@gorgarath - Yes, I can help you fix this if you have all the MAC addresses for each machine. First I need one full SPI image and the correct MAC ID for that machine, preferably pull this from a machine that you have not reflashed already.
If serial number and UUID matters too, then I need those from the machine dump mentioned above as well. Then I can tell you how to fix all the messed up ones.
MAC, usually, will be a much easier thing for you to fix on all machines, but if serial/UUID is also needed to be fixed, this will be more difficult on your end and you may need me to do for all systems

For the rest of the machines, and any other time, if you are only fixing the ME use this command >> FPTw.exe -me -f me.bin
Do that with the extracted, corrected ME region as source file at the end of the command

The most important thing is getting the MAC address corrected so that the machines won't be fighting each other on the network. I figured it had to be a BIOS thing and looked for a bit more info, but my google-fu was failing me and I wasn't finding anything useful. Getting the serial fixed as well would be nice, but I'm not sure I have those anywhere other than the sticker on the chassis, assuming the motherboard matches the chassis. And the fact that it's no guarantee with these refurbs that the motherboard matches, I'm not overly concerned.

@Lost_N_BIOS If you look at my previous post, there is the full SPI. B8-CA-3A-89-DA-87 is the MAC in the file while 90-B1-1C-95-D9-E4 is one of the correct MAC addresses. 8N6MGX1 is the S/N that was installed and 69TLDX1 is the S/N that matches the corrected MAC I gave you. I'm not sure if I have anything that would have a record of the UUID or even where to find that on a machine. My best bet is probably if Spiceworks picked it up on a scan. Is having duplicate hardware UUIDs an issue? I'm not sure what all they would effect.

The reason I had flashed the full SPI is that I had misunderstood what pluto had meant when saying to just flash the full SPI back. He was referring to that machine specifically, not to the rest of the ones I had to fix the Flash Descriptor to enable AMT due to the "lockout" mode Dell uses. So, from now on, I'll just use the -me and -desc with that file to fix the AMT issues.

On a side note, would using the BIOS recovery mode that these systems have work to fix the issue? I have a copy of the Dell BIOS file in renamed format to work, but haven't had a chance to try it yet. I'm thinking it won't do anything, but I'm not sure.

Thank you all so much.

@gorgarath - Serial might be on a sticker on the boards too. Serial is only really necessary if these are under warranty and you needed to file RMA, or if serial/UUID is tied to windows activation on these systems.
UUID can also effect other software activations besides windows activation, it may not matter on your current systems though, you'll find out soon enough if anything else starts saying it's not activated or giving you issues then you'll know this needs fixed too.

Do you mean BIOS in post #134? If yes, incorrect MAC is in 30+ of places in NVRAM volumes, and this can't easily be fixed on many machines, it should be ignored or change once corrected in the main location I think.
The main actual MAC can be corrected for each system using the following method. Open any BIOS in UEFITool, expand the "Intel Image" at top, go to the second entry inside "GbE" Right click GbE and extract as-is.
Open this file in hex editor. MAC address is in this file twice, once at very beginning 0h and again at 2000h. Once edited, flash back this file by itself using FPT >> FPTw.exe -gbe -f gbe.bin


Serial, is in padding file in middle of the BIOS region, this can be seen/extracted with UEFITool and edited with hex editor
Location x2 @ 14Fc and 84dd
Inside this same file is also a PPID number, probably also machine specific
To correct this, on each system, you would need to reflash the BIOS region only, with a corrected edited BIOS (Extract that padding file, edit via hex, replace and save BIOS image, use this as source in below command)
To dump BIOS region for edit >>> FPTw.exe -bios -d biosreg.bin
To flash edited BIOS region back >> FPTw.exe -bios -f modbiosreg.bin

However, for the above BIOS region flash to be possible you will need to make several other BIOS edits, so maybe not ideal for you or the situation, but I will explain them below in case you want to edit.
You can do one by one with programmer, without having to do this.

