Can Intel® Active Management Technology (Intel® AMT) Be Provisioned Using a USB Drive?

Problems finding the USB tool to provision Intel® AMT

This method allows you to set the required values using a USB drive. This method only works if AMT is not provisioned, and the Management Engine BIOS Extension (MEBx) password is known (default MEBx password is: admin).

Step 1: Download USBFile.exe

1. Download the Intel® AMT SDK
2. Extract the Intel® AMT SDK, and then extract USB_File_Module.zip
   • The command line utility you need is bin\USBFile.exe

Step 2:

Get the SHA256 Thumbprint of your root CA Note: You can skip this step if you already have a publicly signed Intel® AMT provisioning certificate and will only need to set the DNS Suffix.

Obtain the root CA certificate (DER or Base64 .cer format) of the trust chain that signed the Intel® AMT provisioning certificate

• • This must be the root CA certificate, not an intermediate CA certificate
  • You can export from Certificate Manager:
    1. In the task bar search, type Certificates
    2. Select Manage User Certificates
    3. Click into Trusted Root Certificate Authorities->Certificates
    4. Find your Root CA and right click, choose All Tasks->Export
    5. Click Next and choose DER encoded binary X.509 (.CER)
    6. Name it rootca.cer
    7. Finish the rest of the wizard

1. Open a PowerShell prompt
2. Run:
3. $path = "C:\full\path\to\your\rootca.cer"
4. $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($path)
5. $cert.GetCertHashString("SHA256")
6. Copy the string from the output of the above command, you will need this in the next step.

Step 3:

Create setup.bin

1. Open a command prompt and navigate to the USB_File_Module\bin
2. Run the command

• • The command you will run is USBFile.exe with the following params:
    • -create setup.bin This specifies to create a new setup.bin file. This must always be named setup.bin
    • current_mebx_password new_mebx_password The Management Engine BIOS Extension (MEBx) is part of the BIOS where Intel® AMT parameters are set
      • Both current and new are required for this command
      • If you have already set the MEBx password, use the same value for both
      • The default password for MEBx is "admin"
      • The MEBx password must be between 8 and 32 characters long and include a mix of upper and lower case letters, digits, and special characters
      • Review the MEBx section for more information
    • -dns your-domain-suffix.com Use this option if you are enrolling over wireless, or not within your environment where DHCP Option 15 is not set to the DNS Suffix specified in the Intel® AMT provisioning certificate
      • Use the DNS Suffix you set in the Intel® AMT provisioning certificate
    • -hashStr [sha256_thumbprint] your-domain-suffix.com Use this option if the Intel® AMT provisioning certificate is signed by your CA and not a publicly trusted CA
      • The SHA256 thumbprint is obtained in Step 2
      • The second value should be your domain suffix
  • USBFile.exe -create setup.bin current_mebx_password new_mebx_password -dns [your dns suffix, e.g. demo.com] -hashStr [SHA256 Thumbprint of the CA that signed the AMT Provisioning Cert] [your dns suffix, e.g. demo.com]
  •  

Example 1 Set the MEBx password to: P@ssw0rd, dns suffix, and CA Trust

USBFile.exe -create setup.bin admin P@ssw0rd -dns example.com -hashStr 5FC7CB2037309BC9605DBC1CD6049CB574A56F730E656F6C69694994F8C55306 example.com

Example 2 The MEBx password is unchanged, set dns suffix and CA Trust

USBFile.exe -create setup.bin P@ssw0rd P@ssw0rd -dns example.com -hashStr 5FC7CB2037309BC9605DBC1CD6049CB574A56F730E656F6C69694994F8C55306 example.com

Example 3 The MEBx password is unchanged, set just the DNS Suffix

USBFile.exe -create setup.bin P@ssw0rd P@ssw0rd -dns example.com

Example 4 The MEBx password is unchanged, set just the CA Trust

USBFile.exe -create setup.bin P@ssw0rd P@ssw0rd -hashStr 5FC7CB2037309BC9605DBC1CD6049CB574A56F730E656F6C69694994F8C55306 example.com

Step 4: Verify setup.bin Run:

USBFile.exe -view setup.bin

You should see the values you specified in the output

Step 5: Run the pre-provision

1. Copy setup.bin to the root of a USB drive
   • Note: If you need to format the USB drive, use an admin command window and run:
2. format [drive_letter_of_your_usb] /FS:FAT /V:AMT_USB
3. Insert the USB drive in the system you want to enroll and reboot
4. You should see a prompt
5. Found USB Key for Provisioning.
6. Continue with Auto Provisioning (Y/N) ?

Note: Sometimes the prompt asks for Enter/Esc

6. • Press Y or ENTER
7. You should see a confirmation:
8. Configuration Settings from the USB file were successfully applied.
9. Press any key to continue with system boot...
10. Press any key, and the system will boot. The parameters are now set.