(196) Microsoft Intune - Set HP BIOS Password as a Win32 App

1. Download and run the installer on an HP machine: HP BIOS Configuration Utility | HP Client Management Solutions 
   

2. Then run HpqPsw64.exe.
   

   

3. Then to create a BIOS password - enter twice for the password to be encrypted and save the location. You can save it to whatever you like, in this case I have saved as HPBIOSPassword.bin

4. Prepare the scripts:

   1. Install.ps1

   2. Uninstall.ps1

   3. BiosConfigUtility64.exe

   4. HPBIOSPassword.bin

   5. Detect.ps1

   
   

   

   
   

5. Prepare the Install.ps1 script:

# Script sets the BIOS unlock password on a HP laptop.
cls
# Change the powershell working path to THIS intunewinapp folder location:
cd $PSScriptRoot

#Command to set BIOS password and hide any windows that pop up
Start-Process -Wait BiosConfigUtility64.exe -Arg "/nspwdfile:HPBIOSPassword.bin" -WindowStyle Hidden

# Sleep for 5 seconds allowing password to be set
Start-Sleep -Seconds 5
cls
#Create a TXT record in this location.  Intune checking this location knows that the above 'App/Script' is installed
If (Test-Path -Path C:\ProgramData\MrBSOEWay\BIOS\BIOS.txt) {
    Write-Host "BIOS Password appears to already have been set" -ForegroundColor Green -BackgroundColor DarkGray
    }
Else {
    Write-Host "Creating 'Intune Detection File' for the 'HPBiosUtility' app" -ForegroundColor Black -BackgroundColor Yellow
    New-Item -Path 'C:\ProgramData\Devicie\BIOS\BIOS.txt' -ItemType Directory -Force | Out-Null
    $IntuneChecksFolder=Get-Item C:\ProgramData\Devicie\BIOS -Force
    $IntuneChecksFolder.attributes='Hidden'

    New-Item -Path 'C:\ProgramData\Devicie\BIOS\BIOS.txt' | Out-Null
}
Start-Sleep -Seconds 2
exit $LASTEXITCODE

6. Prepare the Uninstall.ps1 script:

# Script sets the BIOS unlock password on a HP laptop.
cls
# Change the powershell working path to THIS intunewinapp folder location:
cd $PSScriptRoot

#Command to set BIOS password and hide any windows that pop up
Start-Process -Wait BiosConfigUtility64.exe -Arg "/nspwdfile:""" -WindowStyle Hidden

# Sleep for 5 seconds allowing password to be set
Start-Sleep -Seconds 5
cls
exit

7. Prepare the detect.ps1 script:

Function Get-PasswordState {
<#
.Synopsis
    Get the current state of the BIOS password
.Description
    Get the current state of the BIOS password for HP systems from WMI
    Requires existence of the root\HP\InstrumentedBIOS WMI Namespace and the HP_BIOSPassword WMI Class
.Outputs
    Output is the full contents of the "Setup Password" WMI property
.Example
    Get-PasswordState
    Returns full contents of the "Setup Password" WMI property
.Notes
    Author: Jeroen Bakker
    Version: 1.0
    Date: 27-06-2017
#>

[CmdletBinding()]
Param()

Process{
    $WMINameSpace = "root\HP\InstrumentedBIOS"
    $WMIClass = "HP_BIOSPassword"

    $PropertyName = "Setup Password"

    Write-Verbose -Message "Connecting to WMI Namespace $WMINameSpace and Class $WmiClass."
    Write-Verbose -Message "Getting content of the $Propertyname instance of Class $WmiClass."

    Get-WmiObject -Namespace $WMINameSpace -Class $WMIClass -Filter "Name = 'Setup Password'"
    }

}


# Get the current state for the Bios Password
$PasswordState = Get-PasswordState


If ($PasswordState.IsSet -eq 0){
    #Password not configured
    $State = "Not Configured"
    }
Else {
    # A BIOS password is set
    $State = "Configured"
    }


Write-Host $State

8. Package the app, once installed. Restart the device and load into BIOS where you will be prompted for the password set.

For the most modern approach, go to HP Connect  and select Sign In