Welcome to our peer-to-peer forums, where owners help owners. Need help now? Visit eSupport here.

English Community

Software and Operating SystemEnterprise Client Management
All Forum Topics
Options

19 Posts

11-26-2020

Poland

15 Signins

85 Page Views

  • Posts: 19
  • Registered: ‎11-26-2020
  • Location: Poland
  • Views: 85
  • Message 1 of 13

X1 Gen4 BIOS configuration applied via WMI not saved properly

2021-03-26, 15:37 PM

Hi there,

For a customer we're running PowerShell script that applies BIOS configuration based on the baseline required.

There is a set of setting that are applied to specific models and script uses CSV file per model.

Configuration applies values that are possible to set on specific system.

PC have BIOS Supervisor password set.

 

Anyhow, the issue we are having is that only on X1 Gen4 we're getting following problem:

The device gets the configuration applied, reported as saved properly but upon restart, there's message:

0191: System Security - Invalid remote change requested.

Press F1 to enter Setup.

And after the restart the config comes out as not applied.

 

Can you please help here on where to look into?

 

I have attached CSV file for reference.

 

EDIT: form some reason cannot attach the file, here's the link

Reply
Options

1950 Posts

03-03-2016

United States of America

3976 Signins

47692 Page Views

  • Posts: 1950
  • Registered: ‎03-03-2016
  • Location: United States of America
  • Views: 47692
  • Message 2 of 13

Re:X1 Gen4 BIOS configuration applied via WMI not saved properly

2021-03-26, 16:02 PM

@ W M

 

Is this an X1 Carbon Gen 4 or an X1 Yoga Gen 4?

Does the BIOS version on the device where the initial configuration was generated match the BIOS version on the device where this configuration is to be applied?

 

Have you used the ThinkBIOS Config Tool to ensure all of the settings options are correct?  Can you use the ThinkBIOS Config Tool to test the settings in the link?

 

TLawson

 

 

Reply
Options

19 Posts

11-26-2020

Poland

15 Signins

85 Page Views

  • Posts: 19
  • Registered: ‎11-26-2020
  • Location: Poland
  • Views: 85
  • Message 3 of 13

Re:X1 Gen4 BIOS configuration applied via WMI not saved properly

2021-03-30, 16:38 PM

Hi @tlawson 

 

I've requested to collect the information and will come back to you.

First I'd like to get export from the device, then we will approach modification.

 

The device is X1 Yoga Gen 4.

We're not using Think BIOS config, we're applying the configuration through PowerShell commands.

PS parsing through CSV, comparing setting and applying given value.

Afterwards the configuration is saved and no errors is given either during applying values or saving.

Script is set to interrupt as soon as it gets 1st error during configuration.

 

After running script, if you query system it will show configuration exactly as in the CSV.

However after the reboot config seems to be reset to previous.

 

Change is done with following function:

    # Bind to Lenovo WMI to SET system BIOS configuration
    $ConfigureBios = (gwmi -class Lenovo_SetBiosSetting -namespace root\wmi)
    # Apply the config change
    $Bios_Config_Action = $ConfigureBios.SetBiosSetting("$NewSetting,$NewValue,$BiosPwd,$PwdEncoding")

Save:

    # Bind to Lenovo WMI to SAVE system BIOS configuration
    $SaveBiosConfig = (gwmi -class Lenovo_SaveBiosSettings -namespace root\wmi)
    # Save the config changes
    $Bios_Save_Action = $SaveBiosConfig.SaveBiosSettings("$BiosPwd,$PwdEncoding")

 

OS is French and $PwdEncoding is reflecting that.

 

If you have any remarks meanwhile the export will arrive, please do let me know.

 

Reply
Options

1950 Posts

03-03-2016

United States of America

3976 Signins

47692 Page Views

  • Posts: 1950
  • Registered: ‎03-03-2016
  • Location: United States of America
  • Views: 47692
  • Message 4 of 13

Re:X1 Gen4 BIOS configuration applied via WMI not saved properly

2021-03-30, 20:23 PM

@ W M

 

Would the customer please attempt to test changing the settings with the ThinkBIOS Config Tool?  Even if they do not utilize the tool on all systems during deployment, it will help verify there are no issues with their systems.

