Frequently Asked Questions (FAQ)

MAP uses a multitenancy architecture, meaning that MAP customers are using the same Intel EMA server.

Even though customers are using the same Intel EMA server, they are not aware of each other, and each customer's data is kept completely separate.

Each customer is given access to a tenant created specifically for them. Each tenant's data is isolated and remains invisible to other customers.

To understand multitenancy, think of how banking works. Multiple people can store their money in the same bank, but their assets are completely separate, even though they are kept in the same place. Customers of the bank do not interact with each other, do not have access to other customers' money, and are not even aware of each other.

You can identify the generation of your processor if it is an Intel® Core™ processor.

The generation is indicated by the first number after i9, i7, i5, or i3. For example, in the Intel® Core™ i9-11950K processor, the number 11 indicates it is from the 11th generation.

To view your system information, including details about the processor, use “System Information.”

Intel EMA agent is able to activate & configure Intel AMT for the following ME firmware versions

Intel AMT cannot get activated and configured by the Intel EMA Agent when the ME firmware version is 10 or earlier.
The first number of the ME Firmware Version is linked to the Intel Core Processor Generation. In other words a ME Firmware update will never change the first number of the ME Firmware version

Open a browser and navigate to the Intel EMA server: https://emea1.mappcmanager.com

Login with your credentials (user name & password)
The Tenant Administrator needs to use the following credentials:

Once you have successfully logged in, you´ll be directed to tenant´s home screen. If you are in the correct environment, your tenant´s name (company name) should be displayed on screen.

To change your password, locate the small icon in the top right corner with your login initials. Click on the icon to initiate the password change process.

Your Tenant is created with a default endpoint group using a default Intel AMT profile.

On the left sidebar, find and click on the “Endpoints Group” icon.

Within the endpoint groups screen, the endpoint group with name “Default Endpoint Group” is listed.

Remember, this “Default Endpoint Group” is automatically generated during tenant setup.

On the top of the screen click on “Intel AMT Profiles”.

The Intel AMT profile with name “Default AMT Profile” is listed:
Remember, this “Default AMT Profile” is automatically generated during tenant setup.

By clicking “View” you will see the details of the “Default AMT Profile”

Click on “Cancel” to return to the screen with the Intel AMT profiles.
On the top of the screen click on “Endpoint Groups” to return to the screen with the endpoint's groups.

Click the arrow under “Actions” and select “View Configuration” for detailed insights.

The configuration view provides information about permitted in-band functionalities within the endpoint group.
Click on “Intel AMT auto setup” to get more details about the used Intel AMT profile and the selected AMT provisioning method.

Click in the left sidebar on the “Endpoints Group” icon to return to the list of endpoint groups.
Of course, you can create your own endpoint groups and Intel AMT profiles (FAQ Question How to Set up Endpoint Groups and Intel AMT Profiles).

From the list of endpoint groups select the endpoint group you want to work with.

Click the arrow next to the endpoint group´s name and choose “Create Agent Files”.
In the "Generate Agent Installation Files" screen, download both the endpoint agent and the agent policy file.
Manually copy these downloaded files to each PC (endpoint) where you intend to install the agent. Alternatively, utilize a distribution tool for this purpose.

Following the successful download, proceed to install the agent as a local administrator on each PC. Ensure that the agent and agent policy files have the same name and are kept together.

The registration process runs automatically once the Intel EMA agent is successfully installed on the endpoint. The endpoint will be listed in the endpoint group that was used to download the 2 agent installation files. If the endpoint is a vPro PC, the provisioning will be done automatically when the Intel AMT auto setup is enabled in the endpoint group profile.

Click in the left sidebar on the “Endpoints” icon to access the list of endpoints on you Intel EMA Web Interface.

Refresh the webpage with endpoints until it shows the endpoint that the Intel EMA agent is installed on.

Click on “view” for the endpoint.

The General tab with detailed information about the endpoint will be shown.

First of all, check if the Intel EMA agent is connected.

If “Intel Active Management Technology” or “Intel Standard Manageability” is shown for Hardware Management Capability then you are dealing with a vPro PC.

Once the Intel EMA agent is connected, the provisioning process will start when it is a vPro PC.

You will probably see different phases when you refresh the webpage.
Finally you should see Intel ME is in Client Control Mode and Intel AMT setup status is Provisioning Completed. CIRA (Client Initiated Remote Access) should now be connected.

Click on the “Endpoints” icon on the left sidebar to access the list of endpoints.
On the left side, you can select filters based on the Endpoint Group, Connection Status, Power State or Intel AMT Status
You have the possibility to launch actions on several endpoints at once.
For instance, select multiple endpoints and click on Actions. You will see a dropdown menu of the possible actions, mainly power control commands.
Some actions are greyed out since they cannot be executed on all selected endpoints.

Let us focus on a particular endpoint. Click on “view” for an endpoint.
The General Tab for the selected endpoint will be shown. Different tabs are available.
The General Tab displays general information about the endpoint, such as power state and connection status.
In the Hardware Manageability tab, you can perform out-of-band Intel® AMT operations. It can only be used when the endpoint is a vPro PC with Provisioning Completed and CIRA needs to be connected.
The Desktop tab provides remote desktop functionality. It can be used when the EMA agent is connected. When the EMA agent is not connected this tab will be greyed out.
The Terminal tab provides both in-band and out-of-band remote terminal functionality. Only text-based commands are supported.
In order for the in-band remote terminal functionality to work the EMA agent needs to be connected. For the out-of-band remote terminal functionality to work CIRA needs to be connected.
The Files tab provides in-band remote file browsing functionality. It can be used when the EMA agent is connected. When the EMA agent is not connected this tab will be greyed out.
The Processes tab provides in-band remote process management functionality. It can be used when the EMA agent is connected. When the EMA agent is not connected this tab will be greyed out.
The WMI tab allows to run a Windows Management Instrumentation (WMI) query or WMI action on the endpoint. It can be used when the EMA agent is connected. When the EMA agent is not connected this tab will be greyed out.

If you click on Actions, a dropdown menu is shown providing commands that can be executed to manage the endpoint, such as power control commands.

I want to highlight one element that is shown in red: “Stop managing endpoint” By clicking on “Stop managing endpoint” a pop-up window will appear.

If you click “Take Action”, the endpoint and all the corresponding information will be removed from the Intel EMA server. I recommend that you only perform that action after that the corresponding PC is un-provisioned and the agent is un-installed on that PC.

All Intel EMA In-Band Functionality is only available

Click on Desktop.
Click on Connect.

The Remote Desktop Functionality allows the complete control on the remote PC.

You can choose to Go Full Screen.
You are able to start applications, such as a web browser, a command window, … on the remote PC.

Click on the Escape Key on the console to return to the normal screen

Click on the red Disconnect icon to finish the remote desktop session.

Click on Files.
Click on the blue box “Connect to Files”.
If you are connected, the icon will change to “Disconnect” in a red box.

File Commands are becoming available and available commands are shown in blue instead of gray.

Browse through the files, by clicking on the disk symbol or on the name of the directory:.
Different file handling functionalities as upload, download, delete, rename, create New Folder, …. are available.

Click on Processes.
Click on the blue box “View Processes”
If you are connected, the icon will change to “Disconnect” in a red box.

Process Commands will become available and will be shown in blue instead of gray.
You can launch or terminate a process.

Intel AMT functionality can only be used when CIRA is connected. So, the bullet point concerning CIRA should be green.

A window called “System Status” will gradually show the information that is received directly from the Intel vPro PC.
Before we start with an overview of all the information, I want to highlight the following: the information that is shown in blue, can be clicked on. You will get a popup window allowing you to perform an action or change a setting.

