<#
.SYNOPSIS
Modify Lenovo BIOS from within Windows through WMI
.DESCRIPTION
This script enables the ability to modify the BIOS of a Lenovo computer. If the script is run on a non-Lenovo computer, the script will exit.
The script modifies the BIOS through WMI. The script is currently limited to a few functions; virtualization, secureboot and to enable/disable thunderbolt in preboot environment.
All settings that currently is not enabled by default. Virtualization and Secureboot is often desired, hence the script can be run during OSD.
.EXAMPLES
.\LenovoBIOSManagement.ps1 -EnablePrebootUSB (Enables the ThunderBolt/USB-C port during preboot. Useful if the computer is attached to a Thunderbolt dock, with keyboard attached.
.\LenovoBIOSManagement.ps1 -EnableSecureBoot -Restart (Enables SecureBoot in BIOS and restarts the computer)
.NOTES
FileName: LenovoBIOSManagement.ps1
Author: Martin Bengtsson
Created: 20-08-2017
Version: 1.0
Version:
#>
#Define parameters
[CmdletBinding()]
param(
[parameter(Mandatory=$false)]
[ValidateNotNullOrEmpty()]
[switch]$EnableVirtualization,
[parameter(Mandatory=$false)]
[ValidateNotNullOrEmpty()]
[switch]$DisableVirtualization,
[parameter(Mandatory=$false)]
[ValidateNotNullOrEmpty()]
[switch]$EnableSecureBoot,
[parameter(Mandatory=$false)]
[ValidateNotNullOrEmpty()]
[switch]$DisableSecureBoot,
[parameter(Mandatory=$false)]
[ValidateNotNullOrEmpty()]
[switch]$EnablePrebootUSB,
[parameter(Mandatory=$false)]
[ValidateNotNullOrEmpty()]
[switch]$DisablePrebootUSB,
[parameter(Mandatory=$false)]
[ValidateNotNullOrEmpty()]
[switch]$EnableTPM,
[parameter(Mandatory=$false)]
[ValidateNotNullOrEmpty()]
[switch]$DisableTPM,
[parameter(Mandatory=$false)]
[ValidateNotNullOrEmpty()]
[switch]$Restart
)
$Logfile = "C:\Windows\LenovoBIOSManagement.log"
#Create LogWrite function
Function LogWrite
{
Param ([string]$Logstring)
Add-Content $Logfile -Value $Logstring
}
#Check if Lenovo computer. If not, exit script
$IsLenovo = Get-WmiObject Win32_ComputerSystemProduct | Select-Object Vendor
If ($IsLenovo.Vendor -ne "Lenovo"){
Write-Warning -Message "Not a Lenovo laptop - exiting script" ; LogWrite "Not a Lenovo laptop - exiting script" ; exit 1
}
Else {
#Virtualization, Enable
If ($PSBoundParameters["EnableVirtualization"]) {
#Getting information for Virtualization in BIOS. Output to variable
Write-Host -ForegroundColor Cyan "Collecting Lenovo_BiosSetting information for EnableVirtualization" ; LogWrite "Collecting Lenovo_BiosSetting information for virtualization"
$Virtualization = Get-WmiObject -Class Lenovo_BiosSetting -Namespace root\WMI | Where-Object {$_.CurrentSetting -match "Virtualization*"} | Select-Object CurrentSetting
#If virtualization is disabled, try to enable virtualization
If ($Virtualization.CurrentSetting -eq "VirtualizationTechnology,Disable"){
Write-Host -ForegroundColor Yellow "Virtualization disabled - trying to enable virtualization" ; LogWrite "Virtualization disabled - trying to enable virtualization"
#Trying to modify the BIOS through calls to WMI. Also saving the settings in BIOS
Try {
