LenovoBios.psm1

Class LenovoBiosSetting {
    [string]$Name
    [string]$Value

    LenovoBiosSetting([string]$Name, [string]$Value) {
        $this.Name = $Name
        $this.Value = $Value
    }
}

Enum LenovoBiosPasswordMode {
    Legacy = 0
    Unknown = 1
}

Enum LenovoBiosPasswordState
{
    UserPassword = 1
    AdminPassword = 2
    HardDiskPasswords = 4
}

Enum LenovoBiosPasswordEncoding
{
    Ascii = 1
    Scancode = 2
}

Class LenovoBiosPasswordSettings {
    [int]$MaxLength
    [int]$MinLength
    [LenovoBiosPasswordMode]$PasswordMode
    [bool]$UserPassword
    [bool]$AdminPassword
    [bool]$HardDiskPassword
    [bool]$SupportsAscii
    [bool]$SupportsScancode
    [int]$SupportedKeyboard

    LenovoBiosPasswordSettings([System.Management.ManagementObject]$wmiObject) {
        $this.MaxLength          = $wmiObject.MaxLength
        $this.MinLength          = $wmiObject.MinLength
        $this.PasswordMode       = $wmiObject.PasswordMode
        $this.UserPassword       = $wmiObject.PasswordState -band [LenovoBiosPasswordState]::UserPassword
        $this.AdminPassword      = $wmiObject.PasswordState -band [LenovoBiosPasswordState]::AdminPassword
        $this.HardDiskPassword   = $wmiObject.PasswordState -band [LenovoBiosPasswordState]::HardDiskPassword
        $this.SupportsAscii      = $wmiObject.SupportedEncodings -band [LenovoBiosPasswordEncoding]::Ascii
        $this.SupportsScancode   = $wmiObject.SupportedEncodings -band [LenovoBiosPasswordEncoding]::Scancode
        $this.SupportedKeyboard  = $wmiObject.SupportedKeyboard
    }
}

<#
 .Synopsis
  Check password syntax

 .Description
  Check password syntax

 .Parameter Password
  The password to check

 .Example
  Test-LenovoBiosPasswordSyntax
#>
Function Test-LenovoBiosPasswordSyntax {
    Param(
        [securestring]$Password
    )

    $settings = Get-LenovoBiosPasswordSettings
    
    if ($Password -eq $null) {
        return -not $settings.AdminPassword
    }

    $private:bstr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($Password)
    $private:passwordStr = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($private:bstr)

    return ($private:passwordStr.Length -ge $settings.MinLength `
       -and $private:passwordStr.Length -le $settings.MaxLength `
       -and -not $private:passwordStr.Contains(","))
}

<#
 .Synopsis
  Get Bios settings from a Lenovo computer

 .Description
  Get Bios settings from a Lenovo computer

 .Parameter Name
  The Name of the setting

 .Example
  Get-LenovoBiosSetting

 .Example
  Get-LenovoBiosSetting -Name BootOrder
#>
Function Get-LenovoBiosSetting {

    Param(
        [parameter(Mandatory=$false, ValueFromPipeline=$true)]
        [ValidateScript({-not $_.contains(",")})]
        [String[]]$Name
    )

    Begin {
        Write-Verbose "Parse all settings"

        $settings = @()

        Get-WmiObject -Class Lenovo_BiosSetting -Namespace root\wmi | Where-Object CurrentSetting -ne "" | ForEach-Object {
            $setting = $_.CurrentSetting -split ","

            $settings += [LenovoBiosSetting]::new($setting[0], $setting[1])
        }

        if ($Name -eq $null -or "*" -in $Name) {
            $Name = @("*")
        }
    }

    Process {
        Write-Verbose ("Searching setting: " + $Name)

        if ($Name -eq "*") {
            $settings
        } else {
            $settings | Where-Object {$_.Name.ToLowerInvariant() -eq $private:name.ToLowerInvariant()}
        }
    }
}

<#
 .Synopsis
  Get the availible options for a specific Bios Setting

 .Description
  Get the availible options for a specific Bios Setting

 .Parameter Name
  The Name of the setting

 .Example
  Get-LenovoBiosSettingSelections -Name BootOrder
#>
Function Get-LenovoBiosSettingSelections {
    Param(
        [parameter(Mandatory=$true, ValueFromPipeline=$true)]
        [ValidateScript({-not $_.contains(",")})]
        [String[]]$Name
    )

