BIOS and Driver Updates
Overview
As new hardware components are released, BIOS patches are necessary to ensure that the system can fully support them. This is particularly important for newer CPUs, RAM, and storage devices, where BIOS updates may be required for optimal performance or new features. Some BIOS updates optimize the system's performance by refining hardware initialization, improving power management, or enabling better control over system resources.
Drivers are a critical part of a computer system. As operating systems and software evolve, outdated drivers may no longer be compatible with newer software or operating system versions. Patching drivers ensures continued compatibility, enhancing system functionality and stability. Driver patches introduce new features, optimizations, or better integration with modern hardware, such as supporting newer graphics technologies or offering new functionality for devices.
Update your system BIOS and drivers regularly. Using Vulnerability Manager Plus, you can deploy driver updates through an Automate Patch Deployment task or manually. BIOS updates can also use a Windows APD task when its BIOS Updates option is available. For supported password-protected BIOS packages, add and map the required credentials before deployment.
Prerequisites
The patch module can appear as Patch Mgmt or Threats & Patches. Open Patch Database Settings from that module's settings. In interfaces that group patch settings under Admin, use Admin → Patch Settings. Select the required Driver and BIOS categories under Windows, then save.
If you want the BIOS updates and Driver Updates to be managed by Vulnerability Manager Plus, go to Threats & Patches → Settings → Patch Database Settings.
Under Select the patches that you wish to manage, ensure that Driver and BIOS are selected under Windows, and then click on Save.
Supported BIOS and Drivers
Refer to this page for the list of supported devices for Driver and BIOS updates.
If the model is supported but its BIOS update is not detected as missing, follow the BIOS/Firmware visibility checks.
Edition support
Why are BIOS and driver patches missing in the Professional edition?
BIOS and driver updates are available in the Enterprise edition. They are not deployed from the Professional edition.
If a vendor or model is not listed, download the applicable BIOS or driver package from the hardware vendor and test it on a representative endpoint. Deploy the tested package through Software Deployment. An unlisted package cannot be deployed through the BIOS and Driver Updates feature.
Patching of Password-Protected BIOS
Configuring password protection for the BIOS in the systems of the network is often the first step of defense in preventing unauthorized access to the system. In addition, this also forbids malicious/unauthorized users from making changes to the system's hardware and software configurations.
Password-protected BIOS updates require credentials before installation. Asking end users to enter these credentials can interrupt their work or prevent installation when they are unavailable.
For supported firmware packages, password-protected BIOS patching can use mapped credentials without end-user authentication. BIOS update support and unattended password authentication are separate capabilities. Follow the prerequisites for the applicable vendor package.
To support BIOS patching with password protection on Dell machines, it's essential to have the Dell PowerShell module installed on each endpoint.
- Navigate to Threats & Patches > Supported Patches and search for the Patch ID - 111808 and click Install/Publish Patches.
Store the configured BIOS passwords on the product server. Supported firmware workflows retrieve the mapped password for authentication. The Dell PowerShell module prerequisite applies to the Dell workflow; it is not a Lenovo prerequisite. If a supported Lenovo update still requests authentication after mapping, provide Support with the exact model, package, prompt and agent logs.
BIOS credentials are required only when the target BIOS is password-protected. These are BIOS passwords, not domain administrator credentials.
For password-protected BIOS, add and map the credentials before deploying the patches. Here are the steps:
Adding and mapping BIOS credentials
Credential Name identifies the saved entry; it is not a BIOS login username. The form stores the BIOS password and has no separate BIOS username field. If the vendor update requires additional authentication, confirm its requirements with Support before deployment. Provide the exact computer model, BIOS package and authentication prompt.
- On the product console, navigate to Admin > BIOS Credential Settings (under Patch Settings)
- Click on Add BIOS Credential
- Enter the Credential Name, Description (optional) and the Password.
- You can map the credentials to any of the following:
- All Computers: Maps the BIOS credentials to all of the computers in the network.
- Vendor(s): Maps the credentials to specific vendor(s) (Such as Dell and HP).
- Custom Group(s): Maps the credentials to one or more Custom Groups as required.
- Once done, click on Save to add and map the credentials to the required systems.
Deploying BIOS updates
After you map the credentials when required, deploy BIOS updates to the systems manually. If BIOS Updates is available in your Windows APD task, you can select it for applicable approved BIOS updates. Use a separate BIOS task when firmware updates need their own targets or deployment policy. See BIOS and Driver selection in APD.
A BIOS version installed on a golden machine is not captured as part of its operating system image. After imaging a device, deploy the BIOS update separately. If required, automate the post-imaging update with a vendor-supported command or script after validating it on representative hardware.
Resolve BIOS Update Failures
For a BIOS update that reports Exit Code 4 (Hard Dependency Error) in the Dell firmware log, follow that log's prerequisite instructions. If it requests a restart, restart the computer and retry the applicable update. If the same result continues, follow Dell's instructions for the exact model and package. Where supported, use the F12 One-Time Boot Menu method described in Dell BIOS update guidance, or contact Dell. The exit code alone does not identify which prerequisite failed.
If an update appears older than the installed driver, compare the exact device model, hardware identifier, driver provider and version with the vendor package. Follow the vendor-version comparison before forcing an installation.
For a failed or rolled-back driver update, record the full vendor result and the affected hardware model before retrying. Follow the hardware vendor’s guidance for that result and validate the applicable update on representative pilot computers before a wider rollout. See Test and Approve.
- Exit Code 2: Restart the endpoint once, then deploy the BIOS update again.
- Another BIOS update is in progress: Wait for the current update to finish, then redeploy the failed BIOS update as a separate task.
If the failure reports an invalid password, verify that the correct BIOS credential is mapped to the endpoint. For other vendor-specific exit codes, use the vendor's result details before retrying the deployment.
For an unexpected BIOS or patch restart notification, follow notification diagnostics. Capture the prompt and time before dismissing it; a missing BIOS patch in one report does not identify the notification source.
Review the BIOS-Mapping Status of the Systems
Adding a credential does not confirm that the endpoint has detected and reported its BIOS protection status. If the computer is missing from the view, follow BIOS status reporting checks. A missing row is different from a missing BIOS update.
If the view shows Unprotected despite a configured BIOS password and mapped credentials, follow the Unprotected status checks. Mapping a password does not change the endpoint's detected protection state.
You can review and monitor the BIOS-mapping status of all the systems in the network from a single dashboard. To know more about how to review the status of these systems on the console, refer to this page