HP Workstation Bios & MEBx

[BinzaRaid]

HI Everyone,

I recently purchased an used HP Z440 Xeon Workstation, with an aim to use as a Home Server. 

I am a bit of a N00b with server grade/workstation grade hardware, firmware and bios.  And as I purchased second hand, I want to make sure there are no dodgy security holes that I am not aware of, that was a result of the previous owner. 

Here's what I have done so far:

- removed existing HDD;

- reflashed the Bios to latest revison. 02.50 Rev.A

My questions:

1) The bios has something called MEBx.  I have googled, but still not entirely sure what it is, how to use and what the correct default settings are. 

Can someone give me a quick run down on MEBx and how I ensure the correct settings are in place for Home Network use? And/or how to reset to default.

Thanks heaps in advance for any support.

Binza

[DGroves]

google is your friend try a search with "MEBX"

https://www.google.com/search?q=mebx&rlz=1C1CHBF_enUS850US850&oq=mebx&aqs=chrome..69i57j0l7.1503j0j8...

for a home server disable the "AMT" in the bios  want to know what "AMT" is?  again google is your friend

AMT is really only useful in a domain setting allowing remote access to AMT enabled clients and AMT has known security issues

and therefore should be left disabled

[BinzaRaid]

Cheers, thanks for the help.   Will google like crazy this weekend.

[BinzaRaid]

Hi @DGroves,

I have googled an come up with this instruction:

To disable:

1. In BIOS, Advance Chipset Feature ->Intel AMT (Enabled,Disabled)
2. CTRL P to go AMT Menu (Intel ME Control state(Enabled,Disabled)
3. Depending on HP (Hewlett-Packard) model, check on BIOS: Advanced > Remote Management Options > Active Management / Unconfigure AMT on next boot. 

One I do this I am prompted with a screen that says.  A Configuration change was was requested to disable this computes TPM (Trusted Management Platform).

So is AMT and TPM linked then and is this ok to disable?

Cheers,

Binz

[DGroves · Accepted solution]

Yes, doing so will actually tell the TMP chip that ATM is no longer registered with it TPM itself will still be available for any program that uses it

however be aware that the z820 only has TPM v1.2 (not 2.0) as such windows 10 has reduced TMP features such as drive encryption