1. PDQ Deploy & Inventory Help Center
  2. Community
  3. PDQ Inventory
 

Important Notice: On February 29th, this community was put into read-only mode. All existing posts will remain but customers are unable to add new posts or comment on existing. Please feel to join our Community Discord for any questions and discussions.

Intel Active Management Technology

Avatar
jppowers

Is there a way to scan for deployed AMT machines and vPro machines ?

0

Comments

9 comments
Date Votes
  • Avatar
    Permanently deleted user

    This is what I have so far. It's an Inventory report that looks at driver versions. Unfortunately Inventory doesn't seem to pick up older versions of Intel Management Engine Interface. I have an internal bug ticket open for that.

    <?xml version="1.0" encoding="utf-8"?>
    <AdminArsenal.Export Code="PDQInventory" Name="PDQ Inventory" Version="12.3.0.0" MinimumVersion="3.1">
     <Report>
     <ReportDefinition name="Definition">
     <Columns type="list">
     <Column>
     <Column>Name</Column>
     <Summary></Summary>
     <Table>Computer</Table>
     <Title></Title>
     </Column>
     <Column>
     <Column>Name</Column>
     <Summary></Summary>
     <Table>HardwareDevice</Table>
     <Title></Title>
     </Column>
     <Column>
     <Column>DriverVersion</Column>
     <Summary></Summary>
     <Table>HardwareDevice</Table>
     <Title></Title>
     </Column>
     </Columns>
     <RootFilter name="Filter">
     <Comparison>All</Comparison>
     <Filters type="list">
     <GroupFilter>
     <Comparison>Any</Comparison>
     <Filters type="list">
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>Name</Column>
     <Comparison>Contains</Comparison>
     <Value>Intel Active Management</Value>
     </ValueFilter>
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>Name</Column>
     <Comparison>Contains</Comparison>
     <Value>Intel Management Engine</Value>
     </ValueFilter>
     </Filters>
     </GroupFilter>
     <GroupFilter>
     <Comparison>Any</Comparison>
     <Filters type="list">
     <GroupFilter>
     <Comparison>All</Comparison>
     <Filters type="list">
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>StartsWith</Comparison>
     <Value>6</Value>
     </ValueFilter>
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>VersionLowerThan</Comparison>
     <Value>6.2.61.3535</Value>
     </ValueFilter>
     </Filters>
     </GroupFilter>
     <GroupFilter>
     <Comparison>All</Comparison>
     <Filters type="list">
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>StartsWith</Comparison>
     <Value>7</Value>
     </ValueFilter>
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>VersionLowerThan</Comparison>
     <Value>7.1.91.3272</Value>
     </ValueFilter>
     </Filters>
     </GroupFilter>
     <GroupFilter>
     <Comparison>All</Comparison>
     <Filters type="list">
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>StartsWith</Comparison>
     <Value>8</Value>
     </ValueFilter>
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>VersionLowerThan</Comparison>
     <Value>8.1.71.3608</Value>
     </ValueFilter>
     </Filters>
     </GroupFilter>
     <GroupFilter>
     <Comparison>All</Comparison>
     <Filters type="list">
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>StartsWith</Comparison>
     <Value>9.0</Value>
     </ValueFilter>
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>VersionLowerThan</Comparison>
     <Value>9.1.41.3024</Value>
     </ValueFilter>
     </Filters>
     </GroupFilter>
     <GroupFilter>
     <Comparison>All</Comparison>
     <Filters type="list">
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>StartsWith</Comparison>
     <Value>9.1</Value>
     </ValueFilter>
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>VersionLowerThan</Comparison>
     <Value>9.1.41.3024</Value>
     </ValueFilter>
     </Filters>
     </GroupFilter>
     <GroupFilter>
     <Comparison>All</Comparison>
     <Filters type="list">
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>StartsWith</Comparison>
     <Value>9.5</Value>
     </ValueFilter>
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>VersionLowerThan</Comparison>
     <Value>9.5.61.3012</Value>
     </ValueFilter>
     </Filters>
     </GroupFilter>
     <GroupFilter>
     <Comparison>All</Comparison>
     <Filters type="list">
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>StartsWith</Comparison>
     <Value>10</Value>
     </ValueFilter>
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>VersionLowerThan</Comparison>
     <Value>10.0.55.3000</Value>
     </ValueFilter>
     </Filters>
     </GroupFilter>
     <GroupFilter>
     <Comparison>All</Comparison>
     <Filters type="list">
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>StartsWith</Comparison>
     <Value>11.0</Value>
     </ValueFilter>
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>VersionLowerThan</Comparison>
     <Value>11.0.25.3001</Value>
     </ValueFilter>
     </Filters>
     </GroupFilter>
     <GroupFilter>
     <Comparison>All</Comparison>
     <Filters type="list">
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>StartsWith</Comparison>
     <Value>11.5</Value>
     </ValueFilter>
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>VersionLowerThan</Comparison>
     <Value>11.6.27.3264</Value>
     </ValueFilter>
     </Filters>
     </GroupFilter>
     <GroupFilter>
     <Comparison>All</Comparison>
     <Filters type="list">
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>StartsWith</Comparison>
     <Value>11.6</Value>
     </ValueFilter>
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>VersionLowerThan</Comparison>
     <Value>11.6.27.3264</Value>
     </ValueFilter>
     </Filters>
     </GroupFilter>
     </Filters>
     </GroupFilter>
     </Filters>
     </RootFilter>
     <ReportDefinitionTypeName>BasicReportDefinition</ReportDefinitionTypeName>
     </ReportDefinition>
     <Description>https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&amp;languageid=en-fr</Description>
     <Name>Intel AMT - Vulnerable</Name>
     <ReportFolderId value="1" />
     <ReportType>BasicReport</ReportType>
     </Report>
    </AdminArsenal.Export>
    0
  • Avatar
    Permanently deleted user

