How to completely disable Intel AMT? (Intel ME)

Question

I have a Lenovo M82 box and it has Intel ME. Which means UDP traffic on port 623 just disappears into a black hole without a trace.

Is there any way to completely switch this effect off? Disabling it in BIOS (or playing with settings in Intel ME bios) so far produced zero effect -- it keeps eating all UDP packets on port 623.

Solution

Here's a concise, plain English guide to disabling Intel AMT

Intel AMT is the OS Layer to Intel ME. In some chipsets you can disable Intel ME by following these instructions (at your own risk). Newer chipsets (Haswell on) have Intel Boot Guard set in Verified Boot, which renders the solution above unusable.

UPDATE 2018: Starting with Intel AMT Release 12.0, it is possible to globally disable Intel AMT.

Comments

[C.M.]

It still intercepts port 623 traffic

[C.M.]

removing software components does absolutely nothing to chipset logic that filters all network packets and intercepts any UDP sent to port 623. Your second link may work, but since I've already fixed my problem (by using 3rd-party network card) -- it is unlikely that I ever check it.

[Triynko]

This technology should not exist. Period. In the way that pocket-sized atom bombs should not exist.

[Serge Stroobandt]

@C.M. There is evidence from disassembly that Baseboard Management Controllers (BMCs) like the Intel Management Engine run Linux. If this is the case, the Linux kernel cannot be excluded from featuring all drivers to talk to any NIC through PCIe. On notebooks that would be the case anyway, since WLAN is handled by off-chip plugin modules.

[Serge Stroobandt]

@C.M.That said, the normal pathway for a BCM to talk to a NIC, is through the Network Controller Sideband Interface. Hence, your suggestion of using a (non-Intel) separate PCIe NIC could still be valuable.

[C.M.]

@SergeStroobandt It is certainly valuable in sense that it is the only way I found that allows me to use UDP port 623 from application layer. I would not be surprised if there is a way to configure motherboard to stop intercepting traffic on that port by using some hidden API, but uninstalling software mentioned in Gaia's links produced zero effect.