Repository navigation
Record upstream DAT 10.3.6 history - #27
Merged
Merged
Conversation
Added catch for transient download issues in the BitsJob monitor function
What's New & Fixed - BIOS Management — Fixed the automatic restart after a BIOS update being silently skipped on unattended/Intune devices. The Focus Assist / Do Not Disturb check no longer treats "no interactive user" (the normal state when running as SYSTEM) as a reason to hold back the reboot, so staged BIOS updates now apply as intended while still deferring for users who are genuinely busy or presenting. (maurice-daly#893) - OEM Support — Reworked HP SoftPaq driver extraction to use HP's current /s /e /f switches so files land in the build folder instead of the default SWSetup location, which previously left the folder empty and failed the build. Older SoftPaqs are handled automatically by retrying the legacy switches, with the 7-Zip fallback retained, and success is now judged by the files actually produced rather than the installer's exit code. (maurice-daly#892) - Toast Notifications — Added a Critical Notification (Alarm Mode) option that displays the update prompt even when Focus Assist / Do Not Disturb is active, with an optional audible alarm sound, for forced-reboot or security-critical updates. - Toast Notifications — Clarified the BIOS "firmware prestaged" message so users know they can restart immediately (or any time before the countdown ends) to speed up the update, alongside the existing warning not to power off during the process. - Telemetry & Reporting — Added an optional environment profile so administrators can record an approximate device-count range and their primary management platform (Intune, Configuration Manager, Co-Managed, or Standalone). The values are offered during first-run consent and editable in Common Settings, remain optional, and are only included with the end-of-session summary when telemetry is enabled.
Added an important notice regarding upgrading DAT builds.
What's New & Fixed - Intune RBAC Scope Tags — You can now assign one or more RBAC scope tags to the Intune apps the tool creates. Tenants that enforce role-based scope tags previously rejected every new app (creation failed with a "condition not met" error); apps now carry a permitted tag, with the built-in Default tag used automatically when none is selected. Includes a tag picker in Intune Package Options that populates from the connected tenant, plus scheduled/headless support. (maurice-daly#864) - Automatic Deployment & Assignment Filters — New option to automatically assign freshly built packages to All Devices or a chosen group, applying the matching assignment filter for each package. Fixed a case where an assignment filter's target was never set so the filter wasn't actually applied, and firmed up the per-model filter rule building (including Lenovo baseboard/machine-type matching). (maurice-daly#895, maurice-daly#897) - AzCopy Upload Engine (Intune) — Optional Microsoft AzCopy engine for uploading package content to Intune instead of the built-in chunked uploader. It self-tunes concurrency for higher throughput on large driver packages, is downloaded and signature-verified automatically on first use, can run hidden or in a visible window, and shows its version/signature status in Package Options. Also improved upload error handling and reporting. - WIM Engine Reliability — On machines where DISM hangs during initialization (banner shown, then no progress), the tool now prefers the bundled wimlib engine by default and adds a DISM stall/timeout so a stuck capture no longer wedges the whole build indefinitely. - Model Matching — Feature-Update Gating — Non-Dell driver packages now require the device's Windows feature update (e.g., 24H2 / 25H2) to match the build the pack was created for, preventing a build-specific package from installing on the wrong Windows release. Dell remains major-OS only, and BIOS packages stay OS-agnostic. - Toast / Teams Notifications — Added a custom header line to the Teams card so teams running multiple tenants into one channel can label each build by customer/tenant. Notifications now report genuinely updated models separately from those skipped because already current, with each model's true outcome shown — a check-only run is no longer misreported as having updated everything. (maurice-daly#842) - UI / Branding Fixes — The custom branding/image preview no longer shows a stale image served from the framework's cached decode; the file now loads fresh each time. Also improved file-path detection in settings and refined loading behaviour. (maurice-daly#896) - Build Reliability — A build that fails part-way through now cleans up its working directory and releases file handles correctly, instead of leaving a partial working folder behind. (maurice-daly#816)
Version 10.2.3 What's New & Fixed - Security / FIPS Compliance — Package integrity hashing now uses SHA256 instead of MD5, so the tool no longer errors out with "not part of the Windows Platform FIPS validated cryptographic algorithms" on FIPS-enforced hosts. Where an OEM catalog only publishes an MD5 hash, verification now degrades gracefully to Authenticode/HTTPS trust rather than failing the download. (maurice-daly#900) - BIOS Management — Fixed BIOS package detection that failed during a live ConfigMgr task sequence while working correctly in debug mode. Matching previously relied on a value only populated in debug, which broke SystemSKU-to-model fallback — most visibly on Lenovo, where the SKU is only the 4-character machine type. (maurice-daly#902) - Driver Packaging (Acer) — Disabled the nested cabinet self-expansion that deepened the folder tree on every pass, a primary cause of MAX_PATH overflow and near-empty output WIMs on Acer driver packages. - UI / Usability — Added a long-path advisory: when the selected temporary path exceeds 120 characters and Windows long-path support is off, a warning panel with an "Enable long path support" action is shown to prevent deep driver files from exceeding the 260-character limit. - UI / Usability — The cleanup results list is now wrapped in a height-capped, internally scrolling panel so a large result set can no longer grow the borderless window off-screen and hide the Close button.
What's New & Fixed - OEM Support — Dell and Lenovo now join HP with a Latest Drivers build type. Instead of the OEM's monthly SCCM driver pack, packages can be built from the newest individual drivers pulled straight from the Dell Command Update catalog (Dell) and the Lenovo per-model update catalog (Lenovo). Other manufacturers continue to use their SCCM driver pack. - Driver Packaging — New Update Cadence control (Off, Daily, Weekly, Monthly) throttles how often a Latest Drivers pack is re-evaluated on repeat or scheduled runs. Within the window the existing pack is retained, and a new pack is built only when the underlying driver set actually changes — tracked per model so unchanged sets are skipped rather than rebuilt every run. - Intune Deployment — Auto-deployed packages can now target one or more specific Entra security groups (for example a pilot ring plus a broad ring) instead of only All Devices, applied across each package's assignment. - User Interface — Added a live in-progress build tile so long-running builds show current activity instead of appearing stuck, plus new "New" feature indicators and icons that highlight the Latest Drivers build type and related options, and assorted layout/theme refinements. - Documentation — User guide and README updated for the Dell/Lenovo Latest Drivers build type and update cadence, with new design/feasibility documentation added for the Dell On-Demand (DCU) catalog and Lenovo Latest Driver sourcing. - Telemetry / Backend — Deterministic driver-package contents manifest with a cross-environment-stable content hash, ready to submit to the (pending) backend API for global de-duplication. - User Interface — New "What's New" modal shown once per version after an upgrade; the "New" feature pills now also clear when you interact with a section's controls, not just hover. - Reporting — Individual per-driver download failures are now captured and surfaced in the build "View Failures" modal (previously only logged and silently skipped). - Driver Packaging — Dell and Lenovo Latest Drivers now honour the Concurrent Driver Downloads setting (parallel downloads), which previously only applied to HP.
- OEM Support Panasonic support — added Panasonic as a supported manufacturer (catalog, model listing, packaging). Fujitsu support — added Fujitsu, including its session-gated catalog handling. ASUS support — ExpertBook/ExpertCenter commercial models via the DAT API catalog. Lenovo Custom Driver Pack detection — model now read from Win32_ComputerSystemProduct.Version and SKU from the first four characters of Win32_ComputerSystem.Model, matching the apply-driver script. (maurice-daly#921) - Intune package management — manage and delete existing BIOS/driver packages directly from the tool. - Force BIOS re-application — new -ForceDownload switch / SMSTSForceBIOSDownload task-sequence variable to download and flag the same BIOS version for flashing (e.g. recreating Dell recovery images). Opt-in; default unchanged. (MSEndpointMgr/ModernBIOSManagement#31) ASUS BIOS matching — each model now resolves its own BIOS version instead of every model collapsing onto the newest family BIOS (all showing 311). - Canonical manifest caching crash — fixed a Dell/Lenovo crash during canonical driver-manifest caching under PowerShell 5.1. (maurice-daly#913) Long-path pre-flight advisory — warns before Latest Drivers extraction when Windows long-path support is off and payloads (e.g. Intel DUPs) risk exceeding the path limit. (maurice-daly#912) - DCU graphics driver naming — Dell Command | Update graphics-driver revisions now canonicalise/collapse correctly. (maurice-daly#910) - Catalog OS matching — generic Windows 11 / win11 * catalog entries now appear for every Windows 11 build across all catalog-driven OEMs (10 vs 11 stay separated). - OEM Selections (Common Settings) — restrict which manufacturers are available app-wide via a toggle + multi-select. - Interface Scale (Common Settings) — 75–150% scaling slider plus auto-fit-to-screen for small/high-DPI displays. - Common Settings reorganised — the settings cards grouped into seven labelled sections. - Windows no longer float above other apps — modal dialogs stay above the tool's own window only, not the whole desktop. (maurice-daly#920) - Assorted UI tweaks and feature icons. - Shared desktop shortcut — the launcher now creates one shortcut on the public/all-users desktop instead of one per admin profile, cleans up stale per-user copies, and adds a CreateDesktopShortcut toggle / -NoShortcut switch. (maurice-daly#916) - Hardware inventory check — read-only WMI hardware-inventory class availability check. (maurice-daly#865)
