Lenovo BIOS Windows Management Quick reference guide

Lenovo BIOS Windows Management
Instrumentation Interface
Deployment Guide
Date: August 2008

Lenovo BIOS Windows Management
Instrumentation Interface
Deployment Guide
Date: August 2008

First Edition (August 2008)
©Copyright Lenovo 2008. All rights reserved.
LENOVO products, data, computer software, and services have been developed exclusively at private expense and
are sold to governmental entities as commercial items as defined by 48 C.F.R. 2.101 with limited and restricted
rights to use, reproduction and disclosure.
LIMITED AND RESTRICTED RIGHTS NOTICE: If products, data, computer software, or services are delivered
pursuant aGeneral Services Administration ″GSA″contract, use, reproduction, or disclosure is subject to restrictions
set forth in Contract No. GS-35F-05925.

Contents
Preface ...............v
Chapter 1. Overview .........1
Using Windows Management Instrumentation ...1
Key benefits ..............1
Functions ..............2
Environment .............2
Interface ...............2
Supported computers ...........2
Chapter 2. Script classes and
parameters .............3
Configuring BIOS settings ..........3
Return types ..............3
Password Authentication ..........4
Available BIOS setting names .........4
Chapter 3. Typical usage .......9
Listing current BIOS settings .........9
Changing BIOS settings...........9
Changing the boot order ..........9
Restoring default settings..........10
Changing an existing hardware password ....10
Limitations ..............10
Chapter 4. Security .........11
Appendix A. Sample Visual Basic
scripts for configuring BIOS settings .13
Restore default settings ..........13
List all BIOS settings on the local computer ...13
Set asingle BIOS setting on the local computer ..14
Set asingle BIOS setting on the local computer if a
supervisor password exists .........15
List all BIOS settings on the remote computer ...15
Set asingle BIOS setting on aremote computer ..16
Set asingle BIOS setting on aremote computer
when asupervisor password exists ......17
Set asupervisor password on the local computer
when asupervisor password exists ......18
Set asupervisor password on aremote computer
when asupervisor password exists ......18
Appendix B. Sample PowerShell scripts
for remote BIOS management .....21
Get all current BIOS settings.........21
Show aparticular BIOS setting ........22
Setting aBIOS setting ...........23
Appendix C. Notices .........25
Trademarks ..............26
©Copyright Lenovo 2008 iii

iv Lenovo BIOS Windows Management Instrumentation Interface Deployment Guide

Preface
The purpose of this guide is to explain how to modify BIOS passwords, settings,
and boot order using Windows Management Instrumentation (WMI) through the
Lenovo client-management interface. This guide is intended for skilled IT
administrators who are familiar with configuring BIOS settings on computers in
their organizations.
This guide is provided in aZIP file package that contains this deployment guide as
well as Visual Basic sample scripts to use when configuring BIOS settings.
This deployment guide is developed for IT professionals to assist with the unique
challenges that they encounter. If you have suggestions or comments, communicate
with your Lenovo®authorized representative. To learn more about the technologies
that can help you lower the total cost of ownership and to check for periodic
updates to this guide, visit the following Web site:
www.lenovo.com/support
©Copyright Lenovo 2008 v

vi Lenovo BIOS Windows Management Instrumentation Interface Deployment Guide

Chapter 1. Overview
IT administrators are always looking for easier ways to manage client computer
BIOS settings, which include passwords, hardware settings, and the boot order.
The Lenovo BIOS WMI interface provides asimplified way to change these
settings. Lenovo has developed aBIOS interface that can be manipulated through
Windows Management Instrumentation (WMI). The Lenovo BIOS WMI interface
enables IT administrators to make queries on current BIOS settings, restore settings
to their factory defaults, change single settings, reset or change passwords, and
modify the boot order either at client computers or remotely.
Using Windows Management Instrumentation
WMI is provided as astandard feature in most Windows®operating systems. It
provides apowerful set of functions, such as query-based information retrieval and
event notification, which enables users to manage both local and remote
computers. The Lenovo BIOS WMI interface extends the capabilities of WMI to
allow management of BIOS settings.
The following illustration shows how WMI can be used to access Lenovo BIOS
settings.
WMI uses Windows Script host (WSH) to interpret scripts. You can write your
scripts in either Windows Visual Basic Scripting Edition (VBScript) or JavaScript.
Key benefits
The Lenovo BIOS WMI interface provides the following benefits:
©Copyright Lenovo 2008 1

