Driver and Firmware Steps

Most first-party components run a PowerShell script. Two do not. Install Driver Pack and Install BIOS Update are directive-based: instead of running a script body, the desktop agent detects the host's hardware and pulls the matching package from the Coldsea catalog. You do not supply manufacturer or system IDs. The agent works them out on the machine.

You install and configure them the same way as any other component, from the Marketplace and then the step's Setup tab. See Installing from the Marketplace if you have not added a component before.

Install Driver Pack

Add the component to a workflow, select the step, and open its Setup tab. There are two fields.

  • Fail if no matching driver pack. Off by default. When it is off and the catalog has no driver pack for the detected hardware, the step warns and continues. Turn it on to make a missing pack fail the step instead. The same setting covers a pack that matches but cannot be downloaded or applied: the step fails when it is on, and warns and continues when it is off. Leave it off when driver installation is best-effort, turn it on when a machine is not usable without its drivers.
  • Pin to a specific driver pack. Optional. Leave it blank to install the latest matching pack. Enter a driver pack ID to install that exact pack instead, which is useful when you need to hold a fleet on a known-good version.

Install BIOS Update

Add the component, select the step, and open its Setup tab. There are two fields.

  • Pin to a specific BIOS version. Optional. Leave it blank to apply the latest matching update. Enter a BIOS package ID to apply that exact version instead.
  • Wait for AC power (minutes). 30 by default, from 0 to 1440. Losing power partway through a firmware update can leave a machine unable to boot, so the step does not start the update on battery. If the machine is on battery, the step pauses and waits up to this many minutes for AC power, and continues as soon as the machine is plugged in. If power does not return in time, the step fails and the BIOS is not touched. Set it to 0 to fail right away instead of waiting.

While a firmware step waits for AC power, the deployment shows a Paused blocked status rather than appearing stalled, and the Blocked filter on the deployments list finds it. The deployment still counts as running, so its output keeps streaming and you can still abort it. Someone at the machine sees a banner explaining the pause and can choose Flash on battery anyway to apply the update without waiting. Only do that when the battery is well charged.

If you installed Install BIOS Update before the wait setting was added, its Setup tab does not show the field. The step still waits 30 minutes for AC power on machines running the latest version of the agent. To choose a different wait, remove the old copy from your Task Library, install the component again from the Marketplace, and add the new step to your workflows.

Package verification

Driver packs and BIOS updates run with administrator rights, so every package is checked before it runs. Coldsea downloads each package from the manufacturer once and confirms it matches the checksum the manufacturer published. The agent then checks the copy it downloads against that checksum and against the checksum of Coldsea's copy. A package that fails any check is never installed or flashed.

If the manufacturer's file does not match its own published checksum, the step reports that the package failed the manufacturer's checksum. Install BIOS Update fails. For Install Driver Pack, the Fail if no matching driver pack setting decides whether the step fails or warns and continues. Coldsea does not download that package again until the manufacturer publishes a new checksum for it, which the catalog picks up on its next sync.

BIOS admin password

Machines with a firmware password reject BIOS changes until the password is supplied. Rather than putting that password in a workflow, store it once for the organization. The firmware step then receives it automatically at deployment time.

  1. 1

    Open the Security tab

    Go to Settings, then Organization, then the Security tab. The panel shows whether a password is Configured or Not set.

  2. 2

    Set or rotate it

    Enter a value and choose Save to set it, or Rotate to replace one that already exists.

  3. 3

    Clear it when it changes

    Choose Clear to remove the stored password, for example when the firmware password is retired.

The value is encrypted at rest and is write-only. It is not shown again after you save it, it is not returned by the API, and it is redacted from the audit log. A deployment receives it only when it contains a step that configures firmware, and it is never stored in a published workflow version. Setting and clearing the password are both recorded in the audit trail, without the value.

The Security tab appears only for organization owners and admins. Members without permission to manage organization secrets do not see it.