bios passwords - housekeeping

[beeswax]

being a quiet week with no one in but myself, I've been round the school resetting the bios password on all the machine and I found 5 unprotected by passwords. It may be worth your while to check your own school's machines.

[Halfmad]

Highly unlikely there is such a thing jwood.

 

I've set all of the bios passwords on any computers I've been at since starting work here 2 years ago, still find the odd one that hasn't got one though!

[AnnDroyd]

I doubt it too.

 

Personally I think any kid caught trying to get into a BIOS should get challenged as to what the hell they think they're trying to achieve.

 

There's too much emphasis on locking things down and not enough roastings for scruffy Asbo's who try to break stuff in the first place!

[SYNACK]

Depends what brand of pcs you have, hp has client manager which does this and bios upgrades etc remotely http://h20331.www2.hp.com/Hpsub/downloads/client_manager.pdf

 

http://h20331.www2.hp.com/hpsub/cache/284194-0-0-225-121.html?jumpid=ex_R2845_vanityim/goeasydeploy/ka011106

[Geoff]

You can use CMOSPwd in a startup script to do this for any bios it supports.

 

http://www.cgsecurity.org/wiki/CmosPwd

 

You need to install the 'ioperm' service

 

ioperm -i

 

You need create a dump file for each type of bios you have.

 

cmospwd /d cmos_ami_dump.txt

 

 

Then you need to group machines per CMOS type. Once this is done you simply load the right dump file into each machine at startup. Group based security filtering is your friend here.

 

cmospwd /l cmos_ami_dump.txt

 

It's critical you keep on top of bios updates though. If you have disparate bios versions and attempt to load a dump file from another version bad things will happen, up to and including bricking your motherboard.

[enjay]

I doubt it too.

 

Personally I think any kid caught trying to get into a BIOS should get challenged as to what the hell they think they're trying to achieve.

 

There's too much emphasis on locking things down and not enough roastings for scruffy Asbo's who try to break stuff in the first place!

Why make it an either/or thing? Set the passwords so that they can't actually change anything, and then roast them for trying.

[Geoff]

So you don't know about the backdoor passwords then?

[gwendes]

None of those worked on my PCs...

[enjay]

None of those worked on my PCs...

Nor mine, which could be because RM flash the BIOS to include their logo.

[mattx]

So you don't know about the backdoor passwords then?

 

Heh, some of those have saved me from having to open up cases in my time.......

[gwendes]

Just tested on our iDesk computers - standard BIOSes and they wouldn't work... Don't tend to have any problems with kids trying to get into the BIOS anyway (smug)

[KarlGoddard]

None of those worked on my PCs...

 

and mine......

 

the problem with those kind of lists is that they're about 10 years old but get passed around in 'have you seen this....' kind of emails.

 

I'd bet that unless you have an old PC with an out of date BIOS that all of those are defunct.