1

I work in cybersecurity and would like to find an older laptop that doesn't have the Intel Management Engine built-in, while still able to run a Debian OS well.

I have an IBM ThinkPad t42 with 42T0273 system board laying around, which was introduced in late 2004. While it likely doesn't have IME on it, I found that t42s came equipped with something called Embedded Security System, which sounds eerily similar.

Can you advise on whether my t42 is free from remote management hardware, or is there another, perhaps later model of thinkpads that can be used? (I do not want to use system76 or purism systems).

4
  • 1
    Define "safe". Any CPU and platform old enough not to have IME is going to be missing modern security features that are far more likely to be of practical impact against attackers. You'd be far better off picking a modern platform without AMT if you're concerned about OOB management vulnerabilities.
    – Polynomial
    Sep 20, 2021 at 0:00
  • updated the question to clarify what I mean by safe.
    – Eduard
    Sep 20, 2021 at 0:59
  • There are AMD versions. Sep 22, 2021 at 3:09
  • Consumer laptops don't have Intel Active Management Technology installed in Windows so it won't matter if motherboard has Intel Management Engine.
    – defalt
    Sep 23, 2021 at 8:06

1 Answer 1

1

Intel Management Engine (IME) is an old term. It has now been combined into the internal system management component on the CPU, which is called the Converged Security & Management Engine (CSME). While it does play a role in remote management on supporting platforms, it is not the same thing as remote management.

Your platform must support Active Management Technology (AMT) in order for the out-of-band management capability to be present. AMT is orchestrated by both the processor and the Platform Controller Hub (PCH), along with a supporting NIC. Intel's branding for the family of SKUs that support AMT is "Intel vPro Technology".

If you want to avoid AMT, simply select a non-vPro platform. Examples of mobile CPUs that do not have vPro support are:

11th Gen:

  • i7-1195G7
  • i7-1165G7
  • i7-1160G7
  • i5-1155G7
  • i5-1135G7
  • i5-1130G7
  • i3-1125G4
  • i3-1120G4
  • i3-1110G4

10th Gen:

  • i7-1065G7
  • i7-1060G7
  • i7-10750H
  • i7-10710U
  • i7-10510U

You can find more on Intel Ark.

You can also use a vPro platform, then turn AMT off in the UEFI.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .