I read about Intel Management Engine and how it is a backdoor at the CPU level and does is not installed at the operating system level.
I tried googling this but how would I know if the laptop is still enrolled into some network? I would hate if some sysadmin could remotely do stuff to my PC.
(Edit: I didn't make the relationship between these clear. All modern Intel laptops have ME. AMT is a software component that runs on top of the ME, but is only provisioned for systems that have VPro badging)
To be clear, this is not a technical side-effect of some incidental reliance of the boot process on the management engine (ME). Instead, Intel has deliberately made it impossible for consumers to disable the ME, has obfuscated how the ME works, and offered ME-disabled computers only to "military, government and intelligence agencies".
All under the guise that "Intel considers disabling ME to be a security vulnerability, as a malware could abuse it to make the computer lose some of the functionality that the typical user expects, such as the ability to play media with DRM" - which is beyond laughable.
In short, it could not be more obvious that the ME is malicious.
Source: https://en.wikipedia.org/wiki/Intel_Management_Engine
fixed it
How old?
https://virtualizationreview.com/articles/2020/01/13/configu...
Intel ME is its own can of worms and can only be fully disabled by modifying the firmware image, see tools like me_cleaner.
https://framagit.org/GNUtoo/coreboot-scripts/-/tree/master/f...
On really old or some oddball systems the process requires a CMOS battery pull for a few minutes.
This all assumes your device was enterprise targeted to start with. If it lacks vPro/DASH it's irrelevant.
You can double check your own device in other ways too like seeing if there is a web server at http{s}://your_local_ip:{16992,16993}/ (from another host on your LAN not the same one).
Keep in mind that regardless of the status, you can always reset it. In some cases you can also remove most of it, but since the ME also controls a lot of power functions and on laptops might also hinder EC usage if disabled, you might simply not have much choice.
If the ME (or AGESA) is a problem for you, there are two options:
1. Get a very old machine that doesn't have it
2. Get a machine that doesn't use Intel or AMD processors
And just in case: ME "enrolment" doesn't actually mean much. It's not some cool remote control thing or remote wipe or something like that; it's mostly just crappy VNC and a janky XML API that only works on the local network. So even if it contains provisioning profiles for some company, it's not like they have 'access' to your laptop. It's not like Apple's DEP or the legacy CompuTrace or Intel AT products. Those two are also not really all that exciting considering they mostly just work like rootkits on specific windows versions. If anything, getting your hands on a provisioned laptop gets YOU access to the company network in some badly configured NACs.The only other commercially available x86 processors I'm aware of are Zhaoxin, and I would be very surprised if those didn't have something ME-like baked in.