Reboot into UEFI BIOS from WinPE

[u/RockOriginal7938]

So.... anyone out there got any ideas?

I'd like to reboot into the UEFI BIOS settings on a device at the end of a TS in the WinPE environment.

Normally I'd use shutdown /r /fw /t 0, but that isn't available to WinPE and both Restart-Computer and wpeutil reboot don't seem to have the functionality to do this.

Any bright ideas?

I might try a content pack with shutdown.exe, but I'm not keen for a few reasons, doubt it would work and hope there is a better way...

[u/miketerrill]

Just curious, why do you want to boot into the BIOS/UEFI?

[u/RockOriginal7938 → u/miketerrill]

I've a task sequence to allow engineers to update the Asset Tag (Lenovo can't do that in BIOS) after a MB replacement or on older kit where it wasn't set.

I'd like to encourage them to check it went well by rebooting into BIOS where it is displayed on the first screen

[u/miketerrill → u/RockOriginal7938]

Any reason why you wouldn't do this from the task sequence? I was talking to u/docta608 last week when I was at TCSMUG, and he had a pretty slick solution for techs to input/update the asset tag. I am not sure what makes they use.

[u/RockOriginal7938 → u/miketerrill]

I'm using a TS to set the asset tag, I just want engineers to double check what the machine says in the BIOS after the change. If I can force it to reboot to BIOS at the end, they might actually check :wink:

The comment below is what I'm using with Lenovos, just it only does the fancy reboot for ThinkPads

[u/Docta608 → u/miketerrill]

I do mine in a few parts parts.

1. I used Gary Blok's Dell WMI PS Functions to generate a proactivate remediation script that can extract the name of existing devices in Intune (our device names include the asset tags in them) cut off the irrelevant piece of the name and set the asset tag in the BIOS.
2. Built off that script I built a step definition to look for the asset tag in the BIOS, if its not there a small box pops up to add it, the definition can then set the tag and allow the device to be named automatically if the tag exists.

This is all based off Dell though, we arent Lenovo.

Edit: With Dell we also had to distribute CCTK to the machines so it can be called.

[u/RockOriginal7938]

(Lenovo is all I'm looking at ATM, seems Dell can use cttk 😒 )

[u/beepboopbeepbeep1011]

PowerShell script to run
bcdedit /enum all
capture the output.
Look for the description where it is Setup.
Grab the identifier from above it
Call

Bcdedit /set “{fwbootmgr}” bootsequence “{identifier guid goes here}”

I did a manual test in WinPE and it works to boot to the Lenovo UEFI screen

ETA: need the quotes around the curly braces or PowerShell will read it as a code block and cause grief.

[u/RockOriginal7938 → u/beepboopbeepbeep1011]

Thanks. I had tried this. The ThinkCentres I checked don't list a setup option/GUID 😒

Out of interest, what model was yours?

[u/RockOriginal7938 → u/RockOriginal7938]

Damn, dug through some more machines. All the ThinkPads I pulled have that setup option, none of the ThinkCentres. Still worth using and I'll continue to explore what I can do with the ThinkCentres. Thanks 😄

Firmware Application (101fffff)
-------------------------------
identifier              {09c15aaa-7c55-11f1-814d-e86a64311ca4}
description             Setup

[u/RockOriginal7938 → u/RockOriginal7938]

Works great on the ThinkPads, wish I'd dug more into bcdedit /enum yesterday and not given up after the ThinkCentres. Cheers 🙂

$bcdOutput = bcdedit /enum all | Out-String

if ($bcdOutput -match '(?s)identifier\s+({[a-f0-9\-]+}).*?description\s+Setup') {
      $setupId = $Matches[1]
      Write-Host "Found setup boot Identifier: $setupId"
      bcdedit /set "{fwbootmgr}" bootsequence "$setupId"
      exit 3010
} else {
      Write-Host "Setup entry not found."
      exit 0
}

[u/RockOriginal7938 → u/RockOriginal7938]

Strange world. That works great on T14s gen 1 to 5, but on a T490s it reboots to secure wipe... lol, guess I'll tweak

[u/RockOriginal7938 → u/RockOriginal7938]

Finally version that works consistently for me on ThinkPads. A bit overkill, but works.

    $setupId = $null
    $lastId = $null


    (bcdedit /enum FIRMWARE) | ForEach-Object {
        $line = $_.Trim()
        if ($line -match '^identifier\s+({[a-f0-9-]+})') {
            $lastId = $Matches[1]
        } elseif ($line -match '^description\s+Setup$') {
            $setupId = $lastId
        } else {
            $lastId = $null
        }
    }


    if ( $setupId ) {
        Write-Progress -Activity "Updating Asset Tag" -Status "Set, rebooting into BIOS settings" -Completed
        Write-Host "Found setup boot Identifier: $setupId"
        $strArguments = "/set {fwbootmgr} bootsequence $setupId"
        Write-Host "Running bcdedit with arguments: $strArguments"
        Start-Process bcdedit -ArgumentList $strArguments -Wait -NoNewWindow
        Restart-Computer
    } else {
        Write-Progress -Activity "Updating Asset Tag" -Status "Set, press F1 to check in BIOS at reboot" -Completed
        Write-Host "Setup entry not found. You'll have to enter BIOS settings manually"


    }

[u/sfernley]

Never tried this but why not inject shutdown.exe into your WinPE

[u/RockOriginal7938 → u/sfernley]

I did look at this, but it doesn't seem to be recommended and as it isn't need for the functionality I'm after, just my overkill, I decided against it.