How to update the BIOS of a PC over the network , from HP site

few people update the BIOS of their PCs but it's a best practice do it regularly.

there are several reasons for a BIOS update: improve security , remove BIOS bugs , add features

I know several methods to update the BIOS of an HP Business PC. in this post I just describe how to update the BIOS of PC running Windows 10 , BIOS in UEFI mode and disk with GPT partition scheme.
I doesn't work if disk has MBR partitions in legacy mode.

as usual you need Powershell HP Client Management Script Library form here https://ftp.hp.com/pub/caps-softpaq/cmit/hp-cmsl.html , download and install the package on you management console.
run a second time the installation packege and extract the HP module in  C:\SWSetup\ps1.2\
As the script I wrote need to access Windows Remote Management (WinRM) service running on the remote PC , the management console user must have the right to access  WinRM service of the remote PC and be able to run an invoke-command on remote PC.

The script do there actions:

1. verifies that  management console user is able to access WinRM of remote client, otherwise exit
2. reads remote computer model, sysID , BIOS version
3. reads on HP web site which is latest BIOS version available for the remote PC sysID
4. if PC already has latest BIOS version, exit
5. if BIOS is not latest
1. powershell scripts are copied from management to remote PC
2. BIOS for remote PC is downloaded on the PC it-self
3. if volume is encrypted with bitlocker, it will be suspended
4. a BIOS update in scheduled on the remote PC
5. update will happens at next reboot

bitlocker must be resumed after BIOS update.

script doesn't check if BIOS is really updated. you can use another cmdlet to check current BIOS version of remote PC such as get-HPBIOSVersion -target $ip_address

this is my script , copy&paste into a .ps1 file.

