Firmware password management
Firmware passwords, such as BIOS passwords can be managed by a remotely executed management service. A password reset command can be generated and transmitted to a client device. A management agent can execute the command and provide confirmation to a management service that the password has been updated.
1. A client device, comprising:
a processor and a memory; and
machine-readable instructions stored in the memory which, when executed by the processor, cause the client device to at least:
initiate enrollment of the client device as a managed device among a plurality of managed devices that are managed by a management service;
obtain a request to update a basic input output system (BIOS) password on the client device, wherein the request comprises a new BIOS password for the client device, wherein the request further comprises a command to perform a password reset; and
cause a management agent on the client device to perform the password reset within the BIOS of the client device, wherein the new BIOS password is stored in a device record as a submitted password by a management service.
2. The client device of claim 1 , wherein the machine-readable instructions, when executed by the processor, further cause the client device to at least:
transmit a password reset confirmation from the management agent executed by the client device to the management service.
3. The client device of claim 2 , wherein the machine-readable instructions, when executed by the processor, further cause the client device to at least:
store the new BIOS password as a current BIOS password in the client device.
4. The client device of claim 1 , wherein the request comprises a randomly generated new BIOS password generated from among a plurality of randomly generated new BIOS passwords for a plurality of managed devices managed by the management service.
5. The client device of claim 1 , wherein the machine-readable instructions, when executed by the processor, further cause the client device to at least:
generate an indication that at least one BIOS setting on the client device has changed; and
automatically cause the management service to generate the request to update the BIOS password in response to obtaining the indication.
6. The client device of claim 5 , wherein the indication is obtained in response to a trusted platform module (TPM) chip on the client device indicating that a value indicating a state of the BIOS has changed.
7. The client device of claim 1 , wherein the command is generated in response to the BIOS being updated to a different version.
8. A non-transitory computer-readable medium embodying executable instructions which, when executed by a client device, cause the client device to at least:
initiate enrollment of the client device as a managed device among a plurality of managed devices that are managed by a management service;
obtain a request to update a basic input output system (BIOS) password on the client device, wherein the request comprises a new BIOS password for the client device, wherein the request further comprises a command to perform a password reset; and
cause a management agent on the client device to perform the password reset within the BIOS of the client device, wherein the new BIOS password is stored in a device record as a submitted password by a management service.
9. The non-transitory computer-readable medium of claim 8 , further comprising executable instructions which, when executed by the client device, further cause the client device to at least:
transmit a password reset confirmation from the management agent executed by the client device to the management service.
10. The non-transitory computer-readable medium of claim 9 , further comprising executable instructions which, when executed by the client device, further cause the client device to at least:
store the new BIOS password as a current BIOS password in the client device.
11. The non-transitory computer-readable medium of claim 8 , wherein the request comprises a randomly generated new BIOS password generated from among a plurality of randomly generated new BIOS passwords for a plurality of managed devices managed by the management service.
12. The non-transitory computer-readable medium of claim 8 , further comprising executable instructions which, when executed by the client device, further cause the client device to at least:
generate an indication that at least one BIOS setting on the client device has changed; and
automatically cause the management service to generate the request to update the BIOS password in response to obtaining the indication.
13. The non-transitory computer-readable medium of claim 12 , wherein the indication is obtained in response to a trusted platform module (TPM) chip on the client device indicating that a value indicating a state of the BIOS has changed.
14. The non-transitory computer-readable medium of claim 8 , wherein the command is generated in response to the BIOS being updated to a different version.
15. A method, comprising:
initiating enrollment of a client device as a managed device among a plurality of managed devices that are managed by a management service;
obtaining a request to update a basic input output system (BIOS) password on the client device, wherein the request comprises a new BIOS password for the client device, wherein the request further comprises a command to perform a password reset; and
causing a management agent on the client device to perform the password reset within the BIOS of the client device, wherein the new BIOS password is stored in a device record as a submitted password by a management service.
16. The method of claim 15 , further comprising transmitting a password reset confirmation from the management agent executed by the client device to the management service.
17. The method of claim 16 , further comprising storing the new BIOS password as a current BIOS password in the client device.
18. The method of claim 15 , wherein the request comprises a randomly generated new BIOS password generated from among a plurality of randomly generated new BIOS passwords for a plurality of managed devices managed by the management service.
19. The method of claim 15 , further comprising:
generating an indication that at least one BIOS setting on the client device has changed; and
automatically causing the management service to generate the request to update the BIOS password in response to obtaining the indication.
20. The method of claim 15 , wherein the command is generated in response to the BIOS being updated to a different version.