{"id":2208,"date":"2018-01-20T00:22:17","date_gmt":"2018-01-20T00:22:17","guid":{"rendered":"http:\/\/leinss.com\/blog\/?p=2208"},"modified":"2018-01-20T00:28:44","modified_gmt":"2018-01-20T00:28:44","slug":"update-bios-using-powershell-and-sccm","status":"publish","type":"post","link":"https:\/\/leinss.com\/blog\/?p=2208","title":{"rendered":"Update BIOS Using PowerShell and SCCM"},"content":{"rendered":"<p><a href=\"https:\/\/github.com\/adamleinss\/PowerShellBIOSUpdate\">https:\/\/github.com\/adamleinss\/PowerShellBIOSUpdate<\/a><\/p>\n<p>This is a quick and dirty script for PSADT (<a href=\"http:\/\/psappdeploytoolkit.com\/\">http:\/\/psappdeploytoolkit.com\/<\/a>) to deploy BIOS updates relating to Intel&#8217;s Meltdown\/Spectre vulnerability.<\/p>\n<p>PSADT is designed to be used in SCCM deployments, however, it is agnostic enough that it should be able to be used with any software management solution such as PDQ Deploy.<\/p>\n<p>Main drivers in this script:<\/p>\n<ul>\n<li>Get-WmiObject Win32_ComputerSystem<\/li>\n<li>Get-WmiObject Win32_BIOS<\/li>\n<\/ul>\n<p>Using a Lenovo M900 as an example:<\/p>\n<pre><code>PS C:\\_PUBLIC_REPO&gt; Get-WmiObject Win32_ComputerSystem\r\n\r\n\r\nDomain              : XXXXXXXXX\r\nManufacturer        : LENOVO\r\nModel               : 10FM0026US\r\nName                : XXXXXXXXX\r\nPrimaryOwnerName    : ACME\r\nTotalPhysicalMemory : 8478724096\r\n\r\nPS C:\\_PUBLIC_REPO&gt; Get-WmiObject Win32_BIOS\r\n\r\n\r\nSMBIOSBIOSVersion : FWKT86A  \r\nManufacturer      : LENOVO\r\nName              : FWKT86A  \r\nSerialNumber      : XXXXXXX\r\nVersion           : LENOVO - 1860\r\n<\/code><\/pre>\n<p>Stepping through the code:<\/p>\n<pre><code>$FirmwareUpdateRan = 'FALSE'\r\n<\/code><\/pre>\n<p>Set initial status of <em>$FirmwareUpdateRan<\/em> to FALSE<\/p>\n<pre><code>$ComputerModel = (Get-WmiObject Win32_ComputerSystem).Model\r\n<\/code><\/pre>\n<p>Set\u00a0<em>$ComputerModel<\/em>\u00a0to 10FM0026US as given for the M900 example above.<\/p>\n<pre><code>$BIOSVersion = (Get-WmiObject Win32_BIOS).Name\r\n<\/code><\/pre>\n<p>Set\u00a0<em>$BIOSVersion<\/em>\u00a0to FWKT86A as given for the M900 example above.<\/p>\n<pre><code>if (($ComputerModel -eq '10FM0026US') -and ($FirmwareUpdateRan -eq 'FALSE') -and ($BIOSVersion -lt 'FWKT86A'))\r\n<\/code><\/pre>\n<p>Once we run one at least one block of firmware update code,\u00a0<em>$FirmwareUpdateRan<\/em>\u00a0will be set to TRUE. Setting this flag will prevent the restart prompt later on if we didn&#8217;t run any update code.\u00a0<em>$BIOSVersion<\/em>\u00a0should compared against the version of the BIOS you want to update to. Easiest way of getting this is just running\u00a0<strong>Get-WmiObject Win32_BIOS<\/strong>\u00a0on the test computer after you run the current BIOS update.<\/p>\n<pre><code>{ $Response = Show-InstallationPrompt -Message 'Executing BIOS update...please close all apps' -ButtonRightText \r\n'Cancel' -ButtonLeftText 'Continue' -Timeout 600\r\nif ($Response -eq 'Cancel') { exit 12345 }\r\n<\/code><\/pre>\n<p>Show a prompt to end user. The majority of the BIOS updates will force a reboot right away without any warning, thus we display a message to the end user and allow them to cancel it.<\/p>\n<pre><code>New-Item -Path HKLM:SOFTWARE -Name ACMEDesktop -Force\r\nSet-ItemProperty -Path HKLM:SOFTWARE\\ACMEDesktop -Name MeltdownFirmwareFix -Value \"Yes\" -Type String\r\n<\/code><\/pre>\n<p>This is useful for satisfying the detection rule for SCCM. There&#8217;s no clean way of determining whether there is a failure of the BIOS update, other than running a compliancy report in your software\/hardware inventory reporting tool to make sure the update happened.<\/p>\n<pre><code>set-location $dirfiles\\M900\r\n<\/code><\/pre>\n<p>Lenovo&#8217;s flash utility doesn&#8217;t accept absolute paths: we have to run it from the current directory, so we use set-location to force the location folder.<\/p>\n<pre><code>start-process flash.cmd -ArgumentList '\/quiet' -Wait -PassThru\r\n<\/code><\/pre>\n<p>Run the BIOS update<\/p>\n<pre><code>Show-InstallationRestartPrompt -Countdownseconds 600 -CountdownNoHideSeconds 60\r\n<\/code><\/pre>\n<p>This is only shown if the BIOS update didn&#8217;t force a reboot. Currently, I only found the T460S and Yoga S1 laptops do not force a reboot. Since reboot isn&#8217;t forced, we force one with a 10 minute countdown.<\/p>\n<pre><code>Suspend-BitLocker -MountPoint C: -RebootCount 1 -Confirm:$false\r\n<\/code><\/pre>\n<p>Suspends BitLocker for one reboot, otherwise laptop will go into recovery mode. Note this command is supported for Windows 8 and later only. For Windows 7 you will need to use manage-bde:\u00a0<em>Manage-bde.exe \u2013protectors \u2013disable c:<\/em>. I didn&#8217;t see any -rc option, so you will need to do something such as a scheduled task to turn it back on.<\/p>\n<ul>\n<li>Soli Deo Gloria<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>https:\/\/github.com\/adamleinss\/PowerShellBIOSUpdate This is a quick and dirty script for PSADT (http:\/\/psappdeploytoolkit.com\/) to deploy BIOS updates relating to Intel&#8217;s Meltdown\/Spectre vulnerability. PSADT is designed to be used in SCCM deployments, however, it is agnostic enough that it should be able to be used with any software management solution such as PDQ Deploy. Main drivers in this &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/leinss.com\/blog\/?p=2208\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;Update BIOS Using PowerShell and SCCM&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[11,12],"tags":[],"class_list":["post-2208","post","type-post","status-publish","format-standard","hentry","category-powershell","category-sccm"],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p7wiG8-zC","jetpack-related-posts":[],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/leinss.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/2208","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/leinss.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/leinss.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/leinss.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/leinss.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2208"}],"version-history":[{"count":4,"href":"https:\/\/leinss.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/2208\/revisions"}],"predecessor-version":[{"id":2212,"href":"https:\/\/leinss.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/2208\/revisions\/2212"}],"wp:attachment":[{"href":"https:\/\/leinss.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2208"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/leinss.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2208"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/leinss.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2208"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}