    Process {
        Write-Verbose ("Searching setting: " + $Name)

        $obj = Get-WmiObject -Class Lenovo_GetBiosSelections -Namespace root\wmi

        $selections = $obj.GetBiosSelections($Name).Selections.Split(",")
        $selections
    }
}

<#
 .Synopsis
  Set a Bios setting on a leneovo computer

 .Description
  Set a Bios setting on a leneovo computer

 .Parameter Name
  The Name of the setting

 .Parameter Setting
  A setting object

 .Parameter Value
  The value to set

 .Parameter Password
  If the Bios is protected, this parameter can be used to specify the password

 .Example
  $password = Read-Host "Bios Password" -AsSecureString
  Get-LenovoBiosSetting -Name PasswordBeep | Set-LenovoBiosSetting -Value Disable

 .Example
  Set-LenovoBiosSetting -Name PasswordBeep -Value Enable
#>
Function Set-LenovoBiosSetting {
    Param(
        [parameter(Mandatory=$true, ParameterSetName="NameValue")]
        [ValidateScript({-not $_.contains(",")})]
        [string]$Name,
        
        [parameter(Mandatory=$true, ParameterSetName="LenovoBiosSetting", ValueFromPipeline=$true)]
        [LenovoBiosSetting]$Setting,

        [ValidateScript({-not $_.contains(",")})]
        [string]$Value,

        [securestring]$Password
    )

    if (-not (Test-LenovoBiosPasswordSyntax -Password $Password)) {
        Write-Error "Password syntax incorect" -ErrorAction Stop
    }

    $setObj  = Get-WmiObject -Class Lenovo_SetBiosSetting –Namespace root\wmi
    $saveObj = Get-WmiObject -Class Lenovo_SaveBiosSettings -namespace root\wmi

    if ($Setting -ne $null) {
        $Name  = $Setting.Name

        if ($Value -eq $null) {
            $Value = $Setting.Value
        }
    }

    $private:settingStr = ($Name + "," + $Value)

    if ($Password -ne $null) {
        $private:bstr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($Password)
        $private:biosPassword = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($private:bstr)
    }

    if ($private:biosPassword -eq $null) {
        Write-Verbose "Set without password"
        $setReturn  = $setObj.SetBiosSetting($private:settingStr)
    } else {
        Write-Verbose "Set with password"
        $setReturn  = $setObj.SetBiosSetting(($private:settingStr + "," + $private:biosPassword + ",ascii,gr"))
    }

    if ($setReturn.return -eq "Success") {
        Write-Verbose ("Succesfully set {0} to {1}" -f $Name, $Value)
    } else {
        Write-Error -Message ("Faild to set {0}: {1}" -f $Name, $setReturn.return)
    }

    if ($private:biosPassword -eq $null) {
        Write-Verbose "Save without password"
        $saveReturn = $saveObj.SaveBiosSettings()
    } else {
        Write-Verbose "Save with password "
        $saveReturn = $saveObj.SaveBiosSettings(($private:biosPassword + ",ascii,gr"))
    }

    if ($saveReturn.return -eq "Success") {
        Write-Verbose ("Succesfully saved BIOS")
    } else {
        Write-Error -Message ("Faild to save Bios: {0}" -f $saveReturn.return)
    }

    Get-LenovoBiosSetting -Name $Name
}

<#
 .Synopsis
  Get current Bios password settings

 .Description
  Get current Bios password settings

 .Example
  Get-LenovoBiosPasswordSettings
#>
Function Get-LenovoBiosPasswordSettings {
    [LenovoBiosPasswordSettings]::new((Get-WmiObject -Class Lenovo_BiosPasswordSettings -Namespace root\wmi))
}

<#
 .Synopsis
  Change a Bios password

 .Description
  Change a Bios password like SuperUser oder Power-On password

 .Parameter Password
  The current Bios password

 .Parameter NewPassword
  The new Bios password

 .Parameter Type
  The password type to change

 .Example
  $password = Read-Host "Current Password" -AsSecureString
  $newPassword = Read-Host "New Password" -AsSecureString
  