    I updated it to include Intel Management Engine Interface entries that have an empty Driver Version.

    <?xml version="1.0" encoding="utf-8"?>
    <AdminArsenal.Export Code="PDQInventory" Name="PDQ Inventory" Version="12.3.0.0" MinimumVersion="3.1">
     <Report>
     <ReportDefinition name="Definition">
     <Columns type="list">
     <Column>
     <Column>Name</Column>
     <Summary></Summary>
     <Table>Computer</Table>
     <Title></Title>
     </Column>
     <Column>
     <Column>Name</Column>
     <Summary></Summary>
     <Table>HardwareDevice</Table>
     <Title></Title>
     </Column>
     <Column>
     <Column>DriverVersion</Column>
     <Summary></Summary>
     <Table>HardwareDevice</Table>
     <Title></Title>
     </Column>
     </Columns>
     <RootFilter name="Filter">
     <Comparison>All</Comparison>
     <Filters type="list">
     <GroupFilter>
     <Comparison>Any</Comparison>
     <Filters type="list">
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>Name</Column>
     <Comparison>Contains</Comparison>
     <Value>Intel Active Management</Value>
     </ValueFilter>
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>Name</Column>
     <Comparison>Contains</Comparison>
     <Value>Intel Management Engine</Value>
     </ValueFilter>
     </Filters>
     </GroupFilter>
     <GroupFilter>
     <Comparison>Any</Comparison>
     <Filters type="list">
     <GroupFilter>
     <Comparison>All</Comparison>
     <Filters type="list">
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>StartsWith</Comparison>
     <Value>6</Value>
     </ValueFilter>
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>VersionLowerThan</Comparison>
     <Value>6.2.61.3535</Value>
     </ValueFilter>
     </Filters>
     </GroupFilter>
     <GroupFilter>
     <Comparison>All</Comparison>
     <Filters type="list">
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>StartsWith</Comparison>
     <Value>7</Value>
     </ValueFilter>
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>VersionLowerThan</Comparison>
     <Value>7.1.91.3272</Value>
     </ValueFilter>
     </Filters>
     </GroupFilter>
     <GroupFilter>
     <Comparison>All</Comparison>
     <Filters type="list">
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>StartsWith</Comparison>
     <Value>8</Value>
     </ValueFilter>
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>VersionLowerThan</Comparison>
     <Value>8.1.71.3608</Value>
     </ValueFilter>
     </Filters>
     </GroupFilter>
     <GroupFilter>
     <Comparison>All</Comparison>
     <Filters type="list">
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>StartsWith</Comparison>
     <Value>9.0</Value>
     </ValueFilter>
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>VersionLowerThan</Comparison>
     <Value>9.1.41.3024</Value>
     </ValueFilter>
     </Filters>
     </GroupFilter>
     <GroupFilter>
     <Comparison>All</Comparison>
     <Filters type="list">
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>StartsWith</Comparison>
     <Value>9.1</Value>
     </ValueFilter>
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>VersionLowerThan</Comparison>
     <Value>9.1.41.3024</Value>
     </ValueFilter>
     </Filters>
     </GroupFilter>
     <GroupFilter>
     <Comparison>All</Comparison>
     <Filters type="list">
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>StartsWith</Comparison>
     <Value>9.5</Value>
     </ValueFilter>
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>VersionLowerThan</Comparison>
     <Value>9.5.61.3012</Value>
     </ValueFilter>
     </Filters>
     </GroupFilter>
     <GroupFilter>
     <Comparison>All</Comparison>
     <Filters type="list">
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>StartsWith</Comparison>
     <Value>10</Value>
     </ValueFilter>
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>VersionLowerThan</Comparison>
     <Value>10.0.55.3000</Value>
     </ValueFilter>
     </Filters>
     </GroupFilter>
     <GroupFilter>
     <Comparison>All</Comparison>
     <Filters type="list">
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>StartsWith</Comparison>
     <Value>11.0</Value>
     </ValueFilter>
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>VersionLowerThan</Comparison>
     <Value>11.0.25.3001</Value>
     </ValueFilter>
     </Filters>
     </GroupFilter>
     <GroupFilter>
     <Comparison>All</Comparison>
     <Filters type="list">
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>StartsWith</Comparison>
     <Value>11.5</Value>
     </ValueFilter>
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>VersionLowerThan</Comparison>
     <Value>11.6.27.3264</Value>
     </ValueFilter>
     </Filters>
     </GroupFilter>
     <GroupFilter>
     <Comparison>All</Comparison>
     <Filters type="list">
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>StartsWith</Comparison>
     <Value>11.6</Value>
     </ValueFilter>
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>VersionLowerThan</Comparison>
     <Value>11.6.27.3264</Value>
     </ValueFilter>
     </Filters>
     </GroupFilter>
     <GroupFilter>
     <Comparison>All</Comparison>
     <Filters type="list">
     <ValueFilter>
     <Table>HardwareDevice</Table>
     <Column>DriverVersion</Column>
     <Comparison>Equals</Comparison>
     </ValueFilter>
     </Filters>
     </GroupFilter>
     </Filters>
     </GroupFilter>
     </Filters>
     </RootFilter>
     <ReportDefinitionTypeName>BasicReportDefinition</ReportDefinitionTypeName>
     </ReportDefinition>
     <Description>https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&amp;languageid=en-fr</Description>
     <Name>Intel AMT - Vulnerable</Name>
     <ReportFolderId value="1" />
     <ReportType>BasicReport</ReportType>
     </Report>
    </AdminArsenal.Export>
    0
  • Avatar
    jppowers

