Powershell on Jon's Notes

BIOS Management Scripts v2 Released

Tue, 26 May 2026 00:00:00 +0000

My Dell, HP, and Lenovo BIOS password and settings scripts have been around for years, and over time they drifted away from the modules, operating systems, and hardware they run against. I’ve now finished a top-to-bottom modernization of the whole set (the v2 generation) currently at version 2.3.0. This post summarizes what changed across all of the scripts and links to the individual posts where each one is covered in detail.

Document Encryption Certificates for BIOS Password Management

Sun, 24 May 2026 00:00:00 +0000

The CMS method described in Securing BIOS Passwords relies on a document encryption certificate. The BIOS password is encrypted to that certificate’s public key, and only devices holding the matching private key can decrypt it. This post is a companion to that one. It covers how to create and manage the certificate itself: choosing between a self-signed certificate and one issued from an enterprise PKI, and handling the full lifecycle from creation through distribution, rotation, and removal.

Securing BIOS Passwords in Unattended Deployments

Sun, 24 May 2026 00:00:00 +0000

My Dell, HP, and Lenovo BIOS password and settings scripts all accept the BIOS password as a plain-text parameter. That is intentional, it keeps the scripts simple and broadly compatible, but it means that how you deliver the password to the script is where your security actually lives. This post covers how to do that safely under Configuration Manager and task sequences, and how the built-in CMS support added in version 2.3.0 makes it easier.

HP BIOS Password Management (HPCMSL)

Fri, 22 May 2026 00:00:00 +0000

This post covers script version 2.3.0.

This is the HP Client Management Script Library (HPCMSL) variant of my HP BIOS password management script. It performs the same task as the WMI-based variant - automatically setting, changing, or clearing the Setup and Power-On passwords with logging and optional user prompts - but it uses the HPCMSL cmdlets instead of talking to the HP WMI interface directly. If you would rather avoid the module dependency, see the WMI variant.

HP BIOS Settings Management (HPCMSL)

Fri, 22 May 2026 00:00:00 +0000

This post covers script version 2.3.0.

This is the HP Client Management Script Library (HPCMSL) variant of my HP BIOS settings management script. It performs the same task as the WMI-based variant - getting a list of current BIOS settings and setting BIOS settings from either the body of the script or a CSV file - but it uses the HPCMSL cmdlets instead of talking to the HP WMI interface directly. If you would rather avoid the module dependency, see the WMI variant.

Dell BIOS Password Management - WMI

Fri, 11 Sep 2020 00:00:00 +0000

This post was updated on May 25th, 2026 and covers script version 2.3.0.

Earlier this year, I wrote about how to manage Dell BIOS passwords using PowerShell. The method described in that post uses the DellBIOSProvider PowerShell module. This method works, but I was not completely satisfied with it, as the PowerShell module needs to be downloaded and installed on every system the script runs on.

Thankfully, Dell recently released a technical whitepaper documenting WMI classes that can be used to directly modify BIOS settings without needing an outside program or PowerShell module. This allowed me to create a new version of the Dell BIOS Settings Management script that does not require any additional content to function.

Dell BIOS Settings Management - WMI

Fri, 11 Sep 2020 00:00:00 +0000

This post was updated on May 25th, 2026 and covers script version 2.3.0.

Earlier this year, I wrote about how to manage Dell BIOS settings using PowerShell. The method described in that post uses the DellBIOSProvider PowerShell module. This method works, but I was not completely satisfied with it, as the PowerShell module needs to be downloaded and installed on every system the script runs on.

Installing the HP Client Management Script Library

Tue, 10 Mar 2020 00:00:00 +0000

Update - May 20th, 2026

The HP Client Management Script Library has been around for several years now and has grown considerably since I originally wrote this post. The HPCMSL module now includes 14 sub-modules and supports both PowerShell 5.1 and PowerShell 7. I’ve updated the PowerShell script and the content in this post to reflect the current state of the HPCMSL module. For details on what has changed, see the “What Changed” section at the bottom of this post.

BIOS Management - Example Task Sequences

Mon, 24 Feb 2020 00:00:00 +0000

Warning

The scripts bundled in these zip files are outdated and predate the v2 modernization. Updated example task sequences are still on the to-do list. For the current scripts, see the posts linked below.

Dell BIOS Settings Management - DellBIOSProvider

Fri, 21 Feb 2020 00:00:00 +0000

This post was updated on May 25th, 2026 and covers script version 2.3.0.