You need to first unlock the FD in these BIOS, rewrite each system with an unlocked FD BIOS image, this will be easiest way using programmer, so you don't have to program a tiny region with programmer (unless you know how to do that easily)
Unlock FD by opening entire BIOS in hex editor, and then see second spoiler image in section "B" in this thread - [Guide] Unlock Intel Flash Descriptor Read/Write Access Permissions for SPI Servicing
Then you also need to edit "BIOS Lock" in the setup SubGUID Module, Setup module you can find via search, GUID, and this is the GUID - 899407D7-99FE-43D8-9A21-79EC328CAC21, expand that to find subGUID - 97E409E6-4CC1-11D9-81F6-000000000000
Extract as-is, edit per below, then replace as-is, for this MMTool must be used instead of UEFITool due to some issues UEFITool has with file handling. For MMTool, find "SetupPrep" and extract uncompressed, then edit as mentioned, then replace

Edit 58b16, change 00 to 30
Then edit 58b24 change 30 to 00

Then this BIOS with FD unlocked and BIOS lock disabled, program in with programmer, then you can use FPT commands above to reflash the BIOS regions to change serial # on each system. The FPT GbE commands to fix MAC do not require this edit, only the changes and flash for BIOS region.
Of course, if you use programmer to fix BIOS region, you can do that for each system individually without having to unlock all this stuff, just dump the entire BIOS on each one by one and edit and reprogram, then next, and so on one at a time with their own files.

To avoid all this hassle on the remaining systems that you haven't messed up in this manner, take a fixed ME BIOS image. Open in UEFITool, expand Intel Image, right click the ME and select extract As-Is and save as me.bin
Then use commands I gave in post #136 to reflash to each machine, but again for this, you will need to at least unlock FD on each system, so you can FPT flash the ME. Otherwise, dump each system's BIOS with programmer, replace the ME region via UEFITool with the corrected ME region, then reprogram.
Do this one by one for each system you want to fix with the same ME

To make things easier on you, if you want, I can give you a FD unlocked, BIOS lock removed, generic BIOS image you can reflash to all the affected machines (affected ones only, rest of unaffected machines dump and edit ME properly one by one then reprogram).
This would be similar to what you did, would put in invalid serial and MAC etc, but would have the locks disabled, so you could then easily use FPT to reflash quickly on each instead of having to program each one individually.
Whatever sounds easier to you? If you're reading this now, refresh page in 5 minutes or so and I will upload this BIOS for you, it will be BIOS from #134 edited.
Here is FD unlocked BIOS, with BIOS Lock disabled as well - http://s000.tinyupload.com/index.php?fil...219335065324801

@Lost_N_BIOS That ... is a lot of information. lol

These are all refurbs and the serial isn't really going to make much of a difference as I can get the serial number from the chassis or just supply a serial number from an unaffected machine. (We have a lifetime warranty on the parts from the company we buy our refurbs from and they do ask for serial, but most of the time I just grab one of the serial numbers at random instead of the actual serial on the machine.) Windows activation is all done via KMS with our Education license, so that won't be an issue. It seems the worst case scenario will be I might need to re-run the device based activation for Office 365 on the affected machines if I don't correct the serial and/or UUID.

Just to double check and make sure I have this right, I will need to make a hex edited gbe.bin for each of the affected machines with the corrected MAC address, correct?

If I just skip the serial and UUID, I think the majority of your post I can skip, though will probably come back to later just to give it a try. One thing that confuses me is the bit about needing to unlock the flash descriptor. Is that a software unlock that is different from using the jumper on the motherboard? I did not yet look at the linked post, but it sounds like it accomplishes the same task. (Assuming the linked method will actually make it so I don't need to set the jumper on the motherboard to flash the FD/ME/etc?)

And just to clarify, to get the systems that have completely locked out AMT with the one setting in the FD, I can use my modified SPI file as-is, as long as I only flash the FD and ME? (ie FPT -rewrite -desc -f A29_AMT.bin followed by FPT -rewrite -ME -f A29_AMT.bin) And that should leave my serial numbers/MAC addresses/UUIDs alone?

I don't know if it's worth my time to correct the S/N for each of these machines, but I might give it a go for at least one of them just to do it and for the learning experience.

Thank you so much for all your help and instruction.

