Firmware password management

1. A system, comprising:

a computing device comprising a processor and a memory; and

machine-readable instructions stored in the memory which, when executed by the processor, cause the computing device to at least:

enroll a client device as a managed device among a plurality of managed devices that are managed by a management service;

obtain a request to update a basic input output service (BIOS) password on the client device;

generate a new BIOS password for the client device;

obtain an applied password corresponding to the client device, the applied password stored in a device record associated with the client device, the device record being stored in a data store associated with the management service;

generate a command to perform a password reset, the command comprising the new BIOS password and the applied password;

transmit the command to the client device, wherein a management agent on the client device performs the password reset within the BIOS of the client device; and

store the new BIOS password in the device record as a submitted password corresponding to the client device.

2. The system of claim 1 , wherein the machine-readable instructions, when executed by the processor, further cause the computing device to at least:

obtain a password reset confirmation from the management agent executed by the client device, the management agent configured to execute management commands provided by a management service managing the client device.

3. The system of claim 2 , wherein the machine-readable instructions, when executed by the processor, further cause the computing device to at least:

store the new BIOS password as a submitted password in the device record; and

overwrite the applied password corresponding to the client device in the device record in response to receiving the password reset confirmation from the client device.

4. The system of claim 1 , wherein the request comprises a request to update the BIOS password on a plurality of the managed devices and the new BIOS password comprises one of a plurality of randomly generated new BIOS passwords generated for the plurality of managed devices.

5. The system of claim 1 , wherein the machine-readable instructions, when executed by the processor, further cause the computing device to at least:

obtain an indication that at least one BIOS setting on the client device has changed; and

automatically generate the request to update the BIOS password in response to obtaining the indication.

6. The system of claim 5 , wherein the indication is obtained in response to a trusted platform module (TPM) chip on the client device indicating that a value indicating a state of the BIOS has changed.

7. The system of claim 1 , wherein the command is generated in response to the BIOS being updated to a different version.

8. A non-transitory computer-readable medium embodying executable instructions which, when executed by a computing device, cause the computing device to at least:

enroll a client device as a managed device among a plurality of managed devices that are managed by a management service;

obtain a request to update a basic input output service (BIOS) password on the client device;

generate a new BIOS password for the client device;

obtain an applied password corresponding to the client device, the applied password stored in a device record associated with the client device, the device record being stored in a data store associated with the management service;

generate a command to perform a password reset, the command comprising the new BIOS password and the applied password;

transmit the command to the client device, wherein a management agent on the client device performs the password reset within the BIOS of the client device; and

store the new BIOS password in the device record as a submitted password corresponding to the client device.

9. The non-transitory computer-readable medium of claim 8 , further comprising executable instructions which, when executed by the computing device, further cause the computing device to at least:

obtain a password reset confirmation from the management agent executed by the client device, the management agent configured to execute management commands provided by a management service managing the client device.

10. The non-transitory computer-readable medium of claim 9 , further comprising executable instructions which, when executed by the computing device, further cause the computing device to at least:

store the new BIOS password as a submitted password in the device record; and

overwrite the applied password corresponding to the client device in the device record in response to receiving the password reset confirmation from the client device.

11. The non-transitory computer-readable medium of claim 8 , wherein the request comprises a request to update the BIOS password on a plurality of the managed devices and the new BIOS password comprises one of a plurality of randomly generated new BIOS passwords generated for the plurality of managed devices.

12. The non-transitory computer-readable medium of claim 8 , further comprising executable instructions which, when executed by the computing device, further cause the at least one computing device to at least:

obtain an indication that at least one BIOS setting on the client device has changed; and

automatically generate the request to update the BIOS password in response to obtaining the indication.

13. The non-transitory computer-readable medium of claim 12 , wherein the indication is obtained in response to a trusted platform module (TPM) chip on the client device indicating that a value indicating a state of the BIOS has changed.

14. The non-transitory computer-readable medium of claim 8 , wherein the command is generated in response to the BIOS being updated to a different version.

15. A method, comprising:

enrolling a client device as a managed device among a plurality of managed devices that are managed by a management service;

obtaining a request to update a basic input output service (BIOS) password on the client device;

generating a new BIOS password for the client device;

obtaining an applied password corresponding to the client device, the applied password stored in a device record associated with the client device, the device record being stored in a data store associated with the management service;

generating a command to perform a password reset, the command comprising the new BIOS password and the applied password;

transmitting the command to the client device, wherein a management agent on the client device performs the password reset within the BIOS of the client device; and

storing the new BIOS password in the device record as a submitted password corresponding to the client device.

16. The method of claim 15 , further comprising obtaining a password reset confirmation from the management agent executed by the client device, the management agent configured to execute management commands provided by a management service managing the client device.

17. The method of claim 16 , further comprising:

storing the new BIOS password as a submitted password in the device record; and

overwriting the applied password corresponding to the client device in the device record in response to receiving the password reset confirmation from the client device.

18. The method of claim 15 , wherein the request comprises a request to update the BIOS password on a plurality of the managed devices and the new BIOS password comprises one of a plurality of randomly generated new BIOS passwords generated for the plurality of managed devices.

19. The method of claim 15 , further comprising:

obtaining an indication that at least one BIOS setting on the client device has changed; and

automatically generating the request to update the BIOS password in response to obtaining the indication.

20. The method of claim 19 , wherein the indication is obtained in response to a trusted platform module (TPM) chip on the client device indicating that a value indicating a state of the BIOS has changed.