Setting Bios Settings via WMI

[Tim_Myth]

I wrote a script to change the Ownership Tag on the laptops, desktops, and workstations we have deployed at our site. Sadly it is kind of a mish-mash of models (8470p, 8560p, 8560w, Z420, Z600, ML 110, ML 350, 6000 Pro, 8200 Elite, and several others...a mish-mash). All of the laptops are running Windows 8.1 and all the desktops/workstations are running Windows Server 2012 R2. All the PCs are on a domain, and although I am not a domain admin, I am specifically set as a local admin on all PCs.

I am having two issues:

1. I can set the Ownership Tag on my laptop both locally and remotely regardless of what I enter for a BIOS Setup password. The F10 Setup password IS SET on my laptop, and I get prompted for it when I press F10 during the POST. I don't know if it matters, but my laptop's BIOS version is 68ICF Ver. F.50.

2. My script does not work locally or remotely on a z420 (BIOS Ver J61 v03.85) running Server 2012 r2 even when I know I am using the right password. It consistently returns error code 6 (Access Denied). If I remove the BIOS setup password it will work both locally and remotely. I know Windows Firewall is configured to allow remote WMI.

Here is my script:

If Wscript.Arguments.Count = 2 Then
    strComputer = Wscript.Arguments.Item(0)
    strOwnerTag = Wscript.Arguments.Item(1)

    ' Get BIOS password from user
    Set oPwdCtl = CreateObject("hpPwdCtl.PasswordEdit")
    oPwdCtl.GetPassword _
      "Enter the Computer Setup Password:", strPassword
        
    Set objSWbemLocator = CreateObject _
      ("WbemScripting.SWbemLocator")
    Set objWMIService = objSWbemLocator.ConnectServer _
      (strComputer, "root\HP\InstrumentedBIOS")
    
    Set colItems = objWMIService.ExecQuery _
      ("SELECT * FROM HPBIOS_BIOSString", , 48)

    For Each objItem In colItems
'        strResultMsg = strResultMsg & objItem.Name & _
'          " : " & objItem.Value & vbCrLf
        If InStr(1, objItem.Name, "Owner") Then
            strName = objItem.Name
        End If
    Next
    
    ' Obtain an instance of the the class using
    ' a key property value.
    Set objShare = objWMIService.Get _
      ("HPBIOS_BIOSSettingInterface.InstanceName='ACPI\PNP0C14\0_0'")
    
    ' Obtain an InParameters object specific to the method.
    Set objInParam = _
    objShare.Methods_("SetBIOSSetting").InParameters.SpawnInstance_()
    
    ' Add the input parameters.
    objInParam.Properties_.Item("Name") = strName
    objInParam.Properties_.Item("Password") = strPassword
    objInParam.Properties_.Item("Value") = strOwnerTag
    
    ' Execute the method and obtain the return status.
    ' The OutParameters object in objOutParams
    ' is created by the provider.
    Set objOutParams = objWMIService.ExecMethod _
      ("HPBIOS_BIOSSettingInterface.InstanceName='ACPI\PNP0C14\0_0'", _
      "SetBIOSSetting", objInParam)
    
    ' List OutParams
    strResultMsg = strResultMsg & vbCrLf & "Result: " & _
      objOutParams.Return
    Wscript.Echo strResultMsg
Else
  'Instruct on the proper use of the script
  Wscript.Echo "Target Hostname and/or Ownership Tag missing!" _
    & vbCrLf & "Usage: SetAssetTag <hostname> <asset tag>"
End If

 So, how do I get this to work on a Z420 running Server 2012 R2 when there is a password set, and NOT work on my laptop when an incorrect password is entered? What have I missed?

EDIT:

I should note that on some models the Ownership Tag is named "Enter Ownership Tag" while on other models it is simply "Ownership Tag". I suspect there are other variations, and that is why I search for "owner". I am aware that I can use the WQL LIKE operator (eg, SELECT * FROM HPBIOS_BIOSString WHERE name LIKE '%owner%') to find the tag but I was lazy and busy and not thinking...I'll likely edit it later.

____________________________________________________

Just to help some others out who may find this thread later:

To enable Remote WMI in Windows firewall, you can use this command from a DOS prompt

netsh advfirewall firewall set rule group="Windows Management Instrumentation (WMI)" new enable=yes

If you have admin rights on a remote PC, you can use WINRS to run the command on the remote PC (this is a snippet of VB code)

"winrs -r:" & strComputer & " netsh advfirewall firewall set rule group=" & chr(34) & "Windows Management Instrumentation (WMI)" & chr(34) & " new enable=yes"

For security reasosn you may want to disable Remote WMI when you are done working with the remote machine, so make sure to run that command again but with "enable=no".

Some very helpful tools for working with the HPBIOS WMI stuff are:

WMI Explorer 2.0 (https://wmie.codeplex.com/)

WMI Code Creator (https://www.microsoft.com/en-us/download/details.aspx?id=8572)

HP Client Management InterfaceTechnical White Paper (http://h20331.www2.hp.com/Hpsub/downloads/cmi_whitepaper.pdf)

And if you want a nice easy GUI editor for playing with code that is easily transferable to VBScript, I personally like Excel VBA. Just make sure to add a reference to the Microsoft WMI Scripting Library (https://technet.microsoft.com/en-us/library/ee156554.aspx).

[Tim_Myth]

Ok, so I solved problem number 2. It turns out that the Z420 will not accept passwords encoded as keyboard scancodes. Instead they accept passwords encoded as UTF-16.

So, if your setup password is abc123, the scancode is "<kbd/>1E302E020304". the utf-16 version of that is...wait for it...."<utf-16/>abc123" tada!!

So since I have a mess of models, I'll need to modify my code to either ask the user to re-enter the password so it can be encoded as a scancode, or I can write a function that will convert the utf password that was entered to scancodes. I have not figured out how to pass a string to the hpPwdCtrl object and have it return a value. The documentation on the hpPwdCtl.PasswordEdit object is sketchy or nonexistant, but here's what I've figured out so far:

1. Using early binding

Dim oPwdCtl As New hpPwdCtl.PasswordEdit

strPassword = oPwdCtl.GetPassword("Enter the Setup Password:") 'keyboard scancode encoded password

strUTFPassword = oPwdCtl.GetPasswordAsUnicode(varLocale, "Enter the Setup Password:")

I have no clue what varLocale does, but you must use an empty variable there. (varLocale was just my name for it...call your variable whatever you want, but make sure its empty.)

2. Using late binding

Set oPwdCtl = CreateObject("hpPwdCtl.PasswordEdit")

oPwdCtl.GetPassword "Enter the Setup Password:", strPassword

oPwdCtl.GetPasswordAsUnicode varLocale, "Enter the Setup Password:", strUTFPassword

Again you must have the empty variable for the unicode method.

There is a method named GetPasswordAsScanCode but I can't get it to work with either early or late binding. I always get "The Remote Procedure Call Failed".