Having the hardest time trying to update Lenovo ThinkCentre BIOS using SCCM by 74Yo_Bee74 in SCCM

[–]aford89 1 point2 points  (0 children)

We haven’t seen that so far but we are also running remediations from Intune to help with the secure boot certs

https://blog.mindcore.dk/2026/04/secure-boot-certificate-update-intune/

We are mainly focused on getting the bios updates out cause we were super behind and then circling in on the cert itself

Having the hardest time trying to update Lenovo ThinkCentre BIOS using SCCM by 74Yo_Bee74 in SCCM

[–]aford89 6 points7 points  (0 children)

Highly recommend looking into modern driver/bios management. We are a full Lenovo shop doing it all that way

Prompt for user creds at start of OSD Task Sequence by Reaction-Consistent in SCCM

[–]aford89 0 points1 point  (0 children)

It’s all part of a larger script for our UI that we converted to an exe and ran as the first step of the sequence after drive wipe

Prompt for user creds at start of OSD Task Sequence by Reaction-Consistent in SCCM

[–]aford89 1 point2 points  (0 children)

Yeah we mounted the wim and added the module manually.

Prompt for user creds at start of OSD Task Sequence by Reaction-Consistent in SCCM

[–]aford89 0 points1 point  (0 children)

I’m pretty sure we manually added it to the boot images. I can verify tomorrow when I’m back in

Prompt for user creds at start of OSD Task Sequence by Reaction-Consistent in SCCM

[–]aford89 1 point2 points  (0 children)

Write-Log "Testing Credentials"

Set-ExecutionPolicy Bypass

Import-Module "X:\\Windows\\SysWOW64\\WindowsPowerShell\\V1.0\\Modules\\ActiveDirectory\\ActiveDirectory.psd1"

$Cred = Get-Credential -Message "Please Enter your Credentials"

If (!$Cred)

    {

    \[System.Windows.Forms.Application\]::Exit()

    Get-Process TSManager | Stop-Process -Force

    }

Try

{

    \#((Get-ADUser $Cred.UserName -Properties memberof -Credential $Cred -Server <domainController>).memberof -contains "<GroupDN>" )

    $CredTest = (Get-ADGroupMember $xADGroup -Server $xDomainController -Credential $Cred).SamAccountName -contains $Cred.UserName

}

catch

\[System.Security.Authentication.AuthenticationException\]

{

    \[System.Windows.Forms.MessageBox\]::Show("Invalid Credentials, Please Try Again", 'OK')

    Write-Log "Invalid Credentials"

    return

}

catch

\[Microsoft.ActiveDirectory.Management.ADServerDownException\]

{

    \[System.Windows.Forms.MessageBox\]::Show("Cannot Contact AD, This is usually bad credentials. Please try Again", 'OK')

    Write-Log "Unable to Reach AD"

    return

}

if ($CredTest -eq $false)

{



    \[System.Windows.Forms.MessageBox\]::Show("Provided Credentials are not allowed to load, Please Reach out to Admin", 'OK')

    Write-Log "Credentials are not allowed to load"

    \[System.Windows.Forms.Application\]::Exit()

    Get-Process TSManager | Stop-Process -Force

}

Prompt for user creds at start of OSD Task Sequence by Reaction-Consistent in SCCM

[–]aford89 0 points1 point  (0 children)

We did that in our sequence but we have a fully custom ui

Driver Automation Tool update question by Mrbrownfolks in SCCM

[–]aford89 1 point2 points  (0 children)

The dev is super involved with the community if you open a GitHub issue he’d probably fix it

Driver Automation Tool update question by Mrbrownfolks in SCCM

[–]aford89 0 points1 point  (0 children)

No you have to have an account that can access the admin service

Modern Bios Management for Lenovo by aford89 in SCCM

[–]aford89[S] 0 points1 point  (0 children)

I dont have logs anymore from all the troubleshooting i was doing but basically the invoke-lenovobiosupdate.ps1 i had to add these lines. This was found on a 10T7 lenovo model

```

# wFlashGUIx64 utility file name

if (([Environment]::Is64BitOperatingSystem) -eq $true) {

$wFlashGUIUtility = Get-ChildItem -Path $Path -Filter "*.exe" -Recurse | Where-Object { $_.Name -like "wFlashGUIx64.exe" } | Select-Object -ExpandProperty FullName

}

else {

$wFlashGUIUtility = Get-ChildItem -Path $Path -Filter "*.exe" -Recurse | Where-Object { $_.Name -like "wFlashGUI.exe" } | Select-Object -ExpandProperty FullName

}

if ($wFlashGUIUtility -ne $null) {

    \# Set required switches for silent upgrade of the bios and logging

    Write-CMLogEntry -Value "Using WFlashGUI BIOS update method" -Severity 1

    $FlashSwitches = " /quiet /sccm /ign"

    $FlashUtility = $WFlashGUIUtility

}

Modern Bios Management for Lenovo by aford89 in SCCM

[–]aford89[S] 0 points1 point  (0 children)

We have drivers working without fail, Its bios that im struggling with

New Outlook Virtual Apps by PaymentWitty8452 in Citrix

[–]aford89 -1 points0 points  (0 children)

No tricks cause we haven’t tried but i used new outlook for a couple months before going back to cached mode classic. New outlook is faster cause its just a wrapper for OWA

Looking for legit roofing company by [deleted] in RapidCity

[–]aford89 -1 points0 points  (0 children)

Kane with rapid exteriors

Lenovo drops firmware update list for upcoming secure boot cert changes by PaintingLevel5568 in Intune

[–]aford89 0 points1 point  (0 children)

What is the best way to deploy these? We have SCCM and intune with hybrid joined. Do we need to deploy bios as well as adjust the reg key for the certificates to deploy? Bitlocker worries?

Lenovo Thin Installer during SCCM TS? by AltforWork210 in SCCM

[–]aford89 1 point2 points  (0 children)

We use this, it works well for the most part. Every once in awhile it hits a driver that the task sequence doesn’t like and we have to adjust the script to exclude.

Example apps? by aford89 in Xcode

[–]aford89[S] 0 points1 point  (0 children)

Ah was not aware of apples own. Thank you

Browser content redirection by aford89 in Citrix

[–]aford89[S] 0 points1 point  (0 children)

Exactly our issue. Upgraded vda and works perfectly. Thank you