I think it’s maybe a difference between servers and workstations, then. I did a full BIOS factory reset, and it was in the “Intel AMT”-disabled state after I di

I think it’s maybe a difference between servers and workstations, then. I did a full BIOS factory reset, and it was in the “Intel AMT”-disabled state after I did so. To be clear, are you talking about Intel AMT specifically (which I’m not really aware of being a “thing” with Xeon), or just regular server-OEM BMCs (iLO, DRAC, etc.)? BMCs are definitely usually pre-configured. That’s part of the point of BMCs: you can rack the servers and run cable from their management NICs to the management-VLAN switches; then populate their drive bays; and then batch-provision everything at once through the BMCs (including, hopefully, setting up actual security on the BMC.) But Intel AMT isn’t quite the same thing. (For one, vPro-badged computers don’t usually have a separate management NIC — though some do! — but rather Intel AMT usually uses the IOMMU to virtualize another NIC onto the same physical motherboard RJ45 socket. So it’d be a much worse security design to have AMT default-enabled from the factory, since that’d put new machines’ control-plane interfaces out onto your regular-traffic VLAN by default...)