What's New & Fixed - OEM Support Panasonic support — added Panasonic as a supported manufacturer (catalog, model listing, packaging). Fujitsu support — added Fujitsu, including its session-gated catalog handling. ASUS support — ExpertBook/ExpertCenter commercial models via the DAT API catalog. Lenovo Custom Driver Pack detection — model now read from Win32_ComputerSystemProduct.Version and SKU from the first four characters of Win32_ComputerSystem.Model, matching the apply-driver script. (maurice-daly#921) - Intune package management — manage and delete existing BIOS/driver packages directly from the tool. - Force BIOS re-application — new -ForceDownload switch / SMSTSForceBIOSDownload task-sequence variable to download and flag the same BIOS version for flashing (e.g. recreating Dell recovery images). Opt-in; default unchanged. (MSEndpointMgr/ModernBIOSManagement#31) ASUS BIOS matching — each model now resolves its own BIOS version instead of every model collapsing onto the newest family BIOS (all showing 311). - Canonical manifest caching crash — fixed a Dell/Lenovo crash during canonical driver-manifest caching under PowerShell 5.1. (maurice-daly#913) Long-path pre-flight advisory — warns before Latest Drivers extraction when Windows long-path support is off and payloads (e.g. Intel DUPs) risk exceeding the path limit. (maurice-daly#912) - DCU graphics driver naming — Dell Command | Update graphics-driver revisions now canonicalise/collapse correctly. (maurice-daly#910) - Catalog OS matching — generic Windows 11 / win11 * catalog entries now appear for every Windows 11 build across all catalog-driven OEMs (10 vs 11 stay separated). - OEM Selections (Common Settings) — restrict which manufacturers are available app-wide via a toggle + multi-select. - Interface Scale (Common Settings) — 75–150% scaling slider plus auto-fit-to-screen for small/high-DPI displays. - Common Settings reorganised — the settings cards grouped into seven labelled sections. - Windows no longer float above other apps — modal dialogs stay above the tool's own window only, not the whole desktop. (maurice-daly#920) - Assorted UI tweaks and feature icons. - Shared desktop shortcut — the launcher now creates one shortcut on the public/all-users desktop instead of one per admin profile, cleans up stale per-user copies, and adds a CreateDesktopShortcut toggle / -NoShortcut switch. (maurice-daly#916) - Hardware inventory check — read-only WMI hardware-inventory class availability check. (maurice-daly#865)
What's New & Fixed - OEM Support — added Panasonic, Fujitsu and ASUS (ExpertBook/ExpertCenter) as supported manufacturers, alongside Dell, HP, Lenovo, Microsoft and Acer. - OEM Selections — new Common Settings option to restrict the tool to specific manufacturers via a toggle and multi-select; the model grid, manufacturer picker and pre-flight checks then show only the OEMs you choose. - Interface Scale — new Common Settings option to scale the whole interface (75-150%) or auto-fit to the current screen, for small or high-DPI displays. - Intune Package Management — review and remove existing BIOS and driver packages directly from the tool. - Force BIOS re-application — new -ForceDownload switch and SMSTSForceBIOSDownload task-sequence variable download and re-flag the same BIOS version for flashing, for scenarios such as recreating Dell BIOS recovery images. Opt-in; default behaviour unchanged. (MSEndpointMgr/ModernBIOSManagement#31) - Lenovo detection — Custom Driver Pack now reads the model from