ASUS Z170-A ME firmware update problem, Error 8719, no help from support

[Broheim]

I have a problem with updating vulnerable ME firmware on my Z170-A motherboard with BIOS 3504. First I updated ME Driver to the latest version 11.7.0.1040. MEUpdateTool (version - 2017/11/22) doesn't work - system is still vulnerable according to Intel-SA-00086 Detection Tool. Running "FWUpdLcl64.exe -f ME.bin" gives the same "Error 8719: Firmware update cannot be initiated because Local Firmware update is disabled". Tried solutions from forums, such as clean Windows 10 Pro x64 install, clearing CMOS, running FWUpdLcl64 from flash drive - do not work.

This problem came up in another thread, with a solution to downgrade BIOS to old versions where Local Firmware update was enabled, see https://rog.asus.com/forum/showthread.php?97312-New-BIOS-Version-out-today-(11-09-17)-MH-VIII-Hero&p...
(its a post by Kaelek on the 11th page). Searching the net regarding Error 8719 gives additional weight to the conclusion that this is usually a BIOS bug https://www.win-raid.com/t596f39-Intel-Management-Engine-Drivers-Firmware-amp-System-Tools-121.html#....

However, versions that I can downgrade to have Local Firmware update disabled (remember, Z170-A doesn't have USB BIOS flashback). I can't downgrade to 0901 for example that seems to solve the problem for MH VIII Hero.

ASUS support was not helpful, since they suggested that this is a hardware error: "Obviously, ME firmware is damaged or cannot be updated due to hardware fault". Curious how guys with MH VIII Hero were able to solve it by downgrading BIOS. Support proposed that I send my motherboard to the service center of the shop where I purchased it, which is not local, so that way I will be without a working computer for at least a month. That I will not do, so it seems I just have to live with a vulnerable firmware.

Did anyone with Z170-A and BIOS 3504 or one of the other 3xxx versions managed to update their ME firmware? Make sure it really was upgraded by running Intel-SA-00086 Detection Tool, because ASUS MEUpdateTool will not notify you of the Error 8719, and will look like update was successful when it was not.

Anyone have any solution to this problem other that what support suggested?

[Insert_Coin1]

th3rookie wrote:
Yes, indeed. Z170-A latest bios (3703) contains version 11.6.10.1196 of Intel ME.

That's disappointing.

I checked other brands bios updates and a new ME is referred on a lot of them.

Wouldn't a new ME version included on the Bios solve the OP issue?

[Insert_Coin1]

th3rookie wrote:
Yes, indeed. Z170-A latest bios (3703) contains version 11.6.10.1196 of Intel ME.

Sorry for asking another question:

Is it possible to check the ME version on the Bios?

[Broheim]

@Insert_Coin, if new ME firmware was included in the latest BIOS update, then yes, I think it would solve this problem. It would also be helpful if ASUS made a way to manually control Local FWUpdate setting.

You can check current ME version in BIOS in the first page of advanced mode I think, or you can run MEInfo tool from one of the archives on win-raid.com thread. If you're asking how to check what version of ME firmware is included in the BIOS update file, guys over on the win-raid.com thread are using ME Analyzer.

[KSMerg]

Try to update under "DOS / EFI / Linux"

[Broheim]

Thanks, KSMerg. Do you mean run FWUpdLcl under linux with ME.bin from ASUS's MEUpdateTool? I tried that using FWUpdLcl from Intel CSME System Tools v11 r6 from win-raid.com under Ubuntu. It doesn't work, it gives the same error as the Windows version.

As far as I understand, Local FWUpdate is simply a setting for ME to allow or disallow firmware updates, see for example this manual from Intel.

So I don't think that running the same tool in a different OS will change anything.

So I think the only way to update ME in my case is to somehow change this setting that is not available in Z170-A BIOS UI. Guys in another thread solved it by downgrading to old version using USB BIOS Flashback that had Local FWUpdate enabled. I don't have Flashback in Z170-A, and EZFlash prevents downgrade to pre-3xxx versions.

So that means that ASUS should release a new BIOS version with Local FWUpdate enabled, as MSI did. Or at least provide a tool to enable Local FWUpdate.

[KSMerg]

There is a method with closing 1 and 5 pins on the chip "Realtek" at the stage of loading

[Broheim]

KSMerg wrote:
There is a method with closing 1 and 5 pins on the chip "Realtek" at the stage of loading

Can you elaborate, please? Where is this chip, and what is this procedure supposed to accomplish? Or do you have a link so that I can read about it?

[KSMerg]

Can you elaborate, please? Where is this chip, and what is this procedure supposed to accomplish? Or do you have a link so that I can read about it?

https://forums.overclockers.ru/viewtopic.php?f=25&t=447045
It is possible to update the firmware first to 11.7.
https://forums.lenovo.com/t5/Lenovo-E-H-K-M-Q-Y-and-ErazerX/300-20ISH-Desktop-ideacentre-Error-8719-...