    Thank you. Question, this looks for the existence of the driver, but is there a way to see if the AMT is provisioned or not ?

    0
  • Avatar
    Permanently deleted user

    I put together a package that parses the output of Intel's Platform Discovery tool. All of my systems are currently not provisioned, so I'm trying to provision one of them to verify the effectiveness of this package.

    https://downloadcenter.intel.com/download/25776/Intel-SCS-Platform-Discovery-Utility

    <?xml version="1.0" encoding="utf-8"?>
    <AdminArsenal.Export Code="PDQDeploy" Name="PDQ Deploy" Version="13.0.2.0" MinimumVersion="9.0">
     <Package>
     <PackageDefinition name="Definition">
     <CopyMode>Default</CopyMode>
     <InventoryScanProfileId value="null" />
     <ScanAfterDeployment value="false" />
     <Timeout value="60" />
     <UseCustomTimeout value="false" />
     <RunAs value="null" />
     <Steps type="list">
     <PowerShellStep>
     <CustomCommandLine></CustomCommandLine>
     <Files></Files>
     <Script>. "$(Repository)\Intel\Platform Discovery\PlatformDiscovery.exe" | Out-File results.xml

    [xml]$Results = Get-Content results.xml

    ForEach ( $Device in $Results.PlatformDiscovery.Solution ) {

     if ( $Device.name -eq "Intel(R) AMT" ) {

     if ( $Device.state -notin "unconfigured", "not supported" ) {

     Write-Output $Device.state
     Exit 10

     }

     }

    }</Script>
     <SuccessCodes>0</SuccessCodes>
     <RunAs value="null" />
     <Conditions type="list">
     <PackageStepCondition>
     <Architecture>Both</Architecture>
     <Version>All</Version>
     <TypeName>OperatingSystem</TypeName>
     </PackageStepCondition>
     <PackageStepCondition>
     <IsUserLoggedOn>AlwaysRun</IsUserLoggedOn>
     <TypeName>LoggedOnUser</TypeName>
     </PackageStepCondition>
     </Conditions>
     <ErrorMode>StopDeploymentFail</ErrorMode>
     <Title>Perform Discovery</Title>
     <TypeName>PowerShell</TypeName>
     <IsEnabled value="true" />
     </PowerShellStep>
     </Steps>
     </PackageDefinition>
     <Description>https://downloadcenter.intel.com/download/25776/Intel-SCS-Platform-Discovery-Utility