Win32_ComputerSystemProduct.Version and the SKU from the first four characters of Win32_ComputerSystem.Model. (maurice-daly#921) - ASUS BIOS versions — each model now resolves its own BIOS version instead of every model collapsing onto the newest family value. - Catalog OS matching — generic "Windows 11" and "win11" catalog entries now appear for every Windows 11 build across all catalog-driven OEMs, and Windows 10 and 11 stay separated. - Canonical manifest caching — fixed a Dell/Lenovo crash during canonical driver-manifest caching under PowerShell 5.1. (maurice-daly#913) - DCU graphics driver naming — Dell Command | Update graphics-driver revisions now canonicalise correctly. (maurice-daly#910) - Long-path pre-flight advisory — warns before Latest Drivers extraction when Windows long-path support is off and payloads such as Intel DUPs risk exceeding the path limit. (maurice-daly#912) - Hardware inventory check — read-only WMI hardware-inventory class availability check. (maurice-daly#865) - Shared desktop shortcut — the launcher now creates a single shortcut on the public (all-users) desktop instead of one per admin profile, cleans up stale per-user copies, and adds a CreateDesktopShortcut toggle and -NoShortcut switch. (maurice-daly#916) - Always on top dialogs — modal dialogs now stay above the tool's own window only, not above every other application. (maurice-daly#920) - Intune BIOS deferrals — toast deferral counters now reset once an update is applied and are tracked per update type, so reporting stays accurate and deferrals no longer carry into the next release. - Common Settings reorganised — settings grouped into labelled sections, plus assorted UI tweaks and feature icons.
What's New & Fixed - Windows 11 26H1 — added 26H1 (build 28000) as a target release for driver and BIOS packages, including Modern Driver/BIOS Management support for the Arm64 devices it ships on. - Latest Drivers reliability — a Dell or Lenovo component that downloads but extracts no drivers is now reported in View Failures with the reason from the vendor package, instead of being dropped silently; the build warns that the package is incomplete and the next run rebuilds it rather than treating the set as current. (maurice-daly#936) - Latest Drivers extraction — a component that refuses the staging path is retried through a short working path, and staging folder names are shortened so deeply nested payloads such as NVIDIA graphics stay inside the Windows path limit. (maurice-daly#936) - Extended log viewer — the log now lists the newest entries first, follows new entries live while a build runs, and can be paused and resumed from the toolbar. - Model search — searching the model grid is debounced and filtered in place so large catalogues stay responsive, and punctuation such as [ or ] no longer breaks the filter. - Dell Latest Drivers versions — Dell Command | Update packages now show their build date as the version in the model list, matching how HP SoftPaq packages are shown; ConfigMgr driver pack mode still shows the enterprise catalog version. (maurice-daly#931) - Driver package build type — switching between SCCM driver pack and Latest Drivers now refreshes the model list automatically instead of leaving the previous source versions on screen. - AdminService authentication — service accounts supplied as a bare user name work again after the ConfigMgr 2603 security changes tightened authentication. - Modern BIOS Management — Invoke-CMDownloadBIOSPackage.ps1 can once again run in XML (webservice-less) mode, via the restored XMLPackage parameter set. (MSEndpointMgr/ModernBIOSManagement#32) - Package selection — "latest by creation date" now compares real dates rather than text, so the newest matching driver or BIOS package is chosen correctly. - Intune requirement script — no longer emits registry errors when it runs outside the SYSTEM context. - Interface text — fixed mis-rendered characters in Common Settings and other on-screen descriptions under PowerShell 5.1. - What's New dialog — now shows the notes for the release you are running rather than the previous one.