(Get-WmiObject -Class Lenovo_SetBiosSetting -Namespace root\wmi).SetBiosSetting("VirtualizationTechnology,Enable")
(Get-WmiObject -Class Lenovo_SaveBiosSettings -Namespace root\wmi).SaveBiosSettings()
}
Catch {
Write-Warning -Message "An error occured while enabling virtualization in the BIOS" ; LogWrite "An error occured while enabling virtualization in the BIOS"
}
}
#If already enabled, do nothing
Else {
Write-Host -ForegroundColor Cyan "Virtualization already enabled - doing nothing" ; LogWrite "Virtualization already enabled - doing nothing"
}
}
#Virtualization, Disable
If ($PSBoundParameters["DisableVirtualization"]) {
Write-Host -ForegroundColor Cyan "Collecting Lenovo_BiosSetting information for DisableVirtualization" ; LogWrite "Collecting Lenovo_BiosSetting information for virtualization"
$Virtualization = Get-WmiObject -Class Lenovo_BiosSetting -Namespace root\WMI | Where-Object {$_.CurrentSetting -match "Virtualization*"} | Select-Object CurrentSetting
If ($Virtualization.CurrentSetting -eq "VirtualizationTechnology,Enable"){
Write-Host -ForegroundColor Yellow "Virtualization enabled - trying to disable virtualization" ; LogWrite "Virtualization enabled - trying to disable virtualization"
Try {
(Get-WmiObject -Class Lenovo_SetBiosSetting -Namespace root\wmi).SetBiosSetting("VirtualizationTechnology,Disable")
(Get-WmiObject -Class Lenovo_SaveBiosSettings -Namespace root\wmi).SaveBiosSettings()
}
Catch {
Write-Warning -Message "An error occured while disabling virtualization in the BIOS" ; LogWrite "An error occured while disabling virtualization in the BIOS"
}
}
Else {
Write-Host -ForegroundColor Cyan "Virtualization already disabled - doing nothing" ; LogWrite "Virtualization already disabled - doing nothing"
}
}
#SecureBoot, Enable
If ($PSBoundParameters["EnableSecureBoot"]) {
Write-Host -ForegroundColor Cyan "Collecting Lenovo_BiosSetting information for SecureBoot" ; LogWrite "Collecting Lenovo_BiosSetting information for SecureBoot"
$SecureBoot = Get-WmiObject -Class Lenovo_BiosSetting -Namespace root\WMI | Where-Object {$_.CurrentSetting -match "SecureBoot*"} | Select-Object CurrentSetting
If ($SecureBoot.CurrentSetting -eq "SecureBoot,Disable") {
Write-Host -ForegroundColor Yellow "SecureBoot disabled - trying to enable SecureBoot" ; LogWrite "SecureBoot disabled - trying to enable SecureBoot"
Try {
(Get-WmiObject -Class Lenovo_SetBiosSetting -Namespace root\wmi).SetBiosSetting("SecureBoot,Enable")
(Get-WmiObject -Class Lenovo_SaveBiosSettings -Namespace root\wmi).SaveBiosSettings()
}
Catch {
Write-Warning -Message "An error occured while enabling SecureBoot in the BIOS" ; LogWrite "An error occured while enabling SecureBoot in the BIOS"
}
}
Else {
Write-Host -ForegroundColor Cyan "SecureBoot already enabled - doing nothing" ; LogWrite "SecureBoot already enabled - doing nothing"
}
}
#SecureBoot, Disable
If ($PSBoundParameters["DisableSecureBoot"]) {
Write-Host -ForegroundColor Cyan "Collecting Lenovo_BiosSetting information for SecureBoot" ; LogWrite "Collecting Lenovo_BiosSetting information for SecureBoot"
$SecureBoot = Get-WmiObject -Class Lenovo_BiosSetting -Namespace root\WMI | Where-Object {$_.CurrentSetting -match "SecureBoot*"} | Select-Object CurrentSetting
