> I have yet to hear any explanation of the IME that makes sense without the presence user-hostile intent.

The entirety of enterprise laptop management. Not because you don't want users to change their laptop. The point is to be able to run updates for the users.

Or consider the remote KVM option. Disregarding security, that is a sysadmin's wet dream. Being able to recover a system that can't boot saves a lot of boots on the ground.

I get all that - I've worked in enterprise IT my entire career.

It does not explain the 30 minute timer.

> It does not explain the 30 minute timer.

An innocent use would be: "If the ME is hung, turn it off and on again."

Sigh. If I need to spell this out:

Why is the ME watchdog mandatory?

What innocent explanation details why Intel has chosen to deny me the option to consider the ME a security risk in my environment and disable it?

Even if the CPU running Windows is bluescreened, you can still pull up a KVM remotely. Demonstrates the power that AMT possesses for good or ill.

Consumer ARM-based platforms in the market right now are even more locked down and spy-hook-infected than any x86 laptop. The baseband CPU on most phones is a far more capable device than the microcontrollers used for this on big core machines, and they routinely have access to all of DRAM without the possibility of interception by the application core.

You need a PKI infrastructure to implement AMT/IME.

I used it a few years ago to automatically build classroom computers for training classes. The trainer would pick a configuration, and a complete server and workstation environment would be installed.

You can also do KVM from a powered down state, brick the device, or validate that management engines are present.

Management of "corporate" computers. Installing Windows on hundreds of machines at once, remotely wiping stolend laptops with corporate secrets. But the cancer has spread to all computers, regardless of domain of activity.