The Think BIOS Config tool

For a while now Lenovo’s business-class ThinkPad, ThinkCentre and ThinkStation products have offered a WMI BIOS Interface for controlling BIOS settings through scripting.  This was a big improvement over the old DOS-based utilities that were unique per model.  Now everything needed to make changes in settings during a deployment is built into the machine. 

A downside to the WMI approach has been that you have to be fairly skilled with scripting to make use of it and you have to know all the values of the settings you want to set.  In our lab we constantly felt the need for a GUI interface that would show us the current settings, what their possible values are, and allow us to set them on a local or remote machine.  While we were at it we also wanted a solution that would allow us to create a profile of settings that we could apply via command line in a deployment task sequence.


And that’s why we created the Think BIOS Config tool.  It has been created as an HTA so the source code is freely visible so it is clear exactly what the tool is doing.  Also, if you’re so inclined, the tool can be extended and modified to suit your needs.

When launched, you will see it appear and then be replaced by a UAC prompt.  This is one of the challenges with working with an HTA.  The code being executed to access the WMI BIOS interface requires admin level privileges.  To accomplish this with an HTA in a standard and secure way, the HTA re-launches itself to trigger the UAC prompt and the elevation of privileges.

The tool will initially show the BIOS settings of the local system if it is running on a Lenovo product that supports it.  In the image below you can see that the settings are implemented as a series of drop-downs offering the possible values for each setting.

2016_08_04_14_41_15_Think_BIOS_Configurator

Any changes made will be indicated in red text.  There are buttons at the top and bottom of the settings list that allow you to save the changes in BIOS, reset back to the current settings, or to apply all the Default settings for the targeted machine.

At the top of the tool are some File actions.  The Export Settings button on the right will create a simple .ini text file that captures all of the current settings of the targeted machine.  This file could later be used on the left side of the tool to load in a set of values that you might want to apply. 

2016_08_04_14_43_33_Think_BIOS_Configurator

The .ini file can also be used in a command line scenario which is useful in a deployment task sequence.  The HTA can be launched in WinPE using an MDT or SCCM boot image without any additions or changes to the boot image.  It can be executed and passed the .ini file to silently set a group of BIOS settings.  There is a user’s guide document included in the .zip for this tool that provides all the details on the command line usage and other features of the tool.

Please try the tool out and let us know how it can be improved.  One item we are working on is driving consistency across the Think Brands.  We are also looking at how to securely support some of the management tasks facing enterprises as they straddle the transition from Windows 7 to Windows 10.  Hopefully more to come on this in the near future.


DOWNLOAD LINK

https://download.lenovo.com/cdrt/tools/tbct114.zip

Changes:
1.14:  Improved handling of boot order on certain ThinkStation/ThinkCentre models; added version to title
1.11:  Added command line option to change back to default settings - 

Eg. ThinkBiosConfig.hta “default=true” 

Notice: This script is shared AS IS with no implied warranty or support.  If you have questions or suggestions please post a comment to this post.

Comments

  1. Will this do the settings for UEFI as well as legacy BIOS?

    ReplyDelete
  2. This tool leverages our WMI BIOS interface which is accessible in both Legacy and UEFI modes.

    ReplyDelete
  3. Great tool, much appreciated!

    The docs mention that this requires a formatted disk before being able to run. Is it possible to run this tool to set BIOS settings immediately after that?
    In our SCCM task sequences we use the "Pre-provision BitLocker" step just after formatting. Of course, this requires TPM to be enabled beforehand.

    Also, is it possible to set supervisor password with this tool?

    Martin

    ReplyDelete
    Replies
    1. Hi Martin,

      The reason the disk must be formatted first is because SCCM needs a location to download the package containing the .hta and .ini files before the task sequence can run the tool. You may even want to format the disk, run the tool, reboot, then format the disk again before pre-provisioning BitLocker. (I've had issues in the past where a reboot after formatting but before applying the OS caused my drive letters to get mixed up.)

      Info about setting a supervisor password is here: https://forums.lenovo.com/t5/Enterprise-Client-Management/M700-900-Set-Admin-BIOS-password-from-SCCM2012/m-p/3367636#M2250

      Delete
    2. Hi, I was wondering if I can put in a command to load default(as Commandline)? I found that on Lenovo P310 I cant set secure boot. But if I load defaults, secureboot is the default.
      Something like ThinkBiosConfig.hta “config=Load Defaults,Enable” or something?

      Delete
    3. Let us look into that. There is a separate method in WMI for doing that we may be able to leverage.

      Delete
    4. This feature has been implemented starting with version 1.11. The command line call will look like this: ThinkBiosConfig.hta "default=true"

      Delete
  4. I do not see any specific security chip settings. If I create an .ini file with the settings I want, (Discrete T), will this be applied to the target computer even though there is no mention of it in the .ini file?

    ReplyDelete
  5. The Think BIOS Config Tool only works through the WMI interface. It will display the settings that are available to be set through WMI. Changing the TPM is not available through WMI because it is a security setting that could have serious impact if flipped by a malicious script. The SRSETUP tool can change the TPM setting but must be executed from a bootable USB key so that physical presence is required.

    ReplyDelete
  6. Can this this also be used for Lenovo Miix 720 devices ?

    ReplyDelete
    Replies
    1. Do not have a Miix 720 to test this on but I don't believe the Miix 720 models support the WMI BIOS Interface in which case this tool would not be supported.

      Delete
  7. Having issues setting Secure Boot with ThinkCentre M82 model in a task sequence. BIOS is up to date and has worked for ThinkCentre M93 and M93p models in a task sequence.

    Script Error
    An error has occurred in the script on this page
    Line: 909
    Char: 6
    Error: This key is already associated with an element of this collection
    Code: 0
    URL: file://servername/thinkbiosconfig.hta

    ReplyDelete
    Replies
    1. Unfortunately the M92, M82, M72 models did not support enabling Secure Boot using the WMI interface.

      Delete
    2. Is there any other setting the M82 doesn't support? I removed the Secure Boot portion from my M82 .ini file and I'm still getting the above error. Thanks!

      Delete
    3. Have you tried generating an ini file by running the tool on an M82 and exporting the settings? This should give you a complete list of the settings that are supported on M82 through the WMI BIOS interface.

      Delete
    4. Yes, however it was from an older version of the BIOS than the one I'm targeting/deploying to. Would that matter? I'll try exporting from the newer version and see if that makes a difference.

      Delete
    5. OK, so I tried resetting to factory defaults and then generating a new M82 ini. "Secure Boot,Disabled" is among the settings, but I see a couple of posts above this one you mentioned that the M82 does not support setting Secure Boot through WMI. Any insights here?

      Delete
    6. It's interesting, if I load my intended ini file with the GUI and click "Apply config file", it takes the settings and lets me know they will be applied after a reboot. If I try with the command line, e.g., ThinkBiosConfig.hta "file=M82Config.ini" , it fails with the above error. Strange.

      Delete
    7. Please try v1.14 and let us know if it address the issue.

      Delete
  8. How would you run this from PowerShell? I can't get it to accept the INI file.

    ReplyDelete
    Replies
    1. To get it to run through PowerShell, you will need to put single quotes around the double quotes. Here is an example: ThinkBiosConfig.hta '"file=C:\W550sConfig.ini"'

      The user guide will be updated when the next version is posted. Hope this helps!

      Delete
    2. Is this tool compatible with the Thinkstation P320? We used it without fail for the P310 but have had a lot of issues getting the BIOS to set right for these P320's. Here is the command line we are using with our package in SCCM:
      cmd /c ThinkBiosConfig.hta "file=P320Config.ini"


      Thank you,

      Delete
    3. What is in your P320Config.ini? Are you trying to set boot order?

