Intel (R) MSS User Guide
Intel (R) MSS User Guide
Status Application
User Guide
Supporting Intel® CSME Firmware Version 10 and Above
January 2025
Revision 2.1
Intel Confidential
1.1 • Added Fast Call for Help in Intel® Standard Manageability tab June 2021
1.3 • Added note for MEBx description in section 3.4.4 September 2021
1.5 • Added disclaimer for Windows* 11 support in system requirement February 2022
1.7 • Updated description about the option “Intel® Management and Security November 2022
Status application will be available next time I log on to Windows*” in
General Tab
2.1 • Updated Section 3.5.1 for new design of UPID tab January 2025
3 Using Intel® Management and Security Status Application and Icon ........................ 7
3.1 General Tab ........................................................................................... 7
3.2 Intel® Active Management Technology Tab.............................................. 10
3.2.1 Fast Call for Help ..................................................................... 11
3.2.2 Support Session Status ............................................................ 12
3.2.3 System Defense ...................................................................... 13
3.3 Intel® Standard Manageability Tab ......................................................... 13
3.3.1 Fast Call for Help ..................................................................... 13
3.3.2 Support Session Status ............................................................ 13
3.3.3 System Defense ...................................................................... 14
3.4 Advanced Tab....................................................................................... 14
3.4.1 Intel® Management Engine ...................................................... 15
3.4.2 Secure Output Window Settings ................................................ 15
3.4.3 Network Information ................................................................ 16
3.4.4 Extended System Details .......................................................... 17
3.4.5 Access Monitor ........................................................................ 19
3.5 Intel® Unique Platform ID Tab ............................................................... 20
3.5.1 Intel® UPID Status .................................................................. 20
3.5.2 Intel® Platform Service Record (Intel® PSR) .............................. 21
3.6 Shutting Down the Intel Management and Security Status Application ......... 22
3.7 Windows* 10 ....................................................................................... 22
4 Troubleshooting Intel® Management and Security Status ..................................... 23
4.1 Error Message Appears Upon Application Load .......................................... 23
1 Introduction
This User Guide describes how to use the Intel® Management and Security Status
(Intel® MSS) application. The application’s tabs display information about a platform’s
support for Intel® Active Management Technology (Intel® AMT) and Intel® Standard
Manageability. These technologies are built on the Intel® Management Engine (Intel®
ME), a feature provided within the platform hardware.
The Intel MSS icon indicates whether Intel Active Management Technology or Intel
Standard Manageability are running on the platform. The icon is displayed in the
taskbar’s notification area. By default, each time Windows* starts, the Intel MSS
starts and the notification icon is displayed.
If the Intel MSS starts automatically as a result of the user logging on to Windows*,
the icon is loaded to the notification area only if a supported combination of Intel
Active Management Technology or Intel Standard Manageability is present on the
platform. If the Intel MSS is started manually via the Start button, the icon is loaded
even if neither of these technologies is enabled.
§§
2 System Requirements
The Intel MSS has the following requirements:
• Supported operating systems:
⎯ Windows 10*
⎯ Windows 11* (Note**)
⎯ Windows Server 2019*
• Platform running Intel Management Engine firmware.
• Intel Management Engine software installed.
• Microsoft* .NET Framework: version 4.8 or above
Note: Some Intel systems can be upgraded to Windows 11* but Windows 11* is not POR for
those systems. These include (but are not limited to): Raptor Lake, Alder Lake, Rocket Lake,
Tiger Lake, Comet Lake, Whiskey Lake, Coffee Lake, Kaby Lake, Sky Lake, Purley, Purley
Refresh, Basin Falls, Glacier Falls and older systems. Intel has not validated execution of the
Intel MSS on these systems.
§§
The Intel MSS icon is displayed in the notification area while the Intel MSS is running.
The icon is blue if Intel AMT or Intel Standard Manageability are enabled on the
computer.
Note: The icon is gray if the Intel MSS User Notification Service is not running or the Intel®
Management Engine Interface (Intel® MEI) driver is disabled or unavailable.
