Modern BIOS Management

Modern BIOS Management is a complete dynamic solution for maintaining and deploying BIOS updates in ConfigMgr. What this solution does, is to automate the download of BIOS updates from public system manufacturer web sites, creating packages in ConfigMgr, content distribution, dynamic BIOS package selection during operating system deployment and finally installation of the BIOS update contained in the automatically detected package. All this with only a few clicks in the Driver Automation Tool (which can be set to run on a schedule), the ConfigMgr WebService and two simple steps in your task sequence.

Below are the required components that you would need in your environment in order to leverage this automated solution for BIOS update management.

Driver Automation Tool


The Driver Automation Tool is a PowerShell GUI which automates the process of downloading, extracting, importing and distributing driver and BIOS packages. At present support is provided for Dell, Lenovo, HP and Microsoft client systems.

Version 5.1.5
Changes: Updates to the code that deals with BIOS downloads. Updates to the HP BIOS download parsing code due to XML formatting changes

Version 5.1.4
Changes: Lenovo Update - Important: Package name will no longer include the SKU value in the package name.
Processing updates and minor tweaks.

Version 5.1.3
Changes: Updated to use new GetCWVersion method for 1.5.0 and later of the ConfigMgr web service

Version 5.1.2
Changes : Changed existing package method detection for standard and driver packages
Fixes: Typo Corrected

Version 5.1.1
New Features:
Added MDM/MBM diagnostics tab for testing connectivity to the ConfigMgr WebService

Version 5.1.0
Fixes : Fixed issue with scheduled task button not running function

  • Queries XML content from Dell, Lenovo, HP and Microsoft
  • Provides Driver downloads for all five manufacturers
  • Provides BIOS downloads for Dell, Lenovo or HP systems
  • Create a BIOS update package
  • Download driver package file for each model
  • Extract the drivers contained within
  • Import the extracted drivers
  • Create a category based on the machine model
  • Create a Driver Package based on the machine make, model and version of the extracted drivers
  • Import the associated drivers into the newly created driver package.  Options allow for either a standard program package or driver package to suit your deployment method 

ConfigMgr WebService


The ConfigMgr WebService has been designed to extend the functionality of Operating System Deployment with Configuration Manager Current Branch.

General improvements

  • Inconsistency in parameter positioning has been addressed. The secretKey parameter is now required as the first parameter for all methods.
  • GetCMPrimaryUserByDevice has been renamed to GetCMPrimaryUserByDeviceName.
  • AddCMComputerToCollection now requires a device collection ID instead of the device collection name.
  • GetCMOSImageVersionForTaskSequence and GetCMOSImageArchitectureForTaskSequence now detects the proper information based upon the selected image index in the task sequence. This fixes a bug for when e.g. using a custom image that contains more than a single index or for Windows 10 version 1709 that changes the order of the indexes.
  • RemoveADComputerFromGroup now supports groups that contains more than 1500 members.

ConfigMgr WebService

Configuration Manager

Microsoft Deployment Toolkit

Active Directory

  • GetWebServiceVersion
Configuration Manager
  • AddCMComputerAssociationForUser
  • AddCMComputerToCollection
  • GetCMApplicationByCategory
  • GetCMCollectionsForDeviceByUUID
  • GetCMBootImageSourceVersion
  • GetCMDeployedApplicationsByDevice
  • GetCMDeployedApplicationsByUser
  • GetCMDeviceCollections
  • GetCMDeviceNameByUUID
  • GetCMDeviceResourceIDByMACAddress
  • GetCMDeviceResourceIDByUUID
  • GetCMDiscoveredUsers
  • GetCMDriverPackageByModel
  • GetCMHiddenTaskSequenceDeployments
  • GetCMHiddenTaskSequenceDeploymentsByResourceId
  • GetCMOSImageArchitectureForTaskSequence
  • GetCMOSImageVersionForTaskSequence
  • GetCMPackage
  • GetCMPrimaryDeviceByUser
  • GetCMPrimaryUserByDevice
  • GetCMUniqueUserName
  • GetCMUnknownDeviceByUUID
  • GetCMUser
  • ImportCMComputerByMacAddress
  • ImportCMComputerByUUID
  • RemoveCMComputerAssociation
  • RemoveCMDeviceFromCollection
  • RemoveCMLastPXEAdvertisementsForDevice
  • RemoveCMLastPXEAdvertisementForCollection
  • RemoveCMUnknownDeviceByUUID
  • UpdateCMCollectionMembership
Microsoft Deployment Toolkit
  • AddMDTRoleMember
  • AddMDTRoleMemberByAssetTag
  • AddMDTRoleMemberByMacAddress
  • AddMDTRoleMemberBySerialNumber
  • AddMDTRoleMemberByUUID
  • GetMDTComputerByAssetTag
  • GetMDTComputerByMacAddress
  • GetMDTComputerBySerialNumber
  • GetMDTComputerByUUID
  • GetMDTComputerNameByIdentity
  • GetMDTComputerRoleMembership
  • GetMDTDetailedComputerRoleMembership
  • GetMDTRoles
  • RemoveMDTComputerFromRoles
Active Directory
  • AddADComputerToGroup
  • GetADSiteNameByIPAddress
  • RemoveADComputerFromGroup
  • SetADComputerDescription
  • SetADComputerManagedByAttribute
  • SetADOrganizationalUnitForComputer