Functions
vFlexible BIOS configuration, including the ability to change asingle BIOS setting
or all BIOS settings
vBIOS password management, including updating supervisor passwords,
power-on passwords, and hard disk drive (HDD) passwords
vNo dependency on aspecific BIOS level
Environment
vRemote or local capabilities
vSupport of unattended operations
vNo software installation, including managed object format (MOF), required
vReplaces DOS-based BIOS configuration tools
Interface
vEasy to adopt for various management servers
vReplaces current SMI interface
vCommon interface for different products
Supported computers
BIOS setup through WMI is supported on the following new ThinkPad products
only:
vR400
vR500
vT500
vW500
vX200
vX200s
vX200 Tablet
vX301
2Lenovo BIOS Windows Management Instrumentation Interface Deployment Guide

Chapter 2. Script classes and parameters
This chapter contains WMI implementation details for configuring BIOS settings.
Configuring BIOS settings
The following interface details can be used to access Lenovo BIOS settings.
vNamespace: "\root\WMI"
vBase Class: "Lenovo_BIOSElement"
vInterface details (see Table 1)
Table 1. Interface Details
Class Name Type Parameter /Return Example
Lenovo_BiosSetting Query CurrentSetting: "Item,Value" "WakeOnLAN,Enable"
Lenovo_SetBiosSetting Method "Item,Value,Password,Encoding,
KbdLang;"
"WakeOnLAN,Disable,pswd,
ascii,us;"
Lenovo_SaveBios
Settings
Method "Password,Encoding,KbdLang;" "pswd,ascii,us;"
Lenovo_DiscardBios
Settings
Method "Password,Encoding,KbdLang;" "pswd,ascii,us;"
Lenovo_LoadDefault
Settings
Method "Password,Encoding,KbdLang;" "pswd,ascii,us;"
Lenovo_SetBios
Password
Method "PasswordType,CurrentPassword,
NewPassword, Encoding,KbdLang;"
"pop,oldpop,newpop,ascii,us;”
Notes:
1. See Appendix A, “Sample Visual Basic scripts for configuring BIOS settings,”
on page 13 for Visual Basic sample scripts.
2. See Appendix B, “Sample PowerShell scripts for remote BIOS management,” on
page 21 for PowerShell sample scripts.
3. See Table 4on page 4for alisting of acceptable setting names.
Return types
You will receive one of the following return types after making changes to BIOS
settings:
Table 2. Return Types
Return Type Description
Success Operation completed successfully.
Not
Supported
The feature is not supported on this system.
Invalid
Parameter
The item or value provided is not valid.
Access
Denied
The change could not be made due to an authentication problem. If a
supervisor password exists, the correct supervisor password must be
provided.
©Copyright Lenovo 2008 3

Table 2. Return Types (continued)
Return Type Description
System Busy BIOS changes have already been made that need to be committed. Reboot
the system and try again
Password Authentication
If asupervisor password is already set, you must specify that supervisor password
before you can change any BIOS settings.
The format for password parameters is "abc,ascii,us" with descriptions in Table 3.
Table 3. Password parameters format, password authentication
Parameter Description Possible selections
Parameter 1Current password v“abc” -raw ascii character
v“1e302e” -scancode
Parameter 2Password encoding v“ascii”
v“scancode”
Parameter 3Keyboard languages
(valid only if encoding is ″ascii″)
v″us″-English US, English UK,
Chinese-Traditional, Danish, Dutch,
French-Canadian, Italian, Japanese, Korean,
Norwegian, Polish, Portuguese,
Spanish-European, Spanish-Latin American,
Swiss, Turkish
v″fr″-French-European, Belgian
v″gr″-German, Czech, Slovak, Slovenian
Available BIOS setting names
Some BIOS settings are dependent on the presence of certain hardware features.
Settings might vary on different computers.
Notes:
1. BIOS settings and values are case sensitive.
2. The security-related options are not changed even if the “load default” is
requested.
Table 4. List of available BIOS settings
Item name Selection name Load default?
WakeOnLAN “Enable”, ”Disable” N
FlashOverLAN “Enable”, ”Disable” N
EthernetLANOptionROM “Enable”, ”Disable” N
HarddriveDMA “Enable”, ”Disable” N
WirelessLANAndWiMAXRadios “Enable”, ”Disable” Y
SerialPort “Enable”, ”Disable” Y
SerialPortIO “3F8”, “2F8”, “3E8”, “2E8” Y
SerialPortIRQ “3”, “4”, “5”, “7” Y
ParallelPort “Enable”, ”Disable” Y
4Lenovo BIOS Windows Management Instrumentation Interface Deployment Guide