Note: In the classic Start menu, the path includes Programs instead of All Programs.
The following sections describe the information available in the application’s tabs.
Information about the application is available also by clicking the Learn more link or
the question mark button ( ).
Note: The application dynamically hides tabs that are not relevant. For example, the Intel
UPID tab does not appear if the platform does not support Intel UPID.
The Event History section displays events and some of their details. These can be
sorted by clicking on the relevant column header.
⎯ Disabled: Intel AMT is not enabled on the system or has been disabled by the IT
administrator.
⎯ Information unavailable: Not known whether Intel AMT is supported on the
system. No Intel AMT information is available. This can be for one of the following
reasons: the LMS service has stopped, or the Intel MEI driver is disabled.
• Intel® Standard Manageability: Enabled / Disabled / Information unavailable
⎯ Enabled: Intel Standard Manageability technology is supported on the system.
The Intel ME status in the Advanced Tab provides information on whether the Intel
ME is configured (thereby causing Intel AMT to be functional).
⎯ Disabled: Intel Standard Manageability technology is not enabled on the system
or has been disabled by the IT administrator.
⎯ Information unavailable: Not known whether Intel Standard Manageability
technology is supported on the system. No Intel Standard Manageability
information is available. This can be for one of the following reasons: the LMS
service has stopped, or the Intel MEI driver is disabled.
Note: The information in this field shows the state of the platform at the last platform boot.
Enable User Notification: Checking this box causes the Intel MSS icon to display
important notifications in the notification area (for example, notification will be sent
whenever one of the technologies is enabled or disabled). Affects the Intel MSS
setting for the current user account only.
This option does not appear in the Intel MSS APPx. If users of the Intel MSS APPx
want the Intel MSS to load automatically with Windows* log-on, they need to enable
this feature from both the Startup tab in the task manager and the checkbox in the
General tab. If the Intel MSS status from the task manager’s Startup tab is disabled or
the checkbox is unchecked, the feature will not be enabled.
CIRA allows a user to connect the Intel AMT system to the company’s Information
Technology network via an external internet connection.
CILA allows a user connected to the internal corporate network to send a support
request to the IT administrator.
Click the Get Technical Help button to connect to the Information Technology
network for system diagnostics and maintenance. The current connection status is
displayed in this section.
Note: For CIRA or CILA to work, the machine needs to be configured correctly, and to
support the technology. These settings are typically configured by management software.
Refer to the Intel AMT SDK Implementation and Reference Guide for configuration
instructions.
Note: The information displayed in the Intel® Management and Security Status application,
including the Fast Call for Help section, is not shown in real time. The data is refreshed every
time an event occurs.
Note: When the user is connected as a Guest account (in Windows*) the “Fast Call for Help”
section is grayed out, to prevent users outside the organization from influencing the
organization’s network.
Indicates whether a KVM (Keyboard, Video & Mouse) Remote Control session is
alive. Possible values: Connected / Disconnected / Information unavailable.
The KVM Remote Control Connection section is grayed out if the feature is disabled
on the system.
• Media Redirection
Indicates whether there are any open IDE redirection sessions. Possible values:
Connected / Disconnected / Information unavailable.
• Terminal and Keyboard Redirection
Click Stop Sessions to close any open KVM Remote Control, media redirection, or
terminal/keyboard redirection sessions. If opening a session requires user consent,
re-establishing the session requires renewal of the user consent after clicking this
button.
• Hot Key
Indicates the hot key used for closing any open KVM Remote Control, media
redirection, or terminal/keyboard redirection sessions. Pressing this key has the
same effect as clicking Stop Sessions.
This button appears if user consent is required for opening a remote support
session. In such cases, after the user provides the required approval to the remote
administrator the Prevent Access button is displayed until the healing session starts.
This button enables the user to change their mind, as clicking on it cancels user
consent and prevents the IT administrator from beginning the remote session.
During this time, the hot key also serves to cancel user consent. Once a remote
support session has begun, the Stop Sessions button is displayed instead of the
Prevent Access button.
