Hello,

I've taken some time to try and configure something in powershell to help with my BIOS configs.  It is currently working under the administrator account on the Win7 laptop I'm testing on, but I'm having issues getting it running under system (for deployment with SCCM).  We have a bios password set on all our machines as well, so it will enter that in.

To use this script you need another file to contain all the settings you wish to use.  It will be structured like LockBIOSSetting,Enable with each setting on a new line.  it can be called anything you want, i'll use settings.txt.

Run with these paramaters %scriptname%.ps1 -password %biospassword% -file settings.txt 

If anyone has any suggestions on running as system account, I would greatly appreciate it.  I'm currently launching it useing powershell.exe -executionPolicy bypass -Noninteractive -Noprofile -file %script%.ps1 -password %password% -file LockBIOSSetting-enable.txt

param(
[Parameter(Mandatory=$true,Position=1)]
	[string]$password,
    [Parameter(Mandatory=$true,Position=2)]
    [array]$file
)
$settings = Get-Content $file

foreach($setting in $settings){
$run = "$setting,$password,ascii,us"
write-output $run
$Responce = (gwmi -class Lenovo_SetBiosSetting -namespace root\wmi).SetBiosSetting("$run").return
$Responce
if(-not (gwmi -class Lenovo_BiosSetting -namespace root\wmi | Where-Object {$_.CurrentSetting -eq $setting})){
$errorarray += "$setting"
$errorarray += ","
$errorarray += $Responce
$errorarray += "`r`n"
}
}
if($errorarray -ne $null){
foreach($errorname in $errorarray){
$errorname | out-file "error.txt"
throw 666
}
}

Hi jasgud_RETSD - 

Have you tried using PSEXEC?  

PSExec lets you run items using the system account.  You can download psexec from the Microsoft page for Sys Internals.  

Command - psexec \\localhost -s -h powershell.exe -executionPolicy bypass -Noninteractive -Noprofile -file %script%.ps1 -password %password% -file LockBIOSSetting-enable.txt

-s = Run as System 

-h = no profile

-accepteula - accepts eula

I ran the your command (changing the powershell name) and confirmed you can call powershell.exe and use powershell flags (nointeractive -noprofile).  

Once this to keep in mind when using psexec - the command being called (powershell.exe in this case) must be located in a directory referenced in path variables. 

psexc can be executed multiple clients at once by specifying a txt file with the names of the clients you wish to target.  

Multiple Clients 

PSEXEC @domainclients.txt -s -h powershell.exe -executionPolicy bypass -Noninteractive -Noprofile -file %script%.ps1 -password %password% -file LockBIOSSetting-enable.txt

I am more insterested in getting the bios settings setup for deployments :) 

Thanks 

Jeff Ragucci 

Hey guys,

I just saw your thread when I was browsing the forums. I actually have been playing around with modifying the BIOS settings during a deployment sequence the past couple weeks. I'm assuming you found the information about the WMI statements from this link: Lenovo BIOS Setup using WMI

I have been successful in changing/setting the different features using the VBScript commands during the deployment from a MDT environment. I have access to a SCCM setup so I will attempt to do the same there and let you know if I have any issues. I'll also try to use your script in our MDT environment to see if it will work there.

Can you provide me any information about your setup like SCCM version and computer model you are attempting this on? Thanks!

Glad you were able to find that guide and I agree that the error logging is much better in powershell. 

I was able to sucessfully use the VBScript commands during a Windows 7 x64 deployment from our SCCM 2012 R2 server to a Yoga 12 so I am going to start looking into the powershell. I'll reply back once I have some results. 

Are you getting any error from the script when it runs in the deployment sequence? 

So I think I have figured out what is going on with your script. I'll preface this with I haven't attempted a deployment with my idea yet but I'll try this afternoon. I was able to get it to work in WInPE though. I'll post all the stuff I used so you can see what I had done exactly.

I used the same style of input file. I called it testPSfile.txt.

USB30Mode,Enable
IPv6NetworkStack,Disable

I simplified your script for my own use. The file was called wmiPS.ps1. I changed the file parameter in your script just so I wouldn't get confused when calling it via powershell.

param(
[Parameter(Mandatory=$true,Position=1)]
[string]$password,
    [Parameter(Mandatory=$true,Position=2)]
    [array]$config
)
$settings = Get-Content $config

foreach($setting in $settings)
{
    $run = "$setting,$password,ascii,us"
    $Response = (gwmi -class Lenovo_SetBiosSetting -namespace root\wmi).SetBiosSetting("$run").return
    write-output ("$setting`n$Response")
    $Response = (gwmi -class Lenovo_SaveBiosSettings -namespace root\wmi).SaveBiosSettings("$password,ascii,us").return
    write-output ("$setting`n$Response")
}

The thing you were missing (and should have been elaborated more on in the guide) was this line:

$Response = (gwmi -class Lenovo_SaveBiosSettings -namespace root\wmi).SaveBiosSettings("$password,ascii,us").return

This will save the settings into the BIOS. I think your script was working properly in the deployment sequence but the settings were just never saved. When I did my testing, it seems like that line isn't needed when in a Windows 7 environment which is strange.

And here is the command I used to execute the file:

powershell.exe -executionPolicy bypass -file wmiPS.ps1 -password 123456 -config testPSfile.txt

See if adding that line to your script works. 

Hi thugusher,

Would you be able to provide me with some more information? To be able to help you best, I would need the model of the laptop you are trying to configure and how you are deploying the machine.

The script already handles BIOS passwords so I think the issue is somewhere else.