Disable forced bios update on windows

nissimezra · Apr 14, 2025

Scannerman said:
My personal experience has been that Windows will not do something so drastic as to flash my system BIOS without asking for my consent first. This isn't an opinion. This has been my experience. I recall an incident where Windows was colluding with Intel to inject microcode into the Intel G3258 Silver Anniversary edition CPU to hobble the chip for 'security reasons' but it is my understanding that it was introduced as an optional update. This move prevented users from taking such liberties with the CPU as to attain clock speeds of over 5GHz on a little dual core that cost less than $100 US. For quite some time it was all the rave among gamers until it wasn't. Again, this isn't mere opinion. I own this CPU. I still tinker with it.

I would venture that if this is a paramount concern just turn off Windows Update altogether. Stuff happens and mis-clicks can be easily red as "yes". You can always turn on your permissions for updates when you're ready to receive them again. Even then there is no 100% guarantee that Windows won't foist an update on you in spite of this. After all, it is their software that you have been licensed to use and Microsoft reserves the right to do what they like with it. MS is notorious for their caveats. Herein lies the crux of the matter: Where does one draw the line? I like to draw it at the hardware but in principle I cannot trust the idea that Windows will not violate my preferences. Wishing you the best.

And no way to stop it just disable the updates

XPS 8950, BIOS settings, UEFI Firmware Capsule Updates | DELL Technologies

FYI, we disabled UEFI Firmware Capsule Updates in the BIOS (BIOS setup -> security -> UEFI capsule firmware updates -> Disable) in order to prevent Windows Update (WU) from automatically u...

www.dell.com

Scannerman · Apr 14, 2025

nissimezra said:
I'm glad that you had good experience with windows. I'm doing about 50 to 100 new install a month you are doing 1 year .
What a 100$ CPU with what I asked?

I simply used that as an example of what I knew about Microsoft messing with chip sets. You are concerned about something similar are you not?
I'm a PC builder. Why would you assume that I only do 1 installation a year? I'm sorry you have to keep reinstalling your OS. I would be upset too if I had to do that 50 to 100 times a month. I wasn't suggesting that your superior i5-4570 CPU was a lowly $100 piece of junk.

Scannerman · Apr 14, 2025

nissimezra said:
And no way to stop it just disable the updates

XPS 8950, BIOS settings, UEFI Firmware Capsule Updates | DELL Technologies

FYI, we disabled UEFI Firmware Capsule Updates in the BIOS (BIOS setup -> security -> UEFI capsule firmware updates -> Disable) in order to prevent Windows Update (WU) from automatically u...

www.dell.com

Interesting. I'm pretty sure I suggested a similar approach.

Bree · Apr 14, 2025

My Dell laptops (at least, the ones new enough to still get BIOS updates) routinely get BIOS updates through Windows Update, but these are always optional updates. I can decide whether to install or not.

However, if you have turned on 'Get the latest updates as soon they're available' then optional updates will get installed automatically.

Ghost1959 · Apr 14, 2025

I recently had an unwanted/unintended BIOS update performed on a client laptop and it completely bricked the BitLocker encryption. After the BIOS update it was asking for the reovery key and the key provided at the time of encryption was invalid. I have completely turned off updates on the laptop and do them manually making sure no firmware updates are launched. If a firmware update is considered critical I'll unencrypt first and then reencrypt. More time consuming but safer.

pseymour · Apr 14, 2025

You don't need to decrypt the drive to do a BIOS update. Just suspend BitLocker, do the update, and resume.

Suspend BitLocker protection for non-Microsoft software updates - Windows Client

Describes how to suspend and resume BitLocker protection for non-Microsoft software updates using Control Panel and PowerShell.

learn.microsoft.com

gunrunnerjohn · Apr 14, 2025

pseymour said:
You don't need to decrypt the drive to do a BIOS update. Just suspend BitLocker, do the update, and resume.

However, if Windows sneaks it in without your permission, then you have no chance to suspend BitLocker.

pseymour · Apr 14, 2025

Yes, I know that, Captain Obvious. I just said you don't need to decrypt the drive, which is a much lengthier operation than suspending.

TraderGary · Apr 14, 2025

The nice thing about a Dell BIOS update is that the Dell engineers have built BitLocker awareness into their BIOS update procedure. The update first looks to see if BitLocker is active and, if so, automatically, and transparently, does the BitLocker suspension before updating.

Scannerman · Apr 14, 2025

Bree said:
My Dell laptops (at least, the ones new enough to still get BIOS updates) routinely get BIOS updates through Windows Update, but these are always optional updates. I can decide whether to install or not.

However, if you have turned on 'Get the latest updates as soon they're available' then optional updates will get installed automatically.

