A common error seen in the AMT logs when trying to provision Intel vPro systems is 'Properties Script Failed'. This error indicates that a provisioning attempt has failed, and leaves the system in an unprovisioned state. Use this guide to understand the common problems associated with this error and how to work around them, including details of how to obtain more information. This error in and of itself is generic and the cause for it may vary.

Introduction

Generic errors are often the hardest to troubleshoot because of the lack of details. With the error 'Properties Script Failed' the Out of Band Provisioning piece (OOBProv.exe) has returned an error when trying to provision an Intel vPro system. The errors returned by OOBProv vary, but the Intel SCS component produces this generic error when provisioning isn't successful. The error by OOBProv is not logged by default. Learn here how to get that error details and the most common causes and their resolutions.

Out of Band Trace Logging

Trace logging can be invaluable in discovering the cause of this generic error message. While the trace data can often be difficult to sift through, it is the place to discover the true cause of the issue.

Setting Up the Trace

To enable trace logging in Out of Band Management, follow these steps:

1. Go to Start > Run, type Regedit, and click OK.
2. Browse to HKEY_LOCAL_MACHINE > SOFTWARE > Altiris > eXpress > Notification Server > ProductInstallation > {09954bad-a09c-43ce-b8ad-407b6b93c936}.
3. Create a DWORD value within the above key named TraceLevel (case sensitive).
4. Set the value at FF hex, or 255 decimal, as shown in this screenshot:
   

   Click to view.

5. Download dbgview.exe (DebugView from Sysinternals/Microsoft) from www.sysinternals.com (you'll be redirected to Microsoft), click into the Miscellaneous section, and download Debugview. Note that you can use another debugger program to capture the trace elements, but this utility is free to download and use.
6. Execute dbgview.exe.
7. Ensure all Capture options are checked under the 'Capture' menu.
8. Leave the trace running and when the Properties Script Failed message appears in the AMT Log, there should be corresponding entries in the trace.
9. Use the Save command when trace logging in complete.

Tips for examining the log

The trace elements are not user friendly to read, but text messages should appear. The following details provide assistance when reading the trace data in conjunction with this error:

• Do not actively use the Provisioning nodes in the Altiris Console as this will generate a lot of trace data.
• Search for 'OOBProv' to find entries related to the Properties Script Failed error.
• A common cause for this issue is the FQDN. Try searching for FQDN and see what messages are being logged.

An example of a common log entry with an FQDN mapping problem is displayed here:

00012371    2741.16528320    [736] [D][44424] Searching by uuid = 'FA535827-ECD4-11DB-BBDA-4BC2BCEE001A'...     
00012372    2741.16528320    [736] [D][44424] Executing 'sp_OOBSC_FindResource', parameters:     
00012373    2741.16528320    [736] [D][44424] @UUID: FA535827-ECD4-11DB-BBDA-4BC2BCEE001A [String]     
00012374    2741.16552734    [736] [D][44424] @FQDN:  [String]     
00012375    2741.16552734    [736] [D][44424] @HostName:  [String]     
00012376    2741.16577148    [736] [D][44424] @IP:  [String]     
00012377    2741.16577148    [736] [D][44424] @MAC:  [String]     
00012378    2741.28198242    [736] [D][44424] Result:     
00012379    2741.28222656    [736] [D][44424] Executing 'sp_OOBSC_FindResource', parameters:     
00012380    2741.28222656    [736] [D][44424] @UUID: 275853FA-D4EC-DB11-BBDA-4BC2BCEE001A [String]     
00012381    2741.28295898    [736] [D][44424] @FQDN:  [String]     
00012382    2741.28295898    [736] [D][44424] @HostName:  [String]     
00012383    2741.28295898    [736] [D][44424] @IP:  [String]     
00012384    2741.28295898    [736] [D][44424] @MAC:  [String]     
00012385    2741.32055664    [736] [D][44424] Result:     
00012386    2741.32275391    [736] [D][44424] Can't find resource for 'FA535827-ECD4-11DB-BBDA-4BC2BCEE001A'     
00012387    2741.32275391    [736] [D][44424] No FQDN/ADOU found in NS DB for 'FA535827-ECD4-11DB-BBDA-4BC2BCEE001A'     
00012388    2742.61450195    [736] [D][44424] No FQDN/ADOU found for 'FA535827-ECD4-11DB-BBDA-4BC2BCEE001A', new AMT mapping can't be created     

Note that the FQDN search would find this entry. Useful Search strings include:

1. FQDN - Since FQDN discovery is a common cause of this issue, this becomes a recommended search.
2. UUID - Altiris SCS uses the UUID as the prime identification of a system, and problems associated with it are important to find.
3. Can't - This can reveal messages relating to failed functions.
4. Error - A generic but effective search string.
5. Exception - Exceptions in the code are important to find.
6. OOBprov - As previously indicated this piece is the one that generates this generic message.
7. Failed - If the process fails at something, it's good to know.

