#Intune reports device.model for Lenovo hardware as the machine type model — 21N1CTO1WW — not the friendly name. Writing a model-based assignment filter means writing it against machine type prefixes, which first means working out every prefix that belongs to the model you care about. This post covers a PowerShell script that pulls those prefixes from the Lenovo model catalog and builds the filters for you.
Answering "what is the newest BIOS for this ThinkPad?" or "which of my models got that Intel graphics driver?" usually means opening the support site for one machine type at a time. The Lenovo Updates Dashboard reads the same public System Update catalogs that Lenovo's own update clients use, pools the results for every model you track, and gives you one searchable grid with CSV export.
This post replaces the earlier Autopilot + Thin Installer method. Thin Installer still works, but the Lenovo.Client.Update (LCU) PowerShell module is the current, supported way to drive updates from a script: it queries, downloads, and silently installs applicable driver, firmware, and BIOS updates for a Lenovo device, without the dependency of Thin Installer. Wrapping it in a script and packaging that as an Intune Win32 app lets you run the same update pass unattended — including during an Autopilot for pre-provisioned deployment. This post walks through a wrapper script built for exactly that, and the packaging and detection rules that make it behave inside Intune.
Managing a local Lenovo update repository has traditionally meant Update Retriever — a tool that gets the job done but leaves little room for automation or operational visibility. ThinkVantage Repository Manager (TVRM) is its modern replacement: a WPF GUI backed by a full PowerShell module that supports multiple repositories, per-model targeting, and a per-repository audit log that tracks every operation by user and timestamp.
Commercial Vantage ships ADMX/ADML templates for configuring its policies, and the documented path for Intune is to either ingest those templates and configure each setting or create a custom template profile and add each individual policy as an OMA-URI setting. That works, but can be tedious. Commercial Vantage Policy Manager is a WPF-based PowerShell GUI that takes the same policies and deploys them as a single Custom OMA-URI profile through the Microsoft Graph API — no template ingestion required.
PowerBios is a free, community-developed Windows utility by Claude Boucher (SomeTools) that lets you read, modify, and export BIOS settings on Lenovo ThinkPad, ThinkCentre, and ThinkStation devices using the WMI interface — locally or remotely. It's not an official Lenovo product, but it's a genuinely useful tool for anyone who regularly works with Lenovo BIOS configuration.
Using the Think BIOS Config Tool V2 and the Lenovo.BIOS.Config PowerShell module to securely change the BIOS supervisor password via an Intune Win32 app.
Installing current drivers, BIOS, and firmware during a bare metal OSD with the Lenovo Client Update PowerShell Module (LCU)
Hardware Support Apps (HSAs) are a core part of the modern Windows driver model — UWP/MSIX apps published by OEMs or IHVs that extend a base driver, typically delivered via the Microsoft Store. Common examples include Intel Graphics Command Center, AMD Software, Realtek Audio Console, and Lenovo hardware control apps. They are a fundamental piece of the Declarative, Componentized, Hardware Support Apps (DCH) driver architecture introduced in Windows 10 1809.
Understanding how HSAs are designed to work — and where enterprise management intersects with that design — is critical to deploying and maintaining a clean, supportable Windows environment.
A deep dive on converting to certificate-based authentication in an Autopilot pre-provisioned deployment using Think BIOS Config and Certificates V2 tools