Note: When user consent is required, it is granted to the administrator per session, by the
user giving the administrator a one-time pass code which is displayed on the user’s screen in
the Secure Output Window. See section 3.4.2, Secure Output Window Settings.
Note: During a support session conducted over the wireless interface, a notice is displayed
warning not to change the wireless connection until the remote support session has
completed.
Indicates whether System Defense policies are currently active. Possible values:
Activated / Not activated / Information unavailable.
Click the Intel® Std Mgt tab to display Intel® Standard Manageability information.
Note: This feature is displayed only on Alder Lake platforms (running Intel CSME 16
firmware) or later.
Indicates whether there are any open IDE redirection sessions. Possible values:
Connected / Disconnected / Information unavailable
• Terminal and Keyboard Redirection
Indicates whether System Defense policies are currently active. Possible values:
Activated / Not activated / Information unavailable.
Note: The image shows all the buttons and information that can be displayed in the
Advanced Tab. However, not everything is always displayed, as this depends on the specific
technologies that are enabled and active on the platform: Intel® Active Management
Technology (Intel® AMT) or Intel® Standard Manageability.
If the status is Configured, the configuration date and time are displayed.
• Control Mode
Intel ME can be configured in two modes: Client Control Mode and Admin Control
Mode. If the status is Configured, the relevant Control Mode is displayed.
Specifies the language used by the Secure Output feature for user consent. Choose
one of the listed languages.
When the Intel MSS is installed, the consent language is set according to the
Windows* System Locale language. (Note that this may be different from the
Windows* Display language). Selecting a different message language in the
Advanced Tab overrides this initial setting. Selecting Windows Default Language
reverts the setting to the Windows* System Locale language.
• Message Font Size
Specifies the window font size of messages displayed by the Secure Output Feature.
Choose one of the following: Regular, Large or Auto.
• User Consent Policy
Specifies the policy for when the user’s approval will be required to establish a
remote support session by an IT administrator. User Consent is granted to the
administrator for the duration of a session, by the user giving the administrator a
one-time pass code that will appear on the Secure Output Window displayed on the
user’s screen.
If IPv6 addressing is enabled for the Intel ME, the Intel MSS displays up to 6 IPv6
IP addresses configured for an Intel ME network interface with wired connection,
and up to 5 IPv6 IP addresses for wireless connection.
The report includes both general information regarding the system (Host Information)
and specific Intel Management Engine information (Intel® ME Information).
Host Information:
• Operating System Name: The Windows* operating system that the application is
running on.
• Operating System Version: Version of the operating system
• System Manufacturer: Hardware manufacturer
• System Name: Computer name as recognized by the operating system
• System Model: Hardware platform name
• Processor: Processor’s full brand name
• BIOS Version: BIOS manufacturer’s name and BIOS version number
• LAN DeviceID: LAN device’s PCI Device ID
• LAN Driver – LAN device’s driver version
• WLAN DeviceID: Wireless LAN device’s PCI Device ID
• WLAN Driver: Wireless LAN device’s driver version number
Intel® ME Information:
• Intel® ME Control Mode: Configuration mode (Client Control or Admin Control)
• Provisioning Mode: Intel ME configuration state (Pre / In / Post)
• BIOS boot: BIOS boot state (should be Post Boot)
• Last Intel® ME reset reason: Cause of the last Intel ME reset (Global System Reset
/ FW Reset / Power Up / Unknown cause/ Information unavailable)
• System UUID: Computer’s Universal Unique Identifier. Standard System UUID
presentation, e.g., 03000200-0400-0500-0006-000700080009
• Local FWUpdate: Local firmware update policy (Enabled / Disabled)
• Power Policy: Power modes in which Intel ME is available (Intel ME ON in
S0/S4/S5/DC).NOTE: S0 = Power is on, S4 = Hibernate, S5 = System is shut down
though the power cable is connected, DC = Battery Power
• Cryptography Support: Whether Intel ME can work in TLS/SSL mode
(Enabled/Disabled)
FW Capabilities:
This section indicates whether the following technologies are present on the platform
and enabled:
• Intel Active Management Technology / Intel Standard Manageability
• Intel® TPM Provisioning Service, formerly known as Intel® Capability Licensing
Service (iCLS)
• Intel® Dynamic Application Loader
• Protected Audio Video Path (PAVP)
Components Information
Note: If MEBX is integrated in BIOS, the MEBX version will show 0.0.0.0000.
