Restart/reset AMT for CIRA connection?

[shinomen]

I have noticed on a few machines where Intel AMT is configured for both CIRA connections and agent connections that the CIRA connection will stop working. When I go into mesh central and click on the machine, it shows connected via agent but the connection to intel AMT says "Not connected". Nothing has changed on these computers that I have seen this issue on and they are in different sites and locations so I don't think it's a configuration issue. I have all my groups setup to do Fully Automatic for Intel AMT. I'm guessing that the Intel AMT somehow has locked up or glitched?
Is there a way to get the intel amt connection to work again by running some mesh or terminal command line to restart the intel amt remotely? I have seen similar things happen with Dell iDRAC's and I know resetting/restarting them will get it to work again so I thought maybe there was a similar process that can be taken with intel amt devices.
Thanks!

[seijikun]

We are seeing the exact same thing.
Early on, right after configuring it, we could (on purpose) disconnect the network, connect it again and it always instantly recovered.
Though after some time, CIRA just stops re-connecting.

• Our device is a Minisforum MS-01
• AMT v16.1.25 activated in Admin Control Mode (ACM)
• We used a random CIRA domain to ensure, that environment detection will always select CIRA

[si458]

without physical acess to hardware which supports AMT v16, we really cant help 😢
donations of money, hardware, etc are really welcome! ❤️ https://www.si458.co.uk/2024/01/05/donation/

[shinomen]

Currently I see two computers it happening to for us.
In one group/site it's a Lenovo M80q Gen 3 Desktop AMT v16.0.15 Activated in ACM and in a totally different group/site it's a Dell OptiPlex Micro 7010 AMT v16.1.27 Activated in ACM.

I'm not sure if this coincides with updating Mesh Central recently or something else funky going on somewhere else, but I have not changed my incoming proxy or network settings for accessing mesh central. I have connected to both of these computers recently in the last month and disabled and re-enabled their hard wired network card in windows device manager for other purposes. Just trying to provide any information that might be helpful.

MeshCentral version is currently 1.1.33, just updated from 1.1.32 but noticed this issue initially under 1.1.32. Not saying that it is 1.1.32 causing the issue though, just want you to know I'm up to date.

In the meantime, is there any way to manually have the MeshCentral agent that is installed on the computer, communicate with the AMT and perform a re-provision in an effort to get CIRA to reconnect? Or is this something that the agent just naturally does every blue moon?

[si458]

you would need to either

1. use the meshcmd.exe for the unprovisioning of the amt
2. unprovision the whole group using the amt policy

[shinomen]

Would that factory reset the AMT either way to where we would have to physically go back on-site and do the whole CTRL+P to enter the settings and then configure anything? Because if it does, then we will have to address that another time, if it does not then we can do that now. Could you provide instruction on how to unprovision using meshcmd as well as the whole group? I think I know what you mean but I would rather confirm and be right then to not confirm and be wrong.......if you are willing? :) Thanks!

[si458]

@shinomen when it unprovisions it wipes info like cira, certs, etc BUT NOT THE AMT PASSWORD!!!
so the password would be watever u set to it to begin with (NOT THE DEFAULT admin PASSWORD)

in theory you can reprovision it again using the meshcmd once its unprovisioned, but maybe give it 5mins in between steps

some docs are here
https://ylianst.github.io/MeshCentral/meshcmd/#intel-amt-state-activation
it will by default activate into the ccm mode, and to go into the acm mode, its a seperate command
the is videos on youtube about it (youtube.com/meshcentral) i cant remember them all off the top of my head!

to unprovision the whole group, select the group in meshcentral, then change the AMT Policy to 'Deactivate' and wait about 5mins
beware tho this will dectivate amt for the whole mesh group and every machine in it!
also this will only work if you have the meshagent installed

for amt only groups, you will have to use the meshcmd which again might require site access if things go tits up!
so have a backup remote control installed if needs be!

[shinomen]

AWESOME! That did it thanks! I changed the group from Fully Automatic to Deactivate and waited a bit. Then I changed the group back to Fully Automatic and sure enough the CIRA connection for that one computer (plus the others) came back and I can now connect via CIRA to it.

Thanks again!

[si458]

oh wow! thats weird? but congrats 🎉