2:43 PM
Copyright: Copyright (c) 2004-2008 Intel Corporation, All rights reserved

Trevor Sullivan
Systems Engineer
OfficeMax Corporation

Alright, so I replaced imrsdk.dll in the DTK with imrsdk.dll from the ConfigMgr console, and it still exhibits the same exact error. :-(

Trevor Sullivan
Systems Engineer
OfficeMax Corporation

Tim,

No, I completely agree .... building an SCCM environment isn't exactly a simple task. Thank you for taking the time to try replicating my issue though.

I would also like to extend the offer to you, to set up a Live Meeting session so that you can see (and/or debug) the issue on my system(s). I have a couple different machines we could work with, one running Vista and one running XP, and you could easily see the issue we're having.

If you would like to do this, let me know what times would work well for you, and I will set up a session through our conference provider.

Trevor Sullivan
Systems Engineer
OfficeMax Corporation

Quoting - Tim Tool Guy Duncan (Intel)

Hi Trevor,

I really appreciate your tenacity & patience here. Please ignore the last email for more detail ;) I'll get in the lab by by noon tomorrow (my afternoon is shot today) and attempt to replicate. Building the SCCM wasn't easy.
Tim

Javier,

I have tried Windows XP, Windows Server 2003, and Windows Vista. All of them exhibit the same behavior. Thank you for the suggestion though.

Can you expand on the idea of disabling TLS certificates? How do I do this on an AMT device that has already been provisioned with Configuration Manager?

Trevor Sullivan
Systems Engineer
OfficeMax Corporation

Quoting - javierandrescaceres

Hello Trevor,

Wow, you're facing some of the same problems I got =)
Maybe there are a couple of things you can try:
-Why don't you disable TLS certificates and try again? it'sjust to isolate the problem.
-Is theDTK installed in a Windows Vista machine? It'd be nice if you install in a WinXP just to try.

Good luck

Hey Tim,

Got anything new for me, or do you need any more information about this issue?

Trevor Sullivan
Systems Engineer
OfficeMax Corporation

Quoting - Gael Holmes (Intel)
Hi Trevor - are you and Tim working off-line on this issue?Just wondering since there haven't been any updates.
--Gael

Gael,

I appreciate you following up. I e-mailed him for a status update on March 10th, but haven't heard anything back yet. Can you see where he's at with this?

Also, he called me up a couple weeks ago and gave me his phone number, but I don't think I wrote it down. Would you mind e-mailing that to me offline? FirstLast@OfficeMax.com

A tidbit of information that might be helpful .... I was able to get the utility to work on Windows 2003, but not XP or Vista.

Thanks,

Trevor Sullivan
Systems Engineer
OfficeMax Corporation

Javier,

Thanks for the posting. I've configured the debug_level property to 2 in the imrsdk.ini file, per the directions in your article. Here is the contents of the log.txt file, after attempting to use Serial-over-LAN with this debug level:

LOG STARTED Sun Mar 22 12:10:22 2009
NETMGR: Signal socket created: 1716
SSLSocket::connect: func SSL3_GET_SERVER_CERTIFICATE, reason certificate verify failed

Do you know what this means, and how to resolve it?

Trevor Sullivan
Systems Engineer
OfficeMax Corporation

Quoting - javierandrescaceres
Hello Trevor,

Have you ever read my post about this error message?
Maybe this hels you:
http://software.intel.com/en-us/blogs/2009/03/19/troubleshooting-the-imr...