Setting MSUefiCA with provider

Hello,

We've had some enterprising individuals who took it upon themselves to disable the MS UEFI CA option in the BIOS. Obviously this can have security implications, and cause disk encryption to fail. I'm looking for a way to re-enable it through a powershell script using the provider. In the reference guide I notice this particular attribute is in the PreEnabled group, and there's a note saying "You can enable MSUefiCA in manufacturing mode or, while setting up the BIOS Setup Administrator password." Obviously, I'm not going to be using manufacturing mode, so how would one do this during admin password setup through the provider? Is this attribute Read-only from the provider, and you have to be physically present and in the BIOS to re-enable this?

My tests thus far to set the value to 'Enabled' result in the error "pldm request not processed by bios". Am I just up a creek on this one?

Thanks!