BIOS/UEFI and other Firmware Updates #

LSUClient will install BIOS/UEFI updates silently when possible.

Like with any other package, those for which a silent installation is supported will have their .Installer.Unattended property set to $True. If you get a BIOS/UEFI update for which .Installer.Unattended is $False, that means it uses a type of installer/flasher for which either no silent install options exist or for which LSUClient doesn’t support performing silent installs yet.

When you install such a non-silent package its setup routine will be invoked with the default arguments in the same way System Update would.
Likely this will mean a graphical wizard will come up and wait for you to confirm or cancel the update.

Handling reboots #

It is important to know that some Lenovo computers require a reboot to apply BIOS updates while other models require a shutdown - the BIOS will then wake the machine from the power-off state, apply the update and boot back into Windows. Other, non-BIOS firmware updates typically always require a reboot. So as to not interrupt a deployment or someone working, this module will never initiate reboots or shutdowns on its own, however it’s easy for you to:

1. Capture the PackageInstallResult objects returned by Install-LSUpdate, e.g.:

   [array]$results = Install-LSUpdate -Package $updates
   

2. Then test for the PendingAction values REBOOT_MANDATORY and SHUTDOWN and handle them in your script:

   if ($results.PendingAction -contains 'REBOOT_MANDATORY') {
       # reboot immediately or set a marker for yourself to perform the reboot shortly
   }
   if ($results.PendingAction -contains 'SHUTDOWN') {
       # shutdown immediately or set a marker for yourself to perform the shutdown shortly
   }
   

   If you prefer to loop through the updates one-by-one and handle their result immediately, you can use -eq or a switch statement:

   foreach ($update in $updates) {
       $result = Install-LSUpdate -Package $update
       switch ($result.PendingAction) {
           'REBOOT_MANDATORY' {
               # reboot immediately or set a marker for yourself to perform the reboot shortly
           }
           'SHUTDOWN' {
               # shutdown immediately or set a marker for yourself to perform the shutdown shortly
           }
       }
   }
   

SaveBIOSUpdateInfoToRegistry Parameter #

This parameter is deprecated and only documented for the sake of helping move existing scripts away from it. It may be removed in a future major release of LSUClient. Use the technique described [above](#handling-reboots) instead.

There is also a -SaveBIOSUpdateInfoToRegistry parameter on Install-LSUpdate.

Prior to version 1.4.0, this used to be the only way for LSUClient to communicate a required power cycle back to you.

When Install-LSUpdate is called with this parameter and it successfully installs a BIOS update, it will write some registry keys to HKLM\Software\LSUClient\BIOSUpdate, including the string ActionNeeded which will contain either "REBOOT" or "SHUTDOWN".

However, using the -SaveBIOSUpdateInfoToRegistry parameter is no longer recommended because, as the name implies, it only sets those registry keys when installing BIOS/UEFI updates and not for any other kinds of firmware updates that might require a reboot just the same.

To summarize the differences and aid the transition, the following table compares the values to expect in different scenarios:

As you can see, the PendingAction property is always set and more explicit and granular in communicating whether a power cycle is needed or not.

Excluding BIOS and/or firmware updates #

If you want to simply not install any BIOS/UEFI updates, I recommend filtering them by Type and possibly Category and Title as a fallback.

Not all packages have type information, sometimes `Type` is `$null` so don't rely on this property alone

Packages sourced from internal repositories created with "Lenovo Update Retriever" never have `Category` information. In that scenario it is best to either not have BIOS updates in your repository at all, make sure they always have their `Type` set correctly or to filter them by their IDs before installing.

Filtering out BIOS/UEFI updates:

$updates = Get-LSUpdate |
    Where-Object { $_.Type -ne 'BIOS' } |
    Where-Object { $_.Category -notmatch "BIOS|UEFI" } |
    Where-Object { $_.Title -notmatch "BIOS|UEFI" }

Filtering out other firmware updates:

$updates = Get-LSUpdate |
    Where-Object { $_.Type -ne 'Firmware' } |
    Where-Object { $_.RebootType -ne 5 } |
    Where-Object { $_.Category -notlike "*Firmware*" } |
    Where-Object { $_.Title -notlike "*Firmware*" }

Recommended reading #

https://support.lenovo.com/de/en/solutions/ht507859-bios-flashing-sccm-support-thinkcentre-thinkstation
https://thinkdeploy.blogspot.com/2019/06/what-are-reboot-delayed-updates.html