Need help to configure Intel AMT

[VSKUMBHANI]

I have running meshcentral with MeshAgent and its working fine. Now I need to configure Intel AMT. I check the status of AMT but its showing error.

What need to check?

[si458]

You are using the meshcentral installer, so it installs a background service to run meshcentral, you dont need to run the command manually

You should just need to stop the service then start it again

You can also check the server logs inside of C:\Program Files\Open Source\MeshCentral\winservice\daemon\meshcentral.out.log and meshcentral.err.log

[VSKUMBHANI]

Hi,
Thanks for the reply. I checked in browser and I'm able to access the MPS server url. It means MPS is working but I'm not able to connect AMT system.

Checked in meshcentral.err.log and found below logs.

Node.js v21.5.0
node:internal/modules/cjs/loader:1146
throw err;
^

Error: Cannot find module 'C:\Program Files\Open Source\MeshCentral\node_modules\node-windows\lib\wrapper.js'
at Module._resolveFilename (node:internal/modules/cjs/loader:1143:15)
at Module._load (node:internal/modules/cjs/loader:984:27)
at Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:142:12)
at node:internal/main/run_main_module:28:49 {
code: 'MODULE_NOT_FOUND',
requireStack: []
}

Node.js v21.5.0
node:internal/modules/cjs/loader:1146
throw err;
^

Error: Cannot find module 'C:\Program Files\Open Source\MeshCentral\node_modules\node-windows\lib\wrapper.js'
at Module._resolveFilename (node:internal/modules/cjs/loader:1143:15)
at Module._load (node:internal/modules/cjs/loader:984:27)
at Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:142:12)
at node:internal/main/run_main_module:28:49 {
code: 'MODULE_NOT_FOUND',
requireStack: []
}

Node.js v21.5.0
C:\Program Files\Open Source\MeshCentral\node_modules\node-windows\lib\wrapper.js:177
child.send('shutdown');
^

TypeError: Cannot read properties of null (reading 'send')
at process.killkid (C:\Program Files\Open Source\MeshCentral\node_modules\node-windows\lib\wrapper.js:177:11)
at process.emit (node:events:519:28)
at process.exit (node:internal/process/per_thread:192:15)
at monitor (C:\Program Files\Open Source\MeshCentral\node_modules\node-windows\lib\wrapper.js:99:17)
at ChildProcess. (C:\Program Files\Open Source\MeshCentral\node_modules\node-windows\lib\wrapper.js:170:5)
at ChildProcess.emit (node:events:519:28)
at ChildProcess._handle.onexit (node:internal/child_process:294:12)

Node.js v21.5.0

[si458]

Oh u had the node-windows bug I caused and the fix was here #5695 (comment)
But weird it's running as u can access the url
You could just try the link above and reinstall it and see if that help? But remember as u used the installer u don't need to run the node_modules/meshcentral command!?

[VSKUMBHANI]

I have done this. Now my Meshcentral is working proper. But still I'm not able to access the AMT machine. Machine contain the MeshAgent should I need to create AMT Only group to manage the AMT machine or I can manage it with MashAgent also?

I run the command on Agent. meshcmd.exe amtinfo
It return below info.
Intel AMT v11.8.94, pre-provisioning state.
Wired Enabled, DHCP, 14:B3:1F:1D:D2:3F
Connection Status: Outside, CIRA: Disconnected.

I think I need to active CIRA to access it. Am I right?

[si458]

ok so now you fixed it from running, lets move on, (1 step at a time to debug issues)
now go into the 'My Server' tab, then 'Console' tab and type 'info' and check the output
it will show you what versions you are running,
check meshversion is up to date (1.1.19), if not run the web updater,
check nodejs is at least 18, if not, stop the meshcentral service, then install node 18 x64 msi, then start service again,
check runMode is set to wan or hybrid mode, if not, check your config.json and make sure both lanonly/wanonly is uncommented to get it into hybrid mode

[VSKUMBHANI]

Yes, details are as you said.

info
{
"meshVersion": "v1.1.19",
"nodeVersion": "v21.5.0",
"runMode": "Hybrid (LAN + WAN) mode",
"productionMode": false,
"database": "NeDB",

[si458]

right so now, are you trying to activate AMT in CCM or ACM mode?
how have you got the group setup for your device? intel amt only or meshagent group?

[VSKUMBHANI]

I am activating CCM mode and group setup is meshagent.
Below is status showing now in Agent.
meshcmd.exe amtinfo
Intel AMT v11.8.94, activated in Client Control Mode (CCM).
Wired Enabled, DHCP, 14:B3:1F:1D:D2:3F
Connection Status: Outside, CIRA: Connecting to my.domain.com, Periodic.

