This repository was archived by the owner on Oct 10, 2026. It is now read-only.
Repository navigation
Harden BIOS update safety and compatibility - #5
Merged
Merged
Conversation
Windows 11 26H2 (build 26300) added to the build/version mapping. All Get-WmiObject calls replaced with Get-CimInstance across every script. Removed driver-script residue from the BIOS downloader (OSVersionFallback, TargetOSVersion, driver-package logic) since BIOS updates are OS agnostic. Downloader fixes: - New-TerminatingErrorRecord accepted empty messages and referenced an undeclared $ErrorID - Surface packages matched but never downloaded: the Microsoft arm set a local $NewBIOSAvailable that nothing consulted - Lenovo multi-match threw on a null .PackageDescription; release-date parsing centralised in Get-LenovoBIOSReleaseDate - A stale NewBIOSAvailable task sequence variable could force an unnecessary flash; it is now reset before validation Vendor flash script fixes (Dell, HP, Lenovo, Microsoft): - Exit-code checks used -match 0|2, so 10/12/20/120 passed as success; replaced with explicit switch blocks using documented vendor codes - BitLocker detection and suspension moved from Manage-Bde to CIM, now targeting $env:SystemDrive and verifying suspension before flashing - Utility discovery pinned to -First 1 so multiple matches cannot produce an array, with mutually exclusive if/elseif selection chains - Paths containing spaces quoted; passwords escaped with [regex]::Escape - Start-Process exit codes captured reliably via $null = $Invocation.Handle Removed SupportsShouldProcess from all scripts: none ever called $PSCmdlet.ShouldProcess, so -WhatIf silently flashed the BIOS instead of performing a dry run. Invoke-CMDownloadBIOSPackage_Legacy.ps1 intentionally received only the CIM migration and is otherwise left frozen. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Expand both the WinPE and full OS exit code evaluation to the documented Dell Update Package table instead of treating only 0, 2 and 10 as known. - Treat 13 as success and 14 as reboot required, matching 0 and 2 - Treat 3 (soft dependency) as a warning rather than a hard failure - Treat 6 as success, the package restarts the system itself, so the script no longer requests a second reboot - Treat 15 and 16 as a cold boot requirement and record the new SMSTSBIOSUpdateColdBootRequired task sequence variable - Fail explicitly on 4 and 5 with their own exit codes - Propagate the original Dell exit code instead of a blanket exit 1 Task sequence variable writes in the full OS branch are null guarded because the TSEnvironment object is absent outside a task sequence. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
VM firmware is owned by the hypervisor and has no physical flash chip, so a vendor BIOS payload executed inside a guest cannot succeed. A Dell DUP returns exit code 5 (QUAL_HARD_ERROR), which Invoke-DellBIOSUpdate.ps1 maps to a hard task sequence failure. - Add Test-VirtualMachinePlatform to Invoke-CMDownloadBIOSPackage.ps1, consolidating the two inline VM model lists that had already drifted (one carried VMware7,1, the other did not) into a single 13-entry list plus a manufacturer regex fallback. Microsoft is deliberately excluded from the regex because Surface reports 'Microsoft Corporation' like Hyper-V. - Wire Get-ComputerSystemType and Test-ComputerDetails to the shared helper. - Add an early VM guard to all four vendor flash scripts so they log at severity 2 and exit 0 before BitLocker suspension or any working directory change. - Widen the legacy downloader model list from 5 to 13 entries, model-only, to respect that file's freeze policy. - Document the behaviour in README.md. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Add a read-only Test-SecureBootCertificateStatus helper to the downloader that checks the Secure Boot signature database for 'Windows UEFI CA 2023' ahead of the June and October 2026 expiry of the 2011 Microsoft certificates, and surfaces the result as the SecureBootCertificate2023Present task sequence variable. The check is detection only and never blocks a flash. It is defensively wrapped so legacy BIOS systems and WinPE images without the Secure Boot cmdlets log a skip instead of terminating, and it runs before the virtual machine gate so guests, which hold the same certificates in virtual NVRAM, are still reported on. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Validation
Tests/CimMigration.Tests.ps1Tests/FirmwareSafety.Tests.ps1Tests/SecureBootStatus.Tests.ps1git diff --check origin/main...HEADAll checks pass locally.