EDIT> I know there used to be a tool to erase the Serial number out of the BIOS on older Dells so that the correct one could be set so that the motherboard serial number could match the chassis. Not sure if there is a tool that works on these systems or not. Motherboards from Dell I believe just come with the serial number not set and prompt you for it on first boot. I don't recall that from way-back-when when we bought new systems and had warranties from Dell, though I do recall the first boot prompting me for the code on the inside of the case for the AMT setting to have it enabled (1), disabled (3), locked out (6), etc. Sadly, at the time, I think I had hit 3 because I had no idea what it was talking about and that's what the case had on it. I'll find out when I get around to setting AMT up for that lab. Thankfully, Dell seems kind enough to provide that jumper on the motherboard so I can re-flash the ME without too much trouble. At least, I hope those old 780s or 790s or whatever they are have the jumper it it needs enabled. Else I'll have to wait until they finally get replaced in another 2 or 3 years.

@gorgarath - yes, sorry, I almost backed up and removed some, but wanted to leave for others benefit in the futre if ever needed. I guess I should have asked about the jumper, or looked back in the thread, yes this solves much of what I was describing how to get around

Yes, all you need for the MAC is the hex edited GbE and then reflash that via FPT directly. GbE region is not locked, so nothing needed to be able to write that via FPT. Yes, you can skip almost all of what I said, especially since plutomaniac pointed out you have a service jumper on this model (That unlocks the FD and allows ME reflash via FPT too)
I didn't link any post, but I did link an unlocked BIOS for you (BIOS lock disabled, and FD fully unlocked). You can use that BIOS, to reflash to all machines via FPT if you want, with jumper enabled, then much easier flashing later if ever needed and jumper wont need put on then.

Yes, for the unaffected systems, what you mentioned would be proper way to redo the ME, and FD if needed too. However, I would extract each of those things (FD, ME) from the corrected BIOS using UEFITool, right click each item and extract as-is save as xxx.bin, then flash using only those files as source instead of the entire BIOS.
FPTw.exe -desc -f fd.bin << This flashes the FD (FD extracted as source)
FPTw.exe -me -f me.bin << This to flash ME (ME extracted as the source)

Dell DSTCD tools. in case these can help you redo the serials/service tags easier (Asset_A209.COM is not same as ASSET.COM, try both if one gives you issues) >>
http://s000.tinyupload.com/index.php?fil...250786477991185

Hi, I have a few Dell 7010s that I'd like to enable AMT. Unfortunately all are "white-label-3-disabled" but I've read here that it is possible so before I brick these things perhaps I can ask a couple of questions...

1) I've found the service mode jumper on the Desktop/Mini-Tower, but not on the SFF; does it have one if so where is it?
2) Do I first flash the BIOS that is the same as when some of the files on here were read? For instance I think A21 seems to have been used before...
3) What are the latest/best files to try to flash please?

Many thanks for the great work already done!

PS So I had a go myself with the files on here where someone had dumped A29 files so I preformed the process and flashed the ME area with service mode jumper on a desktop 7010. I did the fpt -greset and also reset the CMOS with the jumper but still no AMT in either CTRL-P or F12. Wonder if I did anything wrong or whether the file I used from here was not AMT_Enabled? Not sure where to go next? Could do with a little help please. Thanks.

PPS Just to update, I've now cracked it, thanks to the thread here! I used the file from post 94 and down-flashed my BIOS from A29 to A25 to match (probably unnecessary?) and then followed the instructions in this thread using the service mode jumper. I also noticed that being able to access AMT survives a BIOS update, as it should I guess, but was a question mark for me. BTW I also found the Service Mode jumper on the 7010 SFF - its on the far right, just up and to the right of the RAM (with the RAM facing you, horizontally, at the front).

Oops, I had one of these in storage. I pull the bios with fptw64 -d. I thought I cleaned it properly, I think we all know where this is going! One bad flash later and it doesn't boot. Beware, ask for help don't do what I did. "nice big paper weight" Can I recover the bios/motherboard?


Thanks everyone.

snakeman

@Lost_N_BIOS what can I do now?

Warning: There are some addresses that are not defined in any regions.
Read/Write/Erase operations are not possible on those addresses.

