The Think BIOS Config tool

For a while now Lenovo’s business-class ThinkPad, ThinkCentre and ThinkStation products have offered a WMI BIOS Interface for controlling BIOS settings through scripting.  This was a big improvement over the old DOS-based utilities that were unique per model.  Now everything needed to make changes in settings during a deployment is built into the machine. 

A downside to the WMI approach has been that you have to be fairly skilled with scripting to make use of it and you have to know all the values of the settings you want to set.  In our lab we constantly felt the need for a GUI interface that would show us the current settings, what their possible values are, and allow us to set them on a local or remote machine.  While we were at it we also wanted a solution that would allow us to create a profile of settings that we could apply via command line in a deployment task sequence.


And that’s why we created the Think BIOS Config tool.  It has been created as an HTA so the source code is freely visible so it is clear exactly what the tool is doing.  Also, if you’re so inclined, the tool can be extended and modified to suit your needs.

When launched, you will see it appear and then be replaced by a UAC prompt.  This is one of the challenges with working with an HTA.  The code being executed to access the WMI BIOS interface requires admin level privileges.  To accomplish this with an HTA in a standard and secure way, the HTA re-launches itself to trigger the UAC prompt and the elevation of privileges.

The tool will initially show the BIOS settings of the local system if it is running on a Lenovo product that supports it.  In the image below you can see that the settings are implemented as a series of drop-downs offering the possible values for each setting.

2016_08_04_14_41_15_Think_BIOS_Configurator

Any changes made will be indicated in red text.  There are buttons at the top and bottom of the settings list that allow you to save the changes in BIOS, reset back to the current settings, or to apply all the Default settings for the targeted machine.

At the top of the tool are some File actions.  The Export Settings button on the right will create a simple .ini text file that captures all of the current settings of the targeted machine.  This file could later be used on the left side of the tool to load in a set of values that you might want to apply. 

2016_08_04_14_43_33_Think_BIOS_Configurator

The .ini file can also be used in a command line scenario which is useful in a deployment task sequence.  The HTA can be launched in WinPE using an MDT or SCCM boot image without any additions or changes to the boot image.  It can be executed and passed the .ini file to silently set a group of BIOS settings.  There is a user’s guide document included in the .zip for this tool that provides all the details on the command line usage and other features of the tool.

Please try the tool out and let us know how it can be improved.  One item we are working on is driving consistency across the Think Brands.  We are also looking at how to securely support some of the management tasks facing enterprises as they straddle the transition from Windows 7 to Windows 10.  Hopefully more to come on this in the near future.


DOWNLOAD LINK

https://download.lenovo.com/cdrt/tools/tbct117.zip

Changes:
1.17:  Bug fix on boot order export when the changes haven't been saved
v1.16:  Added support to change the supervisor password. Added support to create a supervisor password change file
1.15:  Fixed the export of Alarm Time and Date
1.14:  Improved handling of boot order on certain ThinkStation/ThinkCentre models; added version to title
1.11:  Added command line option to change back to default settings - 

Eg. ThinkBiosConfig.hta “default=true” 

Notice: This script is shared AS IS with no implied warranty or support.  If you have questions or suggestions please post a comment to this post.

Comments

  1. Will this do the settings for UEFI as well as legacy BIOS?

    ReplyDelete
  2. This tool leverages our WMI BIOS interface which is accessible in both Legacy and UEFI modes.

    ReplyDelete
  3. Great tool, much appreciated!

    The docs mention that this requires a formatted disk before being able to run. Is it possible to run this tool to set BIOS settings immediately after that?
    In our SCCM task sequences we use the "Pre-provision BitLocker" step just after formatting. Of course, this requires TPM to be enabled beforehand.

    Also, is it possible to set supervisor password with this tool?

    Martin

    ReplyDelete
    Replies
    1. Hi Martin,

      The reason the disk must be formatted first is because SCCM needs a location to download the package containing the .hta and .ini files before the task sequence can run the tool. You may even want to format the disk, run the tool, reboot, then format the disk again before pre-provisioning BitLocker. (I've had issues in the past where a reboot after formatting but before applying the OS caused my drive letters to get mixed up.)