Issue: FQDN

The most common cause of this error is the inability of the OOBProv process to discover what the FQDN (Fully Qualified Domain Name) is for a given hello packet. The identifier used to link to the FQDN is the UUID. This Universally Unique IDentifier is contained within the hello packet including the IP Address of the system. This IP Address can be used to identify the FQDN via DNS, however this can be a risky method due to the possibility that the IP Address is no longer accurate. The following methods can be used to rectify this situation so that the FQDN can be obtained by OOBProv.

DNS Lookup

In Out of Band Management, the default install does not try to attempt an FQDN acquisition using the IP Address. This was done being sensitive to the way IP Addresses can be reassigned, especially when a system is going through a build or imaging process. Items such as PXE boots, AMT IP requests, and OS reconfigurations including name changes can change the IP Address assigned to the physical device. The method for DNS lookup to use the reported IP Address in the AMT's hello packet for FQDN resolution is located under the configuration of the Resource Synchronization. In the Altiris Console browse to View > Solutions > Out of Band Management > Configuration > Provisioning > Intel AMT Systems > and click on Resource Synchronization. See the screenshot below for details. Check the option entitled:

• Use DNS IP resolution to find FQDN when assigning profiles.

Once this option is checked, OOBProv will use DNS to try and find the IP Address of the system.

OOB Discovery

For those systems that are managed within the Altiris Notification Server infrastructure, the best method to allow provisioning is to run the OOB Discovery (Out of Band Discovery) Task. This task executes by the Altiris Agent and does a check to see if the system is AMT capable. If it is, the following information will be collected and placed within the Altiris database relating to AMT:

• _ResourceGuid
• AMT Capable
• AMT Enabled
• IDE Redirection Enabled
• Serial Over LAN Enabled
• Network Interface Enabled
• UUID

This data correlates by _ResourceGuid to the basic NS Resource tables, namely Inv_AeX_AC_Identification and Inv_AeX_AC_Location. The Location table contains the FQDN captured by the Altiris Agent, and is passed to OOBProv at provisioning time. The Task for OOB Discovery is located in the Altiris Console under View > Solutions > Out of Band Management > Configuration > Out of Band Discovery, as shown in this screenshot: The default collections account for all managed systems in the following collections:

• All 32-bit Windows XP Computers
• All 64-bit Windows XP Computers
• All Windows 2000 Professional Computers.

If you are using Vista systems, please add the Vista collections so they are included in this Discovery policy. This policy executes the file located at: C:\Program Files\Altiris\Notification Server\NSCap\Bin\Win32\X86\OOB\Discovery (path may vary if Notification Server was installed on a different drive or to a different path). The files in use are:

• ClientUtility.exe
• ClientUtility64.exe
• BMAPI.dll
• BMAPIa.dll

The command line used for Discovery is:

ClientUtility.exe -mode:discovery

Noted in the preceding screenshot the policy is set to: 'Run once ASAP'. This means each system will only ever run the OOB Discovery Task once. This also means any new computers receiving the task will also execute it once. This should be sufficient for most environments, but if another discovery needs to be run, a schedule can also be set in additional to the ASAP option.

Other Issues

When discovering the issue using the trace log, the issue may not be caused by the inability to find the FQDN of the system. In these cases the logs should provide details on what's causing the error. Search the Altiris Knowledgebase, found here: https://kb.altiris.com/ You can refine the search to Out of Band Management by looking under the 'Search Within:' section and selecting 'Altiris Products' from the 'All Categories' dropdown. A new Product dropdown will appear. Choose 'Out of Band' from this dropdown, which will subsequently show a version dropdown. This screenshot demonstrates this: It's possible the trace logs will not reveal where the problem is coming from. If this is the case, we must rely on the AMT Logs to see if the issue is detailed by Intel SCS directly. Look for errors surrounding the 'Properties Script failed' entries to see if they are paired with another error message. Also check the Action Log to see what actions were attempted when Provisioning failed. If another common cause for this issue is discovered, this document will be updated accordingly.

Conclusion

This document provides solutions for the most common cause of this error. Since the message 'Properties script failed' is generic for 'Something went wrong with Provisioning', it's possible the problem comes from another source. If none of the above helps, please contact Altiris, now a part of Symantec, Support for further assistance (contract may be required).