Updating Bios via SSM + HpSoftPaQ

[AlexB3]

Hello all,

We are trying to do an BIOS (meltdown/spectre) update on our desktops (HP Elite 8200 / G1TWR and G2) using SSM  but we encounter multiple errors like : 

SSM Version: 3.2.7.1 (3.2.7.1)

User Name: SYSTEM

Parameters: /TEMP:"C:\Windows\TEMP\SSM4327.tmp" /SSMFS:"\\SERVERSHARE\HPSSM" /SSMPATH:"C:\Windows" \\SERVERSHARE\HPSSM\ /a /Currentsetuppasswordfile:\\SERVERSHARE\HPSSM\140.bin /noreboot /edebug /log:\\SERVERSHARE\Log_HP\



Errors HP Business Desktop System BIOS (L01) (SP84334.CVA): Problem encountered when launching the install command. Command line was (cmd.exe /c ""hpqflash\hpqflash.exe" -s -a -p"C:\Windows\TEMP\SSM4327.tmp\PWDBC3C.tmp"") which returned (Assuming Failure (Return code = 0x103))

Batfile  executed via GPO : 

\\SERVERSHARE\HPSSM\ssm.exe \\SERVERSHARE\HPSSM\ /a /Currentsetuppasswordfile:\\SERVERSHARE\HPSSM\140.bin /noreboot /edebug /log:\\SERVERSHARE\Log_HP\

On other devices it keeps updating the same version  or getting error that silent install is not available.

Any solutions?

Thank you!

[CF4]

Hi

HP have prepared 3 rather lengthy documents,
and there are videos to watch, to cover, seemingly, all BIOS eventualities.

BIOS Problems LAPtops.
https://support.hp.com/us-en/document/c02693833


BIOS Problems DESKtops.
https://support.hp.com/us-en/document/c00007682

BIOS CheckSum error
https://support.hp.com/us-en/document/c01368145

But they may not be relevant to your situation.

[AlexB3]

No it dosent apply here. 

[sauvesean]

I am also having the same failure code 0x103 when using HP SSM to update the BIOS.  Specifically, my model is the EliteDesk 800 G1, SP84334 (different model, same softpaq).

The guidance posted by CF4, while very well written, is not applicable to this situation.  The problem here seems to be only when using HP SSM.

The 0x103 means that the password file could not be found.  However, in practice this error can indicate other problems (based on my reading of other forum posts).  So, I have:

 - Regenerated the password file

 - Checked the BIOS password on an affected machine

 - Confirmed that the HP Support Solutions Framework Service is installed on the target machine, and in a running state.

Despite the above troubleshooting steps, the problem remains.  The error messsage I am receiving is:

 HP Business Desktop System BIOS (L01) (SP84334.CVA): Problem encountered when launching the install command. Command line was (cmd.exe /c ""hpqflash\hpqflash.exe" -s -p"C:\ssm\PWDCD0F.tmp"") which returned (Assuming Failure (Return code = 0x103))

I am not sure if HP offers support for SSM problems, but I will be calling them to check.

[sauvesean]

I fixed the problem on my end.  The problem was that the HpqPswd.exe that is a part of SSM is *different* than the HpqPswd.exe that the BIOS update is expecting.  BIOS update softpaqs include a copy of HpqPswd.exe, and despite having the same file name, it produces a different output bin file than the SSM version.  That to me is fairly silly, and although I've fixed this particular softpaq, it remains to be seen if it creates descrepancies for my other models and softpaqs.

Here are some steps to follow:

1. Download the Softpaq for your BIOS update (sp84334 in this case).

2. Run the softpaq to extract the files inside of it to c:\swsetup\sp84334\

3. Run the HpqPswd.exe in c:\swsetup\sp84334\HPQFlash\ and create a password bin file

4. Copy the bin to your SSM file system, and point your SSM command line deployment to this new bin file

After doing this, the BIOS update went fine; this time....

[AlexB3]

Hy,

So i did recreate the pwd.bin file with SP84334 and after i tried to import it in SSM i got the message : Unsuported password bin file 😞 

What version of SSM are you using  and what was the command line to invoke SSM ?

Thank you 

*Edit _ Partial Working

It didnt work the first time because it seems SSM cannot run via computer policy ..... If i do it manualy  it works .  How do you deploy it ?

Thank you.

[scott-HOPE]

Does SSM have to be run as a local administrator? or computer account?

Thanks..

[sauvesean]

SSM has to be run first as an administrator to build the catalog, then when you run on the client you should run as administrator.  Myself, I run as an domain account with administrator rights on all domain-joined computers, as well as having read access to the SSM file store share and write access to the SSM log share.

[sauvesean]

@AlexB3

Try the switch /cpwdfile:"\\SERVERSHARE\HPSSM\140.bin"

I always use quotes to surround the password file location; not sure if that is required or not...

[sauvesean]

In case anyone is interested, here is the code that I use to run SSM.  It is kicked off using PDQ Deploy and PowerShell remoting.