Update: Dell does now provide native WMI classes to manage BIOS settings on newer models. For more information, see this post: Dell BIOS Settings Management - WMI. For information on using the Dell PowerShell module to configure settings on older models, continue reading this post.

This post is one of 3 posts in my series on managing BIOS settings using PowerShell. I’ve also written about HP and Lenovo. In this post I’ll be talking about using PowerShell to manage Dell BIOS settings.

Configuration Manager Collection Creation Script

Tue, 18 Feb 2020 00:00:00 +0000

I just finished updating the script I’ve been using to bulk create collections in Configuration Manager. I know there are already many different examples of this same type of script out there, but I figured I’d share my take on it.

The script can be downloaded from my GitHub: https://github.com/ConfigJon/ConfigMgr-Scripts/tree/master/Create-Collections

Create_Collections.ps1

This script can be used to dynamically create user collections, device collections, and folder structure based on information in a CSV file. The script should be run as a user account with rights to connect to and create collections in Configuration Manager. The script should be run on a computer with the Configuration Manager Admin Console installed. The script will automatically search for the ConfigurationManager.psd1 file, attempt to import it, and connect to the specific site.

App Packaging PowerShell Functions

Thu, 30 Jan 2020 00:00:00 +0000

I’ve recently been working on a lot of app packaging, and I decided to take the opportunity to update my scripts. In this post I’ll cover 3 PowerShell functions that I found to be the most useful. The functions can be found on my GitHub.

Invoke-MsiExec

This function works with msiexec.exe. The function allows for installing or uninstalling a .msi based application.

The function has a number of parameters:

FilePath - The path to the .msi or .msp file
Guid - The GUID of the MSI-based application to be uninstalled
Install - Indicates that the /i switch should be used when calling msiexec.exe
Uninstall - Indicates that the /x switch should be used when calling msiexec.exe
Patch - Indicates that the /p switch should be used when calling msiexec.exe
Arguments - A comma separated list of arguments to pass to msiexec.exe
ExitCodes - A comma separated list of non-standard exit codes

Some notes about the parameters:

Dell BIOS Password Management - DellBIOSProvider

Sun, 03 Nov 2019 00:00:00 +0000

This post was updated on May 25th, 2026 and covers script version 2.3.0.

Update: Dell does now provide native WMI classes to manage BIOS passwords on newer models. For more information, see this post: Dell BIOS Password Management - WMI. For information on using the Dell PowerShell module to configure passwords on older models, continue reading this post.

This is the third post in my series on how to manage BIOS / Firmware passwords with PowerShell. Previously, I’ve discussed Lenovo BIOS Password Management and HP BIOS Password Management.

Working with the Dell Command | PowerShell Provider

Sun, 03 Nov 2019 00:00:00 +0000

Update - May 21st, 2026 I’ve updated the script and information in this post to reflect the most recent release of the DellBIOSProvider PowerShell module (2.10.1 at the time of writing). For more details, see the script’s in-file .CHANGELOG block.

Dell BIOS settings and passwords can be accessed and modified using WMI classes. These WMI classes can be accessed directly (Dell BIOS Settings Management - WMI). However, Dell also provides a PowerShell module that simplifies some aspects of working with these WMI classes (Dell Command | PowerShell Provider). This post will discuss the requirements for using the Dell PowerShell Provider as well as the PowerShell script I wrote for installing and updating it.

Lenovo BIOS Settings Management

Thu, 01 Aug 2019 00:00:00 +0000

This post was updated on May 24th, 2026 and covers script version 2.3.0.

This post is one of 3 posts in my series on managing BIOS settings using PowerShell. I’ve also written about Dell and HP. In this post I’ll be talking about using PowerShell to manage Lenovo BIOS settings.

The script can be downloaded from my GitHub: https://github.com/ConfigJon/Firmware-Management/tree/master/Lenovo

This post is part of the v2 update to my BIOS management scripts. For an overview of everything that changed across the Dell, HP, and Lenovo scripts, see BIOS Management Scripts v2 Released.

HP BIOS Settings Management

Mon, 29 Jul 2019 00:00:00 +0000

This post was updated on May 25th, 2026 and covers script version 2.3.0.

This script is now available in two variants. This post covers the WMI-based variant (Manage-HPBiosSettings-WMI.ps1), which talks directly to the HP WMI interface and has no module dependencies. There is also a variant built on the HP Client Management Script Library: HP BIOS Settings Management (HPCMSL).