If ($SecureBoot.CurrentSetting -eq "SecureBoot,Enable") {
Write-Host -ForegroundColor Yellow "SecureBoot enabled - trying to disable SecureBoot" ; LogWrite "SecureBoot enabled - trying to disable SecureBoot"
Try {
(Get-WmiObject -Class Lenovo_SetBiosSetting -Namespace root\wmi).SetBiosSetting("SecureBoot,Disable")
(Get-WmiObject -Class Lenovo_SaveBiosSettings -Namespace root\wmi).SaveBiosSettings()
}
Catch {
Write-Warning -Message "An error occured while disabling SecureBoot in the BIOS" ; LogWrite "An error occured while disabling SecureBoot in the BIOS"
}
}
Else {
Write-Host -ForegroundColor Cyan "SecureBoot already disabled - doing nothing" ; LogWrite "SecureBoot already disabled - doing nothing"
}
}
#PreBootForThunderboltUSBDevice, Enable
If ($PSBoundParameters["EnablePrebootUSB"]) {
Write-Host -ForegroundColor Cyan "Collecting Lenovo_BiosSetting information for EnablePrebootUSB" ; LogWrite "Collecting Lenovo_BiosSetting information for EnablePrebootUSB"
$PrebootDevice = Get-WmiObject -Class Lenovo_BiosSetting -Namespace root\WMI | Where-Object {$_.CurrentSetting -match "PreBootForThunderboltDevice"} | Select-Object CurrentSetting
$PrebootUSB = Get-WmiObject -Class Lenovo_BiosSetting -Namespace root\WMI | Where-Object {$_.CurrentSetting -match "PreBootForThunderboltUSBDevice"} | Select-Object CurrentSetting
If ($PrebootDevice.CurrentSetting -eq "PreBootForThunderboltDevice,Disable" -OR $PrebootUSB -eq "PreBootForThunderboltUSBDevice,Disable") {
Write-Host -ForegroundColor Yellow "PrebootDevice/USB disabled - trying to enable PrebootDevice/USB" ; LogWrite "PrebootDevice/USB disabled - trying to enable PrebootDevice/USB"
Try {
(Get-WmiObject -Class Lenovo_SetBiosSetting -Namespace root\wmi).SetBiosSetting("PreBootForThunderboltDevice,Enable")
(Get-WmiObject -Class Lenovo_SetBiosSetting -Namespace root\wmi).SetBiosSetting("PreBootForThunderboltUSBDevice,Enable")
(Get-WmiObject -Class Lenovo_SaveBiosSettings -Namespace root\wmi).SaveBiosSettings()
}
Catch {
Write-Warning -Message "An error occured while enabling PrebootDevice/USB in the BIOS" ; LogWrite "An error occured while enabling PrebootDevice/USB in the BIOS"
}
}
Else {
Write-Host -ForegroundColor Cyan "PrebootDevice/USB already enabled - doing nothing" ; LogWrite "PrebootDevice/USB already enabled - doing nothing"
}
}
#PreBootForThunderboltUSBDevice, Disable
If ($PSBoundParameters["DisablePrebootUSB"]) {
Write-Host -ForegroundColor Cyan "Collecting Lenovo_BiosSetting information for DisablePrebootUSB" ; LogWrite "Collecting Lenovo_BiosSetting information for DisablePrebootUSB"
$PrebootDevice = Get-WmiObject -Class Lenovo_BiosSetting -Namespace root\WMI | Where-Object {$_.CurrentSetting -match "PreBootForThunderboltDevice"} | Select-Object CurrentSetting
$PrebootUSB = Get-WmiObject -Class Lenovo_BiosSetting -Namespace root\WMI | Where-Object {$_.CurrentSetting -match "PreBootForThunderboltUSBDevice"} | Select-Object CurrentSetting
If ($PrebootDevice.CurrentSetting -eq "PreBootForThunderboltDevice,Enable" -OR $PrebootUSB -eq "PreBootForThunderboltUSBDevice,Enable") {
