Intel AMT and Out-of-Band Management for Industrial PCs

Intel AMT (Active Management Technology) is the out-of-band management engine built into Intel vPro processors and chipsets. It lets an administrator power a computer on, off or reset it, view and control its screen, open the BIOS and boot a recovery image over the network, even when the operating system has crashed or no operating system is installed.

Out-of-band management has long been the way to keep control of computers that nobody can reach easily. By giving an industrial grade PC a management channel that does not depend on its operating system, it allows troubleshooting, recovery and maintenance even when the main system has failed. Our out-of-band management explainer covers the general idea; this guide is about doing it on industrial and edge computers.

Take digital signage as an example. Frozen screens and unresponsive kiosks are common, and the usual fix is a technician visiting to restart the player. Software remote-access tools do not help when the device is off or hung. Out-of-band management does: it can power the device on or off, change BIOS settings and reload the SSD image without anyone on site.

This guide explains what Intel AMT does, compares it with Intel Standard Manageability, IPMI and Redfish baseboard management controllers and add-on out-of-band modules, lists which industrial processors support it, and covers provisioning, security and the alternatives for Atom, Arm and Jetson systems that do not have AMT.

“Integrating a remote management service on an edge computer simplifies system access and upgrades through standard protocols, so our customers’ IT teams can monitor and manage their embedded systems with ease. One of our customers once had to charter a helicopter to replace a real-time clock battery worth a few pounds, a costly and time-consuming effort that remote access to the UEFI firmware, to resynchronise the computer’s real-time clock, could have avoided.” Andrew Whitehouse, Managing Director, Things Embedded

Several technologies offer out-of-band control of an industrial computer. They differ in what they can do, which hardware they need and how they are managed. The table compares them on the points that matter for unattended edge systems; exact features vary by generation and board, so check the computer’s datasheet.

A baseboard management controller is a separate processor on the board with its own power, firmware and usually its own network port, which is why servers rely on it. AMT runs on the Management Engine inside the Intel chipset and shares a network port with the operating system, so it adds out-of-band control without an extra chip. Add-on modules bring similar functions to systems that have neither.

AMT is one part of Intel vPro, Intel’s set of business-class technologies for manageability, security and stability. It runs on the Intel Management Engine, a small processor in the chipset with its own firmware, which stays powered whenever the computer has standby power. Its main functions are below.

The management traffic uses TCP ports 16992 and 16993 for the web and TLS interfaces, 16994 and 16995 for redirection, and 5900 when KVM is reached with a standard VNC viewer. Those ports should only be reachable from the management network.

Is Intel AMT the same as vPro?

Not quite. vPro is the brand for a platform that includes AMT along with security and stability features. A processor or system described as vPro Enterprise includes full AMT; vPro Essentials includes Intel Standard Manageability, a subset without KVM. Industrial datasheets usually say which, or simply list Intel AMT and its version.

AMT needs three things together: a processor with vPro, a chipset that enables it, and the Intel Ethernet port wired for manageability. Firmware must ship with AMT enabled. If any one is missing, the feature is not available, whatever the processor name suggests. The table gives the usual position; always check the specific computer.

Industrial datasheets are usually explicit. The DFI EC70A-ADP series, for example, offers Intel AMT on its Core i5 and i7 builds but not on the i3 builds. Embedded boards built on Q370, Q670E, R680E, Q870 and W880 chipsets list vPro and AMT, while systems built for the lowest power use Atom or Processor N parts without it. If remote KVM matters, choose the processor for it at the start; it cannot be added later.

AMT ships unconfigured. It has to be provisioned before it can be used, and the method decides how it behaves on a headless industrial system.

