Intel AMT Wifi Interface Link is down with enabled state and wifi profile

[shinomen]

I have a lenovo computer which you can see the specs for at the following link:
https://psref.lenovo.com/Detail/ThinkCentre_M80q_Gen_3?M=11U10010US

I activated the Intel AMT by going into the setup by bios or pressing CTRL+P when booting, changed the password, and activated the network. I then installed the Mesh Agent on the machine in Windows 10 and have the group set to fully automatic for Intel AMT. I have a wireless profile setup in my config.json for mesh central which MeshCentral pushed to the device when automating the Intel AMT. I can connect to the IntelAMT from MeshCentral and see the wireless profile under Network Settings.

However, the wireless interface Link State says "Link is down" and Radio is Off.
For my wifi profile I have

name
ssid
authentication
encryption
password

Do I need anything else to make the wifi active?
Below is a screenshot of what I'm seeing.
I have verified that the wifi in the building is configured correctly and broadcasting. (Which brings up another question: Can the AMT wifi connect if the SSID is not broadcasting?---currently it is but it would be nice to hide that network)

Thanks!

[si458]

sadly i have 0% knowledge of how the intel amt works when it comes to wifi but ill try my best.

how did you access the AMT panel to check the wireless interface?
was in through the meshcentral web ui? meshcommander?

does the laptop have a LAN cable connected? as i dont think the wifi gets activated IF the is a network cable plugged in

[shinomen]

Thanks for the response. Yes I accessed the AMT from the MeshCentral console. Yes the hard wired was connected but I was able to disable the network port the computer was connected to in order to simulate the network be disconnected. The computer went offline and did not connect to the wifi and come back online. I also attempted to shut the computer down with the wired network port enabled and disabled and the amt still did not connect to wifi. My thought was that maybe there was another setting I was missing which enabled the wifi link so that's when I decided to make the post.

[si458]

random idea, unplug network cable completely, unplug laptops battery (if possible), wait 15mins, see if the device connects to your wifi network, then see if its appearing in meshcentral.

you need to check if the device is connected to your wifi network FIRST, if you dont see any DHCP requests or IP addresses asssigned to the device over wifi, them meshcentral wont work.

so this has to be something not setup correctly with the intel AMT side of things for the WiFi,
how does your config.json look?

[shinomen]

I will try this when I am on-site again. Maybe today. It's a desktop computer with wireless built in FYI, no battery to remove but I understand what you are looking for me to do. :)
Here's my JSON file in the meantime. It's not the cleanest......don't judge me. :-)

