We normally update BIOS only when necessary, but now we need to update several hundred laptops that are already in customers' hands. They're running Windows 11 25H2, are hybrid AD/Entra joined, and are managed through Configuration Manager and Intune. Bringing every user to the help desk isn't practical, but I'm also concerned about interrupted updates, BitLocker recovery, BIOS passwords, and the risk of bricking devices. Is there a reliable way to silently stage BIOS updates, notify users, and let them reboot at a convenient time instead of forcing them to watch the firmware-update screen? We have Dell, HP, and Lenovo systems in the environment.
3 Answers
There usually isn’t a completely invisible BIOS update. The firmware flash needs a reboot and users must leave the device powered on, preferably connected to AC power. Send a clear warning beforehand, schedule deployments in waves, and use management policies to offer the reboot during an agreed maintenance window. Start with a small pilot covering every major model and then expand gradually.
Build separate deployment groups by manufacturer and model rather than using one package for everything. Confirm that each executable supports unattended installation and document its switches, exit codes, reboot requirements, BIOS-password handling, and BitLocker behavior. Make sure users have recovery keys escrowed before starting, and configure monitoring so failed, pending-reboot, and successfully updated machines are easy to identify.
Check the vendor-supported firmware channels first. Dell, HP, and Lenovo can generally deliver BIOS updates through Windows Update, their management tools, or driver/firmware packages deployed with Intune or Configuration Manager. Some updates may appear under optional updates, while security-critical firmware can be offered as required updates. Test how BIOS passwords, BitLocker suspension, reboot behavior, and return codes work on each model before broad deployment.
Lenovo systems have generally handled this smoothly through Windows Update in our experience, although users still need to avoid powering off during the firmware phase. We had a couple of interrupted updates, and the hardware support agreement covered the resulting motherboard replacements.
In a hospital environment there may never be a genuinely convenient time, so the most realistic approach is to coordinate with departments, warn users repeatedly, and keep the rollout small enough that support can handle failures or recovery prompts.