BIOSConfigUtility64.exe - unable to change BIOS password

[SandyWood]

I'm working on configuring our companies workstations and mobile devices AMT settings. We want to disable AMT in light of the security vulnerabilities they afford. 

Some of our workstations have BIOS passwords that we are unable to change. To test, we created a new password with HPQPswd64.exe. We ran the BIOS Configuration Utility on a test machine that has a BIOS password and we're getting this message

.\BiosConfigUtility64.exe /Set:"Z440-Workstation-AMT-Disable.txt" /nspwdfile:"biospassword.bin"
<BIOSCONFIG Version="" Computername="COMPUTERNAME" Date="2018/05/08" Time="11:13:22" UTC="-7">
<ERROR msg="Unable to process command. Password is set, but no password file is provided" />
<ERROR msg="BCU return value" real="10" translated="10" />
</BIOSCONFIG>

Anyone had this issue before?

[REO51ST]

@SandyWood

Have you tried pushing the CMOS clear button???

http://h20574.www2.hp.com/results.htm?SID=6978828&MEID=376FB9C7-5E57-430C-8EDC-7FA05B847173

Zoom-in lower right hand corner.

REO

[SandyWood]

Haven't resorted to that yet. I've got about 15 different HP models to deal with, over 900 systems to configure. I'm hoping I don't have to resort to that to configure things.

[DGroves]

Seems a bug in the 64bit ConfigUtility tool or the AMT  try the workarounds below

set a password for AMT, ( i suspect this is the cause of the error 10 in your case)

or

try specifying the full path to the TPMEnable.REPSET file

or,

create the password bin file with the 32-bit password application and not the 64-bit,

but use the 64-bit utility to assign the password and config txt file during the task sequence.

[SandyWood]

Thanks for the tips! I'll try them out.

[DGroves]

this ms blog post may also prove helpfull:

https://blogs.technet.microsoft.com/jimriekse/2017/06/16/changing-hp-biosuefi-settings-with-biosconf...

[SandyWood]

I think my issue is that my test machine has a BIOS password set on it. My fault, Duh.

Most of our systems don't have a password so I'll work on testing with them next, should be good.

I've also opted to install MIK in our SCCM world which appears to be able to do much of this automagically. I am running into issues with creating policies there but that's for another post!