1 Rookie
•
2 Posts
0
73
Issue setting BIOS password via Intune
Hi All. Hoping someone can point me in the right direction of how to set a BIOS password on devices via Intune.
A pretty simple setup with the following settings
AdminSetupLockout=Enabled
SetupPwd=<MYPASSWORD>
I've deployed the Dell Command | Endpoint Configure for Microsoft Intune client to my device and have created a simple CCTK to set the password. (I'm want to set my own password rather than let Intune create one)
Now, admittedly, I originally set the config option in Intune for Disable per-device BIOS password protection to "No"
After re-reading the docs, I realised that this should have been set to "Yes"
So I recreated the config in Intune, and set that to "Yes" and redeployed (I waited for it to change from pending before recreating it)
Now from what I understand, by deploying a new config with the Yes setting, any previous password should be removed? Or am I misunderstanding that bit?
What I have now, is a test device with no SetUpPwd at all (I can access the BIOS) and the new config never changes from pending in Intune (left the device for 24 hours)
I am however seeing the following in the logs
15:542024.07.01 14:34:01.740 [05776] (00024) I -----Execution: Process exited at 01/07/2024 13:34:012024.07.01 14:34:01.742 [05776] (00024) I -----Execution: Process Exit code :1062024.07.01 14:34:01.742 [05776] (00024) I -----Execution: Process Elapsed time :126812024.07.01 14:34:01.742 [05776] (00024) I -----Execution: Key operation failed2024.07.01 14:34:01.742 [05776] (00024) E -----Execution: C:\Program Files\Dell\EndpointConfigure\X86_64\cctk.exe exited with error code - 1062024.07.01 14:34:01.747 [05776] (00024) I -----Execution: Updated results upon successful BIOS configuration operation2024.07.01 14:34:01.749 [05776] (00024) I -----Execution: cmdLineArgs : -I "C:\Windows\IMECache\HardwareConfiguration\2fd63c3b-75bc-4abe-9bad-58561494e33f\qydbhpc4_Dell-BIOS.cctk" --ValSetupPwd="################" --logfile=C:\ProgramData\Dell\EndpointConfigure\DellCommandConfigure.log2024.07.01 14:34:14.068 [05776] (00024) I -----Execution: Process exited at 01/07/2024 13:34:142024.07.01 14:34:14.069 [05776] (00024) I -----Execution: CCTK Exit code :02024.07.01 14:34:14.069 [05776] (00024) I -----Execution: Process Elapsed time :123142024.07.01 14:34:14.071 [05776] (00024) I -----Execution: Updated results upon successful BIOS configuration operation2024.07.01 14:34:14.073 [05776] (00024) I -----Execution: Trying to empty the directory: C:\Windows\IMECache\HardwareConfiguration\2fd63c3b-75bc-4abe-9bad-58561494e33f2024.07.01 14:34:14.075 [05776] (00024) I -----Execution: Successfully emptied directory2024/07/01 14:34:01 cctk - Password is not Installed. Please try again without providing --ValSetupPwd2024/07/01 14:34:13 cctk - CCTKAppEngVer=4.11.1.482024/07/01 14:34:14 cctk - AdminSetupLockout=Enabled
So it appears that the 'AdminSetupLockout=Enabled' option is being set, but the password is not applying.
Anybody have any ideas or pointers on what the issue could be?
Thanks!
B4dCh1ck3n
1 Rookie
1 Rookie
•
2 Posts
0
July 2nd, 2024 10:54
Never mind. Managed to figure this out :)
Seems that although there was no BIOS password set, Intune was still trying to use the original password it allocated, to make changes. (Intune had a password stored against the device record)
I was able to get the original password it set using the GraphAPI - I then manually set the Password in the BIOS to the one from GraphAPI
Once the config run again, it was able to make the necessary changes and removed the old Intune password and set my new manual one from the CCTK.
Lesson Learned!!
If you want to use your own password - Make sure that 'Disable per-device BIOS password protection' is set to "Yes" before you apply the configuration to the device.
If you want Intune to control the password, make sure you set "Disable per-device BIOS password protection" to "No"
If you want to get the password for a device using GraphAPI, see the documentation: https://learn.microsoft.com/en-us/mem/intune/configuration/bios-configuration#option-1---read-the-bios-password-one-device-at-a-time
(edited)