Intel Active Management Technology (AMT) is hardware and firmware for remote out-of-band management of select business computers, running on the Intel Management Engine, a microprocessor subsystem not exposed to the user, intended for monitoring, maintenance, updating, and repairing systems. Out-of-band (OOB) or hardware-based management is different from software-based (or in-band) management and software management agents.
Hardware-based management works at a different level from software applications and uses a communication channel (through the TCP/IP stack) that is different from software-based communication (which is through the software stack in the operating system). Hardware-based management does not depend on the presence of an OS or a locally installed management agent. Hardware-based management has been available on Intel/AMD-based computers in the past, but it has largely been limited to auto-configuration using DHCP or BOOTP for dynamic IP address allocation and diskless workstations, as well as wake-on-LAN (WOL) for remotely powering on systems. AMT is not intended to be used by itself; it is intended to be used alongside a software management application. It gives a management application (and thus, the system administrator who uses it) access to the PC down the wire, to remotely do tasks that are difficult or sometimes impossible when working on a PC that does not have remote functionalities built into it.
AMT is designed into a service processor located on the motherboard and uses TLS-secured communication and strong encryption to provide additional security. AMT is built into PCs with Intel vPro technology and is based on the Intel Management Engine (ME). AMT has moved towards increasing support for DMTF Desktop and mobile Architecture for System Hardware (DASH) standards and AMT Release 5.1 and later releases are an implementation of DASH version 1.0/1.1 standards for out-of-band management. AMT provides similar functionality to IPMI, although AMT is designed for client computing systems as compared with the typically server-based IPMI.
Currently, AMT is available in desktops, servers, ultrabooks, tablets, and laptops with Intel Core vPro processor family, including Intel Core i5, Core i7, Core i9, and Intel Xeon E3-1000, Xeon E, Xeon W-1000 product family. AMT also requires an Intel networking card and the corporate version of the Intel Management Engine binary.
Intel confirmed a Remote Elevation of Privilege bug (, SA-00075) in its Management Technology on May 1, 2017. Every Intel platform with either Intel Standard Manageability, Active Management Technology, or Small Business Technology, from Nehalem in 2008 to Kaby Lake in 2017 has a remotely exploitable security hole in the ME. Some manufacturers, like PurismHardOCP: Purism Is Offering Laptops with Intel's Management Engine Disabled and System76System76 to disable Intel Management Engine on its notebooks are already selling hardware with Intel Management Engine disabled to prevent the remote exploit. Additional major security flaws in the ME affecting a very large number of computers incorporating Management Engine, Trusted Execution Engine, and Server Platform Services firmware, from Skylake in 2015 to Coffee Lake in 2017, were confirmed by Intel on November 20, 2017 (SA-00086).
Non-free service access Although iAMT may be included for free in devices sold to the public and to small businesses, the full capabilities of iAMT, including encrypted remote access via a public key certificate and automatic remote device provisioning of unconfigured iAMT clients, are not accessible for free to the general public or to the direct owners of iAMT equipped devices. iAMT cannot be fully utilized to its maximum potential without purchasing additional software or management services from Intel or a 3rd party independent software vendor (ISV) or value added reseller (VAR).
Intel itself provides a developer's toolkit software package that allows basic access to iAMT, but is not intended to be normally used to access the technology. Only basic modes of access are supported, without full access to the encrypted communications of the complete purchased management system.
Features Intel AMT includes hardware-based remote management, security, power management, and remote configuration features that enable independent remote access to AMT-enabled PCs. Intel AMT is security and management technology that is built into PCs with Intel vPro technology.
Intel AMT uses a hardware-based out-of-band (OOB) communication channel that operates regardless of the presence of a working operating system. The communication channel is independent of the PC's power state, the presence of a management agent, and the state of many hardware components such as hard disk drives and memory.
Most AMT features are available OOB, regardless of PC power state. Other features require the PC to be powered up (such as console redirection via serial over LAN (SOL), agent presence checking, and network traffic filtering). Intel AMT has remote power-up capability.
Hardware-based features can be combined with scripting to automate maintenance and service.