Table 4. List of available BIOS settings (continued)
Item name Selection name Load default?
ParallelPortMode ″OutputOnly″,″BiDirectional″,″ECP″Y
ParallelPortIO “378”, “278”, “3BC” Y
ParallelPortIRQ “5”, “7” Y
ParallelPortDMA "0”, “1”, “3” Y
PCIINTA “Disable”, “Auto Select”, “3”, “4”, “5”, “6”,
“7”, “9”, “10”, “11”
Y
PCIINTB “Disable”, “Auto Select”, “3”, “4”, “5”, “6”,
“7”, “9”, “10”, “11”
Y
PCIINTC “Disable”, “Auto Select”, “3”, “4”, “5”, “6”,
“7”, “9”, “10”, “11”
Y
PCIINTD “Disable”, “Auto Select”, “3”, “4”, “5”, “6”,
“7”, “9”, “10”, “11”
Y
PCIINTE “Disable”, “Auto Select”, “3”, “4”, “5”, “6”,
“7”, “9”, “10”, “11”
Y
PCIINTF “Disable”, “Auto Select”, “3”, “4”, “5”, “6”,
“7”, “9”, “10”, “11”
Y
PCIINTG “Disable”, “Auto Select”, “3”, “4”, “5”, “6”,
“7”, “9”, “10”, “11”
Y
PCIINTH “Disable”, “Auto Select”, “3”, “4”, “5”, “6”,
“7”, “9”, “10”, “11”
Y
USBBIOSSupport “Enable”, ”Disable” Y
AlwaysOnUSB “Enable”, ”Disable” Y
TrackPoint “Disable”, “Automatic” Y
TouchPad “Disable”, “Automatic” Y
FnKeyLock “Enable”, ”Disable” Y
ThinkPadNumLock “Independent”, “Synchronized” Y
PowerOnNumLock “Auto”, “On”, “Off” Y
PrimaryVideo “PCIExpress”, “Internal” Y
BootDisplayDevice “LCD”, “VGA”, “DisplayPort”, ”DVI” Y
GraphicsDevice ″IntegratedGfx″,″DiscreteGfx″,
″SwitchableGfx″
Y
OsDetectionForSwitchableGraphics Enable”, ”Disable Y
TimerWakeWithBattery “Enable”, ”Disable” Y
SpeedStep “Enable”, ”Disable” Y
SpeedStepModeAC “MaximumPerformance”,
“BatteryOptimized”, “MaximumBattery”,
“Automatic”
Y
SpeedStepModeBattery “MaximumPerformance”,
“BatteryOptimized”, “MaximumBattery”,
“Automatic”
Y
AdaptiveThermalManagementAC “MaximizePerformance”, “Balanced” Y
AdaptiveThermalManagementBattery “MaximizePerformance”, “Balanced” Y
CDRomSpeed “High”, “Normal”, “Silent” Y
CPUPowerManagement “Disable”, ”Automatic” Y
Chapter 2. Script classes and parameters 5

