This is doing my head in. I have literally Googled for two hours and cannot find an answer to simply turn on SecureBoot with Powershell 7

I cannot find the Lenovo WMI class documentation anywhere, but these syntax's look correct.

Get-CimInstance -Namespace root/WMI -ClassName Lenovo_BiosSetting | Where-Object {$_.CurrentSetting -match "SecureBoot"} | select currentsetting

currentsetting
--------------
SecureBoot,Enable

That works fine - setting the setting, however, just errors:

$saveBios = Get-WmiObject -Namespace root\wmi -Class Lenovo_SetBiosSettings
$interface.SetBIOSSetting("SecureBoot","Enable")
InvalidOperation: Method invocation failed because [Deserialized.System.Management.ManagementObject#root\wmi\Lenovo_SetBiosSetting] does not contain a method named 'SetBIOSSetting'.

Any ideas what I'm doing wrong?

#ThinkPad
(Get-WMIObject -Namespace root\wmi -Class Lenovo_SetBIOSSetting).SetBIOSSetting('SecureBoot,Enable')
#ThinkCenter
(Get-WMIObject -Namespace root\wmi -Class Lenovo_SetBIOSSetting).SetBIOSSetting('Secure Boot,Enabled')

This is code I wrote a long time ago. Not sure if ThinkCentre and ThinkPad still needs separate steps.

@hermangb Yep, that's what I entered above in my post. Tried again anyway, same result.

 (Get-WMIObject -Namespace root\wmi -Class Lenovo_SetBIOSSetting).SetBIOSSetting('SecureBoot,Enable')

InvalidOperation: Method invocation failed because [Deserialized.System.Management.ManagementObject#root\wmi\Lenovo_SetBiosSetting] does not contain a method named 'SetBIOSSetting'.

Thanks @phil_lenovo   - that document was impossible to find, but just what I need - Powershell 7 commands.

As comprehensive as that document is, the one thing it does NOT contain is how to SET a BIOS password where a password does NOT exist. It only shows how to change or use a password.

Are you able to advise how to actually SET one?

Thanks

Setting an initial password programmatically isn't possible unless you're in System Deployment Boot Mode.

It was previously; we used to push out via remediation scripts in InTune. A bit ridiculous that this has been removed, makes it hard to ship a laptop direct to a client. I suppose Lenovo wants us to pay extra for Lenovo deployment services.

Setting an initial password programmatically has never been possible. Since the beginning. Changing one is definitely achievable, but you either have one set in the factory or in System Deployment Boot Mode, which was introduced in Whiskey Lake Gen models. 

Hmmmm. I must be mistaken, maybe we were simply changing them. Thanks for the clarification.

Still strange it's not possible.