View attachment 131246

Yes. And with Dell Windows already has Dell's authorization to do this, so technically it is a Dell BIOS update much like Intel's arrangement with Microsoft for microcode. This is what I was attempting to explain to the OP but Bree put it so much more succinctly. I recall accepting an optional BIOS update similar to this for 24H2 on my DELL touch screen laptop before I gave it to my daughter.

nissimezra · Apr 14, 2025

Scannerman said:
I simply used that as an example of what I knew about Microsoft messing with chip sets. You are concerned about something similar are you not?
I'm a PC builder. Why would you assume that I only do 1 installation a year? I'm sorry you have to keep reinstalling your OS. I would be upset too if I had to do that 50 to 100 times a month. I wasn't suggesting that your superior i5-4570 CPU was a lowly $100 piece of junk.

100 for different customers not for me. I never had a problem with my OS because I never update it.

Scannerman · Apr 15, 2025

nissimezra said:
100 for different customers not for me. I never had a problem with my OS because I never update it.

After re-reading your original post I think perhaps I misunderstood what you were communicating. I have no solution for this apart from blocking Windows Updates altogether because different proprietary builds hold different policies with Microsoft. I think you want something very specific that exclusively blocks Windows from updating the BIOS and it has been my experience that Windows won't update your BIOS without the correct permissions. Perhaps there is a CMD for this that I am not aware of.

nissimezra · Thursday at 4:32 PM

Scannerman said:
After re-reading your original post I think perhaps I misunderstood what you were communicating. I have no solution for this apart from blocking Windows Updates altogether because different proprietary builds hold different policies with Microsoft. I think you want something very specific that exclusively blocks Windows from updating the BIOS and it has been my experience that Windows won't update your BIOS without the correct permissions. Perhaps there is a CMD for this that I am not aware of.

No worries all good.
I just don't want to have a bios update in a customer laptop while it's in my lab. Just installing windows and drivers is my responsibly and I want to keep it that way

nissimezra · Thursday at 4:36 PM

pseymour said:
I would keep a flash drive of current firmware versions and flash the devices before I image them. I know Dell recommends this; other OEMs probably do also. That also keeps the device from wanting to do a firmware update when the user finally gets it.

If the bios fail during update, sadly no flash drive will help. the only way to recover is using CH341A programmer, its long. removing the bios chip, find a good bin file, program back and solder back the chip.

Scannerman · Thursday at 5:37 PM

nissimezra said:
If the bios fail during update, sadly no flash drive will help. the only way to recover is using CH341A programmer, its long. removing the bios chip, find a good bin file, program back and solder back the chip.

I have a personal friend who does this sort of thing and you are correct. He has one of these devices and it is painstaking work. He also knows how to use a compiler. This is well beyond my capability. In my recent years of PC building I was not familiar with Microsoft just up and flashing my BIOS without express consent from the user. After doing some research I discovered that this is not always the case. IMO that is just out right crazy and callous hubris. This is what I've been ranting on about for years: They take ownership of your hardware. Policies like this ought to be considered criminal.

Imagine being in the middle of servicing a PC for a client and suddenly the PC decides to up and flash the BIOS. This could happen at the most inopportune moment, say like in the middle of a power failure. This is insane! Admittedly, I'm kind of old school and I'm a little glad that this doesn't happen on any of my PCs because they are old like me. But perhaps I speak to soon. What with CSM and TPM2 who knows what they will pull next? They've already made dual booting next to impossible to sustain.

The only other thing I can think of is to make sure the app that flashes isn't on the PC before you do the work and keep it disconnected from the internet until it is absolutely necessary to use the device online.

gunrunnerjohn · Friday at 9:50 AM

Scannerman said:
I have a personal friend who does this sort of thing and you are correct. He has one of these devices and it is painstaking work. He also knows how to use a compiler. This is well beyond my capability. In my recent years of PC building I was not familiar with Microsoft just up and flashing my BIOS without express consent from the user. After doing some research I discovered that this is not always the case. IMO that is just out right crazy and callous hubris. This is what I've been ranting on about for years: They take ownership of your hardware. Policies like this ought to be considered criminal.

While it's certainly possible to reflash a BIOS chip if you remove it, the programmer has to have an adapter for each footprint if you want to reprogram it. Also, forget about a compiler in this scenario, that would require you have the BIOS source code, and I'm 100% certain that's not available. :)

Most modern motherboards do have the capability to reprogram even a bricked BIOS, the Gigabyte MB's I use have a shadow BIOS (the previous version) that can be invoked if you brick the upgrade.

hsehestedt · Friday at 10:38 AM

antspants said:
Not sure if that’s actually factual unless you’ve agreed to include driver updates. I’ve never had it happen. Not for PC’s or Laptops

I've had this happen on an ASUS laptop as well as on a Lenovo laptop.

Winuser · Friday at 12:26 PM

It happened on one of my laptops. I didn't know it happened until I found out it went back to using modern standby and I couldn't change it.

Disable forced bios update on windows

Active member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

freshly showered

My Computers

Well-known member

My Computers

freshly showered

My Computers

Stock Market Wizard

My Computer

Well-known member

My Computer

Active member

My Computer

Well-known member

My Computer

Active member

My Computer

Active member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Similar threads