SCCM - Intel AMT Vulnerability Report

Here's the Intel guide to mitigating this risk

Intel-SA-0075 Mitigation Guide

1. Unprovision Client - Using their tool Intel ACUConfig Download

ACUConfig.exe UnConfigure


2. Disable or Remove the Service (should also end the process in the script)
sc config LMS start=disabled
sc delete LMS

Here's a report to find the AMT version and Provisioning State

It doesn't include the syntax for the report generated at the bottom

https://communities.intel.com/docs/DOC-5763

Count of Versions

SELECT COUNT( v_GS_AMT_AGENT.AMT0) as "Count", v_GS_AMT_AGENT.AMT0 FROM v_GS_AMT_AGENT INNER JOIN v_R_System ON v_GS_AMT_AGENT.ResourceID = v_R_System.ResourceID Group by v_GS_AMT_AGENT.AMT0 order by v_GS_AMT_AGENT.AMT0 Report for AMT version and Provisioning State less than 3

Includes model and processor to easier identify what files to download

SELECT v_R_System.Name0, v_GS_AMT_AGENT.AMT0, v_GS_AMT_AGENT.ProvisionState0, v_GS_COMPUTER_SYSTEM.Model0, v_GS_PROCESSOR.Name0 AS Expr1 FROM v_GS_AMT_AGENT INNER JOIN v_R_System ON v_GS_AMT_AGENT.ResourceID = v_R_System.ResourceID INNER JOIN v_GS_COMPUTER_SYSTEM ON v_R_System.ResourceID = v_GS_COMPUTER_SYSTEM.ResourceID INNER JOIN v_GS_PROCESSOR ON v_R_System.ResourceID = v_GS_PROCESSOR.ResourceID WHERE (v_GS_AMT_AGENT.ProvisionState0 < 3) ORDER BY v_GS_AMT_AGENT.ProvisionState0, Model0