Script Resources


Modern BIOS Management uses a custom built PowerShell script that is invoked during operating system deployment. This script automatically detects the manufacturer, SystemSKU/BaseBoard value (used instead of model), operating system version and architecture being deployed and matches that information against the system being deployed in order to determine the matching BIOS package that should be downloaded.

After successful completion of the Invoke-CMDownloadBIOSPackage.ps1 step, a task sequence variable (OSDBiosPackage) will be set if a matching update package is found. The next step is to initialise the BIOS update process, this is done using manufacturer specific scripts listed below. Dell, Lenovo and HP are supported.

Version 2.0.0

(2018-01-10) Updates for running script in the Full OS and other minor tweaks


Exit code



Unable to establish a connection to ConfigMgr WebService


An error occured while calling ConfigMgr WebService for a list of available packages


An error occured while calling ConfigMgr WebService to determine OS Image version


An error occured while calling ConfigMgr WebService to determine OS Image architecture


An error occured while downloading BIOS update package content (single package match)


An error occured while downloading BIOS update package content (multiple package matches)


Unable to determine a matching BIOS update package from package list array, unhandled amount of matches


Empty BIOS package list detected, unable to determine matching driver package


Call to web service for package objects returned empty


Unsupported computer platform detected, virtual machines are not supported


Unable to detect current operating system name from task sequence reference objects


An error occurred while attempting to download package content


BIOS package content download process returned an unhandled exit code: <n>


An error occurred while downloading BIOS update (single package match)


An error occurred while downloading BIOS update (multiple package match)


This script provides support for updating the BIOS on Dell systems using package information obtained from the OSDBIOSPackage variable. To run the script use the following switches;

-Password "YOURBIOSPASSWORD" -Path "%OSDBIOSPackage01%"

If you are in a multi-vendor environment, you should apply the following WMI filter on this step to ensure that the step only runs on Dell systems;

WMI NameSpace : RootCIMV2
Manufacturer: LIKE "%DELL%"

Version 1.0.5
Configured Flash64W.exe as the native update tool for 64-bit Full OS deployments


This script provides support for updating the BIOS on Lenovo systems using package information obtained from the OSDBIOSPackage variable. To run the script use the following switches;

-Password "YOURBIOSPASSWORD" -Path "%OSDBIOSPackage01%"

If you are in a multi-vendor environment, you should apply the following WMI filter on this step to ensure that the step only runs on Lenovo systems;

WMI NameSpace : RootCIMV2
Manufacturer: LIKE "%Lenovo%"

Version 1.0.0
Script created

Implementation Instructions

Step 1 - Download and prepare BIOS packages

For our this approach to Modern BIOS Management we need to populate ConfigMgr with regular packages for client machines. If you are running Dell, HP, Lenovo or Microsoft hardware then you can use our Driver Automation Tool to do exactly that. Read the documentation embedded in the download package for Driver Automation Tool for more information on how the tool can be utilized. For the Modern BIOS Management solution, follow these instructions:

  • Launch the Driver Automation Tool
  • Click on the ConfigMgr Settings tab, then connect to your ConfigMgr environment by entering the name of your Site Server and click Connect To SCCM.
  • Click back to the Make / Model Selection tab, we now need to select the Deployment Platform as SCCM - Standard Pkg, then pick BIOS as the Download Type and pick your OS and Architecture.
  • Select the models from the list you wish to download packages for and hit the Add to Import List button.
  • On the Common Settings tab, enter Storage Locations (UNC paths) for the Repository and Package paths.
  • Click on the Start Download and Import Process to start the BIOS downloads.

