Invoke-OEMUpdateWithPrompt

Overview

Safely deploy OEM BIOS and firmware updates without interrupting user workflows. This script prompts end users to schedule or postpone updates, preventing unexpected restarts and data loss.

Designed for RMM platforms, it requires only a single deployment. The script automatically handles the prompt cycle, language localization (English/Dutch), and forced reboots via self-managing Windows Scheduled Tasks.

Requirements

Requirement	Details
Operating System	Windows 10 or Windows 11
PowerShell	Version 5.0 or later
Execution Context	Administrator / SYSTEM (via RMM)
Internet Access	Required to download the prompt interface and vendor update tools

Note: All dependencies, including the prompt engine and logging modules, are automatically bootstrapped on the first run.

Dependencies

• OmniPrompt
• SilentLauncher
• Initialize-DellCommandUpdate
• Initialize-HPImageAssistant
• Install-LenovoUpdates
• Install-WindowsUpdates

Before You Deploy

Understand how the script behaves in production before adding it to your RMM policies:

• Single Deployment: Run this script once per device via your RMM. It creates background scheduled tasks to handle all subsequent prompts, postponements, and the final update.
• Forced Reboots: Firmware and BIOS updates require restarts. Once the user's scheduled time arrives (or postponements run out), the device will install the updates and forcefully reboot.
• BitLocker Protection: Always use -HandleBitLocker on encrypted devices. This prevents the dreaded BitLocker recovery screen after a firmware update.
• User Presence: By default, prompts only show when a user is actively logged in and unlocked. Use -IfNotLoggedIn to push updates to unattended machines, or -MaxMissedPromptsBeforeForce to force updates on devices that stay locked for too long.
• Business Hours: Protect user productivity by pairing -SkipWeekends with -SuppressPopupTimeWindows '1800-0900' to hide prompts during nights and weekends.
• Restarting the Cycle: If a policy reapplies or you need to reset a stuck device, use the -Force parameter to wipe existing tasks and start the prompt cycle from zero.
• Offline Devices: The script requires internet access to fetch update tools. If a device is offline, it quietly reschedules itself until a connection is restored.

Deployment Examples

Standard deployment (5 postponements, 4-hour intervals):

.\Invoke-OEMUpdateWithPrompt.ps1

Respect business hours and weekends:

.\Invoke-OEMUpdateWithPrompt.ps1 -MaxPostpone 3 -IntervalMinutes 120 -SkipWeekends -SuppressPopupTimeWindows '1800-0900'

Force updates on unattended/locked devices:

.\Invoke-OEMUpdateWithPrompt.ps1 -IfNotLoggedIn -MaxMissedPromptsBeforeForce 3 -UpdateDuringSuppress

Suspend BitLocker on encrypted devices:

.\Invoke-OEMUpdateWithPrompt.ps1 -HandleBitLocker

Use generic Windows updates instead of OEM tools:

.\Invoke-OEMUpdateWithPrompt.ps1 -UsePsWindowsUpdate

Reset a stuck prompt cycle:

.\Invoke-OEMUpdateWithPrompt.ps1 -Force

Prompt Cycle Walkthrough

Standard Cycle (English)

1. Prompts 1 to 5: The user sees a warning and clicks Postpone. The script checks back in 4 hours.
2. Final Prompt: Postponements are exhausted. The user must pick a time within the next 48 hours using the date/time picker. If ignored, the update forces automatically after the timeout.
3. Reminder: 10 minutes before the chosen time, a final "Starting Soon" warning appears.
4. Execution: The update installs and the device forcefully reboots.

Automatic Localization

If the logged-in user's Windows display language is set to Dutch (nl-NL or nl-BE), all prompts and buttons automatically translate (e.g., Uitstellen, Nu bijwerken, Update plannen). No extra parameters are required.

Suppression & Unattended

If -SkipWeekends and -SuppressPopupTimeWindows '1800-0900' are used:

• Prompts are hidden on weekends and between 6 PM and 9 AM.
• If -IfNotLoggedIn is added, the script will silently install updates and reboot the machine if no user is logged in during allowed hours.

Parameters

Parameter	Alias	Default	Description
MaxPostpone	MaxDefer	5	Maximum postponements before the final scheduling prompt appears.
IntervalMinutes	Interval	240	Minutes between prompt attempts.
RegularPromptTimeout	Timeout	600	Seconds before an ignored prompt auto-closes and counts as missed.
FinalPromptTimeout	FinalTimeout	900	Seconds before the final scheduling prompt times out and forces the update.
DelayAfterFinalPrompt	Delay	600	Grace period (in seconds) before forcing the update after a timeout.
SuppressPopupTimeWindows	Suppress		24-hour time window to hide prompts (e.g., 1800-0900).
SkipWeekends	NoWeekends	False	Hides prompts on Saturdays and Sundays.
IfNotLoggedIn	Unattended	False	Bypasses prompts and runs the update immediately if no user is logged in.
MaxMissedPromptsBeforeForce	MaxMissed	0	Forces the update after this many consecutive missed prompts on locked devices.
UpdateDuringSuppress	ForceDuringSuppress	False	Allows forced/unattended updates to bypass suppression windows and weekends.
Force	Recreate	False	Clears active tasks and restarts the prompt cycle from zero.
UsePsWindowsUpdate	WindowsUpdate	False	Uses generic Windows updates instead of OEM-specific vendor tools.
Icon	IconUrl		URL or local path for the prompt window icon.
HeaderImage	HeaderUrl		URL or local path for the prompt window header banner.
HandleBitLocker	BitLocker	False	Suspends BitLocker for one reboot to prevent recovery key prompts.
OEMScriptParametersOverride	Override		Passes custom arguments directly to the underlying vendor update script.

Logs and Artifacts

Log Locations

Logs are automatically generated in the script's working directory.

• Initial RMM Run: C:\Windows\Temp\Invoke-OEMUpdateWithPrompt-log.txt (or your RMM's temp folder).
• Scheduled Runs: C:\ProgramData\_Automation\Script\Invoke-OEMUpdatePrompt\Invoke-OEMUpdateWithPrompt-log.txt
• Vendor Update Logs: Stored in C:\ProgramData\_Automation\Script\<VendorName>\ (e.g., Initialize-DellCommandUpdate-log.txt).

Scheduled Tasks Created

• Scheduled_Task_Invoke-OEMUpdatePrompt (Displays the prompt to the active user)
• Scheduled_Task_Invoke-OEMUpdatePrompt_Reschedule (Manages the background cycle)
• Scheduled_Task_Invoke-OEMUpdatePrompt_Reminder (Displays the 10-minute warning)

Sample Prompts - English

Completion Acknowledgement Prompt (No Reboot Pending) - English

Sample Prompts - Dutch

Completion Acknowledgement Prompt (No Reboot Pending) - Dutch

Changelog

2026-08-17

• Replaced Prompter with OmniPrompt, a lightweight native binary that removes the .NET Desktop Runtime dependency.
• Switched silent task execution to SilentLauncher, avoiding deprecated scripting hosts and common security blocks.
• Improved language detection so prompts correctly display in Dutch or English based on the logged-in user.
• Added MaxMissedPromptsBeforeForce to force the upgrade after repeated missed prompts on locked or inactive machines.
• Added UpdateDuringSuppress to allow unattended or forced upgrades outside normal prompting hours.
• Added a pre-upgrade reminder prompt shortly before a scheduled upgrade begins.
• Added an install-in-progress check to prevent upgrades from conflicting with other active installations.

2026-05-13

• Initial version of the document