[si458]

right so if you go into a device, then into the console tab, and type amt it should show you some info?
also if you type amtconfig it will then spit out logs of it activating the machine, what does it say?

[VSKUMBHANI]

These are output of console.

amt
{
core-ver: 1
OsHostname: "C11"
Flags: 2
MeiVersion: "5.0.0.0"
Versions: {
Flash: "11.8.94"
Netstack: "11.8.94"
AMTApps: "11.8.94"
AMT: "11.8.94"
Sku: "16392"
VendorID: "8086"
Build Number: "4494"
Recovery Version: "11.8.94"
Recovery Build Num: "4494"
Legacy Mode: "False"
}
UUID: "4c4c4544-0042-4710-8051-b5c04f484c32"
ProvisioningMode: 1
ProvisioningState: 2
net0: {
enabled: 1
dhcpEnabled: 1
dhcpMode: "ACTIVE"
mac: "14:B3:1F:1D:D2:3F"
address: "0.0.0.0"
}
}
amtconfig
08:39:21, LMS tunnel start.
08:39:22, Checking Intel AMT state...
08:39:26, Intel AMT connected.
08:39:38, Done.
08:39:38, LMS tunnel closed.

And in Server Trace Output as below.

8:39:37 am - MPSCMD: <-- JSON_CONTROL, close
8:39:37 am - MPSCMD: <-- CHANNEL_CLOSE, 10
8:39:37 am - AMT: C11, Remove device, node//55GluBbK8Q8hD0g$RyLrxKv@CvyQ3VQnR8WLavFz$OAY6zVKfM0$Pu72xekb9@OV, 2, 1
8:39:37 am - AMT: C11, Stop Management, node//55GluBbK8Q8hD0g$RyLrxKv@CvyQ3VQnR8WLavFz$OAY6zVKfM0$Pu72xekb9@OV, 2
8:39:37 am - MPS: CIRA websocket closed, mesh//yzg@hKdY0F8BNa1PNUestn5lqRGXeXKvQc0avd36$cHOi7XmTNaMY3BtkEKxSgo2, node//55GluBbK8Q8hD0g$RyLrxKv@CvyQ3VQnR8WLavFz$OAY6zVKfM0$Pu72xekb9@OV
8:39:37 am - MPSCMD: <-- JSON_CONTROL, close
8:39:37 am - MPSCMD: <-- JSON_CONTROL, console
8:39:37 am - AMT: C11, Done.
8:39:36 am - MPSCMD: --> CHANNEL_WINDOW_ADJUST, 10, 17221, 32768
8:39:35 am - MPSCMD: <-- CHANNEL_WINDOW_ADJUST, 10, 17877
8:39:32 am - MPSCMD: <-- CHANNEL_WINDOW_ADJUST, 10, 17395
8:39:32 am - MPSCMD: --> CHANNEL_WINDOW_ADJUST, 10, 17189, 32768
8:39:30 am - MPSCMD: <-- CHANNEL_WINDOW_ADJUST, 10, 16389
8:39:28 am - MPSCMD: --> CHANNEL_WINDOW_ADJUST, 10, 17333, 32768
8:39:27 am - MPSCMD: <-- CHANNEL_WINDOW_ADJUST, 10, 16883
8:39:25 am - MPSCMD: <-- JSON_CONTROL, console
8:39:25 am - AMT: C11, Intel AMT connected.
8:39:25 am - AMT: C11, Initial Contact Response, 200
8:39:24 am - MPSCMD: --> CHANNEL_OPEN_CONFIRMATION, 10, 10, 32768
8:39:24 am - MPSCMD: <-- CHANNEL_OPEN, forwarded-tcpip, 10, 32768, :16992, 1.2.3.4:1030
8:39:24 am - MPSCMD: --> CHANNEL_CLOSE, 9
8:39:24 am - MPSCMD: <-- CHANNEL_CLOSE, 9
8:39:24 am - MPSCMD: --> CHANNEL_OPEN_CONFIRMATION, 9, 9, 32768
8:39:24 am - MPSCMD: <-- CHANNEL_OPEN, forwarded-tcpip, 9, 32768, :16992, 1.2.3.4:1029
8:39:24 am - AMT: C11, LMS-Connect, NoTLS, admin
8:39:24 am - AMT: C11, Attempt Initial Contact, CIRA-LMS
8:39:24 am - AMT: C11, Initial Contact Response, 408
8:39:23 am - MPSCMD: --> CHANNEL_CLOSE, 8
