Intel ME / AMT

BY | Oct 21, 2026 | Network Security

Intel ME / AMT: What Blacklisting the MEI Stack Actually Does

Intel Management Engine is one of the most misunderstood pieces of modern hardware. Most guides tell you to “disable ME” and stop there, which leaves you with three unrelated things tangled together. Separating them makes the whole subject simple — and stops you from breaking DRM playback for nothing.

Three Things People Confuse

The Management Engine (ME)

Firmware baked into the chipset. It runs from power-on, before any OS, and never stops in normal operation.

MEI / HECI — the interface

The host-to-ME channel. On Linux this is the mei* module stack; on Windows the “Intel Management Engine Interface” device. This is what blacklisting removes.

Intel AMT

Optional remote-management layer on top of ME. It keeps working with no OS driver loaded — that is the entire point of out-of-band.

Bottom line: blacklisting MEI stops the OS talking to the ME. It does not stop the ME, and it does not stop AMT. For that you disable it in firmware or block it on the network.

Linux: Unbinding the MEI Stack

Create /etc/modprobe.d/blacklist-mei.conf:

blacklist mei
blacklist mei_me
blacklist mei_gsc
blacklist mei_hdcp
blacklist mei_pxp
blacklist mei_lb
install mei /bin/false
install mei_me /bin/false
install mei_gsc /bin/false
install mei_hdcp /bin/false
install mei_pxp /bin/false
install mei_lb /bin/false

blacklist # Test without rebooting — config file must be in place first sudo modprobe -r mei_gsc mei_hdcp mei_pxp mei_lb mei_wdt mei_me mei # Verify the stack is gone lsmod | grep mei || echo "Modules unloaded" ls /dev/mei* || echo "No /dev/mei* nodes" stops alias-based autoloading. install ... /bin/false makes modprobe refuse the load even when explicitly requested. Both together is deliberate.

Rebuild the initramfs or it silently does nothing — mei_me loads early on most distros:

sudo update-initramfs -u    # Debian / Ubuntu
sudo dracut -f              # Fedora / RHEL

Confirm it is a module first with modinfo mei; if it reports builtin, blacklisting has no effect. Then verify after reboot:

lsmod | grep mei          # should be empty
ls /dev/mei*              # should be missing
lspci -nn -s 00:16.0      # device still present, just unbound

Per-OS Reality Check

Linux

Full control via modprobe.d. Blacklist plus install /bin/false, then rebuild the initramfs.

Windows

No modprobe equivalent. Disable the PnP device instead: Device Manager → System devices → Intel Management Engine Interface → Disable device. Disable, do not uninstall — an uninstall gets silently reinstalled.

macOS

Least control. No supported way to unload the host interface, and Macs rarely ship with AMT enabled. Hackintosh can drop the device via an OpenCore property.

What Actually Breaks

AMT local tools

Anything using /dev/mei0 stops. Remote AMT over the network is unaffected.

ME watchdog

Blacklisting mei_wdt removes the ME-provided watchdog. Only matters if you rely on it.

DRM playback

mei_hdcp and mei_pxp carry protected-content paths. On some systems, HD streaming in Chrome or Firefox breaks. Test first.

GSC / display features

mei_gsc and friends tie into newer platform features. Usually invisible, occasionally odd.

Blocking the Ports

The part that catches everyone: AMT runs on the NIC firmware, below the OS. Its traffic never reaches the host stack, so iptables, nftables, and Windows Firewall cannot block it. Block it upstream on the router or switch.

16992 / 16993

AMT web interface, HTTP and HTTPS.

16994 / 16995

AMT redirection, plain and TLS.

5900

AMT KVM / VNC is incoming.

623 / 624

IPMI RMCP. Only if the board has IPMI — not AMT.

664

ASF alerting.

Block by port

The ME usually has its own MAC, one above the OS NIC. Blocking by host IP misses it.

The Real Off-Switch

BIOS / UEFI

Set Intel AMT or ME state to Disabled if available. Simplest and most reliable option available.

MEBx

Ctrl+P at boot enters ME configuration, where AMT can be turned off — but only if it is already provisioned.

HAP bit

me_cleaner –soft-disable halts the ME shortly after boot. Fine on older platforms; newer CSME does more of the boot, so verify before flashing.This can kill you computer!

Useful Resources

Kernel

MEI Driver Docs

docs.kernel.org

Kernel

modprobe.d(5)

man7.org

Firmware

me_cleaner

github.com

Firmware

MEAnalyzer

github.com

Reference

Intel Management Engine

wikipedia.org

Reference

Intel AMT

wikipedia.org

Questions for the Community

Have you blacklisted it?

Did blacklisting the MEI stack cause any visible breakage, or did it go clean?

How do you block AMT?

Firmware disable, upstream port block, or both? What did you settle on?

Worth the effort?

Is removing the OS’s ME access worth it on a desktop, or is firmware disable enough?

Blacklisting the MEI stack is a host-side convenience, not a disable. It removes the OS’s view of the ME while the firmware keeps running and AMT keeps answering on the wire. If your goal is genuine reduction of attack surface, the order is firmware first, network block second, driver unbind third.

Disclaimer

This content is for educational and informational purposes only. It is not technical advice. Back up your flash before running me_cleaner, and test blacklisting on one machine before rolling it out — DRM playback is the most common casualty.

DISCUSSION

No replies yet. Be the first to join the discussion!