BIOS Updates & Configuration using BigFix

jgstew · May 18, 2020, 3:39am

Well, that sucks. That is much more complicated. Does Win8 have the reboot thing? I hope so.

You might be able to use the RunOnce key to Resume BitLocker on Windows 7 so that it can happen after the reboot has completed without requiring another action.

Configure a RunOnce task on Windows

I haven’t fully tested this yet:

// Handle BitLocker Resume after reboot for Win7 and Win2008R2
if {version of operating system < "6.2.0.0"}
regset64 "[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]" "ResumeBitLocker"="manage-bde -protectors -enable C:"
endif

jgstew · May 19, 2020, 3:30pm

Here is a work in progress, untested mustache template for BigFix BIOS Update Tasks:

Can be used with any language, but I plan to use it with generate_bes_from_template
Need example BIOS Update Tasks for vendors other than Dell. As well as example results for:
- values "product_name" of structures "system_information" of smbios
- values "vendor" of structures "bios_information" of smbios
- values "bios_version" of structures "bios_information" of smbios
Does not handle BIOS Passwords (yet)
Does not handle BitLocker for WinVista or Win2008 (manage-bde.wsf)
- should be usable as long as BitLocker is not enabled for these OSes.
- I don’t personally plan to address this use case.
Does NOW handle Resuming BitLocker for Win7 or Win2008R2

github.com

jgstew/bigfix-content/blob/master/fixlet/BIOS Update {{vendor}} {{model}} to {{bios_version}} - Windows.bes

<?xml version="1.0" encoding="UTF-8"?>
<BES xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="BES.xsd">
	<Task>
		<Title>BIOS Update {{vendor}} {{model}} to {{bios_version}} - Windows</Title>
		<Description><![CDATA[<P>This task will suspend BitLocker if applicable, and update the BIOS for {{vendor}} {{model}} to {{bios_version}}<BR><BR>BIOS Passwords are not CURRENTLY handled by this task. Dell Command Monitor or similar vendor software is required to populate `wmis "ROOT\DCIM\SYSMAN"` in order to detect if the BIOS password is set properly, otherwise it is assumed the BIOS Password is NOT set.<BR><BR>NOTE: Windows Vista and 2008 use a different command to manage BitLocker, not currently tested there. This should work on those OSes as long as BitLocker is not enabled.<BR></P>]]></Description>
		<Relevance>windows of operating system</Relevance>
		<Relevance><![CDATA[/* Windows XP or Higher */ version of operating system >= "5.1"]]></Relevance>
		<Relevance>/* Check Vendor */ exists values "vendor" whose(it as string as trimmed string as uppercase contains "{{vendor}}" as trimmed string as uppercase) of structures "bios_information" of smbios</Relevance>
		<Relevance>/* Check Model */ exists values "product_name" whose(it as string as trimmed string as uppercase contains "{{model}}" as trimmed string as uppercase) of structures "system_information" of smbios</Relevance>
		<Relevance><![CDATA[/* Check for older BIOS */ exists values "bios_version" whose( it as string as version < "{{bios_version}}" as version ) of structures "bios_information" of smbios]]></Relevance>
		<Relevance>/* to be removed once BIOS Password handling added: */ not exists boolean values whose(it) of selects "IsSet FROM DCIM_BIOSPassword where ElementName='BiosSetupPassword'" of wmis "ROOT\DCIM\SYSMAN"</Relevance>
		<Category></Category>
		<Source>Internal</Source>
		<SourceID></SourceID>
		<SourceReleaseDate>2020-05-19</SourceReleaseDate>
		<SourceSeverity></SourceSeverity>
		<CVENames></CVENames>
		<SANSID></SANSID>
		<MIMEField>
			<Name>x-fixlet-modification-time</Name>

This file has been truncated. show original

jgstew · July 15, 2020, 8:06pm

I’m not currently handling encrypting the BIOS password, but I released 300+ BIOS update tasks here: https://github.com/jgstew/bigfix-content/tree/master/fixlet/BIOS/Dell

These have NOT been tested except for on the 1 model I happen to have, and even then, not all cases. Please test them out carefully and provide me feedback on if they work, if they don’t, and any suggestions for improvement.

You can follow along my process of doing this here: https://github.com/jgstew/bigfix-content/issues/7

I used this python script:

https://github.com/jgstew/generate_bes_from_template/blob/master/examples/BIOS_from_dell_catalog.py
- not my prettiest work, and could use some future refinement, but it works. There are a few edge cases I need to resolve that prevents me from generating the tasks for about 18 models.

I used this template:

https://github.com/jgstew/generate_bes_from_template/blob/master/examples/TEMPLATE_BIOS_Update.bes

These also make use of:

BIOS Updates & Configuration using BigFix

Related: