Troubleshooting

Troubleshooting

Connection refused / cannot reach AMT host

Symptom: IMC shows connection error immediately.

1. Verify AMT is enabled in MEBx (reboot → Ctrl+P → MEBx → Network Setup → TCP/IP)
2. Check AMT is provisioned: rpc amtinfo (install lms or use Docker LMS)
3. Verify ports are open: nmap -p 16992,16993 <amt-ip>
4. Confirm you're using the AMT IP, not the OS IP (check router DHCP table)
5. If on same machine, start LMS first: bash scripts/lms.sh start then connect to localhost

TLS handshake failure

Symptom: Connection hangs or TLS error on port 16993.

• AMT 16.1+ (Alder Lake CSME) dropped cleartext port 16992/16994 for some operations — use TLS
• Our amt-protocol.js auto-upgrades IDER connections from 16994 → 16995 on ECONNREFUSED
• For WS-Man, explicitly select TLS in IMC connection settings

IDER / virtual media not working

• IDER requires OOB access — LMS does NOT proxy ports 16994/16995 (Redirection Protocol)
• Must connect to AMT IP directly from a remote machine, not loopback via LMS
• KVM/IDER from the same physical machine that runs AMT requires a second machine for the client

LMS container won't start

bash scripts/lms.sh status   # check container state
docker logs intel-lms         # inspect LMS output

Common causes:

• /dev/mei0 not present: Intel ME not accessible. Check BIOS → MEBx → enabled, or run lsmod | grep mei
• dbus-daemon fails: container needs --privileged or correct cgroup access — the entrypoint handles this but some hardened kernels block it

Blank screen / white window on launch

Electron sandbox issue on some Wayland compositors.

# Force X11 mode
ELECTRON_OZONE_PLATFORM_HINT=x11 npm start

# Or disable GPU sandbox
./node_modules/.bin/electron upstream/app/main-electron.js --no-sandbox

msiextract fails / MSI checksum mismatch

Intel sometimes updates the MSI at the same URL. If checksum fails:

1. Delete /tmp/imc-extract/
2. Manually download IMCInstaller-2.4.0.msi from Intel Download Center
3. Place at /tmp/imc-extract/IMCInstaller-2.4.0.msi
4. Re-run npm run setup

KVM shows "user consent required"

Expected in CCM (Client Control Mode). The AMT machine's OS must display a consent prompt. ACM (Admin Control Mode) removes this requirement but needs enterprise provisioning server (e.g. MeshCentral). CCM is the default for unconfigured vPro machines.

Credential vault not saving

safeStorage requires a running keyring daemon:

• GNOME: gnome-keyring-daemon (usually auto-started)
• KDE: kwallet
• Headless/SSH: set ELECTRON_PASSWORD_STORE=basic to use unencrypted fallback (not recommended for production)