[void] [System.Reflection.Assembly]::LoadWithPartialName("System.Drawing") 
[void] [System.Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms")

function RestartFormFinished()
{
    $objForm.Hide()
}

function RestartFormTicker()
{
    $script:countDown--
    $objLabel.Text = "Your system will restart in $script:countDown seconds"
    If($script:countDown -le 0) {
        RestartFormFinished
    } 
}

function RestartFormSetup()
{

    #Timer
    $script:countdown = 240
    $timer = New-Object System.Windows.Forms.Timer
    $timer.Interval = 1000
    $timer.add_tick(
        {
            RestartFormTicker
        }
    )

    #Form
    $objForm = New-Object System.Windows.Forms.Form 
    $objForm.Text = "HP Updates - Restart Needed"
    $objForm.Size = New-Object System.Drawing.Size(400,300)
    $objForm.AutoSize = $true 
    $objForm.StartPosition = "CenterScreen"
    $objForm.FormBorderStyle = 'FixedSingle'
    $objForm.MinimizeBox = $false
    $objForm.MaximizeBox = $false

    #Label
    $objLabel = New-Object System.Windows.Forms.Label
    $objLabel.AutoSize = $false
    $objLabel.Font = '40'
    $objLabel.TextAlign = 'MiddleCenter'
    $objLabel.Dock = 'Fill'
    $objLabel.Text = "Your system will restart in $countDown seconds"

    #Restart now button
    $btnRestart = New-Object System.Windows.Forms.Button
    $btnRestart.Location = New-Object System.Drawing.Size(50,200)
    $btnRestart.Size = New-Object System.Drawing.Size(300,50)
    $btnRestart.Text = "Restart Now"

    $btnRestart.Add_Click(
        {
            RestartFormFinished
        }
    )
    $objForm.Controls.Add($btnRestart)
    $objForm.Controls.Add($objLabel)

    #Activate and show form
    $objForm.Add_Shown(
        {
            $objForm.Activate()
        }
    )

    $timer.start()

    [void] $objForm.ShowDialog()
}


<#
.Synopsis
    Runs HP System Software Manager
.DESCRIPTION
    Runs HP System Software Manager
.EXAMPLE
    Run-HPSSM 
.EXAMPLE
    Another example of how to use this cmdlet
#>
function Run-HPSSM
{
    [CmdletBinding()]
    Param
    (
        #
        [Parameter(Mandatory=$false, Position=0)]
        [string]$ExePath='\\fileserver\SSMFS\SSM.EXE',
        #
        [Parameter(Mandatory=$false, Position=1)]
        [string]$FileSystemPath='.',
        #
        [Parameter(Mandatory=$true, Position=3)]
        [ValidateSet("report", "install")]
        [string]$Mode,
        #
        [Parameter(Mandatory=$false, Position=2)]
        [string]$WorkingDirectory='\\fileserver\ssmfs',
        #
        [switch]$NoDialog=$false,
        #
        [Parameter(Mandatory=$false)]
        [int]$TimeToCancel=0,
        #
        [Parameter(Mandatory=$false)]
        [int]$InstallTimeout=0,
        #
        [switch]$Accept=$false,
        #
        [Parameter(Mandatory=$false)]
        [string]$PasswordFile='',
        #
        [switch]$SSMDebug=$false,
        #
        [Parameter(Mandatory=$false)]
        [switch]$NoReboot=$false
        
    )
    
    Begin
    {
    }
    Process
    {
        $ArgumentList = ('"' + $FileSystemPath + '"' + " /$Mode")
        If($NoDialog) { $ArgumentList += " /nodialog" }
        If($TimeToCancel -ne 0) { $ArgumentList += " /cancel:$TimeToCancel" }
        If($InstallTimeout -ne 0) { $ArgumentList += " /timeout:$InstallTimeout" }
        If($Accept) { $ArgumentList += " /accept" }
        If($PasswordFile -ne '') { $ArgumentList += (' /cpwdfile:"' + $PasswordFile + '"') }
        If($SSMDebug) { $ArgumentList += " /debug" }
        If($NoReboot) { $ArgumentList += " /noreboot" }

        $params = @{
            'FilePath'          = $ExePath;
            'ArgumentList'      = $ArgumentList
            'WorkingDirectory'  = $WorkingDirectory;
            'WarningAction'     = 'Continue';
            'LoadUserProfile'   = $true;
            'Wait'              = $true;
        }

        Start-Process @params
            

        
    }
    End
    {
    }
}


function UpdatesAvailable(){

    Run-HPSSM -Mode 'Report' -NoDialog

    $filePath = "$env:LOCALAPPDATA\temp\$env:COMPUTERNAME.htm"
    $fileContents = $(Get-Content $filePath -Raw)
    $firstHtml = ($fileContents -split "</html>" | select -index 0) + '</html>'

