How to update the BIOS of PC over the network , "on premise" solution

in this post I explain how to update the BIOS of PCs in intranet without requiring the PC to access internet to get BIOS file.

I know several methods to update the BIOS of an HP Business PC. in this post I just describe how to update the BIOS of PC running Windows 10 , BIOS in UEFI mode and disk with GPT partition scheme.
I doesn't work if disk has MBR partitions in legacy mode.
as usual you need Powershell HP Client Management Script Library form here https://ftp.hp.com/pub/caps-softpaq/cmit/hp-cmsl.html , download and install the package on you management console. 
Run a second time the installation package and extract the HP modules in  C:\SWSetup\ps1.2\

As the script I wrote needs to access Windows Remote Management (WinRM) service running on the remote PC , the management console user must have the right to access  WinRM service of the remote PC and be able to run an invoke-command on remote PC.
The script does these actions:

1. verifies that  management console user is able to access WinRM of remote client, otherwise exit
2. creates an array of HP computers with these information:
1. model name , is a string of your preference
2. system ID , exadecimal number  , used to identify the model
3. bios version, must match the format returned by HP cmdlet get-HPBIOSVersion
4. bios file name 
5. you have to manually create this list or you can create it using another PS script.
6. example : ("840G5","83b2","1.06.00","Q78_010600.bin") , more in the script
3. gets information from remote PC: Model string , SysID and BIOS version
4. compares sysid and BIOS version with values written in the array.
5. if PC sysid is not found in array list , exit
6. if PC is found , BIOS version read from PC is compared with BIOS version in the array; if they match , exit
7. if BIOS versions are different , overwrite (update) the BIOS version of remote PC
8. HP PS scripts and BIOS.bin files are copied from management console to remote PC folder 
9. an invoke-command will execute cmdlet UPdate-HPFirmware on remote PC 
10. BIOS will be update at next reboot. user can't interrupt it

in order to have this script working, you must have on management console all BIOS files of your model.

you can use the script on my other post "How to quickly download the BIOS of your HP Business PC". both script must have the same model string.