# !!!!!!!!!!!!!!!!!!!!!!!!!!!! # HP CMS library MUST be extracted to # C:\SWSetup\ps1.2\ folder in order to work # C:\SWSetup\ps1.2\Modules\HP.Firmware # C:\SWSetup\ps1.2\Modules\HP.ClientManagement # C:\SWSetup\ps1.2\Modules\HP.Softpaq # C:\SWSetup\ps1.2\Modules\HP.Softpaq.Share # # before to start , I check if the PC answers to get-service WinRM -computername $ip_address , no answer means , either PC off or access denied # this script read remote PC information from the BIOS , download information about last BIOS version from HP ftp site # then update the BIOS of the remote PC copyng script and BIOS file to the remote PC, the remote execute the bios update # Phase 1 : collecting info from remote PC : model , SysID , BIOS version # Phase 2 : collecting info from HP ftp site: last BIOS version , BIOS name , release date (using hp script: get-hpbiosUpdates) # Phase 3 : # using 'switch' , # 1) if PC has last BIOS version already installed , do nothing . # 2) if PC has a different BIOS version , it will be updated , using HP script : get-hpbiosUpdates -saveas bios.bin ; UPdate-HPFirmware -file bios.bin # 3) if PC SysID is not found , write that PC is not managed param( [Parameter(Position = 0,Mandatory = $true)] $ip_address ) $wmi_pass ="P@ssw0rd" # password dell utente di dominio $wmi_user ="Labadmin" # utente di dominio ch può eseguire script sulla macchina remota $remote_pass = ConvertTo-SecureString -String $wmi_pass -AsPlainText -Force $remote_credential = New-Object -typeName System.Management.Automation.PSCredential -ArgumentList $wmi_user, $remote_pass import-module C:\SWSetup\PS1.2\Modules\HP.Softpaq.Shared\HP.Softpaq.Shared.psm1 import-module C:\SWSetup\PS1.2\Modules\HP.ClientManagement\HP.ClientManagement.psm1 if ( get-service WinRM -computername $ip_address -ErrorAction SilentlyCOntinue) #verifica se sul computer remoto è attivo WinRM e se la console da cui si esegui lo script è in grado di accedere a WinREM { # phase 1 - collecting information from remote PC write-host 'reading computer model' $PCmodel = get-HPDeviceModel -target $ip_address #read the PC model string ex "Elitebook 840 G5" write-host 'reading computer sysid' $PCsysid= get-HPDeviceProductID -target $ip_address #read the PC sysID string ex 83B2 write-host 'reading computer BIOS version' $PCmodelbiosver = get-HPBIOSVersion -target $ip_address #read the BIOS version installed on the remote PC $sysfound = '0' # phase 2 - collecting BIOS versione availability of the remote PC , based on sysID [string[]]$HPdati = @() [string[][][]]$dati = @() $HPdati = get-hpbiosUpdates -platform $PCsysid -latest -format list #find latest BIOS version from HP site $dati=$HPdati[0].split(' ').Trim() #split information got with get-hpbiosUpdates write-host $dati[0] write-host $dati[1] write-host $dati[2] $latestbiosver = $dati[2].split(',').Trim() # got from HP site with get-hpbiosUpdates - this is the BIOS verssion ex 1.06.00 $latestbiosfilename = $dati[0] # got from HP site with get-hpbiosUpdates - ex Q78_010600.bin $modello = $PCmodel #read from remote PC write-host '' write-host '' write-host 'Model is ' $PCmodel 'Current BIos version is' $PCmodelbiosver , 'sysID' $PCsysid write-host $latestbiosver $sysid = $PCsysid #read from remote PC # phase 3 - check if installed BIOS is already latest and if we have a file name if ( $latestbiosver -eq $PCmodelbiosver -and $latestbiosfilename) { write-host $modello , $ip_address , 'already has latest BIOS version' $latestbiosver ; $sysfound = '1' ; $adesso = (get-date).ToString() ; $line = $adesso+' , '+$modello+' , '+$ip_address+' , '+$latestbiosver ; write-output $line >> logfile_already_latest.csv ; } # if BIOS is not latest , update it if ( $latestbiosver -ne $PCmodelbiosver -and $latestbiosfilename ) { write-host 'copying Powershell script' ; $client1 = New-PSSession -ComputerName $ip_address -Credential $remote_credential ; copy-Item 'C:\SWSetup\ps1.2\Modules\HP.Firmware' -Force -Destination 'C:\users\public\Downloads' -ToSession $client1 -Recurse ; copy-Item 'C:\SWSetup\ps1.2\Modules\HP.ClientManagement'-Force -Destination 'C:\users\public\Downloads' -ToSession $client1 -Recurse ; copy-Item 'C:\SWSetup\ps1.2\Modules\HP.Softpaq' -Force -Destination 'C:\users\public\Downloads' -ToSession $client1 -Recurse ; copy-Item 'C:\SWSetup\ps1.2\Modules\HP.Softpaq.Shared\*' -Force -Destination 'C:\users\public\Downloads\HP.Softpaq' -ToSession $client1 -Recurse ; invoke-command -ComputerName $ip_address -Credential $remote_credential -ScriptBlock { set-executionpolicy unrestricted ; cd 'C:\users\public\Downloads\HP.Firmware' ; import-module .\HP.Firmware.psm1; cd 'C:\users\public\Downloads\HP.ClientManagement' ; import-module .\HP.ClientManagement.psm1; cd .. ; remove-item 'C:\users\public\Downloads\bios.bin' -Force -ErrorAction SilentlyContinue $PCsysid= get-HPDeviceProductID ; get-hpbiosUpdates -platform $PCsysid -download -saveas bios.bin ; UPdate-HPFirmware -file bios.bin -bitlocker suspend ; $sysfound = '1' ; } } if ($sysfound -ne '1' -and -NOT $latestbiosfilename) { write-host 'model' $PCmodel 'is not in the list of managed computer' } # this should happen if the PCmodel in not avalable in pub/pcbios folder } #end if $status else # in case WinRM in not accessible or PC is not found in the network .... {write-host 'host' $ip_address 'not found on the network or access denied' ; $adesso = (get-date).ToString() ; $line = $adesso+' , '+$ip_address+' , not found' ; write-output $line >> logfile_not_found.txt } #END
bye
Franco