  Set-LenovoBiosPassword -Password $password -NewPassword $newPassword -Type Power-on
#>
Function Set-LenovoBiosPassword {
    Param(
        [parameter(Mandatory=$true)]
        [securestring]$Password,
        [parameter(Mandatory=$true)]
        [securestring]$NewPassword,

        [ValidateSet(
            "Supervisor",
            "Power-on",
            "User HDP 1",
            "Master HDP 1",
            "User HDP 2",
            "Master HDP 2",
            "User HDP 3",
            "Master HDP 3"
        )]
        [string]$Type = "Supervisor"
    )

    if (-not (Test-LenovoBiosPasswordSyntax -Password $Password)) {
        Write-Error "Password syntax incorect" -ErrorAction Stop
    }

    if (-not (Test-LenovoBiosPasswordSyntax -Password $NewPassword)) {
        Write-Error "New password syntax incorect" -ErrorAction Stop
    }


    $private:t = "pap"

    switch ($Type) {
        "Supervisor"   { $private:t = "pap" }
        "Power-on"     { $private:t = "POP" }
        "User HDP 1"   { $private:t = "uhdp1" }
        "Master HDP 1" { $private:t = "mhdp1" }
        "User HDP 2"   { $private:t = "uhdp2" }
        "Master HDP 2" { $private:t = "mhdp2" }
        "User HDP 3"   { $private:t = "uhdp3" }
        "Master HDP 3" { $private:t = "uhdp3" }
    }

    $private:obj = Get-WmiObject -Class Lenovo_SetBiosPassword –Namespace root\wmi

    $private:bstr        = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($Password)
    $private:passwordStr = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($private:bstr)

    $private:newBstr        = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($NewPassword)
    $private:newPasswordStr = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($private:newBstr)

    $private:value = @($private:t, $private:passwordStr, $private:newPasswordStr, "ascii", "gr") -join ","

    $private:result = $private:obj.SetBiosPassword($private:value)

    if ($private:result.Return -ne "Success") {
        Write-Error ("Error setting password: {0}" -f $private:result.Return)
    } else {
        Write-Verbose "Successful changed password"
    }
}

<#
 .Synopsis
  Export current Bios Settings

 .Description
  Export current Bios settings

 .Parameter Path
  Path to Export File

 .Example
  Export-LenovoBiosSettings -Path .\bios
#>
Function Export-LenovoBiosSettings {
    Param(
        [parameter(Mandatory=$true)]
        [string]$Path
    )

    Get-LenovoBiosSetting | Export-Csv -Path $path -NoClobber -Delimiter ";" -NoTypeInformation
}

<#
 .Synopsis
  Import new Bios Settings

 .Description
  Import new Bios settings

 .Parameter Path
  Path to Export File

 .Parameter Password
  Current Bios password

 .Example
  Import-LenovoBiosSettings -Path .\bios
#>
Function Import-LenovoBiosSettings {
    Param(
        [parameter(Mandatory=$true)]
        [ValidateScript({Test-Path -Path $_})]
        [string]$Path,

        [securestring]$Password
    )

    if (-not (Test-LenovoBiosPasswordSyntax -Password $Password)) {
        Write-Error "Password syntax incorect" -ErrorAction Stop
    }

    $settings = Import-Csv -Path $path -Delimiter ";" -Header "Name","Value"

    foreach ($setting in $settings) {
        if ($setting.Name -eq "Name") {
            continue;
        }

        Write-Verbose ("Setting {0} to {1}" -f $setting.Name, $setting.Value)
        
        try {
            Set-LenovoBiosSetting -Name $setting.Name -Value $setting.Value -Password $Password -ErrorAction Stop
        } catch {
            Write-Error $_.Exception.Message
            break
        }
    }
}

Export-ModuleMember -Function Get-LenovoBiosPasswordSettings, `
                              Get-LenovoBiosSetting, `
                              Get-LenovoBiosSettingSelections, `
                              Set-LenovoBiosSetting, `
                              Set-LenovoBiosPassword, `
                              Test-LenovoBiosPasswordSyntax, `
                              Import-LenovoBiosSettings, `
                              Export-LenovoBiosSettings

Question:
Is the script able to initially enable and set a BIOS Password in case it wasn't set?