Once downloaded you should end up with something like this in your ConfigMgr console:

Note: Remember to distribute the packages created by the Driver Automation Tool, unless you've specifically configured the tool to do that for you. For manually creating the packages, use the Driver Automation Tool to create a single package and follow the naming convention and including the different property configurations.

Step 2 - Install ConfigMgr WebService

Modern BIOS Management solution requires the ConfigMgr WebService to be installed in your environment, with the minimum of version 1.4.0. Detailed installation steps can be found in the documentation included in the ConfigMgr WebService package, downloadable from above.

The web service is a key function to this process as it will be used during the task sequence to query the available packages from ConfigMgr (using the Get-CMPackage method).

Step 3 - Configure your Task Sequence

Adding the required step in your Task Sequence for Modern BIOS Management could not be simpler. Download the script called Invoke-CMDownloadBIOSPackage.ps1 from the Script Resources above. This script will automatically detect the computer model and manufacturer, operating system image version and architecture in the executing task sequence, by calling the ConfigMgr WebService for available packages and matching those values. In the case of multiple packages that match the criteria, the most current package will be selected based upon the SourceDate property of the package object. If there are no matches at all, the script will exit, allowing the task sequence to continue.

When a package matching the criteria required is found, the task sequence variables used by OSDDownloadContent.exe will be set and that executable will be invoked. This automatically downloads the matching package for the model being deployed, making it available locally ready for the vendor specific BIOS update script. Once the package is available locally, and the download completed successfully, the Invoke-CMDownloadBIOSPackage.ps1 script will determine if the system requires an BIOS update by comparing the current BIOS version of the system to the newly downloaded package. Only if a system requires an update, a task sequence variable named NewBIOSAvailable, will be set to True. If this task sequence variable is set to True, the manufacturer script will take over and update the BIOS with the latest firmware.

In the event of this script should fail, see the Documentation tab under Script Resources for a list of return codes that could be used for troubleshooting. In terms of logging, the script is writing to a separate log file called BIOSPackageDownload.log located in the same directory as the smsts.log file at the time of operation. For exit codes for the manufacturer steps you should refer to the manufacture support sites as these can change over time.

Follow this simple process of using the Invoke-CMDownloadBIOSPackage.ps1 script inside your task sequence:

  • Package the Invoke-CMDownloadBIOSPackage.ps1 script and distribute it to your Distribution Points.

  • Add a Run PowerShell Script command somewhere after the Apply Operating System step calling the Invoke-CMDownloadBIOSPackage.ps1 script with parameters for the following:
    • URI - URL of the ConfigMgrWeb service - example:"
    • SecretKey - The secret key used to connect to the ConfigMgrWebService site
    • Filter - Enter the term "BIOS" or "BIOS Update Pilot" depending on the type of deployment you wish to run
    • DeploymentType - Here you can specify three different options.
      • BareMetal
        This is the default option and intended for a WinPE environment. Logs are saved into the log folder within the _SMSTaskSequence\Logs folder
        Invoke-CMDownloadBIOSPackage.ps1 -URI ""  -SecretKey "12345" -Filter "BIOS"
      • BIOSUpdate
        This switch is intended for use in a full Windows environment. Logs are saved into the WinDir\Temp folder
        Invoke-CMDownloadBIOSPackage.ps1 -URI "" -SecretKey "12345" -Filter "BIOS" -DeploymentType BIOSUpdate

  • Add a new Group and call it Apply New BIOS. Add the following condition -
  • Add a Run PowerShell Script command under the Apply New BIOS group, calling the manufacturer script you wish to run. For example use Invoke-DellBIOSUpdate.ps1 script with parameters for the following:
    • Password - The BIOS password used in your systems
    • Path- The variable name used in the previous script to store details of the available package - %OSDBIOSPackage01%

For troubleshooting there is also an extensive log management process that runs during the execution of the script, exit codes are documented under the Script Resources - Documentation section of this post.

Comments are closed.