Table 4. List of available BIOS settings (continued)
Item name Selection name Load default?
PCIPowerManagement “Disable”, ”Automatic” Y
PowerControlBeep “Enable”, ”Disable” Y
LowBatteryAlarm “Enable”, ”Disable” Y
PasswordBeep “Enable”, ”Disable” Y
KeyboardBeep “Enable”, ”Disable” Y
ExtendedMemoryTest “Enable”, ”Disable” Y
SATAControllerMode “Compatibility”, “AHCI”, “RAID” Y
CoreMultiProcessing “Enable”, ”Disable” N
VirtualizationTechnology “Enable”, ”Disable” N
VTdFeature “Enable”, ”Disable” N
IntelAMTControl “Enable”, “Disable” N
LegacyDevicesOnMiniDock “Enable”, “Disable” N
Passphrase “Enable”, ”Disable” N
LockBIOSSetting “Enable”, ”Disable” N
MinimumPasswordLength “Disable”, “4”, “5”, “6”, “7”, “8”, “9”, “10”,
“11”, “12”
N
BIOSPasswordAtUnattendedBoot “Enable”, ”Disable” N
PasswordResetService “Enable”, ”Disable” N
FingerprintPredesktopAuthentication “Enable”, ”Disable” N
FingerprintReaderPriority “External”, “InternalOnly” N
FingerprintSecurityMode “Normal”, “High” N
FingerprintPasswordAuthentication “Enable”, ”Disable” N
SecurityChip “Active”, “Inactive”, “Disable” N
TXTFeature “Enable”, ”Disable” N
BIOSUpdateByEndUsers “Enable”, ”Disable” N
DataExecutionPrevention “Enable”, ”Disable” N
EthernetLANAccess “Enable”, ”Disable” N
WirelessLANAccess “Enable”, ”Disable” N
WiMAXAccess “Enable”, ”Disable” N
WirelessWANAccess “Enable”, ”Disable” N
BluetoothAccess “Enable”, ”Disable” N
WirelessUSBAccess “Enable”, ”Disable” N
ModemAccess “Enable”, ”Disable” N
USBPartAccess “Enable”, ”Disable” N
IEEE1394Access “Enable”, ”Disable” N
SerialPortAccess “Enable”, ”Disable” N
ParallelPortAccess “Enable”, ”Disable” N
CardBusSlotAccess “Enable”, ”Disable” N
ExpressCardAccess “Enable”, ”Disable” N
PCIExpressSlotAccess “Enable”, ”Disable” N
6Lenovo BIOS Windows Management Instrumentation Interface Deployment Guide

Table 4. List of available BIOS settings (continued)
Item name Selection name Load default?
UltrabayAccess “Enable”, ”Disable” N
MemoryCardSlotAccess “Enable”, ”Disable” N
SmartCardSlotAccess “Enable”, ”Disable” N
IntegratedCameraAccess “Enable”, ”Disable” N
MicrophoneAccess “Enable”, ”Disable” N
FingerprintReaderAccess “Enable”, ”Disable” N
ComputraceModuleActivation “Enable”, ”Disable” N
BootMode “Quick”, “Diagnostics” Y
StartupOptionKeys “Enable”, ”Disable” Y
BootDeviceListF12Option “Enable”, ”Disable” N
BootOrder “HDD0″,″HDD1″,″HDD2″,″PCILAN″,
″ATAPICD0″,″ATAPICD1″,″USBFDD″,
″USBCD″,″USBHDD″,″NODEV″
Y
NetworkBootOrder “HDD0″,″HDD1″,″HDD2″,″PCILAN″,
″ATAPICD0″,″ATAPICD1″,″USBFDD″,
″USBCD″,″USBHDD″,″NODEV″
Y
Chapter 2. Script classes and parameters 7

