We normally avoid touching BIOS unless there's a specific need, but now we need to update a few thousand laptops that are already in customers' hands. They're running Windows 11 25H2, are hybrid AD/Entra joined, and are generally managed through Configuration Manager and Intune. Bringing every user to a help desk isn't practical, but I'm also concerned about failed updates, BitLocker or BIOS-password issues, and users powering off during the firmware flash. I haven't found a reliable way to silently stage the update, suppress the firmware-update screen, or make the install happen silently followed by an ordinary reboot. How are others handling this safely?
3 Answers
Use the vendor’s supported enterprise deployment method wherever possible rather than repackaging a consumer BIOS executable. Build detection rules around the current BIOS version, deploy only to matching models, and make the update conditional on AC power and other prerequisites. Test several models and firmware revisions before expanding the deployment, then monitor failures and BitLocker recovery events after each wave.
Don’t deploy the whole fleet at once. Validate the firmware on representative models first, then use small waves with a pilot group and a rollback or recovery plan. Require the laptop to be connected to AC power, confirm it has enough battery, and make sure BitLocker handling is documented. Firmware updates usually can’t be completely invisible because the user has to see a warning not to interrupt the flash, so plan around that instead of trying to suppress it.
Start by checking whether the manufacturers can deliver the firmware through Windows Update. Dell, HP, and Lenovo all support BIOS updates through Windows Update in at least some models and configurations. Critical firmware updates may be offered as required updates, while others can appear under Optional Updates. Vendor-specific management tools or Intune/Configuration Manager deployment packages are also worth evaluating if Windows Update doesn’t cover your hardware.
With Lenovo systems, BIOS updates have generally arrived through Windows Update without users needing to do anything. The main failure cases were users forcibly powering off during the flash, so make sure devices are on AC power and communicate clearly that the process must not be interrupted.
We use Dell, HP, and Lenovo, so we’ll need to verify the behavior for each model. The important things to test are BIOS passwords, BitLocker suspension and recovery behavior, power requirements, reboot prompts, and whether the update can be staged before the user chooses a maintenance window.
That’s the difficult part in a hospital environment—there’s rarely a genuinely convenient time for a reboot. We’ll probably need advance notice, maintenance windows, and smaller batches even though that makes the rollout take longer.