      Delete
    4. Primary Boot Sequence and Configure Sata as AHCI are just two of major settings that fail. But none of the settings are taking properly. The bios never changes from the default. This will not let me attach a file, so here it goes:
      Serial Port1 Address,3F8/IRQ4
      USB Support,Enabled
      USB Legacy Support,Enabled
      USB Virtual KBC Support,Disabled
      USB Enumeration Delay,Disabled
      Front USB Ports,Enabled
      USB Port 1,Enabled
      USB Port 2,Enabled
      Rear USB Ports,Enabled
      USB Port 3,Enabled
      USB Port 4,Enabled
      USB Port 5,Enabled
      USB Port 6,Enabled
      USB Port 7,Enabled
      USB Port 8,Enabled
      SATA Controller,Enabled
      SATA Drive 1,Enabled
      SATA Drive 2,Enabled
      SATA Drive 3,Enabled
      SATA Drive 4,Enabled
      SATA Drive 5,Enabled
      SATA Drive 6,Enabled
      SATA Drive 6 Hot-Plug Support,Enabled
      Configure SATA as,AHCI
      Hard Disk Pre-delay,Disabled
      Select Active Video,Auto
      Pre-Allocated Memory Size,32MB
      Total Graphics Memory,Maximum
      Onboard Audio Controller,Enabled
      Internal Speaker,Enabled
      Onboard Ethernet Controller,Enabled
      PXE Option ROM,Enabled
      PXE IPV4 Network Stack,Disabled
      PXE IPV6 Network Stack,Disabled
      PCIe 16x Slot Speed,Auto
      PCIe 4x Slot Speed,Auto
      PCIe 1x Slot 1 Speed,Auto
      PCIe 1x Slot 2 Speed,Auto
      Intel Thunderbolt Technology,Disabled
      Security Level,No Security
      Ignore Thunderbolt Option Rom,Enabled
      TBT Device IO resource Support,Disabled
      EIST Support,Enabled
      Intel(R) Hyper-Threading Technology,Enabled
      Core Multi-Processing,Enabled
      Intel(R) Virtualization Technology,Enabled
      VT-d,Disabled
      TxT,Disabled
      C1E Support,Enabled
      C State Support ,C1C3C6C7C8
      Turbo Mode,Enabled
      Intel(R) Manageability Control,Enabled
      Press to Enter MEBx,Enabled
      Console Type,VT100+
      USB Provisioning,Disabled
      Intel(R) SGX Control,Software controlled
      Intel(R) SIPP Support,Enabled
      CPU CRID Support,Enabled
      Chipset CRID Support,Enabled
      After Power Loss,Last State
      Enhanced Power Saving Mode,Disabled
      ICE Performance Modes,Better Acoustic Performance
      ICE Thermal Alert,Enabled
      Wake on LAN,Automatic
      Wake from Serial Port Ring,Primary
      Wake Up on Alarm,Disabled
      Startup Sequence,Primary
      Alarm Time(HH:MM:SS),[00:00:00][Status:ShowOnly]
      Alarm Date(MM/DD/YYYY),[01/01/2016][Status:ShowOnly]
      Alarm Day of Week,Sunday
      Sunday,Disabled
      Monday,Enabled
      Tuesday,Enabled
      Wednesday,Enabled
      Thursday,Enabled
      Friday,Enabled
      Saturday,Disabled
      User Defined Alarm Time,[05:00:00][Status:ShowOnly]
      Allow Flashing BIOS to a Previous Version,Yes
      Require Admin. Pass. when Flashing,No
      Windows UEFI Firmware Update,Enabled
      Require POP on System Boot,Yes
      Require POP on Restart,No
      Require Admin. Pass. For F12 Boot,No
      Smart USB Protection,Disabled
      Require HDP on System Boot,Auto
      Preboot Authentication,Enabled
      Security Chip,Enabled
      Secure Boot,Disabled
      Network Offline Locker,Disabled
      Chassis Intrusion Detection,Disabled
      Configuration Change Detection,Disabled
      Password Count Exceeded Error,Enabled
      CSM,Enabled
      Boot Mode,Auto
      Boot Priority,UEFI First
      Boot Up Num-Lock Status,On
      Option Keys Display,Enabled
      Option Keys Display Style,Normal
      Startup Device Menu Prompt,Enabled
      OS Optimized Defaults,Disabled
      Primary Boot Sequence,SATA 1:USB KEY:OEM Device 2:OEM Device 4:SATA 2:SATA 3:SATA 4:SATA 5:SATA 6:Network 1:USB HDD:USB CDROM:Other Device

      Delete
    5. We see the problem and will release an update very soon.

      Delete
    6. Is it the Bios or the TBC software ? What update should I be on the lookout for?

      Delete
    7. We'll release a new version of TBC probably tomorrow. I'll update the download link on this blog post.

      Delete
  9. ThinkStation P500 gives me 'Invalid Parameter' when attempting to change the boot order. I can do it fine from the BIOS. Any thoughts?

    ReplyDelete
  10. The P500 needs to be added to the list of machines in the .hta file that what I assume includes the [Excluded from boot order] phrase. On line 489,911 and 927. I put mine between P410 and P510

    Or InStr (gTargetComputerModel, "P500")

    Without it, the P500 cannot have it's boot order changed and you get an error saying Invalid.

    Please add this so I don't need to run a special version of the script!

    Thanks

    ReplyDelete
  11. We've released v1.14 that addresses some of the issues seen on ThinkStation and ThinkCentre systems. Please try this new version if you encountered issues.

    ReplyDelete

Post a Comment