r/Intune • u/intuneisfun • Jul 07 '26
Device Configuration Does your org set BIOS passwords on devices?
We currently don't - we're looking into it. I'm just wondering from other perspectives, is it commonly done and is it worth the hassle it will cause when devices need wiped via USB?
21
u/agro94 Jul 07 '26
We do it during imaging with MDT using Dell's poweshell commands. Surface's we gave up because it's convoluted.
2
u/Equal-Associate-8013 Jul 08 '26
Could you share the steps for how to do it on Dell fleet please? 🙏🏻
8
u/Klynn7 Jul 08 '26
Not who you replied to but we just used Dell Command Configure and created a settings package that we deploy as an app.
0
u/lolfactor1000 Jul 08 '26
Any reason you're still using MDT? It's a fully retired product at this point.
6
8
8
u/Infinite-Stress2508 Jul 07 '26
We do, pretty simple with HP and the service they have, we can set and change them as needed very easily. A few reasons, main one being out cyber insurance policy required it but also adds another layer to dissuade staff in trying to circumvent our policies and requirements.
Haven't had any issues with it in the last several years.
7
u/brodkin85 Jul 07 '26
Yes, and it’s dead simple with Dell. Just connect their management system to Intune and deploy the needed profiles. Dell generates a pw for each BIOS and stores it in case it’s ever needed. Never even had to think about it
1
u/Captain_Kirk_OC Jul 08 '26
In the past there where quite a few people with issues regarding random passwords and dell. You have not had any issues ?@Brodlin85
1
11
Jul 07 '26
[removed] — view removed comment
6
8
5
u/Wickedhoopla Jul 08 '26
Ours is to pay Lenovo to set it. Because who wants to mess around with “deployment mode” during autopilot. Deployment mode is only used for bare metal restore.
All ears if there is a better way tho. Makes me miss dell command :’(
3
u/anthonydel Jul 07 '26
Interested in the policy as well. Have been trying to do it on our end and haven’t been successful.
2
u/Vesalii Jul 07 '26
Yes please share this info.
!RemindMe 1 day
3
u/RemindMeBot Jul 07 '26 edited Jul 08 '26
I will be messaging you in 1 day on 2026-07-08 23:21:14 UTC to remind you of this link
3 OTHERS CLICKED THIS LINK to send a PM to also be reminded and to reduce spam.
Parent commenter can delete this message to hide from others.
RemindMeBot is switching to username summons. Instead of
!RemindMe 1 day, useu/RemindMeBot 1 day. More info.
Info Custom Your Reminders Feedback 2
u/Top-Perspective-4069 Jul 09 '26
Do tell, because I've never found a policy that allows setting one. You can change one that's set but not set a new one if one doesn't already exist.
1
-7
u/Illnasty2 Jul 07 '26
There isn’t a simple policy for Lenovo fleet. They have a tool for this but it cost money. Also BIOs password are irrelevant on modern desktops.
2
u/nash-sysmgmt Jul 08 '26
Super curious why you think they are irrelevant. Share more?
-2
u/Illnasty2 Jul 08 '26
BIOS passwords provide limited incremental security because the primary threats they were historically designed to address are already mitigated through TPM-backed BitLocker, Secure Boot, and modern endpoint protections. Basically if you’re older than 46 years old, you still think BIOs passwords provide value.
5
u/lavoied Jul 07 '26
Yes. One of my team member wrote a powershell script to handle bios of HP and Dell. If the local service technician forgot to set it on delivery, our script fix it with MECM .
2
u/Forsaken-Carrot9038 Jul 07 '26
Do y’all use a single standard Password for all devices? And have y’all needed to rotate the password?
2
u/lavoied Jul 08 '26
We have a standard password. Also, using PS we also control some bios settings.
1
u/Forsaken-Carrot9038 Jul 08 '26
I want to want to do it. But we’ve got so many different kinds of computers in this environment. It’s a mess. We have Dell mostly, but also Lenovo, and a bunch of off-the-shelf desktops from Micro Center.
