As we plan for our migration from Windows 7 to Windows 10 as an organization we know that we want to take advantage of Credential Guard and Device Guard in our new OS. ConfigMgr, we also know that this requires us to make a few configuration changes to our workstation “BIOS” configuration - namely converting from BIOS to UEFI, enabling SecureBoot, and enabling the virtualization technologies. Our organization has about 2300 workstations, and at least 1800 of them are physical devices spread over 50 sites including international offices - this is definitely not something that we want to handle manually.

Luckily - our gracious manufacturers have kept with the times and have offered us options to manage these settings from a command line! This is great, but since switching from BIOS to UEFI and enabling SecureBoot effectively screws up booting into the existing OS (UEFI doesn’t like non-GPT partitioned disks, etc) automating this process is going to require us to do it during the refresh task sequence. This is also not an issue - and there are a couple ways to accomplish it.

Since we are nearly exclusively a Lenovo shop, we wrote a script to handle the conversion. To save you some time - I’m sharing that script with you because:

FIRST: A quick disclaimer. This script does modify your BIOS. Use at your own discretion. Test, test, test. I’m still in the process of testing and refining this script (and I will maintain a change log here as well). If you test this script on a model of ThinkCentre that is not listed in the requirements, and it works, please let me know what BIOS revision you are running and what model machine it is so that I can update my requirements log (you will receive credit for the find as well).

Change Log:

Requirements:

http://ccmexec.com/2016/07/switch-from-bios-to-uefi-seamless-using-configuration-manager-ts-in-6-simple-steps/ - Jörgen Nilsson

http://www.adaptiva.com/blog/2016/adaptiva-speeds-secure-windows-10-migrations-free-microsoft-system-center-configuration-manager-community-solution/ - Adaptiva

Once we complete our testing internally, I’ll be writing up our full process including where we placed in the task sequence and the other supporting steps that we used.

Thanks for reading, and happy admining!