Provisioning steps

• Confirm the processor, chipset and network port support AMT, and that it is enabled in the BIOS.
• Enter the Intel Management Engine BIOS Extension (MEBx), typically with Ctrl+P at boot, and change the default password to a strong one.
• Set the network options: DHCP or a static address, and which network the management port sits on.
• Choose CCM or ACM. For unattended systems, provision ACM so remote KVM does not wait for a consent code nobody can read.
• Enable TLS and register the system with a management console, such as Intel Endpoint Management Assistant (EMA) or an open-source console.
• Test power control, KVM and USB redirection before the system leaves for site.

For systems that sit behind NAT, on cellular links or on networks you do not control, Intel’s Client Initiated Remote Access (CIRA) lets AMT open an outbound encrypted connection to the management server, so nothing needs to be exposed inbound. That is how AMT is typically used over a cellular gateway link.

Any interface that can control a computer below its operating system needs care. In May 2017 Intel published advisory INTEL-SA-00075 (CVE-2017-5689), a flaw that let an attacker gain control of provisioned AMT systems without a valid password; it was fixed in firmware updates. The lesson is not that AMT is unsafe, but that it must be configured and maintained like any other management interface.

On an industrial network the management interface belongs in its own zone, in line with the zones and conduits model of IEC 62443 and the Purdue model. Our IEC 62443-4-2 hardware security checklist covers the device-level requirements, and OT security explains the wider approach. A TPM 2.0 and Secure Boot protect the operating system image that AMT can help you recover.

IPMI (Intelligent Platform Management Interface) is an industry standard for server management, implemented on a baseboard management controller. Redfish is its modern successor from the DMTF, a RESTful API over HTTPS. A BMC monitors temperatures, fans, voltages and power supplies, keeps a system event log, and provides iKVM and virtual media. Because it has its own processor, power rail and network port, it works whatever state the host is in.

AMT does similar jobs for client and embedded systems without a separate chip. It has fewer hardware sensors and no fan or power supply management, but it costs nothing extra on a vPro system and fits small fanless computers where a BMC would not. In practice: edge AI servers and server motherboards use a BMC; box PCs, panel PCs and SBCs use AMT where they have a vPro processor; everything else uses an add-on module or simpler tools.

Many edge systems use processors without AMT: low-power Atom and Processor N computers, AMD systems, and Arm and NVIDIA Jetson Orin computers. For these, industrial computer makers offer add-on out-of-band modules, usually a small microcontroller with its own network port or a header for a module, wired to the power button, reset line and serial console.

Allxon out-of-band management

We partnered with Allxon for out-of-band management because its solution works across a wide range of our industrial computers, built for harsh environments at the edge. It is designed for both x86 and Arm systems and supports Windows IoT Enterprise and Ubuntu Linux, so the same management approach covers a fleet that mixes Intel box PCs and Jetson AI computers. Allxon exposes out-of-band functions such as power actions and a remote serial console through standard protocols and an API, so they can be built into an existing control centre, and it works with public clouds such as AWS and Azure, private clouds or on-premises systems.

The trade-off against AMT is depth. An OOB module typically offers power control and a serial console rather than full graphical KVM and image mounting. For many edge AI systems, which run headless and boot from a known image, that is enough to recover a hung system without a site visit.

Getting started with out-of-band management

Start by choosing the out-of-band functions your project needs, then the hardware and operating system. Tell us the system architecture, the operating system and how the systems will be reached, and we will select a computer with the right management path, AMT, a BMC or an OOB module, and configure it with the rest of the build.

The value of out-of-band management is measured in site visits avoided. A truck roll to a remote cabinet can cost more than the computer inside it. The table maps common failures to the recovery action each method allows.

Out-of-band management works best alongside simpler tools. A watchdog timer restarts a system that stops responding, Wake on LAN powers systems on at scheduled times, and a power cycle from a switched supply is the last resort. A remote monitoring system tells you which of them to use and when.

These systems show each management route in practice. We enable and provision AMT, configure BMC or OOB module network settings, set passwords and certificates, register systems with your console where required, image the operating system and test remote power and console access before the computer ships.