Lenovo on Jon's Notes

BIOS Management Scripts v2 Released

Tue, 26 May 2026 00:00:00 +0000

My Dell, HP, and Lenovo BIOS password and settings scripts have been around for years, and over time they drifted away from the modules, operating systems, and hardware they run against. I’ve now finished a top-to-bottom modernization of the whole set (the v2 generation) currently at version 2.3.0. This post summarizes what changed across all of the scripts and links to the individual posts where each one is covered in detail.

Document Encryption Certificates for BIOS Password Management

Sun, 24 May 2026 00:00:00 +0000

The CMS method described in Securing BIOS Passwords relies on a document encryption certificate. The BIOS password is encrypted to that certificate’s public key, and only devices holding the matching private key can decrypt it. This post is a companion to that one. It covers how to create and manage the certificate itself: choosing between a self-signed certificate and one issued from an enterprise PKI, and handling the full lifecycle from creation through distribution, rotation, and removal.

Securing BIOS Passwords in Unattended Deployments

Sun, 24 May 2026 00:00:00 +0000

My Dell, HP, and Lenovo BIOS password and settings scripts all accept the BIOS password as a plain-text parameter. That is intentional, it keeps the scripts simple and broadly compatible, but it means that how you deliver the password to the script is where your security actually lives. This post covers how to do that safely under Configuration Manager and task sequences, and how the built-in CMS support added in version 2.3.0 makes it easier.

BIOS Management - Example Task Sequences

Mon, 24 Feb 2020 00:00:00 +0000

Warning

The scripts bundled in these zip files are outdated and predate the v2 modernization. Updated example task sequences are still on the to-do list. For the current scripts, see the posts linked below.

Lenovo BIOS Settings Management

Thu, 01 Aug 2019 00:00:00 +0000

This post was updated on May 24th, 2026 and covers script version 2.3.0.

This post is one of 3 posts in my series on managing BIOS settings using PowerShell. I’ve also written about Dell and HP. In this post I’ll be talking about using PowerShell to manage Lenovo BIOS settings.

The script can be downloaded from my GitHub: https://github.com/ConfigJon/Firmware-Management/tree/master/Lenovo

This post is part of the v2 update to my BIOS management scripts. For an overview of everything that changed across the Dell, HP, and Lenovo scripts, see BIOS Management Scripts v2 Released.

Lenovo BIOS Password Management

Mon, 08 Jul 2019 00:00:00 +0000

This post was updated on May 25th, 2026 and covers script version 2.3.0.

This post discusses how to manage Lenovo BIOS passwords using WMI. My goal was to have a script that could change or clear existing passwords and could display a prompt to the screen when manual intervention was required. In this post, I’ll cover the basics of how the script works. I’ll also talk about some limitations of the script and some areas it could be improved in the future.