This feature allows Org Admins, IT Admins and MSP Admins to
centrally manage Windows BIOS, drivers and firmware updates on any Lenovo
Windows device. Updates are checked in three scenarios:
- When
new devices are claimed and licensed.
- On-demand
from the System Update page by clicking on the Check for updates link.
- As
enabled from Policy Management/Feature Settings/Features/System Update Preferences.
Key Features
- Remote
Deployment: Available updates can be deployed remotely at any time to
one or more devices, as well as to groups of devices.
- User
Control: End users can accept or deny updates requiring a reboot based
on the deferral configuration set in Device Management.
- Tracking:
All System Update installations are tracked through the System Update
Status Report.
This feature requires
either a Pro or a Premium license and a
special add-in service on the device to check for updates from the Lenovo
repository. Most Lenovo devices are automatically preloaded with this service
but if it was removed or your custom preload does not include it, Device
Management can automatically install it during provisioning. To enable
automatic validation for the service, go to Policy Management/Feature Settings/Features/System
Update Preferences.
Troubleshooting
To enable System Update to seamlessly push BIOS updates to
devices without requiring a Supervisor Password, the following BIOS settings
are required on the device. These settings are pre-configured by
default in the correct state for remote updates. However, if these values have
not been manually modified on the target device, they will need to be adjusted
back to the following:
To use this feature, navigate to App Management >
System Update.
The Schedule available updates button is in the
top-left corner of the page. It is available across all tabs (Update, Updates
by Devices, Updates by Groups, Scheduled Updates, Test History) and subtabs
(All, Non Tested, Testing, Allowed to Deploy, Blocked), and works in
combination with the selected filters and Search box.
Click the Schedule available updates button.
A pop-up window appears, offering two options: Deploy Now and Schedule
Deployment. Choose an option and follow the steps described in the Deploying
Updates (Update button) section under the Updates Tab below.
The Check for updates button is located at
the top-right corner of the page. Clicking this button triggers a scan for all
Pro and Premium licensed devices in the organization.
Once the scan starts, each device searches for updates and
sends any newly found updates to Device Management. This process typically
takes a few minutes.
If the option Automatically
Scan only for New Updates under Policy Management > Device Management
Organization Settings > Feature is enabled, the Check for
updates link will be disabled for 30 minutes immediately after the last
automatic scan is initiated.
Updates Tab
- Each
update listed in the following subtabs has a small downward arrow to
its left. Click the arrow to expand the accordion and view the
corresponding list of devices.
- Click
the Eye icon to access detailed information about the
update.
- For
updates categorized as Critical or Recommended, a downloadable ReadMe file
is available with additional details.
- You
can further refine the displayed list of updates by filtering based
on Severity, Update Type, or Reboot Status.
All subtab
This subtab displays all packages in any of the possible
Test states. Click the downward arrow next to a package to expand the accordion
and view the devices associated with it.
Not Tested Subtab
All new updates are assigned the Non tested state and
appear in this subtab. This state indicates that the updates have not yet been
validated. Updates that are not authorized for deployment will also appear in this subtab with the Non tested state.
Not Tested, Testing, Allowed to Deploy and Blocked statuses, the Test History, etc. are only available if the Update
Testing functionality is enabled under Policy Management > Feature
Settings > System Update Settings. Testing Subtab
This tab displays updates in the following states: Running
Test, Scheduled for Testing or Test Completed.
To track the installation status of an update during
validation, click the downward arrow next to the update. The Tested
Devices button displays the installation status of this update across
all devices selected for testing.
Once the installation process is complete and the test is
finished, the system updates the test state to Test Completed and
sends a notification email to the Admin. The Admin can then choose one of the
following actions:
- Allow
to Deploy: Selecting this option enables the update to be deployed to
all types of devices. The update is removed from this tab and moved to
the Allow to Deploy subtab.
- Block
Update: Selecting this option removes the update from this tab and
moves it to the Blocked subtab. Blocked updates cannot be
deployed to any device.
Other actions the Admin can perform:
- Add
devices / Remove devices: Modify the list of devices involved in the
test. You can add and remove devices; however, there is one restriction:
if there is only one device scheduled for the test you cannot delete
it.
- Edit
Schedule: Change the date and time for the scheduled test.
- Cancel
Schedule: Cancel a scheduled test. The update will be returned to the Not
Tested subtab.
While the package is being tested, the system will
prevent other users from deploying this package on other devices that where not
selected to be part of this test.
Allowed to Deploy subtab
This subtab displays packages that have been validated by
the Org Admin and are safe to deploy on all device types.
If you need to block an update, expand the accordion, click Block
Update, and confirm by selecting Yes, block. Alternatively, you can
restart the testing process by clicking Restart.
Once blocked, the package will be moved to the Blocked subtab
and can no longer be deployed to any device.
Blocked Subtab
This subtab displays the packages that were blocked by the
users. These updates cannot be deployed on any device.
- To unblock updates, select the checkboxes of the updates you
want to unblock and click Unblock update(s).
