Intune compliance with Lenovo dynamic BIOS configuration

Intune compliance with Lenovo dynamic BIOS configuration

Introduction

Using compliance policies in Intune is a great idea for many reasons. Main reason is to be able to set certain security standards before granting your users’ access to company resources.

Letting your users deal with setup configurations in BIOS might be to much of a task to be asking, so this blog post will show how we can regulate device BIOS configurations with a dynamic configuration stored in the cloud.

clip_image002

 

Requirements

  • Microsoft Endpoint Manager
  • Lenovo device
  • GitHub

 

Setup BIOS script and configuration

We need to know the configuration available for the system.

Start an elevated PowerShell Prompt

(Get-WmiObject -Class Lenovo_BiosSetting -Namespace rootwmi).CurrentSetting | Where-Object {$_ -ne ""} | Sort-Object

clip_image004

 

Here we see the parameter we need to use for configuring SecureBoot. Copy that.

clip_image006

 

Go to GitHub (if you don’t have one already start creating one, or use another storage type that can host your csv.)

Add file

Create new files

clip_image008

 

Give it a name

clip_image010

 

Add these values to it (you can add as many you like, to configure on your device)

clip_image012

 

Setting,Value;

SecureBoot,Enable;

   

Commit changes

clip_image014

 

Click on the CSV file

clip_image016

 

Click RAW

clip_image018

 

Copy the URL

clip_image020

 

Download this script

Paste your link into the script

clip_image022

Save it locally.

 

Go to Endpoint Manager https://endpoint.microsoft.com/

clip_image024

 

Go to Endpoint analytics

clip_image026

 

Proactive remediations

clip_image028

 

Create script package

clip_image030

 

Give it a name

clip_image032

 

Insert detection script and Remediation script.

Detection script can be downloaded here

Remediation script is the one you where you added the URL.

clip_image034

 

Click next

clip_image036

 

Select groups to include

Choose a test group with few clients and work your way toward full production.

My flow will run every day.

clip_image038

Create

 

Now sit back and relax enjoy a cup of coffee and see your remediation data stream into Endpoint Manager.

clip_image040

 

On the client a local log is placed for the Intune diagnostics collector to collect if you need to debug

clip_image042

 

Next time compliance check happens

clip_image044

 

Summary

Compliance settings is great once you found out how to use them correctly. They can be somewhat difficult, as some use cases are difficult to cover.

Hope this post helped you to see the benefit of configuring your setup as dynamic as possible for you to easily add new changes without to much effort.

Happy testing!

Table of Contents

Share this post
Search blog posts
Authors
Modern Workplace consultant and a Microsoft MVP in Enterprise Mobility.
Modern Workplace consultant and a Microsoft MVP in Windows and Devices for IT.

Infrastructure architect with focus on Windows Client management & security.

Cloud & security specialist with focus on Microsoft backend products and cloud technologies.

Infrastructure architect with focus on design, implementation, migration and consolidation.

Infrastructure consultant with focus on cloud solutions in Office365 and Azure.

follow us in feedly
Categories

Follow on SoMe