I recently deployed a Lenovo M93p desktop that has AMT 9.0.2-build 1345. I set up vPro from MEBx, changing the password as required when I first went in to MEBx. That's the password I'm still using to access the web UI.
The web UI event log is reporting thousands of authentication failures (see screen shot).Since the vPro ports are only open inside the LAN and across a private VPN, it's unlikely that it's a real attack.
I found a 2009 reference on this:
but I don't quite understand what it means. Is it "normal" to see thousands of failures when no one is connecting? Where are these failures coming from?
Also: is it normal for AMT to use GMT time rather than local time?