course: Home

Switching Off Intel AMT on a ThinkStation P720 - Homelab



The ThinkStation P720 that will run this lab arrived with the refurbisher's Windows 11 still on it, and I kept that install for one more job. Lenovo ships ThinkStation firmware as Windows executables, and once Proxmox owns the disk that route is gone. So the firmware work came first.

The plan had two parts: flash the BIOS if anything newer existed, and get rid of Intel AMT. AMT is the remote management feature that runs on the Management Engine, the separate processor inside the chipset that stays powered whenever the machine is plugged in. It gives remote power control, a remote console and remote BIOS access, all below the operating system. My notes from the acceptance tests said the ME firmware was 11.22.60.1561, that this was the newest version Lenovo published for the P720, and that Intel had fixed the AMT IPv6 bug in INTEL-SA-00391, exploitable over the network without authentication, in 11.22.80, and INTEL-SA-00783 in 11.22.94. So AMT could not be patched and had to go. Half of that was wrong, and how I found out is most of this story.

The BIOS part was quick. msinfo32 reported S04KT78A, dated 11 May 2026. Lenovo's download page contradicted itself, with a version table still showing S04KT76A from 2025 while the download links pointed at files numbered 78, but the README in the package settled it: S04KT78A is the newest, and it was already installed. I didn't flash it again.

Before touching AMT I wanted a baseline, so I tested its two ports from my laptop, which sits on the same subnet over Wi-Fi:

16992,16993 | % { "$_ : " + (Test-NetConnection LAB_HOST_IP -Port $_ -InformationLevel Quiet -WarningAction SilentlyContinue) }

Both came back False. Get-NetNeighbor had an ARP entry for the tower, so the packets were arriving and nothing was answering. AMT only opens those ports once someone provisions it, so the previous corporate owner had most likely never set it up. That was good news, and it also meant the network test could never show a change.

I timed one boot with no settings change behind it, since every earlier figure had included memory retraining: 67 seconds of POST, 70 to the Windows sign-in screen. Then into Setup. Unconfigure AMT/ME has to run before the disable, because the checkbox disappears once AMT is off. POST showed "Unconfiguration in progress...", asked nothing, and rebooted twice by itself. I set Intel(R) Manageability Control to Disabled and added an administrator password, but no power-on password, which would stop every unattended boot and defeat Wake-on-LAN. Computrace, the Absolute anti-theft module, read Enabled but Not Activated, so no agent had ever woken it; I set it to Disabled rather than the irreversible Permanently Disabled. Intel VMD was off on every port, which matters because it can hide NVMe drives from a Linux installer.

Then the check I had planned failed. The AMT serial-over-LAN port, COM3 in Device Manager, was supposed to vanish once AMT was off. It stayed. Get-PnpDevice showed it present, PCI ID 8086:A1BD, and it was still there after a reboot, after a night switched off, and after I pulled the power cord for a minute so the ME lost its standby power.

What settled it was the ME's own report through the Intel ME WMI provider. Its ME_System class has two bitmaps, Capabilities and EnabledCapabilities, and they read 5062673 and 4997136. The difference is bits 0 and 16. In Intel's open-source code for that provider, the lms project, bit 0 is AMT, and since 2023 bit 16 has carried the firmware's own AMT flag as well. The firmware was reporting AMT as supported and switched off, and this Lenovo board simply leaves the SOL function on the bus with nothing behind it. Two fields nearly fooled me: ManageabilityMode reads 2, meaning vPro, but that is only the firmware brand, and EnabledState reads 5 on every class because the provider hard-codes it.

While chasing the COM3 question I read through the full changelog in Lenovo's BIOS README, looking for anything about AMT. It had lines I didn't expect: S04KT51A, "Update ME to 11.22.80.1734", and S04KT55A, "Update ME to 11.22.86.1877". This machine runs S04KT78A, so the BIOS package had been carrying a newer ME for years, and the ME was still on 11.22.60. Then I opened Lenovo's ME update page for the P720 and P920, the one my notes cited. It offered 11.22.96.2588, released in November 2024, with machine type 30BB listed in the README. That is above both of Intel's fixes. I never worked out where the original figure came from. What I do know is that I had planned a whole session on a number I hadn't checked again.

There is a lesson in it for anyone buying a refurbished workstation: a current BIOS version tells you nothing about the ME. Somebody had flashed this BIOS without the ME being updated, whether because the flash skipped that region or the step failed, and the only way to see it is to read the ME version on its own.

The ME runs whether AMT is on or not, so updating it was worth doing regardless, and it had to happen while Windows was still there. I checked the tool's Authenticode signature first, closed everything, and ran it as administrator. It reported success. WMI still said 11.22.60.1561, which worried me for a minute, but the tower had not restarted and the new image only takes over on the next boot. After a restart, the AMT Configuration screen showed 11.22.96.2588, and Manageability Control and Computrace were both still Disabled. Back in Windows the same WMI query read 11.22.96.2588 with the AMT bit still off, and the ports were still closed from the laptop.

AMT stays off, but for a different reason than the one I started with. It can be patched now. It would still be a management service answering on the network below the operating system, on a flat home LAN, and nothing here needs it: Wake-on-LAN covers remote power-on. I also tested a fallback by accident. When the power cord went back in, the tower started on its own, because After Power Loss was still on Power On, which made a smart plug a usable remote power button. That plan lasted one day: I then set After Power Loss to Power Off, and Wake-on-LAN turned out not to work after a shutdown from Linux, which is the next article. Turning AMT back on is two minutes in the BIOS, and with a current ME that would be a safer choice than it was yesterday.

The COM3 port will show up in lspci under Proxmox too, and the WMI provider leaves with Windows, so in the next session I will read the AMT state again from Linux and repeat the port test.