How to determine the state of the motherboard intrusion switch?

Question

Many motherboards have an integrated chassis intrusion switch function to detect if the case has been opened. There is a related BIOS setting to enable/disable it.

I would like to view, in Windows, the current/previous states of the intrusion switch, to see if there has been an intrusion since I last checked.

I triggered a breach, which was detected (presumably by BIOS) on startup, but couldn't see any results in the following:

I have had a look at ChassisBootupState mentioned in https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-computersystem , but it's always Safe(3).
Also, WMI Win32_SystemEnclosure-->SecurityBreach is unset, and -->SecurityStatus is None(3)
dmidecode displays that there's an intruder connector, but I don't see its state; I just see that it exists. I found out about dmidecode from Chassis Intrusion API?

I can't find any info online; does anyone know how to find these events?

Regards, JB

score 1 · Accepted Answer · answered Aug 12 '20 at 00:53

1

For Dell systems you can use the CCTK command line interface

download it here

Chassis Intrusion Status usage instructions are located here. You can also use this to enable chassis intrusion detection.

If you don't want to use the command line utilities, most of the CCTK functionality is available in the WMI namespace ROOT\dcim\sysman after you install the Dell Command Monitor framework

answered Aug 12 '20 at 00:53

Paul G

1,039
5
14

Thanks very much for this working solution, and the three links. Just a note: this works for machines with WMI-ACPI BIOS only. – James Brown Aug 13 '20 at 11:05

How to determine the state of the motherboard intrusion switch?

1 Answers1