    This will return error code 10 if AMT is not "unconfigured" or "not supported".</Description>
     <FolderId value="null" />
     <Name>Find Provisioned AMT</Name>
     <Path>Find Provisioned AMT</Path>
     <Version>1.0</Version>
     <PackageDisplaySettings name="DisplaySettings">
     <DisplayType>Normal</DisplayType>
     <IconKey>Icon-Package</IconKey>
     <SortOrder value="14" />
     </PackageDisplaySettings>
     </Package>
    </AdminArsenal.Export>
    0
  • Avatar
    molnar
    (Edited )

    Please help, maybe I'm doing something wrong here.

    I've imported your .xml into PDQ deploy, I downloaded and copied the PlatformDiscovery tool and placed it into $Repository directory folowing the \Intel\Platform Discovery\ path location.. 

    This is the error I'm getting:

    Cannot convert value "C:\Documents and Settings\All Users\Documents\Admin Arsenal\PDQ Deploy\Repository\Intel\Platform Discovery\PlatformDiscovery.exe" to type "System.Xml.XmlDocument". Error: "The specified node cannot be inserted as the valid chil
    d of this node, because the specified node is the wrong type."
    At C:\WINDOWS\AdminArsenal\PDQDeployRunner\service-1\exec\user.ps1:3 char:1
    + [xml]$Results = Get-Content results.xml
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     + CategoryInfo : InvalidArgument: (:) [], ParentContainsErrorRecordException
     + FullyQualifiedErrorId : InvalidCastToXmlDocument

    I'm not sure if you noticed, but Intel provided a special tool to check if your system is ATM vulnerable

    https://downloadcenter.intel.com/download/26755

    Don't you guys considering to create a user-friendly PDQ Invetory collection to allow us to see, if our workstations are vulnerable? 

    Thank you

     

    0
  • Avatar
    Permanently deleted user

    It looks like it saved the path of your repository to results.xml instead of running the tool. Try replacing the . with a &.

     

    I will look into that discovery tool.

    0
  • Avatar
    Permanently deleted user

    I updated that package to use Start-Process. Hopefully it works better now :)

     

    <?xml version="1.0" encoding="utf-8"?>
    <AdminArsenal.Export Code="PDQDeploy" Name="PDQ Deploy" Version="13.0.4.0" MinimumVersion="9.0">
     <Package>
     <PackageDefinition name="Definition">
     <CopyMode>Default</CopyMode>
     <InventoryScanProfileId value="null" />
     <ScanAfterDeployment value="false" />
     <Timeout value="60" />
     <UseCustomTimeout value="false" />
     <RunAs value="null" />
     <Steps type="list">
     <PowerShellStep>
     <CustomCommandLine></CustomCommandLine>
     <Files>$(Repository)\Intel\Platform Discovery\PlatformDiscovery.exe</Files>
     <Script>Start-Process PlatformDiscovery.exe | Out-File results.xml

    [xml]$Results = Get-Content results.xml

    ForEach ( $Device in $Results.PlatformDiscovery.Solution ) {

     if ( $Device.name -eq "Intel(R) AMT" ) {

     if ( $Device.state -notin "unconfigured", "not supported" ) {

     Write-Output $Device.state
     Exit 10

     }

     }

    }</Script>
     <SuccessCodes>0</SuccessCodes>
     <RunAs value="null" />
     <Conditions type="list">
     <PackageStepCondition>
     <Architecture>Both</Architecture>
     <Version>All</Version>
     <TypeName>OperatingSystem</TypeName>
     </PackageStepCondition>
     <PackageStepCondition>
     <IsUserLoggedOn>AlwaysRun</IsUserLoggedOn>
     <TypeName>LoggedOnUser</TypeName>
     </PackageStepCondition>
     </Conditions>
     <ErrorMode>StopDeploymentFail</ErrorMode>
     <Title>Perform Discovery</Title>
     <TypeName>PowerShell</TypeName>
     <IsEnabled value="true" />
     </PowerShellStep>
     </Steps>
     </PackageDefinition>
     <Description>https://downloadcenter.intel.com/download/25776/Intel-SCS-Platform-Discovery-Utility

    This will return error code 10 if AMT is not "unconfigured" or "not supported".</Description>
     <FolderId value="null" />
     <Name>Find Provisioned AMT</Name>
     <Path>Find Provisioned AMT</Path>
     <Version>2.0</Version>
     <PackageDisplaySettings name="DisplaySettings">
     <DisplayType>Normal</DisplayType>
     <IconKey>Icon-Package</IconKey>
     <SortOrder value="11" />
     </PackageDisplaySettings>
     </Package>
    </AdminArsenal.Export>
    0
  • Avatar
    Permanently deleted user

    Hmm, Start-Process isn't behaving how I thought it would. I switched to & and added some detail to the logging.