      Info about setting a supervisor password is here: https://forums.lenovo.com/t5/Enterprise-Client-Management/M700-900-Set-Admin-BIOS-password-from-SCCM2012/m-p/3367636#M2250

      Delete
    2. Hi, I was wondering if I can put in a command to load default(as Commandline)? I found that on Lenovo P310 I cant set secure boot. But if I load defaults, secureboot is the default.
      Something like ThinkBiosConfig.hta “config=Load Defaults,Enable” or something?

      Delete
    3. Let us look into that. There is a separate method in WMI for doing that we may be able to leverage.

      Delete
    4. This feature has been implemented starting with version 1.11. The command line call will look like this: ThinkBiosConfig.hta "default=true"

      Delete
  4. I do not see any specific security chip settings. If I create an .ini file with the settings I want, (Discrete T), will this be applied to the target computer even though there is no mention of it in the .ini file?

    ReplyDelete
  5. The Think BIOS Config Tool only works through the WMI interface. It will display the settings that are available to be set through WMI. Changing the TPM is not available through WMI because it is a security setting that could have serious impact if flipped by a malicious script. The SRSETUP tool can change the TPM setting but must be executed from a bootable USB key so that physical presence is required.

    ReplyDelete
  6. Can this this also be used for Lenovo Miix 720 devices ?

    ReplyDelete
    Replies
    1. Do not have a Miix 720 to test this on but I don't believe the Miix 720 models support the WMI BIOS Interface in which case this tool would not be supported.

      Delete
  7. Having issues setting Secure Boot with ThinkCentre M82 model in a task sequence. BIOS is up to date and has worked for ThinkCentre M93 and M93p models in a task sequence.

    Script Error
    An error has occurred in the script on this page
    Line: 909
    Char: 6
    Error: This key is already associated with an element of this collection
    Code: 0
    URL: file://servername/thinkbiosconfig.hta

    ReplyDelete
    Replies
    1. Unfortunately the M92, M82, M72 models did not support enabling Secure Boot using the WMI interface.

      Delete
    2. Is there any other setting the M82 doesn't support? I removed the Secure Boot portion from my M82 .ini file and I'm still getting the above error. Thanks!

      Delete
    3. Have you tried generating an ini file by running the tool on an M82 and exporting the settings? This should give you a complete list of the settings that are supported on M82 through the WMI BIOS interface.

      Delete
    4. Yes, however it was from an older version of the BIOS than the one I'm targeting/deploying to. Would that matter? I'll try exporting from the newer version and see if that makes a difference.

      Delete
    5. OK, so I tried resetting to factory defaults and then generating a new M82 ini. "Secure Boot,Disabled" is among the settings, but I see a couple of posts above this one you mentioned that the M82 does not support setting Secure Boot through WMI. Any insights here?

      Delete
    6. It's interesting, if I load my intended ini file with the GUI and click "Apply config file", it takes the settings and lets me know they will be applied after a reboot. If I try with the command line, e.g., ThinkBiosConfig.hta "file=M82Config.ini" , it fails with the above error. Strange.

      Delete
    7. Please try v1.14 and let us know if it address the issue.

      Delete
  8. How would you run this from PowerShell? I can't get it to accept the INI file.

    ReplyDelete
    Replies
    1. To get it to run through PowerShell, you will need to put single quotes around the double quotes. Here is an example: ThinkBiosConfig.hta '"file=C:\W550sConfig.ini"'

      The user guide will be updated when the next version is posted. Hope this helps!

      Delete
    2. Is this tool compatible with the Thinkstation P320? We used it without fail for the P310 but have had a lot of issues getting the BIOS to set right for these P320's. Here is the command line we are using with our package in SCCM:
      cmd /c ThinkBiosConfig.hta "file=P320Config.ini"


      Thank you,

      Delete
    3. What is in your P320Config.ini? Are you trying to set boot order?