this is my script
# !!!!!!!!!!!!!!!!!!!!!!!!!!!! # HP CMS library MUST be extracted to # C:\SWSetup\ps1.2\ folder in order to work # C:\SWSetup\ps1.2\Modules\HP.Firmware # C:\SWSetup\ps1.2\Modules\HP.ClientManagement # C:\SWSetup\ps1.2\Modules\HP.Softpaq # C:\SWSetup\ps1.2\Modules\HP.Softpaq.Share # # This script dosen't requires remote PC accesses Internet # script library AND BIOS file are provided to remote PC copying them from management console to remote PC # IT people have to download the BIOS file here: 'C:\SoftpaqRepository\bios\'+$modello+'\'+$biosfilename # were $sysid is the motherboard sysID (uppercase) and biosfilename must match the the name founf on HP ftp site. see $HPcomputer array below # before to start , I check if the PC answers to get-service WinRM -computername $ip_address , no answer means , either PC off or access denied # this script read remote PC information from the BIOS , download information about last BIOS version from HP ftp site # then update the BIOS of the remote PC copyng script and BIOS file to the remote PC, the remote execute the bios update # Phase 1 : collecting info from remote PC : model , SysID , BIOS version # Phase 2 : $HPComputer array is used to compare if remote PC already has latest BIOS version and listed in the array. # : $HPComputer array must be manually build taking the information from FTP web site # : latest BIOS must ne on management console # using 'switch' , # 1) if PC has last BIOS version already installed , do nothing . # 2) if PC has a different BIOS version , it will be updated , using HP script : UPdate-HPFirmware -file bios.bin # 3) if PC SysID is not found , write that PC is not managed # these are the credential used in my lab. # management console and Remote PC are in the same domain # Labadmin user has Remote management capability on remote PC $wmi_pass ="P@ssw0rd" $wmi_user ="Labadmin" $remote_pass = ConvertTo-SecureString -String $wmi_pass -AsPlainText -Force $remote_credential = New-Object -typeName System.Management.Automation.PSCredential -ArgumentList $wmi_user, $remote_pass import-module C:\SWSetup\PS1.2\Modules\HP.Softpaq.Shared\HP.Softpaq.Shared.psm1 import-module C:\SWSetup\PS1.2\Modules\HP.ClientManagement\HP.ClientManagement.psm1 param( [Parameter(Position = 0,Mandatory = $true)] $ip_address ) if ( get-service WinRM -computername $ip_address -ErrorAction SilentlyCOntinue) { [string [][][]] $HPcomputer = @( ("645G3","823a","1.24","P82_0124.bin"), ("X2_612_G2","828b","1.23","P86_0123.bin"), ("X2_1012_G2","82CA","1.25","P87_0125.bin"), ("X2_1013_G3","8414","1.06.00","Q87_010600.bin"), ("1030G2","827D","1.25","P80_0125.bin"), ("1030G3","8438","1.06.00","Q90_010600.bin"), ("1040G3","80FA","1.33","N83_0133.bin"), ("1040G4","8417","1.25","P96_0125.bin"), ("1040G5","8470","1.06.00","Q74_010600.bin"), ("1050G1","84E9","1.06.03","Q72_010603.bin"), ("840G3","8079","1.38","N75_0138.bin"), ("830G5","83b3","1.06.00","Q78_010600.bin"), ("840G5","83b2","1.06.00","Q78_010600.bin"), ("840rG4","8418","1.06.00","Q80_010600.bin"), ("735G5","83da","1.06.01","Q81_010601.bin"), ("745G5","83d5","1.06.01","Q81_010601.bin"), ("640G2","80FD","1.33","N76_0133.bin"), ("640G4","83d2","1.06.03","Q83_010603.bin"), ("650G4","8416","1.06.03","Q83_010603.bin"), ("650HG4","844A","1.06.03","Q83_010603.bin"), ("645G4","8401","1.06.01","Q82_010601.bin"), ("X360_440G1","84D8","1.06.00","Q98_010600.bin"), ("EliteOne1000G2","83E5","2.06.03","Q10_020603.bin"), ("800G4_DM_83E2","83E2","2.06.03","Q21_020603.bin"), ("800G4_DM_GPU_83E2","83E2","2.06.03","Q21_020603.bin"), ("800G4_DM_8409","8409","2.06.03","Q21_020603.bin"), ("800G4_DM_845A1809","845A","2.06.03","Q21_020603.bin"), ("EliteDesk800G4_TWR","83E0","2.06.03","Q01_020603.bin"), ("EliteDesk800G4_AIO_83E3","83E3","2.06.03","Q11_020603.bin"), ("EliteDesk800G4_AIO_83E4","83E4","2.06.03","Q11_020603.bin"), ("EliteDesk800G4_SFF","83E1","2.06.03","Q