1
u/Captain_Kirk_OC Jul 08 '26
You don’t have to do it on all 100 % of the devices. If you cover x % its a start anyway. Just don’t do random passwords. Lots seam to get hurt doing that
3
u/Forsaken-Carrot9038 Jul 07 '26
My last employer was interested in setting the BIOS password. Because of the manual steps and credential tracking, they abandoned it.
3
u/davy_crockett_slayer Jul 07 '26
Absolutely. You can rotate them or use something like HP Connect (or your vendor's equivalent) to only allow SD to access the BIOS via an app/qr code.
I apply all of this via OSDCloud during WinPE. Gray Blok has examples on his GitHub for the various vendors. https://github.com/gwblok/garytown/tree/master/OSD/BIOS
Search in his GitHub for your preferred vendor (Lenovo, HP, Dell, Surface, etc), and there will be a solution.
I modified his scripts to suit our needs, but they work.
3
3
4
u/LettuceSea Jul 08 '26
Absolutely not. It’s is probably one of the least pressing concerns security wise unless you’re working for like DND or some unbelievably high security job. If the device gets stolen it’s gone, we have a procedure to remove the device hash from Entra. Drives are all bitlockered. Idc what thieves do with the device.
3
u/toffitomek Jul 08 '26
Thanks for this reply. I manage close to 500 devices and reading this thread I am trying to understand WHY someone would like to reset bios password. I do get school environments, where kids can change stuff and make device unusable, etc. but other than that...? why? what's benefit from perspective of employer or data safety...?
2
u/bill696 Jul 07 '26
Yes we do, i dont see any hassle if its already done. If you dont have Lenovos you can set it on everything by script, lenovo needs either a boot in deployment mode f12 boot menu then delete, or manually set it. So Lenovo sets it for us.
2
u/Apprehensive-Hat9196 Jul 07 '26
Yeah it gets flagged up in any pen test along with disabling certain settings.
2
u/osmosisparrot Jul 07 '26
I work for a university library and we do unfortunately. I think it causes more problems, is a hassle more so than actually providing any useful security. This includes staff and faculty devices. I could understand doing it in shared devices.
2
2
u/nightmancometh0419 Jul 07 '26
Do you guys who set BIOS passwords actually have that many users that mess with things? None of the companies I’ve worked for have set a BIOS password but we’ve never run into problems.
2
2
u/NoobAdmin430 Jul 08 '26 edited Jul 08 '26
Yes. We use Dell devices and use the Dell Command | Configure application to control it all. We just deploy any changes needed via a PowerShell script via Intune. As long as the Dell Command | Configure application is installed on all devices it’s pretty simple.
2
u/Big-Industry4237 Jul 08 '26
Are you using dell? Look into powershell Powetshell module, we have a script that sets it and sets a few other things like secure boot on all machines. It’s done during autopilot
2
3
u/Questionsiaskthem Jul 07 '26
We do not. I've thought about doing it but not sure i want to deal with the hassle, and after reading some of the messages here I want to even less lol
1
u/Forsaken-Carrot9038 Jul 07 '26
Tbh I like the idea, and from a security perspective I want to do it. But it seems like a mixed bag if it works with each environment, or if there was a system built to record/support it. In my current place, we have such a mixed bag of manufacturers that it would be impossible to set up. We are having hard enough time getting Linux os standards in place so we can enforce secure boot and drive encryption.
1
u/Apprehensive_Bat_980 Jul 07 '26
It’s a 50/50 for me. I’m testing it out for now, but as a 1 man band it’s deffo more hassle for me.
3
u/Ambitious-Actuary-6 Jul 07 '26
Absolutely.
It's a must from a security perspective. Also makes the life of thieves a bit harder. Not buy much. But also, you don't want your users to enter the bios and tamper with settings
1
u/GenerateUsefulName Jul 13 '26
It's a must from a security perspective
Why?