Same message I got when i bricked the other board, I was trying to do a fptw64 -f 7010_bios I get this in total

C:\70102>fptw64 -f 70102_bios.bin

Intel (R) Flash Programming Tool. Version: 8.1.60.1561
Copyright (c) 2007 - 2014, Intel Corporation. All rights reserved.

Platform: Intel(R) Q77 Express Chipset
Reading HSFSTS register... Flash Descriptor: Valid

--- Flash Devices Found ---
MX25L6405D ID:0xC22017 Size: 8192KB (65536Kb)
MX25L3205D ID:0xC22016 Size: 4096KB (32768Kb)


Warning: There are some addresses that are not defined in any regions.
Read/Write/Erase operations are not possible on those addresses.

PDR Region does not exist.

- Reading Flash [0x600000] 6144KB of 6144KB - 100% complete.
- Erasing Flash Block [0x004000] - 100% complete.
- Programming Flash [0x004000] 16KB of 16KB - 100% complete.
- Verifying Flash [0x600000] 6144KB of 6144KB - 100% complete.

I'm afraid to reboot!


Solved, already great guides thanks for all the write ups,


snakeman

@snakeman - did you get it sorted out?

@Jed1 - great you figured it all out yourself, and thanks for posting the 2pin jumper location

@Lost_N_Bios I almost used the -erase but I was afraid! So instead I flashed the original back with -rewrite and then I verified it a few times, before I did -greset. I got real lucky.

Now probably try and get nvme booting working in this bios.

Dear friends, @gorgarath & Lost_N_BIOS, did I understand that with @gorgarath kvm on Optiflex 7010 it works? I have a model with AMT_DASH_VPRO: DEFAULT 1. Everything works except KVM
I do not see the KVM enable menu in MEBx.
@gorgarath can you tell me how you turned on KVM? Through MEBx menu or on software?
Lost_N_BIOS, can you guess where this option is disabled and what to do to make it available?
Thank.

@Ohlamon I was able to get KVM working on the Optiplex 7010 by flashing one of the first files in this thread. It worked for all of my devices except for the ones that were marked by Dell as 6 (lockout) instead of 1 (default, though it sometimes is only the stripped down version that doesn't include KVM) or 3 (AMT disabled). The file I am currently using is the last one I posted myself that is a whole BIOS file. But make sure you do not actually flash the entire BIOS as that will rewrite your serial number and MAC address and possibly other things. The nice thing with these Dells is the fact they have a jumper that allows you to completely overwrite the normally inaccessable parts of the BIOS. I'm not sure which version of the 7010 you have, but here is where the jumpers are located on the two I have here. On the Ultra Small Form Factor ones, it is next to the password clearing jumper under the hard drive/optical drive enclosure. On the Small Form Factor desktops, it is located on the edge of the board next to the PCI-Express slots.

I have a bootable USB drive with FreeDOS that I use for flashing. On it I have a directory (called 7010) with all of the files (FPT.EXE, fparts.txt, A29_AMT.bin, O7010A29.EXE) needed for enabling AMT on the 7010. If the BIOS is not already at A29, I will update the BIOS by either booting from the USB drive and running the update file, or running the update file from Windows first. After updating the BIOS, I will shut the PC off and put a jumper on the the service mode pins. Then simply boot up the PC with the USB drive. I then change to the 7010 directory and run a batch file that runs these commands:

FPT -rewrite -desc -f A29_AMT.bin
FPT -rewrite -ME -f A29_AMT.bin
FPT -greset

@Lost_N_BIOS recommends saving the individual parts as separate files, but I find it simpler to have the single file and just flash the parts of it. (Mostly because I already had the full file already made.) The first command will write to the Flash Descriptor and includes the change to enable AMT if it a machine that has the AMT lockout (6 according to the sticker inside the cover) as well as the change to disable the 3G driver since the Intel Anti-theft Technology is disabled in the ME due to being EOL. The second command flashes the ME region which includes enabling full AMT, including KVM, and the disabling of the EOL Intel Anti-theft Technology.

After the machine boots back to the USB drive again, I shut the PC off and remove the jumper from the service mode pins and boot back to the USB drive. I will then run one final FPT -greset. I am fairly certain that I do not need to do that step, but I do it anyway. I then will hit Ctrl+P when it reboots to go and set my settings for AMT before moving on to the next machine.