AMT : Create your own SOAP messages with SOAP UI


AMT is a management technology from Intel. It's embedded in the motherboard (if your laptop or desktop is "VPro") and accessible from the network with a simple and standard web interface.

With AMT (and after configuration at the BIOS level), you can boot your desktop remotely with a simple web service "SOAP" call. And many more ... check for more information and use cases.

To execute the commands from this post you'll need a remote AMT machine (with a "VPro" sticker) configured, and a local machine. Any OS will work fine.


You can work with SOAP in any language, or no language at all ! Exemple of a SOAP message :


If you can send this simple message over a socket to the port 19662 of your machine, it will reboot. Of course there's a login/password challenge using the "digest" method, just like in your web browser.


Easy to send but not easy to write. There's a lot of methods you can call in AMT, each with several parameters. That's why everything is nicely defined in a standard XML file : a .WSDL file. You can use a WSDL file with your favorite language, but also from a simple WSDL aware tool : "SOAP UI".

SOAP UI is both open source and commercial, here we'll work with the open source (and free) version. So please go to and download the tool for your OS (or as a plugin for eclipse).

After you launched the interface, click "New SOAP UI Project", fill a name (i picked "RemoteControl") and select the WSDL (attached to this post) for the "RemoteControl" part of AMT : "RemoteControlInterface.wsdl". Make sure "Create sample requests" is checked and click "OK".

On the top left of the interface, you can deploy a tree for the project "RemoteControl", select "RemoteControlSoapBinding", then "RemoteControl" and finnaly double click on "Request 1".
On the Right you will see a window containing a SOAP message, with missing arguments "?".

SOAP Message

Some arguments are required, some are optionnal. Today we'll try a simple reboot, the optionnal arguments are not required, so delete the lines :


Replace the "?" in the "IanaOemNumber" line with the number 343. It's invariant for AMT. The interesting number is 19 for the "Command" line replacing the "?". 19 is the code for reboot. Your message is now ready to send.


At the top of the window, click on the URL list, and chosse "Edit current". Replace localhost with the name or IP of your AMT machine. To fill the login ("admin") and password, right click "RemoteControlSoapBinding", choose "Show Interface Viewer". In the new window select the "Service Endpoints" tab.

Everything is ready, make sure your AMT machine is powered on (we requested a reset) and click "Submit request" (green arrow in your request window).

Hopefully your AMT machine rebooted, magic isn't it ?

The request window is now splitted in two : on the right side you'll see the answer from the

OK, but Why ?

This method is interesting for several reasons. First you can control basic features of your AMT machines yourself from scratch, hacker style, just for fun.

It's also interesting if you are a software developper, because you need to control and experiment the underlying technology before you begin coding. (If you like to see what is really happening, you can try the "ngrep -d eth0 port 16992" command under linux).

More ?

Want the code for power down or power up ?
Check the AMT SDK documentation or ... the WSDL itself.

<xs:simpleType name="RemoteControlCommandType">
<xs:restriction base="xs:unsignedByte">
<xs:enumeration value="16">
<xs:documentation>"0x10 = Reset"</xs:documentation>

(0x10 in hexadecimal = 16 in decimal).

The SDK is full of ressources, and the management community is sharing on the forums :


Para obtener información más completa sobre las optimizaciones del compilador, consulte nuestro Aviso de optimización.
Datos Binarios remotecontrolinterface.wsdl16.04 KB