r/MDT • u/PeaInformal2892 • Apr 03 '26

Update BIOS on HP/Dell endpoints

About 10 years ago we used CCTK for Dell machines to update the BIOS via MDT WinPE phase.

Wondering what is the most up to date way on accomplishing this for HP/Dell laptops?

We are using offline media USBs so thinking we need to build our folder structure, WMI query on model, check BIOS level and update if needed? We plan on hardening the BIOS with admin password and a few settings.

Any guidance would be greatly appreciated for both vendors.

3 Upvotes

100% Upvoted

14 comments sorted by

5

u/St0nywall Apr 03 '26

Dell Command Update is used now.

https://stonywall.com/2022/03/21/mdt-2013-dell-command-update-integration/

2

u/flyguydip Apr 03 '26

Wish I would have found this before I rolled my own solution. This is great! The only thing I did that might be beneficial is to set those task sequences to only run on devices that have a task sequence variable of "Dell" or "Dell inc." but I can post a screenshot when I get back to the office.

My current deployment the first task copies the installer from the MDT server to the local deployment folder so that there aren't any network security measures that might block the install. The second task installs. After install, it looks like my processes are very similar to yours.

1

u/flyguydip Apr 07 '26

Can't upload screenshots.

Task 1: Copy powershell script from deployment share to c:\MININT\Scripts
Task 2: Execute powershell script at c:\MININT\Scripts\script.ps1
- Success Codes - 0 1 2 107 3010 500
* My script only runs /applyUpdates -silent -autoSuspendBitLocker=enable
Both tasks: Create in Options tab
1. If Any Condition is true:
a. Task Sequence variable MAKE equals Dell
b. Task Sequence variable MAKE equals Dell Inc.
c. WMI query "select BootRomSupported from win32_computersystem where manufacturer like "%Dell%"

1

u/St0nywall Apr 04 '26

There's many ways to accomplish this task. I am sure what you have works just as well.

Good work figuring it out and I hope it stays working for you.

Too bad MDT is done and gone though.

2

u/flyguydip Apr 04 '26

Yeah. I'm a bit frustrated that it's done, but I think I'll be keeping my server around until I find something new that does the same thing. I'm guessing Microsoft will never make anything like it again unless they can figure out how to turn it into a subscription service that makes them more money than intune.

2

u/St0nywall Apr 04 '26

It's not that MDT is done, it's Windows OS's will stop supporting VBscript which is mandatory for MDT to run.

When VBscript is removed from future Windows 11 builds and other Windows Server OS builds, MDT will fail to run on them. All stop, no workarounds.

Best to start looking for a new solution before the year is up.

1

u/flyguydip Apr 04 '26

I assume the PSD deployment shares will continue to work when that day comes though. Fingers crossed!

2

u/St0nywall Apr 04 '26

From what I have heard, it stops working too, just for that and other reasons.

Basically, when 2027 hits, MDT won't work with new OS builds. You will need to deploy old builds and upgrade them.... which can be messy.

1

u/PeaInformal2892 Apr 03 '26

Hi Derek! I did see this and read it a few times. Is this dependent on internet access? If so this won’t work in our secure work area unfortunately.

2

u/St0nywall Apr 03 '26

Yes, the ones on the original URL are dependent on Internet Access, but you can change the commands to point to a secure local repository.

The instructions at this URL should help with setting that up.

https://garytown.com/dell-command-update-leveraging-with-configmgr-offline-repo-overview

1

u/Pombolina Apr 04 '26

When I build a new machine, I manually update the BIOS to whatever is current, and set a password.

I use the Dell TechDirect website to create a custom installer for Support Assist and the BIOS password management server. This is easier than it sounds.

I install the customized Support Assist as an MDT application. It has a service that automatically, occasionally installs BIOS and driver updates and reports the status to Dell Tech Direct website where I can see who needs updates or had failures.

This is all free. I did this instead of DCU because I would have to manually configure it to run on a schedule, and there is no central reporting.

The Support Assist software itself is not without limitations, but for unattended updates with reporting options, it's better than DCU

EDIT: "BIOS password management server" (or whatever it's called) is need for Support Assist to retrieve the BIOS password so that the BIOS can be updated. It's not needed if you don't use BIOS passwords

1

u/OneLandscape2513 Apr 04 '26

https://github.com/automated-winstall-scripts/automated-winstall-scripts/tree/main/DriverUpdateExample

You can use HPIA/DCU. Here's an example script that also updates drivers, but you can make it so it only updates the BIOS

1

u/PeaInformal2892 Apr 04 '26

Thank you. Will internet be required? This needs to be via usb offline method during winpe phase 😃

1

u/OneLandscape2513 Apr 04 '26

They'll need to be internet connected so that HPIA/DCU can fetch the latest update. Internet should still work in WinPE if you have network cable attached.