This isn't something your consumer computer is doing automatically, in fact, your computer is almost certainly not capable because it lacks an AMT-capable NIC. I suspect the software capability is baked into ME itself rather than the AMT component so it's probably present in your ME, but it's not doing anything without an AMT NIC to communicate with.

This is the kind of feature that you pay an extra $1k for when you configure your $20k server.

We have ~$400 Sandy Bridge workstations at work that have separate AMT enabled NICs. You don't have to spend $1k for the feature; here's a vPro enabled board for $100:

http://www.newegg.com/Product/Product.aspx?Item=N82E16813157...

Dell's add-in card to do out-of-band management is called the DRAC and it's been optional in their servers for about 17 years: https://en.m.wikipedia.org/wiki/Dell_DRAC

https://defcon.org/images/defcon-22/dc-22-presentations/Kall...

and

http://legbacore.com/Research_files/HowManyMillionBIOSWouldY...

The example in the first link is especially depressing, because they found an integer overflow vulnerability in a code file that started with this warning comment:

   /*
   Caution: This module requires additional review when
   modified.
   This driver will have external input − capsule image.
   This external input must be validated carefully 
   to avoid security issue like buffer overflow, integer
   overflow. */

http://superuser.com/questions/360754/what-is-intel-active-m...

The fuses are blown when the chip is manufactured to encode a _pre-calculated_ 2048-bit rsa key-pair, selected from a giant collection which intel generated en-mass to have some properties that allow the two 1024-bit primes to be encoded using only 272 bits each (if I'm reading it right):

"The TPM on the security and management engine features a preinstalled endorsement key (2048-bit RSA). The endorsement key is required to be unique per hardware part. Because of its uniqueness, the endorsement key cannot simply be hard-coded in the firmware, which is the same on all parts. Instead, hundreds of millions of endorsement keys are pregenerated. During Intel’s manufacturing process, different key materials are burned to the platform’s security fuses for all parts, respectively. Note that key materials are not the key value. [...] This algorithm is implemented by the key generation facility and not the TPM firmware."

(Same source as parent)

https://www.coreboot.org/pipermail/coreboot/2016-September/0... - "AFAIK the ME will allow the platform to stay on for 30 minutes, and will then shut it down hard." (when the firmware/ME has gone bad)

https://www.coreboot.org/pipermail/coreboot/attachments/2016...

If this will turn out to be something that could be reliably disabled on other laptops, this is going to be huge.

I built a headless compile-slave box recently, and was looking forward to using AMT features to manage it and keep it headless, but found out too late that the board I ordered didn't have AMT support. Now, whenever its fragile boot-stack of GRUB+iSCSI+Xen+LVM decides to wedge into single-user mode on a reboot, I have to power the box off and carry it over to a monitor to see what's wrong. I'd much rather just fix it from my laptop.

You can disable SuperMicros IPMI though by pulling out the PCI card, though :-)

Once you have a serial console, you can either just plug the cable into your laptop (likely through USB-attached serial port) or set up a small second box (that just runs an ssh daemon and has something like picocom installed) and connect it to that. Then you'll have access over the network.

As long as the actual owner has the keys, I agree.