How can I safely confirm Intel Management Engine status Disabled or Enabled

After I set up my new PC, I received a notification to update the Dell firmware for my new Dell Precision 3240 Compact. iIt said it was an update for security, so I did it. The next time I started up the computer it started installing the updated firmware. I noticed it started listing things like "updating BIOS" and "updating Intel ME" and a few more similar titles mentioning the Intel Management Engine went across the screen, and it finally said "Intel Management Engine successfully updated".

This doesn't make sense, because Dell said they would disable the management engine before shipping. I reviewed the product summary for my bill, and sure enough I had selected the option that says "ME Disable".

Product description:

• NVIDIA Quadro P620, 2GB, 4 mDP to DP adapter

• Ubuntu 18.04

• Intel Xeon W-1270 (8 Core, 16M cache, base 3.4GHz, up to 5.0GHz) DDR4-2933

• Info Sku OS Software Linux/ Embedded

• Dell Precision TPM

• 16GB 2X8GB DDR4 2666MHz or 2933MHz (2933MHz requires Intel Core i7 or above) SoDIMM ECC Memory

• Precision 3240 Compact Chassis

• Integrated Intel SATA Controller

• 240W A/C Adapter

• Precision 3240, 240W Reg Label DAO

• US Power Cord

• ME Disable - Manageability

• 256GB PCIe Class 40 M.2 SSD

• C2 M.2 PCIe Boot SSD

I would never have purchased a system with the ME enabled because of the security vulnerabilities and how it can be exploited as a back door into your system. I made sure to double and triple check that I chose this option in the configuration, yet now that I get the computer it's acting like ME is enabled.

Is there any way I can check whether Intel Management Engine was disabled? Does the fact that I just watched the firmware update say that ME updated successfully mean that ME is active or am I missing something? I want to be able to confirm that it is disabled. The only things I've found online like ME-cleaner say using it will void the warranty, which I don't want to do. If Dell sent me a PC without disabling ME then I'm returning it and will build my own PC. I just don't want to give Dell an excuse to deny the return or try to stick me with a restocking fee.

2 Answers

To verify ME I used:

This tool (Linux & win versions available) can detect if Manufacturing Mode is enabled, which makes ME vulnerable to code execution even if the system has been patched.

BTW IME can also access your networking interface adapter in a way transparent to the OS, I don't think PSP does that.

Despite the claims ME can't be disabled, Dell sells computers advertised as ME disabled. I hoped there was a way to resolve this conflicting information using the command line in Ubuntu to check the status of ME, but eventually found a different approach from speedstep on Dell forums.

You can check the case for a sticker that shows the management mode configured for that PC. If it has the number 3, than the PC was configured with ME disabled.

I assumed "ME disabled" meant "The Management Engine is Disabled", but that post seems to suggest it is vPro that is being disabled. I guess you could interpret "ME disabled" as meaning "The Management Engine disabled vPRO." I'm not sure if that is correct, but it would reconcile the apparent contradiction between not being to disable the management engine and Dell selling "ME disabled" computers.

I had hoped there was a safe way to check the status of the ME in Ubuntu using the command line, without having to download any software that might brick my PC or void the warranty, but since there doesn't seem to be any way to do that, I'm satisfied with checking the sticker, which in my case, says "3 Disabled."

Thanks to everyone who contributed answers.