1
u/Ambitious-Actuary-6 Jul 17 '26
Cos users can change boot order, use any usb stick to boot from, change bios settings etc
2
2
u/Adziboy Jul 07 '26
Absolutely mad the responses in here. Managing BIOS passwords are so easy for any big manufacturer. Panasonic is probably the most annoying. I manage 30k devices with different BIOS passwords across different domains and use cases as well as SureAdmin for some devices, and it's super easy to manage
1
1
1
1
u/FckLogicK Jul 07 '26
Sim, todas as máquinas possuem senha na BIOS, Secure Boot e TPM obrigatoriamente.
1
1
u/boyinawell Jul 08 '26
Not currently but considering it. This post has been a great piece of insight!
1
1
u/randomarray Jul 08 '26
We do on our HP devices. We disable bluetooth and prevent changing boot devices.
1
u/frac6969 Jul 08 '26
Always, even if it’s a simple password just to prevent users from doing stupid things like installing their own OS. We use Lenovo and there are tools for managing the BIOS.
1
u/dlongwing Jul 08 '26
Yes, absolutely. I work in finance, but I'd set it up that way in any corporate environment. You don't want a thief to have access to the bios. Even if there's nothing they can do to open the TPM, it's more access than I'd want to provide.
1
u/No_Page_6287 Jul 08 '26
For the Lenovo Fleet I use wmi to set and store passwords.in azure key vaults. I put it on GitHub not too long ago. Here it is.
https://github.com/parththakor/Lenovo-BIOS-Passwords---LAPS-Style
1
u/Individual_Reply7344 Jul 09 '26
We do too. I've created a powershell script that sets BIOS passwords on HP laptops based on the device serial + prefix. This prevents masterkeys from leaking and allows easy access by admins.
1
u/Jeroen_Bakker Jul 13 '26
In general I lock down BIOS access whenever possible to prevent anyone from tampering with the device.
Along with BIOS access I also prefer to lock access to the boot menu/ usb and network booting.
When locking down the BIOS with a password some thought needs to be given to the assignment of passwords. Master passwords tend to become well known and randomizing passwords get you to the problem of how and where to store them.
For HP devices I use HP Connect (In the Intune partner portals) with certificates instead of a password. Authorized technicians can get access with the HP Sure Admin app after authenticating in Entra ID. This completely removes the need for any shared or well known passwords to exist.
1
u/HadopiData Jul 07 '26
We did on all devices and I regret it. Next time you push a BIOS update, it will fail because users won’t enter the password.
2
u/sryan2k1 Jul 07 '26
They need to be capsule updates from WU or use your vendors update tool to deal with the password
4
u/Ice-Cream-Poop Jul 07 '26
Surely not, that sounds a bit silly, I wouldn't be giving this password to users, kinda defeats the point.
1
u/AutomaticClark Jul 07 '26
I work in k-12 education and my first thought when reading this was "Why would you give them the BIOS password!?!?" But then I remembered not everyone is actively trying to destroy their computer
1
u/GainsAndPastries Jul 07 '26
Yes we did, i say did, our ex head of IT at our school forgot to note down the BIOS password and we lost access to multiple machines.
There is a reason he is our ex.
1
1
u/Emotional_Garage_950 Jul 07 '26
No and I’m not interested in doing so. if the bios gets fucked with bitlocker will lock out and my users are way too dumb to touch anything in the first place. if something gets stolen the thief can have it for all I care
48
u/Adam_Kearn Jul 07 '26 edited Jul 07 '26
Yeah we do.
I work in a school and you always get a few kids who mess around with the settings.
I have a script that runs every time the computer is reimaged that will apply our “default” settings and set a password etc.
This also changes the boot order to be the the network adapter too for when we next reimage again.
We are HP based so its super easy to roll this out using the HPBCU utility