UEFI Capsule BIOS Update Whitepaper on WU_4.2

ManualsBrandsHP ManualsDesktopsHP ProBook 440 G5 Notebook PC

HP Commercial Systems

Automatic BIOS Update

Through Windows Update Whitepaper

Version 0.4.8 - 05/03/2021

Update - The process for releasing firmware or BIOS updates through Microsoft WU has been delayed.

During the course of pre-flight testing on multiple platforms, HP identified an issue with updates through

WU on test systems. HP Development teams are working with Microsoft to identify and deploy a resolution.

A new launch date will be sent to HP TC‘s and Sales community (by updating the HP Whitepaper and

Customer Advisory) when the resolution has been found.

***

Introduction

The purpose of this paper is to detail changes to HP’s process for releasing system firmware to Microsoft

Windows Update (‘WU’). This paper will provide details on the upcoming change, the benefits of this new

policy, as well as methods an IT Administrator can take to block these updates if desired.

HP Platforms Covered in This Document

The platform list within this document (below) indicates HP’s initial list of PCs eligible to update firmware

through Microsoft Windows Update. New platforms released after the creation-date of this paper will be

made eligible for firmware updates via Microsoft Windows Update.

Product Names

Notebook

Desktop

2021

HP ProBook 430 G8 Notebook PC

HP ProBook 440 G8 Notebook PC

HP ProBook 450 G8 Notebook PC

HP EliteBook 830 G8 Notebook PC

HP EliteBook 840 G8 Notebook PC

HP EliteBook 850 G8 Notebook PC

HP EliteBook x360 830 G8 Notebook PC

HP ZBook Firefly 14 in G8 Mobile Workstation

2020

Summary of content (11 pages)

PAGE 1
HP Commercial Systems Automatic BIOS Update Through Windows Update Whitepaper Version 0.4.8 - 05/03/2021 Update - The process for releasing firmware or BIOS updates through Microsoft WU has been delayed. During the course of pre-flight testing on multiple platforms, HP identified an issue with updates through WU on test systems. HP Development teams are working with Microsoft to identify and deploy a resolution.
PAGE 2
HP ZHAN 66 Pro 14 G3 Notebook PC HP ZBook Power G7 Mobile Workstation HP Zbook 17 G7 Mobile Workstation HP Zbook 17 G7 Mobile Workstation HP Zbook Studio G7 Mobile Workstation HP EliteBook x360 1040 G7 Notebook PC HP EliteBook x360 1030 G7 Notebook PC HP EliteBook 830 G7 Notebook PC HP EliteBook 840 G7 Notebook PC HP EliteBook 850 G7 Notebook PC HP ZBook Firefly 15 G7 Mobile Workstation HP ZBook Firefly 14 G7 Mobile Workstation HP EliteBook x360 830 G7 Notebook PC HP EliteBook 855 G7 Notebook PC HP EliteBoo
PAGE 3
HP EliteBook 830 G6 Notebook PC HP EliteBook x360 830 G5 Notebook PC HP EliteBook x360 830 G6 Notebook PC HP ZHAN X 13 G2 Notebook PC HP ProBook 745 G6 Notebook PC HP ProBook 735 G6 Notebook PC HP ProBook 650 G5 Notebook PC HP ProBook 640 G5 Notebook PC HP ProBook 445R G6 Notebook PC HP ProBook 455R G6 Notebook PC HP ProBook 445R G6 Notebook PC HP ProBook 455R G6 Notebook PC HP ProBook 430 G6 Notebook PC HP ProBook 440 G6 Notebook PC HP ProBook 450 G6 Notebook PC HP Zhan 66 Pro 13 G2 Notebook PC HP Zhan 66
PAGE 4
Why is HP Releasing BIOS Updates as Automatic via Windows Update? Modern devices depend on up-to-date firmware for performance and security. Updating a system BIOS can be challenging, particularly as remote work is proliferating and leveraging Windows Update for BIOS updates simplifies the process. The additional advantage of servicing BIOS via Windows Update is security vulnerabilities which require a BIOS update can be remediated in a quick, efficient, and automatic manner.
PAGE 5
Automatic Updates via Windows Update Criteria • Microsoft will push the BIOS capsule package to client systems and perform the update without any user interaction. The customer doesn’t need to do anything additional to apply the update. Which OS Versions are targeted? • HP targets Windows Update with Windows 10, Version v1809(RS5) and later OS versions.
PAGE 6
Blocking Windows Update BIOS Updates with BIOS Settings Native OS Firmware Update Service The setting titled “Native OS Firmware Update Service” is the primary mechanism to enable or disable the UEFI Capsule BIOS update on an HP client. The default value for this setting is “Enable.” When enabled the HP BIOS will accept updates from UEFI Capsule via Windows Update. To block the update from Windows Update set this setting to “Disable.
PAGE 7
Prompt for Admin Authentication on Capsule Update The settings titled “Prompt for Admin authentication on Capsule Update” controls the password requirement for use with BIOS updates via UEFI Capsule. The default value is “Disable,” which does not require a password for this flash mechanism. When WU pushes an automatic update to the system and it reboots to perform the update, a prompt asking for admin authentication will be displayed.
PAGE 8
How to Manage BIOS Settings Related to UEFI Capsule Update In all of the options below for modifying BIOS settings, if a BIOS password or Sure Admin is deployed to the client, authentication will be required to make these changes. F10 BIOS Interface The F10 Bios interface is accessed by pressing the F10 key at system start up.
PAGE 9
Examples: Set-HPBIOSSettingValue -Name "Native OS Firmware Update Service" -Value "Enable" Set-HPBIOSSettingValue -Name "Prompt for Admin authentication on Capsule Update" -Value "Disable" BIOS Configuration Utility HP’s BIOS Configuration Utility (BCU) is a tool designed to deploy the BIOS settings found in a file to an HP System. BCU can be found here. Screenshot of Sample BCU file shown below To deploy this file, after downloading and extracting BCU, open a command prompt and run BIOSconfigutility64.
PAGE 10
FAQ • What happens if my system is not plugged into AC when WU starts updating the BIOS? o Before the update starts, if AC-power is not plugged in and the remaining battery is below 50%, a message (prompting to charge the battery or connect to AC-power) will be displayed for up to 30 seconds. If an AC source is still not plugged in, the update will fail.
PAGE 11
via WU will not occur. If you need to lock the HP BIOS to a specific version, the BIOS setting “Lock BIOS Version” should be set to “Enable” (see How to Manage BIOS Settings Related to UEFI Capsule Update for methods to do this). With some early version of BIOS, when “Lock BIOS Version” is enabled, Update via WU will still be attempted and fail. In that case, a yellow bang on system firmware device in device manager is expected.