    $strNoUpdates = '<h3 id="UpPerformed"><a>Updates Performed</a></h3>

<ul></ul>'

    return (!($firstHtml -like "*$strNoUpdates*"))
}

function SSMErrorsFound() {

    $filePath = "$env:LOCALAPPDATA\temp\$env:COMPUTERNAME.htm"
    $fileContents = $(Get-Content $filePath -Raw)
    $firstHtml = ($fileContents -split "</html>" | select -index 0) + '</html>'
    $log =  New-Object -ComObject "HTMLFile"
    $log.IHTMLDocument2_write($firstHtml)
    return $log.IHTMLDocument3_getElementById("ErrorList").innerhtml

}

function EmailLogs() {
    param([switch]$SSMDebug=$false)
    
    $attachments = @("$env:LOCALAPPDATA\temp\$env:COMPUTERNAME.htm")
    if($SSMDebug) { $attachments += "$env:LOCALAPPDATA\temp\$env:COMPUTERNAME.ssmtrace" }

    $param = @{
        'To'            = 'toemail@uss.salvationarmy.org';
        'From'          = 'fromemail@uss.salvationarmy.org';
        'Subject'       = "HP System Software Manager Error On $env:COMPUTERNAME";
        'Body'          = (Get-Content "$env:LOCALAPPDATA\temp\$env:COMPUTERNAME.htm" -Raw);
        'BodyAsHtml'    = $true;
        'Attachments'   = $attachments;
        'Verbose'       = $true
        'SmtpServer'    = '10.0.0.50'

    }

    Send-MailMessage @param
}

function SuspendBitLocker() {
    $bitlocker = (get-bitlockervolume -MountPoint $env:systemdrive)
    if($bitlocker.ProtectionStatus -eq 'On') {
        Suspend-BitLocker -MountPoint $bitlocker.MountPoint
    }
}

function ResumeBitLocker() {
    $bitlocker = (get-bitlockervolume -MountPoint $env:systemdrive)
    if(!($bitlocker.VolumeStatus -eq 'FullyDecrypted')) {
        Resume-BitLocker -MountPoint $bitlocker.MountPoint
    }
}

function DisableHPPasswordManager {
    $key = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon'
    $name = 'Userinit'
    $DPAgentPath = "${env:ProgramFiles(x86)}\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe,"

    $oldValue = (Get-ItemProperty -Path $key -Name $name).Userinit

    if($oldValue.Contains($DPAgentPath))
    {
        $newValue = $oldValue.Replace($DPAgentPath,'')
        New-ItemProperty -Path $key -Name $name -Value $newValue -PropertyType STRING -Force
    }
}

#Main

#Check if on battery power.  Do not run if on battery power
$continue = $true
$classExists = (Get-WmiObject -List -Namespace root\wmi | Where Name -eq 'BatteryStatus')
if($classExists)
{
    if(!([BOOL](Get-WmiObject -Class BatteryStatus -Namespace root\wmi ).PowerOnLine))
    {
        $continue = $false
    }
}
if(!($continue))
{
     Write-Error 'SSM Should not be run while on battery power.'
     Exit 1
}

#Check if updates are available.  If no updates are available, we are done.
If(!(UpdatesAvailable)) {
    Write-Error 'No updates available'
    Exit 69001 #No updates
}

#Delete C:\SSM so we can see later if the user chose to proceed with installation
If(Test-Path -Path $env:SystemDrive\ssm\) {
    Remove-Item -Path $env:SystemDrive\ssm\ -Force -ErrorAction Stop -Recurse
}

#Suspend BitLocker
SuspendBitLocker

#Run SSM
Run-HPSSM -Mode 'Install' -InstallTimeout 60 -TimeToCancel 240 -NoReboot -Accept -Debug -PasswordFile '\\fileserver\SSMFS\AdminPwdHPQFlash.bin'

# the c:\ssm folder is only created if the user didn't press 'Later'.  If they did press later, then resume bitlocker and we are done.
If(!(Test-Path -Path "$env:SystemDrive\ssm\")) {
    ResumeBitlocker
    Write-Error 'User cancelled installation'
    Exit 1602 #User cancelled installation.
}

#Nobody likes HP Password Manager.  Disable it in case it was installed during this update.
DisableHPPasswordManager

#Parse the logs to see if any errors occured.
$errorsFound = SSMErrorsFound  
       
If($errorsFound) {
            
    $exitCode = 69002 #Errors found, Check logs for details
    EmailLogs

    RestartFormSetup
    
    <#If(Test-Path -Path $env:SystemDrive\ssm\) {
        Remove-Item -Path $env:SystemDrive\ssm\ -Force -ErrorAction Continue -Recurse
    }#>

    Restart-Computer -Force

    Exit 69002 #error found

} else {

    $exitCode = 1641 #The requested operation completed successfully. The system will be restarted so the changes can take effect.

    RestartFormSetup
    
    <#If(Test-Path -Path $env:SystemDrive\ssm\) {
        Remove-Item -Path $env:SystemDrive\ssm\ -Force -ErrorAction Continue -Recurse
    }#>

    Restart-Computer -Force

    Exit 1641

}