01_020603.bin"), ("EliteDesk705G4_SFF_83E8","83E8","2.04.01","Q16_020401.bin"), ("EliteDesk705G4_SFF_8462","8462","2.04.01","Q19_020401.bin"), ("EliteDesk705G4_SFF_8463","8463","2.04.02","Q15_020402.bin"), ("EliteDesk705G4_MT_83E7","83E7","2.04.02","Q15_020402.bin"), ("EliteDesk705G4_MT_8460","8460","2.04.02","Q15_020402.bin"), ("EliteDesk705G4_MT_8461","8461","2.04.02","Q05_020402.bin"), ("EliteDesk705G4_DM_83E9","83E9","2.04.01","Q26_020401.bin"), ("EliteDesk705G4_DM_8464","8464","2.04.02","Q27_020402.bin"), ("ProDesk600G4_MT_83EC","83EC","2.06.03","Q02_020603.bin"), ("ProDesk600G4_MT_PCI_83ED","83ED","2.06.03","Q02_020603.bin"), ("ProDesk600G4_MT_8580","8580","2.02.00","R04_020200.bin"), ("ProDesk600G4_SFF","83EE","2.01.09","Q07_020109.bin"), ("ProDesk600G4_DM","83EF","2.06.03","Q22_020603.bin"), ("EliteDesk600G4_AIO_83EA","83EA","2.06.03","Q12_020603.bin"), ("EliteDesk600G4_AIO_83EB","83EB","2.06.03","Q12_020603.bin"), ("ProDesk400G5_MT_83F0","83F0","2.06.00","Q03_020600.bin"), ("ProDesk400G5_MT_83F1","83F1","2.06.00","Q03_020600.bin"), ("ProDesk400G5_SFF","83F2","2.06.00","Q08_020600.bin"), ("ProDesk400G4_DM","83F3","2.06.00","Q23_020600.bin"), ("EliteDesk400G4_AIO_83EA","83EA","2.06.03","Q12_020603.bin"), ("EliteDesk400G4_AIO_83EB","83EB","2.06.03","Q12_020603.bin"), ("Zbook15G5","842A","1.06.03","Q70_010603.bin") ) write-host 'reading computer model' $PCmodel = get-HPDeviceModel -target $ip_address write-host 'reading computer sysid' $PCsysid= get-HPDeviceProductID -target $ip_address write-host 'reading computer BIOS version' $PCmodelbiosver = get-HPBIOSVersion -target $ip_address $sysfound = '0' write-host '' write-host '' write-host 'Model is ' $PCmodel 'Current BIos version is' $PCmodelbiosver foreach ($elemento in $HPcomputer) { $modello = $elemento[0] $sysid = $elemento[1] $lastesbiosver = $elemento[2] $biosfilename = $elemento[3] switch ( $PCsysid ) { $sysid { switch ( $PCmodelbiosver ) { $lastesbiosver { write-host $modello , $ip_address , 'already has latest BIOS version' $lastesbiosver ; $sysfound = '1' ; $adesso = (get-date).ToString() ; $line = $adesso+' , '+$modello+' , '+$ip_address+' , '+$lastesbiosver ; write-output $line >> logfile_already_latest.csv ; break } default { write-host 'copying Powershell script' ; $client1 = New-PSSession -ComputerName $ip_address -Credential $remote_credential ; copy-Item 'C:\SWSetup\ps1.2\Modules\HP.Firmware' -Force -Destination 'C:\users\public\Downloads' -ToSession $client1 -Recurse ; copy-Item 'C:\SWSetup\ps1.2\Modules\HP.ClientManagement'-Force -Destination 'C:\users\public\Downloads' -ToSession $client1 -Recurse ; copy-Item 'C:\SWSetup\ps1.2\Modules\HP.Softpaq' -Force -Destination 'C:\users\public\Downloads' -ToSession $client1 -Recurse ; copy-Item 'C:\SWSetup\ps1.2\Modules\HP.Softpaq.Shared\*' -Force -Destination 'C:\users\public\Downloads\HP.Softpaq' -ToSession $client1 -Recurse ; $biosbin = 'C:\SoftpaqRepository\bios\'+$modello+'\'+$biosfilename $sysfound = '1' copy-Item $biosbin -Force -Destination 'C:\users\public\Downloads\bios.bin' -ToSession $client1 ; invoke-command -ComputerName $ip_address -Credential $remote_credential -ScriptBlock { set-executionpolicy unrestricted ; cd 'C:\users\public\Downloads\HP.Firmware' ; import-module .\HP.Firmware.psm1; cd 'C:\users\public\Downloads\HP.ClientManagement' ; import-module .\HP.ClientManagement.psm1; cd .. ; UPdate-HPFirmware -file bios.bin -bitlocker suspend ; $sysfound = '1'; break} } } } } #end switch sysid } #end froeach iif ($sysfound -ne '1' -and -NOT $biosfilename) { write-host 'model' $PCmodel 'is not in the list of managed computer' } # this should happen if the PCmodel in not avalable in pub/pcbios folder } #end if $status else {write-host 'host' $ip_address 'not found' ; $adesso = (get-date).ToString() ; $line = $adesso+' , '+$ip_address+' , not found' ; write-output $line >> logfile_not_found.txt }
end of the scipt