UEFI Capsule BIOS Update Whitepaper on WU_4.2

ManualsBrandsHP ManualsDesktopsHP EliteDesk 800 G4 Small Form Factor PC

HP Commercial Systems

Automatic BIOS Update

Through Windows Update Whitepaper

Version 0.4.2 7/7/2020

Introduction

The purpose of this paper is to detail changes to HP’s process for releasing system firmware to Microsoft

Windows Update. This paper will provide details on the upcoming change, the benefits of this new

policy, as well as methods an IT Administrator can take to block these updates if desired.

HP Platforms Covered in This Document

Product Names

Note Book

Desktop

2020

2019

HP ProBook 430 G7 Notebook PC

HP EliteDesk 800 G5 TWR

HP ProBook 440 G7 Notebook PC

HP EliteDesk 800 G5 SFF

HP ProBook 450 G7 Notebook PC

HP EliteOne 800 G5 AIO

HP ZHAN 66 Pro 14 G3 Notebook PC

HP EliteDesk 800 G5 DM

HP EliteDesk 705 G5 SFF

2019

HP EliteDesk 705 G5 SFF

HP ZBook 17 G6 Mobile Workstation

HP EliteDesk 705 G5 DM

HP ZBook 15 G6 Mobile Workstation

HP ProDesk 600 G5 MT

HP EliteBook x360 1040 G6 Notebook PC

HP ProDesk 600 G5 PCI MT

HP Elite Dragonfly Notebook PC

HP ProDesk 600 G5 SFF

HP EliteBook x360 1030 G4 Notebook PC

HP ProDesk 600 G5 DM

HP Elite x2 G4

HP ProOne 600 G5 AiO

HP EliteBook 850 G6 Notebook PC

HP ProOne 400 G5 AiO

HP EliteBook 840 G6 Notebook PC

HP ProOne 440 G5 AiO

HP Zbook Studio 15u G6 Mobile Workstation

HP ProDesk 400 G6 SFF

HP Zbook Studio 14u G6 Mobile Workstation

HP ProDesk 400 G6 MT

HP EliteBook 840 G6 Healthcare Edition Notebook

HP ProDesk 480 G6 MT

HP EliteBook 830 G6 Notebook PC

HP ProDesk 400 G5 DM

HP EliteBook x360 830 G5 Notebook PC

HP ProDesk 405 G4 DM

HP EliteBook x360 830 G6 Notebook PC

HP ProDesk 680 G4 Microtower PC

Summary of content (9 pages)

PAGE 1
HP Commercial Systems Automatic BIOS Update Through Windows Update Whitepaper Version 0.4.2 7/7/2020 Introduction The purpose of this paper is to detail changes to HP’s process for releasing system firmware to Microsoft Windows Update. This paper will provide details on the upcoming change, the benefits of this new policy, as well as methods an IT Administrator can take to block these updates if desired.
PAGE 2
HP ZHAN X 13 G2 Notebook PC HP ProBook 745 G6 Notebook PC HP ProBook 735 G6 Notebook PC HP ProBook 650 G5 Notebook PC HP ProBook 640 G5 Notebook PC HP ProBook 445R G6 Notebook PC HP ProBook 455R G6 Notebook PC HP ProBook 445R G6 Notebook PC HP ProBook 455R G6 Notebook PC HP ProBook 430 G6 Notebook PC HP ProBook 440 G6 Notebook PC HP ProBook 450 G6 Notebook PC HP Zhan 66 Pro 13 G2 Notebook PC HP Zhan 66 Pro 14 G2 Notebook PC HP Zhan 66 Pro 15 G2 Notebook PC HP ProBook x360 11 G3 Education Edition HP ProBook
PAGE 3
HP ProBook 640 G4 Notebook PC HP ProBook 650 G4 Notebook PC HP ProBook 650 G4 Notebook PC HP ProBook 430 G5 Notebook PC HP ProBook 440 G5 Notebook PC HP ProBook 450 G5 Notebook PC HP ProBook 470 G5 Notebook PC HP ZHAN 66 Pro G1 HP ZHAN 66 Pro G1 HP ProBook 455 G5 HP ProBook x360 440 G1 Notebook PC HP mt21 Mobile Thin Client HP mt31 Mobile Thin Client HP Engage Go Mobile System HP ProBook x360 11 G3 Education Edition Why is HP Releasing BIOS Updates as Automatic via Windows Update? Modern devices depend on
PAGE 4
Manual Updates via Windows Update • • HP currently submits all WU as optional to Microsoft in every BIOS release Microsoft will not push the manual/optional BIOS capsule package; to install, a customer needs to search for the System Firmware update from device manager -> System Firmware on the client system What is changing? HP will begin submitting updates to Windows Update via Automatic Updates when the following criteria are met.
PAGE 5
the HP BIOS to a specific version, the BIOS setting “Lock BIOS Version” should be set to “Enable” via either the F10 BIOS interface or some other method. BitLocker Recovery Key If using any Bitlocker policies other than the Windows 10 defaults and BIOS updates via Windows Update are desired, it is recommended that customers consult with Microsoft on the likelihood of these updates triggering a Bitlocker Recovery key request.
PAGE 6
Prompt for Admin Authentication on Capsule Update The settings titled “Prompt for Admin authentication on Capsule Update” controls the password requirement for use with BIOS updates via UEFI Capsule. The default value is “Disable,” which does not require a password for this flash mechanism. How to Manage BIOS Settings Related to UEFI Capsule Update F10 BIOS Interface The F10 Bios interface is accessed by pressing the F10 key at system start up.
PAGE 7
HP Client Management Script Library The HP Client Management Script Library is a set of PowerShell modules designed to make managing HP clients significantly easier for IT administrators. These modules can be installed from the PowerShell Gallery via install-module HPCMSL or via this download location. One of the modules deals with getting and settings BIOS settings. Documentation on this module can be found here.
PAGE 8
BIOS Configuration Utility HP’s BIOS Configuration Utility (BCU) is a tool designed to deploy the BIOS settings found in a file to an HP System. BCU can be found here. Screenshot of Sample BCU file shown below To deploy this file, after downloading and extracting BCU, open a command prompt and run BIOSconfigutility64.exe /set:BCU.
PAGE 9
• What if user Lock specific BIOS version (block BIOS update from any method) vs Native OS firmware update service (block firmware update from WU)? If your environment requires you to qualify each BIOS release before broad roll out, you are recommended to set “Native OS firmware update service” to “Disable” so that automatic update via WU will not occur.