8:39:23 am - MPSCMD: <-- CHANNEL_CLOSE, 8
8:39:23 am - MPSCMD: --> CHANNEL_OPEN_CONFIRMATION, 8, 8, 32768
8:39:23 am - MPSCMD: <-- CHANNEL_OPEN, forwarded-tcpip, 8, 32768, :16993, 1.2.3.4:1028
8:39:23 am - MPSCMD: --> CHANNEL_CLOSE, 7
8:39:23 am - MPSCMD: <-- CHANNEL_CLOSE, 7
8:39:22 am - MPSCMD: --> CHANNEL_OPEN_CONFIRMATION, 7, 7, 32768
8:39:22 am - MPSCMD: <-- CHANNEL_OPEN, forwarded-tcpip, 7, 32768, :16993, 1.2.3.4:1027
8:39:22 am - MPSCMD: --> CHANNEL_CLOSE, 6
8:39:22 am - MPSCMD: <-- CHANNEL_CLOSE, 6
8:39:22 am - MPSCMD: --> CHANNEL_OPEN_CONFIRMATION, 6, 6, 32768
8:39:22 am - MPSCMD: <-- CHANNEL_OPEN, forwarded-tcpip, 6, 32768, :16993, 1.2.3.4:1026
8:39:21 am - MPSCMD: --> CHANNEL_CLOSE, 5
8:39:21 am - MPSCMD: <-- CHANNEL_CLOSE, 5
8:39:21 am - MPSCMD: --> CHANNEL_OPEN_CONFIRMATION, 5, 5, 32768
8:39:21 am - MPSCMD: <-- CHANNEL_OPEN, forwarded-tcpip, 5, 32768, :16993, 1.2.3.4:1025
8:39:21 am - MPSCMD: --> CHANNEL_CLOSE, 4
8:39:21 am - MPSCMD: <-- CHANNEL_CLOSE, 4
8:39:20 am - MPSCMD: --> CHANNEL_OPEN_CONFIRMATION, 4, 4, 32768
8:39:20 am - MPSCMD: <-- CHANNEL_OPEN, forwarded-tcpip, 4, 32768, :16993, 1.2.3.4:1024
8:39:20 am - AMT: C11, LMS-Connect, TLS, admin
8:39:20 am - AMT: C11, Attempt Initial Contact, CIRA-LMS
8:39:20 am - MPSCMD: <-- JSON_CONTROL, console
8:39:20 am - AMT: C11, Checking Intel AMT state...
8:39:20 am - AMT: Start Management, node//55GluBbK8Q8hD0g$RyLrxKv@CvyQ3VQnR8WLavFz$OAY6zVKfM0$Pu72xekb9@OV, 2
8:39:20 am - MPSCMD: <-- REQUEST_SUCCESS, 16993
8:39:20 am - MPSCMD: --> GLOBAL_REQUEST, tcpip-forward, C11:16993
8:39:20 am - MPSCMD: <-- REQUEST_SUCCESS, 16992
8:39:20 am - MPSCMD: --> GLOBAL_REQUEST, tcpip-forward, C11:16992
8:39:20 am - MPSCMD: <-- SERVICE_ACCEPT, [email protected]
8:39:20 am - MPSCMD: --> SERVICE_REQUEST, [email protected]
8:39:20 am - MPSCMD: <-- USERAUTH_SUCCESS
8:39:20 am - MPSCMD: --> USERAUTH_REQUEST user=MeshAgentApfTunnel, service=[email protected], method=password, password=RJWodZdMQ79dYJXRa90R1oUbP4B0jxq@93M6iMkhd9jlv1npec@wllw@NvCWr2W0kP4H70J915OvzQN5Ct0RXLYSVC5eGmHmzxfQXOntx6oWjN6eakFq8CzVkQX@HdbRX$ZGOPEE4KzwxrROEsRThCWricRK$i$xzETW2TcGrZaA$ucqZE76$mJoVGGdLFg8h0jY9lQ9O56$CzXYBBQ@kiLh$U3Fi1buPXmQMKMX1ydkHnxbKaUTWxI6HU0NFCvkoWZdOFe0slJNxka5OgxsBHuXcw==
8:39:20 am - MPSCMD: <-- SERVICE_ACCEPT, [email protected]
8:39:20 am - MPSCMD: --> SERVICE_REQUEST, [email protected]
8:39:20 am - MPSCMD: --> PROTOCOLVERSION, 1, 0, 4c4c4544-0042-4710-8051-b5c04f484c32
8:39:20 am - MPSCMD: --> JSON_CONTROL, meiState
8:39:20 am - MPSCMD: --> JSON_CONTROL, connType
8:39:20 am - MPS: New CIRA websocket connection

[si458]

OK that's strange? What's ur group settings set to? Ie the AMT settings?