      Delete
    4. Primary Boot Sequence and Configure Sata as AHCI are just two of major settings that fail. But none of the settings are taking properly. The bios never changes from the default. This will not let me attach a file, so here it goes:
      Serial Port1 Address,3F8/IRQ4
      USB Support,Enabled
      USB Legacy Support,Enabled
      USB Virtual KBC Support,Disabled
      USB Enumeration Delay,Disabled
      Front USB Ports,Enabled
      USB Port 1,Enabled
      USB Port 2,Enabled
      Rear USB Ports,Enabled
      USB Port 3,Enabled
      USB Port 4,Enabled
      USB Port 5,Enabled
      USB Port 6,Enabled
      USB Port 7,Enabled
      USB Port 8,Enabled
      SATA Controller,Enabled
      SATA Drive 1,Enabled
      SATA Drive 2,Enabled
      SATA Drive 3,Enabled
      SATA Drive 4,Enabled
      SATA Drive 5,Enabled
      SATA Drive 6,Enabled
      SATA Drive 6 Hot-Plug Support,Enabled
      Configure SATA as,AHCI
      Hard Disk Pre-delay,Disabled
      Select Active Video,Auto
      Pre-Allocated Memory Size,32MB
      Total Graphics Memory,Maximum
      Onboard Audio Controller,Enabled
      Internal Speaker,Enabled
      Onboard Ethernet Controller,Enabled
      PXE Option ROM,Enabled
      PXE IPV4 Network Stack,Disabled
      PXE IPV6 Network Stack,Disabled
      PCIe 16x Slot Speed,Auto
      PCIe 4x Slot Speed,Auto
      PCIe 1x Slot 1 Speed,Auto
      PCIe 1x Slot 2 Speed,Auto
      Intel Thunderbolt Technology,Disabled
      Security Level,No Security
      Ignore Thunderbolt Option Rom,Enabled
      TBT Device IO resource Support,Disabled
      EIST Support,Enabled
      Intel(R) Hyper-Threading Technology,Enabled
      Core Multi-Processing,Enabled
      Intel(R) Virtualization Technology,Enabled
      VT-d,Disabled
      TxT,Disabled
      C1E Support,Enabled
      C State Support ,C1C3C6C7C8
      Turbo Mode,Enabled
      Intel(R) Manageability Control,Enabled
      Press to Enter MEBx,Enabled
      Console Type,VT100+
      USB Provisioning,Disabled
      Intel(R) SGX Control,Software controlled
      Intel(R) SIPP Support,Enabled
      CPU CRID Support,Enabled
      Chipset CRID Support,Enabled
      After Power Loss,Last State
      Enhanced Power Saving Mode,Disabled
      ICE Performance Modes,Better Acoustic Performance
      ICE Thermal Alert,Enabled
      Wake on LAN,Automatic
      Wake from Serial Port Ring,Primary
      Wake Up on Alarm,Disabled
      Startup Sequence,Primary
      Alarm Time(HH:MM:SS),[00:00:00][Status:ShowOnly]
      Alarm Date(MM/DD/YYYY),[01/01/2016][Status:ShowOnly]
      Alarm Day of Week,Sunday
      Sunday,Disabled
      Monday,Enabled
      Tuesday,Enabled
      Wednesday,Enabled
      Thursday,Enabled
      Friday,Enabled
      Saturday,Disabled
      User Defined Alarm Time,[05:00:00][Status:ShowOnly]
      Allow Flashing BIOS to a Previous Version,Yes
      Require Admin. Pass. when Flashing,No
      Windows UEFI Firmware Update,Enabled
      Require POP on System Boot,Yes
      Require POP on Restart,No
      Require Admin. Pass. For F12 Boot,No
      Smart USB Protection,Disabled
      Require HDP on System Boot,Auto
      Preboot Authentication,Enabled
      Security Chip,Enabled
      Secure Boot,Disabled
      Network Offline Locker,Disabled
      Chassis Intrusion Detection,Disabled
      Configuration Change Detection,Disabled
      Password Count Exceeded Error,Enabled
      CSM,Enabled
      Boot Mode,Auto
      Boot Priority,UEFI First
      Boot Up Num-Lock Status,On
      Option Keys Display,Enabled
      Option Keys Display Style,Normal
      Startup Device Menu Prompt,Enabled
      OS Optimized Defaults,Disabled
      Primary Boot Sequence,SATA 1:USB KEY:OEM Device 2:OEM Device 4:SATA 2:SATA 3:SATA 4:SATA 5:SATA 6:Network 1:USB HDD:USB CDROM:Other Device

      Delete
    5. We see the problem and will release an update very soon.