     

    <?xml version="1.0" encoding="utf-8"?>
    <AdminArsenal.Export Code="PDQDeploy" Name="PDQ Deploy" Version="13.0.4.0" MinimumVersion="9.0">
     <Package>
     <PackageDefinition name="Definition">
     <CopyMode>Default</CopyMode>
     <InventoryScanProfileId value="null" />
     <ScanAfterDeployment value="false" />
     <Timeout value="60" />
     <UseCustomTimeout value="false" />
     <RunAs value="null" />
     <Steps type="list">
     <PowerShellStep>
     <CustomCommandLine></CustomCommandLine>
     <Files>$(Repository)\Intel\Platform Discovery\PlatformDiscovery.exe</Files>
     <Script>&amp; ".\PlatformDiscovery.exe" | Out-File results.xml

    [xml]$Results = Get-Content results.xml
    $AMT_Found = $false

    ForEach ( $Device in $Results.PlatformDiscovery.Solution ) {

     if ( $Device.name -eq "Intel(R) AMT" ) {

     $AMT_Found = $true

     Switch ( $Device.state ) {

     "unconfigured" {

     Write-Output "Intel AMT is not provisioned"
     Write-Output "Hardware version: $($Device.Hardware.version)"
     Write-Output "Software version: $($Device.Software.version)"
     Exit 1

     }
     
     "not supported" {

     Write-Output "Intel AMT is not supported"
     Exit 0

     }

     default {

     Write-Output "Intel AMT is provisioned"
     Write-Output "State: $($Device.state)"
     Write-Output "Hardware version: $($Device.Hardware.version)"
     Write-Output "Software version: $($Device.Software.version)"
     Exit 10

     }

     }

     }

    }

    if ( $AMT_Found -eq $false ) {

     Write-Output "No AMT entries were found"
     Exit 20

    }</Script>
     <SuccessCodes>0,1</SuccessCodes>
     <RunAs value="null" />
     <Conditions type="list">
     <PackageStepCondition>
     <Architecture>Both</Architecture>
     <Version>All</Version>
     <TypeName>OperatingSystem</TypeName>
     </PackageStepCondition>
     <PackageStepCondition>
     <IsUserLoggedOn>AlwaysRun</IsUserLoggedOn>
     <TypeName>LoggedOnUser</TypeName>
     </PackageStepCondition>
     </Conditions>
     <ErrorMode>StopDeploymentFail</ErrorMode>
     <Title>Perform Discovery</Title>
     <TypeName>PowerShell</TypeName>
     <IsEnabled value="true" />
     </PowerShellStep>
     </Steps>
     </PackageDefinition>
     <Description>https://downloadcenter.intel.com/download/25776/Intel-SCS-Platform-Discovery-Utility

    This will return error code 10 if AMT is not "unconfigured" or "not supported".</Description>
     <FolderId value="null" />
     <Name>Find Provisioned AMT</Name>
     <Path>Find Provisioned AMT</Path>
     <Version>3.0</Version>
     <PackageDisplaySettings name="DisplaySettings">
     <DisplayType>Normal</DisplayType>
     <IconKey>Icon-Package</IconKey>
     <SortOrder value="11" />
     </PackageDisplaySettings>
     </Package>
    </AdminArsenal.Export>
    0
  • Avatar
    molnar

    That last version you've posted is working just fine. In the output.log I can see what I'm looking for. 

    Question now is, is this tool really doing what it should?

    My system was ATM vulnerable. I change BIOS/UEFI setting to disable ATM support. Started up Windows system again, ran the Intel-SA-00075-GUI utility again, and status has updated to: Unknow

     

    When I ran your latest script, output log says:

    Intel AMT is not supported

     

    So I'm wondering, does these tools really telling you actual status? But that's the question for another company (Intel). In my situation I've discovered that only two model lines are vulnerable. 

    Also wondering, no other admins are debating this security issue? Not interested ? 

    In any case, thank you for your effort. New BIOS firmwares should be released soon, this is the way we will go and patch our systems

    0