Use configuration baseline disable windows service

Home

About Me

Contact Me

Lots of news about vulnerability Intel AMT, example Lenovo published an article (CVE-2017-5689) https://support.lenovo.com/fi/en/product_security/len-14963

In Intel Mitigation Guide https://downloadcenter.intel.com/download/26754 , it mentions about disable LMS service, so here is a sample how to use SCCM compliance settings disable LMS service.

I don’t write details how to do compliance settings, there are lots of blogs about it, example: http://www.scconfigmgr.com/2017/04/09/configmgr-configuration-baselines-a-beginners-guide/

So I only give you the discovery script and the remediation script:

Create Configuration Items, name Disable Intel AMT LMS service, remember, the service name is LMS, not LSM, they are not the same! 🙂 Discovery script: PowerShell $Servicestatus= Get-WmiObject win32_service -filter "name='LMS'" $StartMode=$Servicestatus.StartMode $State = $Servicestatus.State $StartMode $State if(!$Servicestatus -or ($StartMode -like "Disabled" -and $State -like "Stopped")) { $check = "Secured" $check } 1 2 3 4 5 6 7 8 9 10 11 $Servicestatus = Get-WmiObject win32_service -filter "name='LMS'" $StartMode = $Servicestatus . StartMode $State = $Servicestatus . State $StartMode $State if ( ! $Servicestatus -or ( $StartMode -like "Disabled" -and $State -like "Stopped" ) ) { $check = "Secured" $check } Remediation script: PowerShell Stop-Service -Name LMS -force -ErrorAction SilentlyContinue Set-Service -Name LMS -startuptype Disabled -ErrorAction SilentlyContinue 1 2 Stop-Service -Name LMS -force -ErrorAction SilentlyContinue Set-Service -Name LMS -startuptype Disabled -ErrorAction SilentlyContinue

1 2 3 4 5 6 7 8 9 10 11

$Servicestatus = Get-WmiObject win32_service -filter "name='LMS'" $StartMode = $Servicestatus . StartMode $State = $Servicestatus . State $StartMode $State if ( ! $Servicestatus -or ( $StartMode -like "Disabled" -and $State -like "Stopped" ) ) { $check = "Secured" $check }

Stop-Service -Name LMS -force -ErrorAction SilentlyContinue Set-Service -Name LMS -startuptype Disabled -ErrorAction SilentlyContinue

Create Configuration Baseline name Disable Intel AMT LMS service , add the “Disable Intel AMT LMS service” Configuration Item” in it.

Deploy to your clients.

You can download my baseline and import to your SCCM: click here

If you want to query Intel AMT versions, here is the query:

select distinct SMS_R_System . Name , SMS_G_System_AMT_AGENT . AMT , SMS_G_System_COMPUTER_SYSTEM . Manufacturer , SMS_G_System_COMPUTER_SYSTEM . Model , SMS_G_System_COMPUTER_SYSTEM_PRODUCT . Version from SMS_R_System inner join SMS_G_System_AMT_AGENT on SMS_G_System_AMT_AGENT . ResourceID = SMS_R_System . ResourceId inner join SMS_G_System_COMPUTER_SYSTEM on SMS_G_System_COMPUTER_SYSTEM . ResourceID = SMS_R_System . ResourceId inner join SMS_G_System_COMPUTER_SYSTEM_PRODUCT on SMS_G_System_COMPUTER_SYSTEM_PRODUCT . ResourceID = SMS_R_System . ResourceId where SMS_G_System_AMT_AGENT . ProvisionState <= 3

And here is the query for find out if “Intel(R) Management Engine” installed on clients :

x86:

select distinct SMS_R_System . Name , SMS_G_System_ADD_REMOVE_PROGRAMS . DisplayName from SMS_R_System inner join SMS_G_System_ADD_REMOVE_PROGRAMS on SMS_G_System_ADD_REMOVE_PROGRAMS . ResourceID = SMS_R_System . ResourceId where SMS_G_System_ADD_REMOVE_PROGRAMS . DisplayName = "Intel(R) Management Engine Components"

x64:

select distinct SMS_R_System . Name , SMS_G_System_ADD_REMOVE_PROGRAMS_64 . DisplayName from SMS_R_System inner join SMS_G_System_ADD_REMOVE_PROGRAMS_64 on SMS_G_System_ADD_REMOVE_PROGRAMS_64 . ResourceID = SMS_R_System . ResourceId where SMS_G_System_ADD_REMOVE_PROGRAMS_64 . DisplayName = "Intel(R) Management Engine Components"

Click to share on Reddit (Opens in new window)

Click to share on Facebook (Opens in new window)

Click to email this to a friend (Opens in new window)

Click to share on Google+ (Opens in new window)

Click to share on WhatsApp (Opens in new window)

curtiz p October 15, 2017 Very simply put, I will say through experience. The A.M.T.; lms.exe, A.R.M. with A.M.Dx64.sys drivers are dangerous when used by malicious hackers. There needs to be more safeguards available. Also more forth coming from Intel with regards to the power of these tools. That is all. Reply ↓

Very simply put, I will say through experience. The A.M.T.; lms.exe, A.R.M. with A.M.Dx64.sys drivers are dangerous when used by malicious hackers. There needs to be more safeguards available. Also more forth coming from Intel with regards to the power of these tools. That is all.

Your email address will not be published. Required fields are marked *

Comment

Name *

Email *

Website

Notify me of follow-up comments by email.

Notify me of new posts by email.

Follow me on Twitter

ConfigMgr Team Blog

Update 1802 for Configuration Manager Technical Preview Branch – Available Now! Yvette O'Meally

EMS news roundup: January 2018 Enterprise Mobility + Security Team

Update 1801 for Configuration Manager Technical Preview Branch – Available Now! Yvette O'Meally

Watch: The Endpoint Zone with Brad Anderson [1801] Microsoft Intune Team

Update 1712 for Configuration Manager Technical Preview Branch – Available Now! Yvette O'Meally

Update for the Configuration Manager Client Messaging SDK Yvette O'Meally

Now Available: Update 1710 for System Center Configuration Manager The Configuration Manager Team

Update 1711 for Configuration Manager Technical Preview Branch – Available Now! Yvette O'Meally

Introducing support for Cryptography: Next Generation (CNG) certificates in Configuration Manager Yvette O'Meally

Update 1710 for Configuration Manager Technical Preview Branch – Available Now! Yvette O'Meally

MDT Team Blog

MDT 8450 Now Available Aaron Czechowski [Microsoft]

Microsoft Deployment Toolkit (8443) Now Available Aaron Czechowski [Microsoft]

MDT 2013 Update 2 Now Available Aaron Czechowski [Microsoft]

How to get help with MDT Aaron Czechowski [Microsoft]

MDT 2013 Update 1 re-released (build 8298) Aaron Czechowski [Microsoft]

MDT 2013 Update 1 Release Notes and Known Issues Aaron Czechowski [Microsoft]

MDT 2013 Update 1 Now Available Aaron Czechowski [Microsoft]

Windows 10 ADK release and MDT 2013 Update 1 plans Aaron Czechowski [Microsoft]

MDT Updates for Windows 10 Technical Preview Build 10041 Aaron Czechowski [Microsoft]

MDT 2013 Update 1 Preview Release Notes Aaron Czechowski [Microsoft]

Subscribe to Blog via Email

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

Join 16 other subscribers

Email Address