• FW Version: Firmware version
• LMS Version: Local Management Service software version
• MEI Driver Version: Intel® Management Engine Interface (Intel® MEI) driver
version
• MEI DeviceID: Intel Management Engine Interface PCI Device identification
• SOL Driver Version: Serial Over LAN driver version
• SOL DeviceID: Serial Over LAN PCI Device identification
• PMC Version: Power Management Controller version
Network Information:
• LAN MAC Address: Media Access Control address for the LAN device
• LAN Configuration state: DHCP or static mode for LAN
• LAN Link Status: LAN link up or down
• LAN IPv4 Address: IPv4 address assigned to LAN
• LAN IPv6 Enablement: IPv6 enabled or disabled for LAN
• WLAN MAC Address: Media Access Control address for the Wireless LAN device
• WLAN Configuration state: Only DHCP mode supported for Wireless LAN
• WLAN Link Status: Wireless LAN link up or down
• WLAN IPv4 Address: IPv4 address assigned to Wireless LAN
• WLAN IPv6 Enablement: IPv6 enabled or disabled for Wireless LAN
Note: When the user is connected as a Guest account (in Windows*), some system
information is unavailable. In such a case, all the Host Information and some of the Intel ME
Information (such as Software Versions) appears as “NA”.
Access Monitor content includes descriptions of system events that may be of interest
to the user from a privacy and security perspective, such as network administration,
storage administration, remote control operations and more.
Note: Events that occur before Intel AMT is provisioned for the first time are displayed with
incorrect time and date.
If Intel UPID is disabled, Intel® Platform Service Record (Intel® PSR) continues
logging (collecting events, counting power transitions, etc.), but its log cannot be
retrieved from the OS or from BIOS.
The following table shows what Intel MSS displays, and what functions it makes
available, depending on whether Intel UPID and Intel PSR are enabled and supported:
UPID PSR
Supported UPID Enabled Supported Intel MSS Behavior
After IMSS 2442.7.1.0, the UPID tab is redesigned as below, depending on whether
Intel UPID and Intel Platform Brand Identity (PBI) are enabled and supported:
Click Yes to automatically start the Intel MSS when you next log on, or No to prevent
the Intel MSS from starting automatically. This change affects the Intel MSS behavior
for the current user account only.
This user selection will affect the Intel® Management and Security Status
application will be available next time I log on to Windows* checkbox in the
General Tab of the legacy version of Intel MSS.
3.7 Windows* 10
When the application is installed on a Windows* 10 operating system, a tile is placed
on the Start window. This allows the application to send toast notifications to the
Windows UI. If the tile is deleted, no toast notifications can be posted.
§§
4 Troubleshooting Intel®
Management and Security
Status
If no Microsoft* .NET Framework is present in the system, the Intel MSS displays the
following error message:
To resolve these issues, install Microsoft* .NET Framework version 4.8 or above and
then re-open the Intel MSS.
§§
Code Meaning
8703 PLEASE REBOOT YOUR SYSTEM. Firmware update cannot be initiated without a reboot
8706 Firmware update not initiated due to integrity failure or invalid FW image
8708 Firmware Update operation not initiated because a firmware update is already in progress
8714 Firmware update not initiated due to file open or read failure
8719 Firmware update cannot be initiated because Local Firmware update is disabled
Code Meaning
8728 This version of the Intel® Firmware Update Tool is not compatible with the current platform.
8745 Firmware update cannot be initiated because the OEM ID provided is incorrect.
8772 Invalid usage, -allows v switch required to update the same version firmware.
Code Meaning
8778 Unable to read FW version from file. Please verify the update image used.
§§