Thanks

{
   "__comment__": "This is a sample configuration file, edit a section and remove the _ in front of the name. Refer to the user\u0027s guide for details.", 
  "$schema": "https://raw.githubusercontent.com/Ylianst/MeshCentral/master/meshcentral-config-schema.json",
   "settings": {
      "cert": "NPI-mydomain.com", 
      "_mongodb": "mongodb://127.0.0.1:27017", 
      "_mongodbname": "meshcentral", 
      "_mongodbchangestream": true, 
      "_wanonly": true, 
      "_lanonly": true, 
      "_minify": 1, 
      "_sessiontime": 30, 
      "_sessionkey": "MyReallySecretPassword1", 
      "sessionsamesite": "strict", 
      "_dbencryptkey": "MyReallySecretPassword2", 
      "_dbexpire": {
         "events": 1728000, 
         "powerevents": 864000
      }, 
      "_port": 443, 
      "redirport": 80, 
      "_allowlogintoken": true, 
      "_allowframing": true, 
      "_webrtc": false, 
      "_nice404": false, 
      "_clickonce": false, 
      "_selfupdate": true, 
      "_agentping": 60, 
      "_agentpong": 60, 
      "_agentidletimeout": 150, 
      "_mesherrorlogpath": "c:\\tmp", 
      "_npmpath": "c:\\npm.exe", 
      "_npmproxy": "http://1.2.3.4:80", 
      "_allowhighqualitydesktop": true, 
      "_userallowedip": "127.0.0.1,192.168.1.0/24", 
      "_userblockedip": "127.0.0.1,::1,192.168.0.100", 
      "_agentallowedip": "192.168.0.100/24", 
      "_agentblockedip": "127.0.0.1,::1", 
      "_localdiscovery": {
         "name": "Local server name", 
         "info": "Information about this server"
      }, 
      "_tlsoffload": true, 
      "_mpstlsoffload": true, 
      "_no2factorauth": true, 
      "_webrtconfig": {
         "iceServers": [{
            "urls": "stun:stun.services.mozilla.com"
         }, 
         {
            "urls": "stun:stun.l.google.com:19302"
         }]
      }, 
      "_autobackup": {
         "backupIntervalHours": 24, 
         "keepLastDaysBackup": 10, 
         "zipPassword": "MyReallySecretPassword3", 
         "_backupPath": "C:\\backups"
      }, 
      "_redirects": {
         "meshcommander": "https://www.meshcommander.com/"
      },
      "webrtc": true
   }, 
   "domains": {
      "": {
         "Title": "companyname", 
         "Title2": "vPro", 
         "_TitlePicture": "title-sample.png", 
         "_UserQuota": 1048576, 
         "_MeshQuota": 248576, 
         "_NewAccounts": true, 
         "_UserNameIsEmail": true, 
         "_NewAccountEmailDomains": ["sample.com"], 
         "_NewAccountsRights": ["nonewgroups", 
         "notools"], 
         "Footer": "\u003ca href=\u0027https://twitter.com/mytwitter\u0027\u003eTwitter\u003c/a\u003e", 
         "_CertUrl": "https://192.168.2.106:443/", 
         "LoginKey": "eccompro",
         "_PasswordRequirements": {
            "min": 8, 
            "max": 128, 
            "upper": 1, 
            "lower": 1, 
            "numeric": 1, 
            "nonalpha": 1, 
            "reset": 90, 
            "force2factor": true
         },
        "AmtManager": {
        "AdminAccounts": [
          {
            "user": "admin",
            "pass": "supersecretpass22"
          }
        ],
         "wifiProfiles": [
          {
            "name": "ManagementWifi",
            "ssid": "mcmanagement",
            "authentication": "wpa2-psk",
            "encryption": "ccmp-aes",
            "password": "supersecretpassword99"
          }
        ]
      },
         "_AgentNoProxy": true, 
         "_GeoLocation": true, 
         "UserAllowedIP": "127.0.0.1,192.168.250.0/24,192.168.10.0/24",
         "_UserBlockedIP": "127.0.0.1,::1,192.168.0.100", 
         "_AgentAllowedIP": "192.168.0.100/24", 
         "_AgentBlockedIP": "127.0.0.1,::1", 
         "___UserSessionIdleTimeout__": "Number of user idle minutes before auto-disconnect", 
         "_UserSessionIdleTimeout": 30, 
         "__UserConsentFlags__": "Set to: 1 for desktop, 2 for terminal, 3 for files, 7 for all", 
         "_UserConsentFlags": 7, 
         "_Limits": {
            "_MaxDevices": 100, 
            "_MaxUserAccounts": 100, 
            "_MaxUserSessions": 100, 
            "_MaxAgentSessions": 100, 
            "MaxSingleUserSessions": 10
         }, 
         "_AmtAcmActivation": {
            "log": "amtactivation.log", 
            "certs": {
               "mycertname": {
                  "certfiles": ["amtacm-leafcert.crt", 
                  "amtacm-intermediate1.crt", 
                  "amtacm-intermediate2.crt", 
                  "amtacm-rootcert.crt"], 
                  "keyfile": "amtacm-leafcert.key"
               }
            }
         }, 
         "_Redirects": {
            "meshcommander": "https://www.meshcommander.com/"
         }, 
         "_yubikey": {
            "id": "0000", 
            "secret": "xxxxxxxxxxxxxxxxxxxxx", 
            "_proxy": "http://myproxy.domain.com:80"
         }, 
         "_httpheaders": {
            "Strict-Transport-Security": "max-age=360000", 
            "x-frame-options": "SAMEORIGIN", 
            "Content-Security-Policy": "default-src \u0027none\u0027; script-src \u0027self\u0027 \u0027unsafe-inline\u0027; connect-src \u0027self\u0027; img-src \u0027self\u0027 data:; style-src \u0027self\u0027 \u0027unsafe-inline\u0027; frame-src \u0027self\u0027; media-src \u0027self\u0027"
         }, 
         "_agentConfig": ["webSocketMaskOverride=1"], 
         "_SessionRecording": {
            "_filepath": "C:\\temp", 
            "__protocols__": "Is an array: 1 = Terminal, 2 = Desktop, 5 = Files, 100 = Intel AMT WSMAN, 101 = Intel AMT Redirection", 
            "protocols": [1, 
            2, 
            101]
         }
      }, 
      "_customer1": {
         "_DNS": "customer1.myserver.com", 
         "_Title": "Customer1", 
         "_Title2": "TestServer", 
         "_NewAccounts": 1, 
         "_Auth": "sspi", 
         "_Footer": "Test", 
         "_CertUrl": "https://192.168.2.106:443/"
      }, 
      "_info": {
         "_share": "C:\\ExtraWebSite"
      }
   }, 
   "letsencrypt": {
      "__comment__": "Go to https://letsdebug.net/ first before trying Let\u0027s Encrypt.", 
      "email": "[email protected]", 
      "names": "mydomain.com", 
      "rsaKeySize": 3072, 
      "production": true
   }, 
   "_peers": {
      "serverId": "server1", 
      "servers": {
         "server1": {
            "url": "wss://192.168.2.133:443/"
         }, 
         "server2": {
            "url": "wss://192.168.1.106:443/"
         }
      }
   }, 
   "_smtp": {
      "host": "smtp.myserver.com", 
      "port": 25, 
      "from": "[email protected]", 
      "__tls__": "When \u0027tls\u0027 is set to true, TLS is used immidiatly when connecting. For SMTP servers that use TLSSTART, set this to \u0027false\u0027 and TLS will still be used.", 
      "tls": false, 
      "___tlscertcheck__": "When set to false, the TLS certificate of the SMTP server is not checked.", 
      "_tlscertcheck": false, 
      "__tlsstrict__": "When set to true, TLS cypher setup is more limited, SSLv2 and SSLv3 are not allowed.", 
      "_tlsstrict": true
   }
}

[Wlhet]

You need to confirm whether your WIFI network card supports vPro,I have a ThinkCentre_M70q_Gen_4,I also encountered the same problem。Can you show me your wifi card photo?

[shinomen]

@Wlhet
I don't have a photo of the wifi card as it's the internal network card that comes with the computer, but it's a Intel(R) Wi-Fi 6E AX211 160MHz.
The model computer is 11U10010US
You can find the specifications of that computer here
https://psref.lenovo.com/Detail/ThinkCentre_M80q_Gen_3?M=11U10010US
If you search the page for vPro you will see the following for WLAN+Bluetooth: Intel® Wi-Fi® 6E AX211, 802.11ax 2x2 + BT5.3, vPro®
I have attempted to disable the port on the ubiquiti switch that this device is connected to but I have not actually removed the cable to see if that would allow it to connect.