Let´s start with the overview of the information shown by System Status.
On the first line the Power status of the PC is shown. It is also shown if the PC is plugged-in or working on battery.
Click on that information and the Power Dialog window pops up.
There will be a drop down menu of all possible power control commands that can be executed.
Click on “Only Show Valid Commands”
After a while, loading the information needs to be finished, only the power control commands that can be executed in the current status of the vPro PC will be shown.
Click on “Cancel”
Next Line shows the Intel AMT hostname & domain name.
Due to the settings in the Intel AMT profile these names are synched with the OS hostname and domain name. You can click on it and change the AMT hostname & domain name, but in general there is no reason to change these names.
Next line contains the System ID. It is a unique identifier of an Intel vPro PC.
The Intel ME line lists 2 pieces of information.
Firstly is the version of the ME (Manageability Engine) firmware, also called AMT firmware. The first number (v16 in this case) is related to the generation of the Intel Core Processor and will never change by a firmware update.
It also lists how Intel AMT is activated on the vPro PC: Client Control Mode or Admin Control Mode.
The line of the Active Features shows the Intel AMT functionalities that are selected in the Intel AMT profile. It can be changed per endpoint.
There are normally 4 features displayed: Redirection Port, Serial over LAN, IDE Redirection, KVM Remote Desktop.
Redirection Port needs to be enabled otherwise the other Intel AMT functionalities cannot be used successfully.
Next line lists some characteristics of the Intel AMT Hardware KVM or Remote Desktop functionality. It can be changed per endpoint.
The Default display that will be shown.
Opt-in Timeout: The time you have to enter the user consent
Session Timeout: The remote desktop session will end automatically if there is no activity during this period.
Port 5900, which is only visible in the popup window: Do not to enable this port.
Next line lists when User Consent will be required.
User Consent is grey and not changeable when the vPro PC is provisioned in client control mode
User Consent is blue and changeable when the vPro PC is provisioned in admin control mode
Next line provides the Power Policy settings defining when Intel AMT can be used. It can be changed per endpoint. There are 2 options, only when the PC is up and running or in all power states.
The last line shows the Date & Time of the Manageability Engine. It is the current date and time in UTC format.
That is all information available on the “System Status” window. Let´s have a look at the other ones.

Click in the left bar on “Remote Desktop”
It provides the Intel AMT Hardware KVM or out-of-band Remote Desktop functionality.
If the PC is not powered up, let´s start with waking up the PC.

Click on Connect.

A 6 digit User Consent will show up on the screen of the Intel vPro PC.
Enter the 6 digits in the management console.
The Intel AMT Hardware KVM session will start and you will have full remote control on the endpoint.

Also notice the red-yellow blinking framework on the screen of the Intel vPro PC. This is to inform the user of the Intel vPro PC that an Intel AMT Hardware KVM session is active.

If there is more than one display connected to the Intel vPro PC, you can choose which display you want to see remotely. At the bottom, you can select Primary display, Secondary display, …
You can also choose “Full Screen” on the management console.

Let´s now restart the Intel vPro PC and boot the PC into BIOS.

You could simply exit the BIOS, but we can also force a reboot.

Finally, you return to the login screen of the Intel vPro PC.
Click on “Disconnect” to end the Intel AMT Hardware KVM session.

Click on the next tab in the left bar: “Network Settings”
The “Network Settings” window provides information on the status and the settings of Intel AMT on the different interfaces (wired and/or wireless) of the vPro PC
If there are profiles explicitly defined for Intel AMT, via the Intel AMT profile or individually for the endpoint, these WiFi profiles will be listed.

Click on the next tab in the left bar: “Security Settings”
The “Security Settings” window shows information about the certificates that are used for the CIRA connection between the endpoint and the Intel EMA server.

Click on the next tab in the left bar: “User Accounts”
The “User Accounts” window shows the Intel AMT users used by the Intel EMA server, such as EMA-user, for using the Intel AMT functionality. The default AMT administrator (admin) is also listed.

Click on the next tab in the left bar: “Alarm Clocks”
The “Alarm Clocks” window shows the alarms clock that are currently active on this endpoint.
Click on “Add Alarm”.
An “Alarm Clock” popup window appears.
It allows you to enter a new alarm clock.
If you change “Delete on Completion” to “No”, you are able to define a repetitive alarm.
The endpoint will wake up when the alarm goes off. Take into account that the time is displayed in UTC format.

Click on the next tab in the left bar: “Event Log”
The “Event Log” provides an overview of system events, such as a reboot of the endpoint.

Click on the next tab in the left bar: “Audit Log”
The “Audit Log” provides an overview of the Intel AMT functionality used on the endpoint.
Click on “Click here to load the audit log” to get the audit log.

Click on the next tab in the left bar: “Hardware Information”
The “Hardware Information” provides an overview of the hardware & firmware components of the Intel vPro PC. It is up-to-date information that is sent from the Intel vPro PC to the Intel EMA server each time you click on the “Hardware Manageability” tab. This up-to-date overview is also available when the vPro PC is powered off or crashed.