This post is one of 3 posts in my series on managing BIOS settings using PowerShell. I’ve also written about Dell and Lenovo. In this post I’ll be talking about using PowerShell to manage HP BIOS settings.

HP BIOS Password Management

Thu, 18 Jul 2019 00:00:00 +0000

This post was updated on May 25th, 2026 and covers script version 2.3.0.

This script is now available in two variants. This post covers the WMI-based variant (Manage-HPBiosPasswords-WMI.ps1), which talks directly to the HP WMI interface and has no module dependencies. There is also a variant built on the HP Client Management Script Library: HP BIOS Password Management (HPCMSL).

In my last blog post, (Lenovo BIOS Password Management), I talked about managing Lenovo BIOS passwords with PowerShell. I liked how that process worked, so I decided to create a similar process to handle HP BIOS passwords. Once again, the goal was to have a script that could automatically set, change, or clear BIOS passwords while providing logging and optional user prompts. In this post, I’ll cover the basics of how the script works and some limitations of the script.

Lenovo BIOS Password Management

Mon, 08 Jul 2019 00:00:00 +0000

This post was updated on May 25th, 2026 and covers script version 2.3.0.

This post discusses how to manage Lenovo BIOS passwords using WMI. My goal was to have a script that could change or clear existing passwords and could display a prompt to the screen when manual intervention was required. In this post, I’ll cover the basics of how the script works. I’ll also talk about some limitations of the script and some areas it could be improved in the future.

Windows Customizations with PowerShell

Wed, 26 Jun 2019 00:00:00 +0000

The out of the box Windows 10 experience has improved over the years, but I still find most clients I work with want to make various tweaks and modifications to the default settings. In the past I would add these customizations to a Configuration Manager task sequence as individual steps. But I’m lazy, and I didn’t want to have to continually add each individual step over and over. Plus I like to keep task sequences shorter when I can. The solution was to create a PowerShell script that allows the admin to select which of the common Windows customizations to run in their environment.

Create and Print a Word Document with PowerShell

Thu, 25 Apr 2019 00:00:00 +0000

I was working with a client that had a requirement where each computer that was deployed needed to be paired with a physical document that had information about the computer. The solution I used to automate this process was to use a PowerShell script to take information from a running task sequence, then write and print a Word document.

Here is a high level outline of the process.
- Information about the computer and deployment is collected by a PowerShell script during the task sequence
- The same PowerShell script then copies that information to a network share as a CSV file
- A separate computer or server has a Windows Scheduled Task set to run a second PowerShell script on a schedule
- The second PowerShell script takes any CSV files in the network location as input. It uses the data from the CSV files to build a Word document and then sends that document to a printer.

This is the script that runs during the task sequence to collect information and write it to a CSV file on a network share. This example script is collecting the Serial Number, Asset Tag, and Computer Model.

Create Configuration Manager Antimalware Policies with PowerShell

Sun, 24 Mar 2019 00:00:00 +0000

As I spend time working in many different Configuration Manager environments, I find myself regularly needing to create Antimalware Policies. Most of the settings in the antimalware policies can be configured quickly, however the setting that always takes me the most time is the Exclusion Settings.

There needs to be different policies with different exclusion settings for different types of devices. Each of these separate policies have 3 different areas for adding file paths, file types, and processes. And for some reason, unknown to me, the dialog window for adding exclusions has a 260 character limit. This means that even if all the exclusion settings are in a list, you can’t just copy the whole list in at once. All this adds up to make this process time consuming and inconsistent.

Create Windows Firewall Rules for AppData Executables

Thu, 14 Mar 2019 00:00:00 +0000

I was recently deploying an application that required Windows Firewall rules to be created for an executable that ran from each user’s AppData folder. The way I accomplished this was to use a combination of PowerShell scripts and the Windows Task Scheduler.

I created two PowerShell scripts for this solution. Create_Scheduled_Task.ps1 and Create_Firewall_Rules.ps1.

The Create_Scheduled_Task.ps1 script copies the Create_Firewall_Rules.ps1 script to a subfolder in C:\Users\Public and creates a scheduled task to run that script each time a user logs onto the computer. You will need to set the $appName, $scriptName, and $folderPath variables.

Modify Local Administrators Membership

Wed, 13 Mar 2019 00:00:00 +0000

I encountered a scenario where I needed to add or remove domain users from the local administrators group on an individual computer basis. The Run Script feature in Configuration Manager worked great for this.

I used an Add script and a Remove script. Both scripts have a $Member parameter that takes the name of a domain user or group and adds it to or removes it from the local administrator group on selected computers.