8Lenovo BIOS Windows Management Instrumentation Interface Deployment Guide

Chapter 3. Typical usage
Through WMI, you can configure BIOS settings in the following ways:
vList BIOS settings
vChange BIOS settings
vChange the boot order (sometimes referred to as the startup sequence)
vLoad default BIOS settings
Listing current BIOS settings
For alist of all available BIOS settings that can be changed through WMI on a
specific computer, use the Lenovo_BiosSetting class (see “List all BIOS settings on
the local computer” on page 13 and “List all BIOS settings on the remote
computer” on page 15 for sample scripts).
See Table 4on page 4for alist of available BIOS settings.
Changing BIOS settings
To change aBIOS setting, complete the following steps:
1. Identify the BIOS setting you want to change using the Lenovo_BiosSetting
class (see “List all BIOS settings on the local computer” on page 13 and “List
all BIOS settings on the remote computer” on page 15 for sample scripts).
2. Identify the value to which the setting will be changed.
Note: See Table 4on page 4for alist of available values for aparticular setting.
3. Change the BIOS setting to the desired value using the Lenovo_SetBiosSetting
class, then use the Lenovo_SaveBiosSetting class to save the settings (see “Set a
single BIOS setting on the local computer” on page 14 and“Set asingle BIOS
setting on aremote computer” on page 16 for sample scripts).
Note: BIOS settings and values are case sensitive.
After making changes to the BIOS settings, you must reboot the computer before
the changes will take effect.
Changing the boot order
To change the boot order, complete the following steps:
1. Determine the current setting for “BootOrder” by using the Lenovo_BiosSetting
class (see “List all BIOS settings on the local computer” on page 13 and “List
all BIOS settings on the remote computer” on page 15 for sample scripts).
2. To set anew boot order, use the Lenovo_SetBiosSetting class, then use the
Lenovo_SaveBiosSetting class to save the settings (see “Set asingle BIOS setting
on the local computer” on page 14 and“Set asingle BIOS setting on aremote
computer” on page 16 for sample scripts). Specify anew boot order by listing
the boot devices in order, separated by colons. Devices that are not specified
are excluded from the boot order. In the following example, the CD drive 0is
the first boot device and hard disk drive 0is the second startup device.
ATAPICD0:HDD0
©Copyright Lenovo 2008 9

Restoring default settings
To restore default BIOS settings, use the Lenovo_LoadDefaultSettings class, then
use the Lenovo_SaveBiosSettings class to save the BIOS changes (see sample
scripts).
Changing an existing hardware password
To update apassword, specify apassword type and format the password. The
format for password parameters is ″pop,abc,def,ascii,us″with descriptions in
Table 5(see “Set asupervisor password on the local computer when asupervisor
password exists” on page 18 and “Set asupervisor password on aremote
computer when asupervisor password exists” on page 18 for sample scripts).
Table 5. Password parameters format, changing existing hardware password
Parameter Description Possible selections
Parameter 1Password type string v“pap": Supervisor
v“POP": Power-on
v"uhdp1": User HDP 1
v"mhdp1": Master HDP 1
v"uhdp2": User HDP 2
v"mhdp2": Master HDP 2
v"uhdp3": User HDP 3
v"mhdp3": Master HDP 3
Parameter 2Current password string v“abc” -raw ascii character
v“1e302e” -scancode
Parameter 3New password string vRaw ascii ″def″
vScan code ″201221″
Parameter 4Password encoding v“ascii”
v“scancode”
Parameter 5Keyboard languages v″us″-English US, English UK,
Chinese-Traditional, Danish, Dutch,
French-Canadian, Italian, Japanese, Korean,
Norwegian, Polish, Portuguese,
Spanish-European, Spanish-Latin American,
Swiss, Turkish
v″fr″-French-European, Belgian
v″gr″-German, Czech, Slovak, Slovenian
Limitations
The following WMI limitations exist for BIOS setup:
vBIOS settings cannot be changed at the same boot as power-on passwords (POP)
and hard disk passwords (HDP). If you want to change BIOS settings and POP
or HDP, you must reboot the system after changing one of them.
vApassword cannot be set using this method when one does not already exist.
Passwords can only be updated or cleared.
10 Lenovo BIOS Windows Management Instrumentation Interface Deployment Guide

Chapter 4. Security
WMI-based administration scripts operating over aremote connection send data
over the network in clear text by default. You can enhance security by modifying
WMI-based administration scripts to establish an encrypted remote connection as
follows:
1. Set an impersonation level of ″impersonate″
2. Set an authentication level of ″pktPrivacy″
See Appendix A, “Sample Visual Basic scripts for configuring BIOS settings,” on
page 13 for sample scripts used to implement WMI-based administration scripts
that include these parameters for encryption.
©Copyright Lenovo 2008 11

12 Lenovo BIOS Windows Management Instrumentation Interface Deployment Guide