      Delete
    6. Is it the Bios or the TBC software ? What update should I be on the lookout for?

      Delete
    7. We'll release a new version of TBC probably tomorrow. I'll update the download link on this blog post.

      Delete
  9. ThinkStation P500 gives me 'Invalid Parameter' when attempting to change the boot order. I can do it fine from the BIOS. Any thoughts?

    ReplyDelete
  10. The P500 needs to be added to the list of machines in the .hta file that what I assume includes the [Excluded from boot order] phrase. On line 489,911 and 927. I put mine between P410 and P510

    Or InStr (gTargetComputerModel, "P500")

    Without it, the P500 cannot have it's boot order changed and you get an error saying Invalid.

    Please add this so I don't need to run a special version of the script!

    Thanks

    ReplyDelete
  11. We've released v1.14 that addresses some of the issues seen on ThinkStation and ThinkCentre systems. Please try this new version if you encountered issues.

    ReplyDelete
  12. This appears to be a great tool and appears to be active, however is there any plans to have support added for T470s and M710s models? I'm not seeing any options listed for UEFI/Legacy Boot Mode, UEFI/Legacy Boot Priority or CSM Support options?

    ReplyDelete
    Replies
    1. The tool supports those models; however, the particular settings you mention are not supported by the WMI BIOS interface which the tool relies upon. If you are looking to take a Legacy system with CSM support enabled to UEFI without CSM, then you just need to set Secure Boot to Enabled.

      Delete
  13. I am using v1.14 and the boot order is working as expected, however the Alarm time is not setting. The event, startup sequence and day of the week are all sticking but for some reason the time is not. I have it set on a test machine and exported the ini file so any help appreciated.

    Also, is it possible to set a Administrator password using this utility?

    ReplyDelete
    Replies
    1. Found an issue with the exported string. Fixed in v1.15 which is now released. No, it is not possible to set an Administrator password using this utility. The WMI BIOS interface does not allow it.

      Delete
  14. So i'm using the tool and trying to get it to run during installation in SCCM. I've got it coded out for the T470 and M910q. I've setup the boot image to have HTML (WinPE-HTA) enabled. I put the HTA and the INI files in a package together, and the command line step (pointing at the package):

    cmd.exe /c ThinkBiosConfig.het "file=t470Config.ini"


    But when it gets to this point in the TS, I get the error
    C:\_SMSTaskSequence\Packages\PRI00533\ThinkBiosConfig.hta No Such Interface Supported

    What am I doing wrong here that I can't get it to run?

    ReplyDelete
    Replies
    1. That error really seems to indicate that the boot image that was actually booted does not have the HTA support. When you made the change to the boot image in SCCM did you click "OK" or "Apply". If you click OK then you need to manually go and make sure your Distribution Points are updated. Clicking Apply will go through a wizard that asks if you want the DPs updated automatically. You can click on the Boot Image in SCCM and at the bottom check the Last Modified Date.

      Delete
  15. It does not appear to work on the P50. When launching the HTA, there are no BIOS settings listed. Any idea why? It works on all other devices.

    ReplyDelete
    Replies
    1. Please update the BIOS on your P50. At one of the previous updates the BIOS lost the WMI interface for settings. It has been addressed in the newest BIOS update.

      Delete
  16. Has anyone been able to get the P320 desktops to work with this application? We continue to have issues with tbct 1.15.

    ReplyDelete
    Replies
    1. Please try v1.17. We had to address an issue with the Boot Order on ThinkCentre and ThinkStation models.

      Delete

Post a Comment