- To make the updates available for deployment, click Allow
to deploy.
To test updates:
- Click
the downward arrow to expand the accordion.
- Select
the device(s) you want to include in the test.
If the status of an update is Test Completed, it will not be listed
because it still requires the Org Admin to either approve or deny its
deployment.
- Click Test.
- A
pop-up window appears with the options Test Now or Schedule
Test.
- Test Now. Starts the test immediately on the
selected device(s).
- Schedule Test. Schedules the test to start at a
specified date and time.
- Select a date and a time.
- Click Next. A confirmation window
will appear, displaying details about the scheduled update and the associated
devices.
- Click Submit.
When the scheduled time is reached, the test
will start, the update will be moved to the Testing subtab,
its state will change to Running Test, and it will be marked as In
Test.
To deploy a system update:
- Select
a device or a device group, if applies, to view all available system
updates for that device or group.
- Expand
the system update accordion to view the list of devices associated with
that update.
- Select
the checkboxes next to the devices you want to update.
- Click Update to
begin the installation.
- A
pop-up window will appear with the options Deploy Now and Schedule
Deployment
- Deploy Now
- Select
this option to deploy the updates immediately.
- Click Next.
- A notification window will appear, displaying a
list of updates affected by this operation.
- Detailed information for each update is
presented, similar to the System Update page.
- However, if the status of an update is Test
Completed, it will not be listed because it still requires the Org Admin to
either approve or deny its deployment.
- You
can expand the accordions to view the list of devices that each update will be
applied to.
- Click Submit.
This operation will take some minutes.
- Schedule Deployment
Select a specific Date and Time for deploying
the update.
If devices are in different time zones, ensure the selected date and time is in the future for all devices. For example, if you have a device in India and another in Brazil, the India time zone is ahead of Brazil by several hours. To accommodate this, you must select a date and time that is several hours ahead of Brazil's local time, as this will be the earliest allowable time for deployment across all devices.
However, to prevent users from being blocked by a long-running operation, a minimum limit of 24 hours ahead has been set to ensure compatibility across all time zones.
- Click Next.
- An information window appears
showing the selected date and time, and information about the updates
programmed to be deployed.
- Whether you choose Deploy Now or Schedule Deployment, you can use the search box to deploy a specific device, group, or update—depending on the tab you are currently in.
- The Schedule All Available Updates will remain disabled for 5 minutes to avoid overlapping operations.
- If the Status of a system update displays Reboot Required, it indicates that the device has deferred the reboot the maximum number of times allowed (for more information, refer to Using Policy Management. In this case, the checkboxes for all updates will be disabled.
- Click Submit.
Updates by Devices Tab
Displays all available system updates for each device.
- Expand
the device accordion to view all packages available for that specific device.
The table displays update-specific information, including System Update
Description, Update Type, Test Status, Severity, Status, and Reboot Type. All
columns can be sorted. Click the eye icon to view additional details.
- Select the checkboxes next to the system updates you want to deploy.
- Click Update. Repeat this process for other devices, if applicable.
- A pop-up window will appear with the options Deploy Now and Schedule Deployment.
- Choose one of these options and follow the steps explained on section Deploying Updates (Update button) section under the Updates Tab section above. The procedure explained in that section is the same.
Updates by Groups Tab
This section displays all available system updates for each
device group. You can either Test the update on selected device(s) or proceed
to Update and deploy it immediately. Refer to the Testing Updates (Test
button) or Deploying Updates (Update button) sections under
the Updates Tab section above.
- Only
devices within a group that require the update will be listed.
- If a
device is not shown in the list, be sure it is assigned a Pro or a Premium
license.
Scheduled Updates Tab
This page displays all created schedules, which can be
filtered, deleted, and edited.
Filtering updates
Updates can be filtered by:
- Severity
- Update
Type
- Reboot
Status
Deleting a Schedule
To permanently remove a specific schedule:
- Select
the checkbox next to the schedule you want to delete.
- Click Delete.
- Click Confirm
Delete.
A confirmation message will appear, and the page will
reload.
Editing Schedules
To edit a scheduled system update:
- Select
the checkbox next to the system update(s) you want to edit.
- Click Edit.
- A
pop-up window will appear, where you can modify the schedule for the
selected update(s). If the update includes multiple devices in different
time zones, the new schedule will follow the same rules as those applied
when creating a new schedule: the system ensures that the deployment time
is scheduled in the future for all devices.
- Click Edit.
Test History Tab
Displays results for ongoing, scheduled and allowed or
blocked packages. When a schedule is edited or deleted, its details are updated
in the table. Similarly, changing a concluded package from allowed to blocked
(or vice versa) updates the table accordingly. Additionally, the Test History
tab is linked to the other test-related tabs.
If the Update Testing feature is disabled
in Policy Management > Device Management Org Settings >
Feature > System Update Preferences, the tab remains hidden until
re-enabled. When reactivated, all historical data is restored without loss.
This button opens a pop-up window displaying the tested
devices. If the devices were selected through a group, the group name will also
be shown, along with the installation status and date.