- Create and read SCVMM custom properties with PowerShell and the VMM Console - Mon, Apr 18 2022
- Prevent ransomware attacks on network shares with File Server Resource Manager (FSRM) - Mon, Mar 7 2022
- Block brute force Remote Desktop attacks with Windows PowerShell - Fri, Feb 11 2022
Updating the BIOS on multiple laptops and desktops can be a tiresome task that may just seem easier to do without. However, securing the BIOS can prevent attackers from overwriting or tampering with the OS and ensures your data stays safe.
Please note that this guide only applies to Dell systems. I tested these steps on a Dell OptiPlex 780 SFF (Small Form Factor), Dell OptiPlex 790 SFF, and Dell OptiPlex 3040 MT (Mini-Tower). All systems were running Windows 7 Professional x64 and Windows 10 Pro x64. I cannot guarantee this guide will work with Windows Vista or Windows XP.
Before we get started, you are going to need the following tools installed on your workstation:
- System Center Configuration Manager 2012 R2 Admin Console
- Dell Command | Configure Toolkit (Download)
First, download the latest BIOS revisions for each of the models deployed throughout your organization from Dell’s support website. Create a new folder in which you will place the downloaded revisions. For this guide, I will be saving all necessary files to the following location:
I have created separate folders for each model. If you download multiple revisions for one model, I suggest you come up with a naming convention so you don’t have multiple separate directories to hold one revision. For this guide, I will be using the following naming convention:
O780-A15 | O = OptiPlex (Family), 780 = (Model), – A15 = (BIOS Revision)
Next, launch the Dell Command | Configure Toolkit Wizard. Although you can configure separate packages for each model in your organization, I recommend creating a multiplatform package that will work with all models. I have never had any issues creating a multiplatform package that works with different Dell models, even those manufactured as late as 2010. With that in mind, select the Create Multiplatform Package tab and configure the package options.
For this guide, I have configured the following options:
When you are satisfied with your configuration, export your package as a .CCTK (Client Configuration Toolkit) file using the EXPORT CONFIG button and save it to a location SCCM can access. For this guide, I will be saving my configuration to the following location:
Once you save your configuration, navigate to “C:\Program Files (x86)\Dell\Command Configure” and copy the contents of the folder “X86_64” to a location SCCM can access. You will be importing the directory to which you copy these files as a package in SCCM. For this guide, I will be copying these files to the following location:
Note your configuration file and the contents from the “X86_64” folder must be accessible through the same package in SCCM. This is because you need Dell’s CCTK executable to apply your configuration.
Now we are ready to create the task sequence that will push the BIOS configuration. The toolkit will deploy this task sequence as a required advertisement and will also flash any BIOS updates needed using the revisions you downloaded earlier.
Open the Configuration Manager Admin Console and navigate to the Software Library applet. Expand the Application Management node and click on the Packages applet. Create a new package using the Dell CCTK folder you just created, but do not create a program or add any requirements.
When you are finished creating the package, distribute it to the necessary distribution points. Now we need to import the BIOS revisions downloaded earlier into SCCM. Create a package for each model you wish to deploy BIOS updates to, but do not create a program or add any requirements.
After creating your packages, you can distribute them to the necessary distribution points. When you add a new revision to the source folder, you will need to update your distribution points to push the revision out to clients.
Finally, we are going to create the task sequence that will push your BIOS configuration and any needed updates.
Expand the Operating Systems node and click on the Task Sequences applet. Create a new custom task sequence, and specify a name and boot image to use.
When you are done, click Close to exit the New Custom Task Sequence Wizard. Open your newly created task sequence and create a new group called “Apply BIOS Updates.” Add a new step to Run Command Line and configure the step as shown below:
Note you do not need to specify the BIOS password to install the HAPI driver. The next step in the task sequence will clear the password before applying any updates or configurations. Add another step to Run Command Line and configure the step as shown below:
Note that this is the only step where we will tell the task sequence to continue on error, as new machines will not have a password set in the BIOS. Make sure the value you set for “‑valsetuppwd” is your current administrator password and that you’ve typed it correctly, otherwise your task sequence will fail. Add another step to Run Command Line and configure the step as shown below:
Take note of the following parameters:
- O780-A15.exe – Name of the executable located in the package source folder.
- /s – Switch to run the executable silently.
- /r – Switch to force a system restart. If this switch is not present, the flash with fail and generate error code 2.
- /l=C:\Temp\O780_A15.log – Switch to generate a log file from the executable.
Make sure to point the step to the package that contains the executable you wish to run. Repeat this process for every model to which you wish to deploy BIOS updates. If you add a new revision, you will need to update the executable name and WMI queries as needed. It seems that newer Dell models such as the OptiPlex 3040 do not use A01, A02, etc. as their BIOS revisions but just numbers instead (1, 1.4.2, etc.). Pay close attention when entering your WMI query for the “SMBIOSBIOSVersion” property. When you are done, add a new group called “Apply BIOS Configuration” and add another step to Run Command Line. Configure the step as shown below:
Unlike the previous steps in the task sequence, this step will run if any of the conditions are true. In this case, if any models match the model on which this task sequence is running, the step will apply the BIOS configuration. You will need to add a WMI query for each model in your organization. Finally, add one more step to Run Command Line and configure the step as shown below:
Close the task sequence when you’ve finished configuring the last step. Finally, we are going to deploy the task sequence to a device collection. Right-click on the task sequence and click Deploy. Choose a collection to deploy the task sequence to and click Next. Choose Required as the purpose and make the advertisement available only to Configuration Manager clients. When specifying the deployment schedule, keep in mind the task sequence will force a reboot on the machine. For this reason, I have chosen to deploy the task sequence at 11:00 PM.
Since we do not need to modify any other settings past this point, keep clicking Next until you finish the Deploy Software Wizard. Depending on the time at which you specified your deployment to become available, you will be able to see the task sequence start to run.
To confirm the task sequence successfully applied your BIOS configuration, check the directory you specified for the CCTK log file to see the changes that took place. If an option is not applicable to a certain model, the CCTK executable will flag it accordingly.