[VSKUMBHANI]

It set to Fully Automatic.

[si458]

Huh? That's weird?
One thing you could try is, pull battery out of computer, to reset bios and amt, then let device start up, then go I to the console tab quickly and type, amtconfig and just check it does set it bk up again correctly?
You can also run amtevents to check what amt has done in the past for that device,
Also is the amt connect button enabled in the amt tab?
One other thing u could try is downgrade node 21 to 18/20 and see if it works then?
Don't forget to restart after every change as such
I will have to check with my amt 7 and 12 device when I'm in the office next week I'm afraid,

[VSKUMBHANI]

Okay, Let me check with your suggestions. I'll update here.

[mtran-88]

Hi, my AMT connect button is not enabled. Do you have any suggestions on how to enabled that, and the 'Scan for Intel AMT devices does not give any results? AMT is enabled. Thx!

[amoljagdalepucsd]

Hi @VSKUMBHANI
For me its showing Intel AMT not detected in console command. e.g. amt / amtconfig.
Please suggest how to activate it on device.

[silversword411]

Amt is an option feature of the processor.

If you didn't buy an AMT vpro processor for the extra money, you won't have Amt.

[VSKUMBHANI]

He he he...! Thanks for info. I know it and my processor is vPro enabled.

[Serajalhorany]

The port 4433 is occupied by another device ,

[VSKUMBHANI]

Yes, port 4433 is open.

[si458]

@VSKUMBHANI so what is ur current issue now? As the is loads of issues listed here and we have all lost track 6 months later

[si458]

Right, so are u using the latest version of meshcentral? 1.1.25 trleased few days ago
and are you using at least node 16 or above?
Can u also access https://mymeshcentralserver.com:4433 and see the amt should be here message?

[VSKUMBHANI]

My version is 1.1.25 and URL is accessible.

[si458]

ok, and is ur meshgroup still set the AMT as fully automatic?
and if you want ACM mode (without permission) have you made sure in the intel AMT bios (mebx),
it has the DNS suffix set as your meshcentral server, with a computer name set?
also what is the general tab of the device say? just the AMT line
screenshots of everything plz 👍

[VSKUMBHANI]

Below is screenshot.
Intel AMT SS.

AMT as Fully Automatic SS

[si458]

Hmm right ok so it's in ccm mode (user permission)

to change it to acm (no user permission) you need to go into the intel amt bios (mebx) and set the dns suffix to ur meshcentral dns name

But in theory, the ccm mode should still show the connect button

Can u go into the Intel amt tab of the device and then click connect and it load up the web ui for amt?

What's the output if u go into the console tab and run amtconfig (This will take about 60 seconds)

[VSKUMBHANI]

Intel AMT tab connect showing disabled.

Below is output of amtconfig

amtconfig
Enabled live view of Intel AMT configuration events, "amtevents off" to disable.
17:01:53, LMS tunnel start.
17:01:54, Checking Intel AMT state...
17:02:00, Intel AMT connected.
17:02:10, Added server root certificate.
17:02:18, Done.
17:02:18, LMS tunnel closed.

[si458]

ok so whats the output of running amt in the console tab?

[VSKUMBHANI]

amt
{
core-ver: 1
OsHostname: "C111"
Flags: 2
MeiVersion: "5.2.0.0"
Versions: {
Flash: "11.8.94"
Netstack: "11.8.94"
AMTApps: "11.8.94"
AMT: "11.8.94"
Sku: "16392"
VendorID: "8086"
Build Number: "4494"
Recovery Version: "11.8.94"
Recovery Build Num: "4494"
Legacy Mode: "False"
}
UUID: "4c4c4544-0042-4710-8051-b5c04f484c32"
ProvisioningMode: 1
ProvisioningState: 2
net0: {
enabled: 1
dhcpEnabled: 1
dhcpMode: "PASSIVE"
mac: "14:B3:1F:1D:D2:3F"
address: "0.0.0.0"
}
}

[si458]

i have an AMT v7 and its showing MeiVersion: "11.0.0.34052"
but yours is showing MeiVersion: "5.2.0.0" and ur using AMT v11 ?
so i dont think you have the correct/latest AMT drivers installed on the computer from intel or your motherboard manufacturer?
but i could be mistaken tho?

[si458]

what you might also need to do is FULLY UNPROVISION the machine from within the AMT bios (mebx)
then restart the machine and try let it activate it again

[VSKUMBHANI]

Okay, let me check it.
Thanks for your help. @si458