It allows to connect via Serial Over LAN, alias SOL, to the Intel AMT interface and to boot the PC remotely into BIOS.

Click on Terminal.
Choose “Actions” from the dropdown menu on the blue box .
Click on Start AMT Terminal.
It will start an AMT Terminal session and the following message will be displayed: “Terminal is connected. Waiting for display data…”
Choose “Action” from the dropdown menu on the blue box.
Click on Power cycle to BIOS.
A popup window will show “User Consent required”
The popup window will appear when the PC is provisioned in Client Control mode or when the user consent is set for “Advanced Boot Options” in the Intel AMT profile.
As mentioned in the popup window the remote PC must be powered on to see the user consent code.
A popup containing a user consent code with 6 digits will appear on the remote PC window.
The 6 digits need to be entered in the pop-up window on the console.
Click Next
PC boots to BIOS in text mode.
You can go through the different BIOS screens and change any settings.
You can exit the BIOS, as shown in the BIOS.
The PC will boot normally and nothing will be shown on the console.
At the end, Choose “Actions” from the dropdown menu on the blue box again.
Click on Disconnect to end the Intel AMT Terminal session.
Instead of exiting the BIOS, you could also go back to the General tab of the endpoint and use a power control command to reboot the PC.

You can add other users to manage the endpoints in your tenant.

On the left sidebar, find and click on the “Users” icon

Within the “Manage Users” screen, you´ll find at least one user with the User name provided by you and with the role of “Tenant Administrator”.
Click on the blue box “New User” on the right to add a user.
A window pops up to create a new user
Enter a user name. The format needs to be an email address.
Provide a description.
Provide a valid Password and confirm the Password
Select the role of the user. You have the choice between:

Click on Save.
You´ll be taken back to the screen showing the different users, where you newly created user will be listed.
Use the same process to create different users.

3 steps are needed to remove an endpoint of the Intel EMA Web interface.
If it is an Intel vPro PC, you will need to un-provision the PC.
The Intel EMA agent then needs to be un-installed
Finally you can remove the endpoint from the tenant.

We´ll start the process by navigating to the General tab of an endpoint.
The 1st step, un-provisioning the PC, is only needed when the endpoint is an Intel vPro PC with Provisioning Completed. Otherwise you can skip this first step.

Un-provisioning the Intel vPro PC can only be done when the endpoint is up and running. The first bullet point of the power status should be green.
The Intel EMA agent needs to be connected to the Intel EMA server. So, the second bullet point should also be green.

If both bullets are not green, you will not be able to un-provision the Intel vPro PC.

Click on Actions
Select “Provision Intel AMT” from the dropdown menu.
The “Remote Intel AMT Provisioning” window pops up.
Click on “Remove provisioning”
You get a popup window asking to confirm the un-provisioning process. Click Continue.
Close the “Remote Intel AMT Provisioning” window.
The Intel AMT setup status in the General tab should show “Deactivate Completed”. Or refresh the web page until you get this message.
Notice also that CIRA is not connected anymore.
The first step is completed.

Do not reboot the vPro PC or wait too long after un-provisioning the vPro PC to uninstall the Intel EMA agent. Otherwise the agent will discover that the Intel vPro PC is not provisioned and will restart the provisioning process.

Log in to the PC and navigate to the installation directory of the intel EMA Agent. The default installation directory is “C:\Program Files\Intel\EMAAgent”
Right Click on the EMAAgent.exe file and select “Run as administrator”
The “Intel EMA Agent Installer” window will pop up.
Click on “Uninstall”
The popup window will disappear when the EMA agent is uninstalled.
It is possible that you will receive an error message stating that deleting the EMAAgent directory failed.
If that is the case, it is recommended to delete the directory manually.
You can check if the uninstallation is successful.
In the Windows Service the “Intel EMA Agent background” service should be disappeared.
Take into account that you could use the in-band remote desktop functionality of that endpoint on the Intel EMA Web Interface to uninstall the Intel EMA Agent. Once the Intel EMA agent is uninstalled, Intel EMA will lose the connection with the endpoint.

