Sounds like Lenovo will no longer provide a way to set the
initial supervisor password. You would have to pay Lenovo to do a custom
BIOS per machine if you want an initial temp password set. Going forward
you can only change it or remove it (if you know the current password).
This can be done via WMI scripting with VBscript or Powershell. Guide on
how to do that here
http://support.lenovo.com/en_US/detail.page?LegacyDocID=MIGR-68488. Be
aware the last Powershell example is wrong in the guide.
It calls a property instead of a method. It reads:
*(gwmi -class Lenovo_SaveBiosSettings -namespace root\wmi).SaveBiosSettings*
Whoever wrote the guide even ran it and posted the wrong output following
the command. The line should read like this:
*(gwmi -class Lenovo_SaveBiosSettings -namespace
root\wmi).SaveBiosSettings()*
And if a supervisor password is set it would be something like this:
*(gwmi -class Lenovo_SaveBiosSettings -namespace
root\wmi).SaveBiosSettings("pswd,ascii,us;")*
* *
per table 3 (on page 4) for the password parameters to put within
parenthesis.
On Tue, Apr 30, 2013 at 6:45 PM, Klish, Brian <kli...@morrisville.edu>wrote:
> In the past we have disabled UEFI mode and used legacy boot. Microsoft is
> requiring that Secure Boot and UEFI mode be turned on by default for
> Windows 8 machines. For obvious security reasons these settings cannot be
> programmatically changed. They can only be changed manually.****
>
> ** **
>
> We’re now left trying to figure out how to get hundreds of laptops
> configured. Before now we’ve been able to use DOS-based tools to set BIOS
> settings including a supervisor password. Since those aren’t native 64-bit
> UEFI friendly apps those won’t work anymore. Lenovo provides the “ThinkPad
> Settings Capture/Playback Utility” for both DOS and Windows. Looking at
> the Windows one they have 64-bit executables that might work with WinPE
> during imaging (preferred) or once the OS has been installed. After you
> setup and capture the settings on a donor machine you can then “playback”
> those settings to a target machine. Strangely the documentation states the
> following:****
> ------------------------------
>
> [Starting playback]****
>
> **1. **Set supervisor password to a target ThinkPad.****
>
> **2. **Boot Windows.****
>
> **3. **For 32bit Windows, prepare SRSETUPWIN32.EXE and SRSWDRV32.SYS
> to the same
> directory. For 64bit Windows, prepare SRSETUPWIN64.EXE and SRSWDRV64.SYS
> to the same directory.****
>
> **4. **Copy the ThinkPad Setup Settings file in the step 10 of the
> "Capturing ThinkPad Setup Settings".****
>
> **5. **Open Command Prompt as "Run as Administrator"****
>
> **6. **At the command line, execute SRSETUPWIN.EXE with the /u option.
> Example: SRSETUPWIN.EXE \path\file_name /u /kpap
> Where \path\file_name is the path and file name of ThinkPad Setup Settings
> file. And type the superviosr password setting in Step1.****
>
> **7. **Restart, the computer.****
>
> *Note:* A target ThinkPad must have superviosr password beforehand.****
> ------------------------------
>
> ** **
>
> It seems we have a chicken and the egg situation. Step 1 states you have
> to set a supervisor password before you can apply any settings. I also
> find it interesting that the DOS version talks about UEFI BIOS, but makes
> no mention of it not working in UEFI-only mode. Has anyone tackled this
> problem yet?****
>
> ** **
>
> -Brian****
>