Write-Host -ForegroundColor Yellow "PrebootDevice/USB enabled - trying to disable PrebootDevice/USB" ; LogWrite "PrebootDevice/USB enabled - trying to disable PrebootDevice/USB"
Try {
(Get-WmiObject -Class Lenovo_SetBiosSetting -Namespace root\wmi).SetBiosSetting("PreBootForThunderboltDevice,Disable")
(Get-WmiObject -Class Lenovo_SetBiosSetting -Namespace root\wmi).SetBiosSetting("PreBootForThunderboltUSBDevice,Disable")
(Get-WmiObject -Class Lenovo_SaveBiosSettings -Namespace root\wmi).SaveBiosSettings()
}
Catch {
Write-Warning -Message "An error occured while disabling PrebootDevice/USB in the BIOS" ; LogWrite "An error occured while disabling PrebootDevice/USB in the BIOS"
}
}
Else {
Write-Host -ForegroundColor Cyan "PrebootDevice/USB already disabled - doing nothing" ; LogWrite "PrebootDevice/USB already disabled - doing nothing"
}
}
#TPM (SecurityChip), Enable
If ($PSBoundParameters["EnableTPM"]) {
Write-Host -ForegroundColor Cyan "Collecting Lenovo_BiosSetting information for EnableTPM" ; LogWrite "Collecting Lenovo_BiosSetting information for EnableTPM"
$TPM = Get-WmiObject -Class Lenovo_BiosSetting -Namespace root\WMI | Where-Object {$_.CurrentSetting -match "SecurityChip"} | Select-Object CurrentSetting
If ($TPM.CurrentSetting -eq "SecurityChip,Disable") {
Write-Host -ForegroundColor Yellow "TPM disabled - trying to enable TPM" ; LogWrite "TPM disabled - trying to enable TPM"
Try {
(Get-WmiObject -Class Lenovo_SetBiosSetting -Namespace root\wmi).SetBiosSetting("SecurityChip,Enable")
(Get-WmiObject -Class Lenovo_SaveBiosSettings -Namespace root\wmi).SaveBiosSettings()
}
Catch {
Write-Warning -Message "An error occured while enabling TPM in the BIOS" ; LogWrite "An error occured while enabling TPM in the BIOS"
}
}
Else {
Write-Host -ForegroundColor Cyan "TPM already enabled - doing nothing" ; LogWrite "TPM already enabled - doing nothing"
}
}
#TPM (SecurityChip), Disable
If ($PSBoundParameters["DisableTPM"]) {
Write-Host -ForegroundColor Cyan "Collecting Lenovo_BiosSetting information for DisableTPM" ; LogWrite "Collecting Lenovo_BiosSetting information for DisableTPM"
$TPM = Get-WmiObject -Class Lenovo_BiosSetting -Namespace root\WMI | Where-Object {$_.CurrentSetting -match "SecurityChip"} | Select-Object CurrentSetting
If ($TPM.CurrentSetting -eq "SecurityChip,Enable") {
Write-Host -ForegroundColor Yellow "TPM enabled - trying to disable TPM" ; LogWrite "TPM enabled - trying to disable TPM"
Try {
(Get-WmiObject -Class Lenovo_SetBiosSetting -Namespace root\wmi).SetBiosSetting("SecurityChip,Disable")
(Get-WmiObject -Class Lenovo_SaveBiosSettings -Namespace root\wmi).SaveBiosSettings()
}
Catch {
Write-Warning -Message "An error occured while disabling TPM in the BIOS" ; LogWrite "An error occured while disabling TPM in the BIOS"
}
}
Else {
Write-Host -ForegroundColor Cyan "TPM already disabled - doing nothing" ; LogWrite "TPM already disabled - doing nothing"
}
}
#Restart computer
If ($PSBoundParameters["Restart"]) {
Write-Host -ForegroundColor Yellow "Rebooting the computer" ; LogWrite "Rebooting the computer computer"
Restart-Computer -Force
}
}