Log in to the PC
Open a command prompt window with local administration rights and navigate to the installation directory of the intel EMA Agent. The default installation directory is “C:\Program Files\Intel\EMAAgent”
Use the following command “emaagent.exe -fulluninstall” to uninstall the agent.
It is possible that you will receive an error message stating that deleting the EMAAgent directory failed.
If that is the case, it is recommended to delete the directory manually.
You can check if the uninstallation is successful.
In the Windows Service the “Intel EMA Agent background” service should have disappeared.
Take into account that you could use the in-band remote desktop functionality or in-band terminal functionality of that endpoint on the Intel EMA Web Interface to uninstall the Intel EMA Agent. Once the Intel EMA agent is uninstalled, Intel EMA will lose the connection with the endpoint.
As a result, the Intel EMA agent is not connected anymore.

The last step is Removing the endpoint from the tenant.
Back to the General tab of the endpoint on the Intel EMA Web interface.
Click on Actions
Select “Stop managing endpoint” in the dropdown menu.
Click on “Take Action”
You will return automatically to the list of endpoints belonging to the tenant.
The endpoint will be removed from the Intel EMA Web interface.

The order of these steps is quite important.
The Intel EMA agent is needed to remotely un-provision an Intel vPro PC.
As already mentioned, do not reboot the Intel vPro PC or do not wait too long after un-provisioning the Intel vPro PC to uninstall the EMA agent. Otherwise the agent will discover that the Intel vPro PC is not provisioned and will re-start the provisioning process.
Never remove an endpoint from the tenant if the endpoint is still provisioned. When you remove an endpoint from the tenant, all information will be deleted, including the Intel AMT administrator password. That password could be needed to un-provision the Intel vPro PC.
If you remove an endpoint from the tenant without uninstalling the agent, the agent will re-connect with the Intel EMA server and the endpoint will re-appear in the list of endpoints of the tenant.

You can add other endpoint groups and create new Intel AMT Profiles.

On the left sidebar, find and click on the “Endpoints Group” icon.
On the top of the screen click on “Intel AMT profiles”.
Click on "New Intel AMT Profile".
You need to provide details for the various sections on the left side.

In the general tab of the new AMT profile:

Click on "Power States."
Choose the default and recommended choice: "Anytime the system is connected to power."

Click on "Management Interfaces."
Choose the Intel AMT functionalities you wish to use.

Click on "FQDN Source."
This defines how the host name and domain name will be set in Intel AMT.
The recommended setting is "Shared with Host OS." This means the AMT host name will be the same as the OS host name, and the domain name will remain blank.

Click on "IP Address."
This setting determines how Intel AMT will obtain the IP address of the endpoint.
Select "From the DHCP server" when the endpoint is assigned an IP address automatically from DHCP. This is the recommended configuration as it simplifies IP address management.
If the endpoint has a statically assigned IP address, choose "Use a static IP address from Host."

Click on “WiFi”

Cannot be used
After adjusting all the settings, click "Save" to apply the changes.

You'll be taken back to the Intel AMT profiles screen, where your newly created profile will be listed.

On the top of the screen click on “Endpoint Groups”.
For a new endpoint group, click "New Endpoint Group."
Enter a name, description, and password. The password can be used later to change specific endpoint group settings.

In the group policy setup, determine the desired in-band functionalities.
Choose individual functions or select all for comprehensive inclusion.
“User consent for in-band KVM” is significant. Selecting this option prompts users for permission when using remote in-band desktop functionality.
Note that the user must be logged onto the PC for this to work. The remote in-band desktop functionality cannot be used on a PC that is up and running but where no user is logged in, if this option is selected.

Click on “Save & Intel AMT AutoSetup" at the top.
Choose "Enabled" and the appropriate Intel AMT profile from the drop-down menu.
Choosing Activation Method:
Select the activation method - either host-based provisioning (HBP)or certificate provisioning (TLS-PKI).
The latter requires specific network conditions and an uploaded AMT provisioning certificate. If no AMT Provisioning Certificate is uploaded in the tenant only Host Based Provisioning is available.
Administrator Password Options:
For the AMT administrator password, choose between randomized and custom password options.
Finalize by clicking "Save" at the bottom. The button should be blue once your selections are made.
The endpoint group that you created should be part of the list.