 

TLawson

Reply
Options

19 Posts

11-26-2020

Poland

15 Signins

85 Page Views

  • Posts: 19
  • Registered: ‎11-26-2020
  • Location: Poland
  • Views: 85
  • Message 5 of 13

Re:X1 Gen4 BIOS configuration applied via WMI not saved properly

2021-03-31, 11:11 AM

Hi @tlawson 

 

That's the plan :)

I just want to make sure I get consent information from the system. 

Will come back you once I have response.

Reply
Options

19 Posts

11-26-2020

Poland

15 Signins

85 Page Views

  • Posts: 19
  • Registered: ‎11-26-2020
  • Location: Poland
  • Views: 85
  • Message 6 of 13

Re:X1 Gen4 BIOS configuration applied via WMI not saved properly

2021-04-13, 14:53 PM

Hi @tlawson 

 

It's been a while, yet, finally I got some feedback.

 

There were couple of things done meanwhile and what has been confirmed:

1. Changing the settings from ThinkBiosConfig works

2. BIOS config was reset to default values and that seemed to help but then te error appeared again..

 

There's one setting that is being repeatedly reported as different from baseline although log shows as changed..

Quote from log:

WARNING : The setting ThunderboltSecurityLevel is different from baseline
INFO : Current setting value is: NoSecurity

INFO : Applying setting: ThunderboltSecurityLevel with value: UserAuthorization
INFO : New value for ThunderboltSecurityLevel is UserAuthorization
SUCCESS : The setting has been applied
SUCCESS : BIOS settings have been saved

 

Would that implicate the behavior we're getting?

Would that be one of the settings that cannot be changed remotely?

Reply
Options

19 Posts

11-26-2020

Poland

15 Signins

85 Page Views

  • Posts: 19
  • Registered: ‎11-26-2020
  • Location: Poland
  • Views: 85
  • Message 7 of 13

Re:X1 Gen4 BIOS configuration applied via WMI not saved properly

2021-04-20, 9:55 AM

Hi @tlawson 

 

Do you happen to be around?

Can you respond, please?

Reply
Options

1950 Posts

03-03-2016

United States of America

3976 Signins

47692 Page Views

  • Posts: 1950
  • Registered: ‎03-03-2016
  • Location: United States of America
  • Views: 47692
  • Message 8 of 13

Re:X1 Gen4 BIOS configuration applied via WMI not saved properly

2021-04-21, 15:59 PM

@W M

 

I am looking at this issue.  When I attempt to change the ThunderboltSecurityLevel setting to UserAuthorization and reboot, the setting does not stick after a reboot.

 

I am working to find out more information about this.

 

TLawson

Reply
Options

1950 Posts

03-03-2016

United States of America

3976 Signins

47692 Page Views

  • Posts: 1950
  • Registered: ‎03-03-2016
  • Location: United States of America
  • Views: 47692
  • Message 9 of 13

Re:X1 Gen4 BIOS configuration applied via WMI not saved properly

2021-04-21, 16:20 PM

@W M

As I was investigating, the Kernel DMA Protection setting was enabled and was preventing the ThunderboltSecurityLevel setting change from going through.  Could this be the same in your case?  Kernel DMA Protection setting has to be disabled in the BIOS.  It cannot be changed via WMI.

 

TLawson

Reply
Options

19 Posts

11-26-2020

Poland

15 Signins

85 Page Views

  • Posts: 19
  • Registered: ‎11-26-2020
  • Location: Poland
  • Views: 85
  • Message 10 of 13

Re:X1 Gen4 BIOS configuration applied via WMI not saved properly

2021-04-23, 17:03 PM

Hi @tlawson 

 

Thanks for your response.

The default config comes with: KernelDMAProtection = Enable.

We do not control this setting and it's left default.

 

Just to confirm - you're saying that in order to get the ThunderboltSecurityLevel changeable remotely, we would need to disable KernelDMAProtection?

 

If yes, is there any list of such dependencies within BIOS configuration available or can it be provided via enterprise (customer) channels?

Reply
Forum Home

Community Guidelines

Please review our Guidelines before posting.

Learn More

Check out current deals!

Go Shop
X

Save

X

Delete

X

No, I don’t want to share ideas Yes, I agree to these terms