Push HP BIOS Settings via OSD (Windows 10)

[adurrant 0]

Hi guys,

Hoping to find people that have managed to push HP BIOS settings via OSD (Windows 10), I've pretty much followed this guide (only the folder structures are slightly different) but I'm having issues actually deploying the settings, setting the BIOS password seems to work okay and I've read that for certain TPM settings to be pushed then a BIOS password must be set prior.

My folder setup:

BIOS Config settings to push:

BIOSConfig 1.0
;
;     Originally created by BIOS Configuration Utility
;     Version: 4.0.24.1
;     Date="2018/03/20" Time="14:53:23" UTC="0"
;
;     Found 215 settings
;
Virtualization Technology (VTx)
    Disable
    *Enable
    Reset to default
TPM Reset to Factory Defaults
    *No
    Yes
Reset of TPM from OS
    *Disable
    Enable
OS Management of TPM
    Disable
    *Enable
Activate TPM On Next Boot
    Disable
    *Enable
TPM Device
    Hidden
    *Available
TPM Activation Policy
    F1 to Boot
    Allow user to reject
    *No prompts
    Hide
TPM Device Security Level
    Change
    *View
    Hide
OS Management of TPM Security Level
    Change
    *View
    Hide
Reset of TPM from OS Security Level
    Change
    *View
    Hide

Task sequence setup:

The bios password sets just fine, but in the SMSTS log I see the following for BIOS settings - HP EliteBook 840 G2 itself:

Have attached the SMSTS.log.

Any help would greatly be appreciated, I've been working on this for the last couple of days without success, I've tried:

• Adding CMD.exe /C prefix (same error)
• Changing the format of the file to repset (same error)
• Ran the command manually on the device and works just fine with the same configuration files (as .txt and .repset)
• Tried running the steps in WinPE rather than in the operating system (same error)

Thanks in advance.

smsts.log

[Ath3na 6]

Hi,

Exit code 11 means:

Config file not valid,

BCU was unable to locate the configuration file or unable to read the file at the specified path.

http://whp-hou4.cold.extweb.hp.com/pub/caps-softpaq/cmit/whitepapers/HP_BCU_FAQ.pdf

[adurrant 0]

Hi Ath3na,

Sure, I looked at this error code, I don't how it's not valid as it works manually and it's in the same folder in the package, I'm thinking it's a red herring... 

[Ath3na 6]

should the command be something like ?

biosconfigutility.exe /CurSetupPasswordFile:"passwordfile.bin" /setconfig:Elitebook820.REPSET

Ours are like this.

The password is set at an earlier stage, both occur during winpe

[adurrant 0]

Hello,

Thanks, I have tried something like this, I will try this and get back to you.  curious, where abouts in your task sequence do you have these steps? Before partition disks I assume?

[Ath3na 6]

you can always set to continue on error.

[adurrant 0]

I could do this, I'm not sure if I'll have any joy, the BIOS settings don't get applied when the task sequence fails. I'm currently trying running the command line as a defined user rather than system.

[xerxes2985 6]

48 minutes ago, Ath3na said:

should the command be something like ?

biosconfigutility.exe /CurSetupPasswordFile:"passwordfile.bin" /setconfig:Elitebook820.REPSET

Ours are like this.

The password is set at an earlier stage, both occur during winpe

Exactly as this post says. The manual refers to the proper config file that is .REPSET

 

Additionally, I believe I ran into this issue with my Elitebook 8560P. What I did was use the bios tool to extract the current REPSET, and then ensure that the commands I am using match what my existing configuration file says. I found that some of the setting names didn't match what the instructions said.

[adurrant 0]

Thanks both, trying this config out now:

 

Can confirm that the contents of the repset file is good as when ran manually, it does what I need it to do...

[adurrant 0]

Hi gents,

 

Unfortunately my last screenshot exited with the same error code, I'm going to try the 32-bit application tomorrow and post results here.

[ryandengstrom 0]

What version of BiosConfigUtility64.exe are you using?  I am not sure when the change occurred, but I believe the /CurSetupPasswordFile switch was replaced with /cpwdfile.  This is what v4.0.21.1 is showing.  We also have continue on error checked on the step as I believe it will technically fail as it is trying to write to some lines from the config file to read-only things in the bios.  I think you could go through the config and remove what is read-only as an alternative also.  We reference a package without a program to accomplish this during OSD.

[ryandengstrom 0]

Also, what path is your package source referencing?  You are using the same package on the two steps, but you have two separate sub folders where the password .bin files are kept.

EDIT: In reviewing the 4sysops post, I see they specified the ~configs subfolder within their command in the TS.  Assuming your COL0009C package source is the root of the "HP EliteBook 840 G2 Configuration Files" folder, you would need to specify the subfolder in the path to the config files and encrypted password bin files.

[danielclasson 0]

Hi,

Have a look at a blog post I have created on this topic and see if it helps you:

http://www.danielclasson.com/2019/01/deploy-hp-bios-settings-using-powershell-in-a-sccm-task-sequence/

[thecatdidit 0]

@danielclasson your procedure worked perfectly. Thanks for putting all of that information together.

I have begun to play around with HP's Client Management Script Library. It's a (surprisingly) robust set of PowerShell modules for a lot of activities - Softpaq repositories, BIOS/firmware updates, BIOS config baselines and the like. It seems to do a lot of things and do them well. 

Still, though, we don't adjust procedures like BIOS updates until we've done significant testing over a period of months. CMSL is worth a test drive for sure, though.

https://ftp.hp.com/pub/caps-softpaq/cmit/hp-cmsl.html