Hardware-based AMT features on laptop and desktop PCs include:
Encrypted, remote communication channel for network traffic between the IT console and Intel AMT. Ability for a wired PC (physically connected to the network) outside the company's firewall on an open LAN to establish a secure communication tunnel (via AMT) back to the IT console. Examples of an open LAN include a wired laptop at home or at an site that does not have a proxy server. Remote power up / power down / power cycle through encrypted WOL. Remote boot, via integrated device electronics redirect (IDE-R). Console redirection, via serial over LAN (SOL). Keyboard, video, mouse (KVM) over network. Hardware-based filters for monitoring packet headers in inbound and outbound network traffic for known threats (based on programmable timers), and for monitoring known / unknown threats based on time-based heuristics. Laptops and desktop PCs have filters to monitor packet headers. Desktop PCs have packet-header filters and time-based filters. Isolation circuitry (previously and unofficially called "circuit breaker" by Intel) to port-block, rate-limit, or fully isolate a PC that might be compromised or infected. Agent presence checking, via hardware-based, policy-based programmable timers. A "miss" generates an event, and this can also generate an alert. OOB alerting. Persistent event log, stored in protected memory (not on the hard drive). Access (preboot) the PC's universal unique identifier (UUID). Access (preboot) hardware asset information, such as a component's manufacturer and model, which is updated every time the system goes through power-on self-test (POST). Access (preboot) to the third-party data store (TPDS), a protected memory area that software vendors can use, in which to version information, .DAT files, and other information. Remote configuration options, including certificate-based zero-touch remote configuration, USB key configuration (light-touch), and manual configuration. Protected Audio/Video Pathway for playback protection of DRM-protected media.
Laptops with AMT also include wireless technologies:
Support for IEEE 802.11 a/g/n wireless protocols Cisco-compatible extensions for Voice over WLAN
History
Software updates provide upgrades to the next minor version of Intel AMT. New major releases of Intel AMT are built into a new chipset, and are updated through new hardware.
Applications Almost all AMT features are available even if the PC is in a powered-off state but with its power cord attached, if the operating system has crashed, if the software agent is missing, or if hardware (such as a hard drive or memory) has failed. The console-redirection feature (SOL), agent presence checking, and network traffic filters are available after the PC is powered up.
Intel AMT supports these management tasks: Remotely power up, power down, power cycle, and power reset the computer. Remote boot the PC by remotely redirecting the PC's boot process, causing it to boot from a different image, such as a network share, bootable CD-ROM or DVD, remediation drive, or other boot device. This feature supports remote booting a PC that has a corrupted or missing OS. Remotely redirect the system's I/O via console redirection through serial over LAN (SOL). This feature supports remote troubleshooting, remote repair, software upgrades, and similar processes. Access and change BIOS settings remotely. This feature is available even if PC power is off, the OS is down, or hardware has failed. This feature is designed to allow remote updates and corrections of configuration settings. This feature supports full BIOS updates, not just changes to specific settings. Detect suspicious network traffic. In laptop and desktop PCs, this feature allows a sys-admin to define the events that might indicate an inbound or outbound threat in a network packet header. In desktop PCs, this feature also supports detection of known and/or unknown threats (including slow- and fast-moving computer worms) in network traffic via time-based, heuristics-based filters. Network traffic is checked before it reaches the OS, so it is also checked before the OS and software applications load, and after they shut down (a traditionally vulnerable period for PCs). Block or rate-limit network traffic to and from systems suspected of being infected or compromised by computer viruses, computer worms, or other threats. This feature uses Intel AMT hardware-based isolation circuitry that can be triggered manually (remotely, by the sys-admin) or automatically, based on IT policy (a specific event). Manage hardware packet filters in the on-board network adapter. Automatically send OOB communication to the IT console when a critical software agent misses its assigned check in with the programmable, policy-based hardware-based timer. A "miss" indicates a potential problem. This feature can be combined with OOB alerting so that the IT console is notified only when a potential problem occurs (helps keep the network from being flooded by unnecessary "positive" event notifications). Receive Platform Event Trap (PET) events out-of-band from the AMT subsystem (for example, events indicating that the OS is hung or crashed, or that a password attack has been attempted). An alert can be issued on an event (such as falling out of compliance, in combination with agent presence checking) or on a threshold (such as reaching a particular fan speed). Access a persistent event log, stored in protected memory. The event log is available OOB, even if the OS is down or the hardware has already failed. Discover an AMT system independently of the PC's power state or OS state. Discovery (preboot access to the UUID) is available if the system is powered down, its OS is compromised or down, hardware (such as a hard drive or memory) has failed, or management agents are missing. Perform a software inventory or access information about software on the PC. This feature allows a third-party software vendor to store software asset or version information for local applications in the Intel AMT protected memory. (This is the protected third party data store, which is different from the protected AMT memory for hardware component information and other system information). The third-party data store can be accessed OOB by the sys-admin. For example, an antivirus program could store version information in the protected memory that is available for third-party data. A computer script could use this feature to identify PCs that need to be updated.