How to prevent attack via Intel AMT

[JWong19]

I have a computer system that the underlying hardware (Q77 chipset) supports Intel AMT technology. The computer system will be distributed to my users soon. I predict that it could be a nightmare of my support time to the users, in case the computer system is maliciously managed via the channels of Intel AMT.

How can I prevent attack via the channels of Intel AMT?

How can I check if a computer system is attacked via the channels of Intel AMT? (provided that I still have Administrator rights of the OS)

[Joseph_O_Intel1]

Intel AMT is not enabled by default, so it will require an IT admin to enable the feature. So by default there are no openings for remote access to AMT while it is not enabled..

It is recommended that Intel AMT be enabled prior to deployment, so If your concerned about configuration by some third party, you can always change the MEBx password at a minimum or perform your own complete configuration, either of which would enable you to secure the system with your own custom password. 

Joe