What's New & Fixed - Windows 11 26H1 — added 26H1 (build 28000) as a target release for driver and BIOS packages, including Modern Driver/BIOS Management support for the Arm64 devices it ships on. - Latest Drivers reliability — a Dell or Lenovo component that downloads but extracts no drivers is now reported in View Failures with the reason from the vendor package, instead of being dropped silently; the build warns that the package is incomplete and the next run rebuilds it rather than treating the set as current. (maurice-daly#936) - Latest Drivers extraction — a component that refuses the staging path is retried through a short working path, and staging folder names are shortened so deeply nested payloads such as NVIDIA graphics stay inside the Windows path limit. (maurice-daly#936) - Extended log viewer — the log now lists the newest entries first, follows new entries live while a build runs, and can be paused and resumed from the toolbar. - Model search — searching the model grid is debounced and filtered in place so large catalogues stay responsive, and punctuation such as [ or ] no longer breaks the filter. - Dell Latest Drivers versions — Dell Command | Update packages now show their build date as the version in the model list, matching how HP SoftPaq packages are shown; ConfigMgr driver pack mode still shows the enterprise catalog version. (maurice-daly#931) - Driver package build type — switching between SCCM driver pack and Latest Drivers now refreshes the model list automatically instead of leaving the previous source versions on screen. - AdminService authentication — service accounts supplied as a bare user name work again after the ConfigMgr 2603 security changes tightened authentication. - Modern BIOS Management — Invoke-CMDownloadBIOSPackage.ps1 can once again run in XML (webservice-less) mode, via the restored XMLPackage parameter set. (MSEndpointMgr/ModernBIOSManagement#32) - Package selection — "latest by creation date" now compares real dates rather than text, so the newest matching driver or BIOS package is chosen correctly. - Intune requirement script — no longer emits registry errors when it runs outside the SYSTEM context. - Hardware inventory class check — the Check Inventory Classes button no longer reports "Argument types do not match" under PowerShell 5.1; the check now returns its per-class results correctly. (maurice-daly#926) - Interface text — fixed mis-rendered characters in Common Settings and other on-screen descriptions under PowerShell 5.1. - What's New dialog — now shows the notes for the release you are running rather than the previous one.
What's New & Fixed - BIOS automatic restart — the post-flash restart was suppressed on effectively every deployment because the Focus Assist check misread the SYSTEM session as "do not disturb", leaving BIOS updates staged but never applied and BitLocker suspended until someone rebooted manually; the notification state is now only acted on when it was measured inside a real user session, and Critical Notification genuinely bypasses it. Existing packages carry the old logic and must be recreated and redeployed. - ConfigMgr package source path — a local package storage path is now converted to a UNC path against the machine that actually holds the content, matching its real shares first and falling back to its admin share, instead of assuming the tool runs on the primary site server; fixes content distribution failing in split hierarchies. (maurice-daly#934) - Package Storage Path — Common Settings now shows the exact UNC source path ConfigMgr will be given, and the Browse dialog notes that a UNC path can be entered for content hosted elsewhere. (maurice-daly#934) - Startup connectivity check — the pre-flight probe now only tests the vendor hosts for manufacturers enabled under OEM Selections, so a disabled OEM no longer raises "required URLs could not be reached" warnings at every launch. (maurice-daly#937) - Shutdown cleanup window — the cleanup dialog shown while the application closes no longer floats above every other application, and now appears in the taskbar so it stays reachable during long cleanups. (maurice-daly#938) - Dell Latest Drivers diagnostics — the Dell Command | Update stage now logs components skipped by component type, OS/architecture and SystemID plus the category breakdown of the selected set; investigation confirmed the reported missing Intel Chipset Device Software is absent from Dell's DCU catalog rather than filtered out by the tool. (maurice-daly#940)
What's New & Fixed - Panasonic devices — TOUGHBOOK models such as FZ-G2[N/P] (mk3) now build; the slash and brackets in Panasonic variant-series names were read as a path separator and as wildcards, which failed every Panasonic build at the first step. (maurice-daly#956) - Scheduled build time limit — the hidden four hour cap is now configurable, the deadline is logged when the build starts, a warning is raised before it is reached, and an interrupted run is detected and reported on the next launch. (maurice-daly#950) - Package retention in headless builds — automatic cleanup of superseded packages now runs in scheduled and headless builds; the setting was written to the build configuration and discarded when it was read back, and a skipped retention run now records why. (maurice-daly#947) - Teams build reports — the notification lists each model with its driver and BIOS versions as a table, and counts packages that were already current separately from packages that were built. - Teams custom header — the optional per-tenant headline is available again in Teams Notifications settings, and now applies to scheduled and headless builds as well. (maurice-daly#955) - Latest Drivers diagnostics — components that are applications rather than drivers are no longer counted as failures or as an incomplete package, and Windows long path support is only named as a cause when the evidence points to it. (maurice-daly#949) - Incomplete package rebuild — a Latest Drivers package that finished with components missing is re-evaluated on the next run instead of being held for a full update cadence. (maurice-daly#948) - HPCMSL updates — an update that completes without moving the version is now reported as such, with the module path and anything the installer reported, instead of being logged as successful. (maurice-daly#953) - Lenovo BIOS prompts — devices are no longer prompted to flash a BIOS they already have; the comparison understands Lenovo firmware version formats and falls back to the release date where two versions cannot be compared directly. - Package telemetry — the package hash is taken before content distribution begins rather than while it is running, and is skipped entirely when telemetry is switched off. (maurice-daly#951, maurice-daly#952)
What's New & Fixed - Security — removed the TLS certificate-validation bypass from the OSD deployment scripts; connecting to a self-signed AdminService now requires a pinned certificate thumbprint instead of trusting any certificate on the network. This is a breaking change for anyone relying on the old bypass — see docs/AdminServiceAuthRewrite.md. - Security — the OSD scripts no longer depend on the retired PSIntuneAuth/AzureAD module chain to authenticate to the AdminService (AzureAD stopped working in October 2025); they request the token directly, and a failed sign-in now names the actual reason (bad credentials, MFA required, Conditional Access) instead of a bare "Unauthorized". - Security — catalog-supplied baseboard/SKU values written into the generated Intune detection and requirement scripts are now validated against an allow-list before being emitted, closing a code-injection risk from a compromised or malformed catalog entry. - Security — the BIOS install log no longer records the plaintext flash password, its length or its first and last characters. - Security — SYSTEM cleanup during headless and scheduled builds now refuses to delete outside an approved content root and will not follow a reparse point planted in the temp folder. - Security — driver and BIOS downloads that fail their catalog hash check after every retry are no longer packaged; archive extraction (driver/BIOS payloads and the tool's own updater) now validates every entry path before writing, closing a directory-traversal risk. - Security — the scheduled build task now refuses to register if the install folder is writable by anyone other than the account running the build, SYSTEM, Administrators or TrustedInstaller, and Intune packaging locks down its staging folders and verifies IntuneWinAppUtil.exe's signature before running it. - Security — Settings/BuildConfig.json (which can hold the Teams webhook and Intune app secret) is no longer copied into standalone release packages, and packaging now fails outright if a credential is detected in the staged files. - OEM Support — Panasonic TOUGHBOOK models with a variant-series name such as "FZ-G2[N/P] (mk3)" can be packaged again; the model name previously produced an invalid folder path and blocked Intune script generation for effectively the whole catalog. (maurice-daly#956) - OEM Support — Fujitsu builds no longer crash on a blank SystemSKU on some models (e.g. ESPRIMO D757), and the value read now actually matches the driver package's own detection rule. (maurice-daly#945) - Latest Drivers reliability — an incomplete Dell/Lenovo Latest Drivers build (a component that staged no files) no longer parks the model for a full cadence period; the next run retries it automatically. (maurice-daly#948) - Latest Drivers diagnostics — a "Windows long path support is disabled" failure reason is now shown only when there is real evidence of a path-length failure, not just because the host setting happens to be off. (maurice-daly#949) - Lenovo BIOS — devices already on the catalog's BIOS version are no longer repeatedly prompted to reflash; version comparison now reads the correct field for both BIOS and System Firmware package types. - Build summary — the completion dialog and Teams notification no longer count packages skipped as already-current toward "Succeeded"; a separate Skipped figure is shown for each. (#19) - Build summary — a per-model table (manufacturer, model, OS, driver/BIOS status) is now written to the log on every run and shown in the completion dialog. - Teams notification — build cards now include per-model driver and BIOS version tables alongside the existing counts, and the optional custom header text dropped since 10.2.3 is restored. (maurice-daly#955) - Telemetry — the package hash computed only for the optional telemetry report is now skipped entirely when telemetry is off, saving 15-25 minutes on large builds; the ConfigMgr driver and BIOS package hash no longer runs while ConfigMgr is still distributing the content, which could previously time out and fail the package. (maurice-daly#951, maurice-daly#952) - Telemetry — users who have never opted in are now invited to enable it from the interface, at most twice a year, with a clear list of what is and is not sent. - HPCMSL — the tool now reports the HPCMSL version actually loaded rather than the highest version installed anywhere, and warns when a newer install is being shadowed by an older one; update checks correctly report when an update did not apply instead of claiming success. (maurice-daly#953, maurice-daly#958) - Scheduled builds — the fixed 4-hour run limit is now configurable (0-72 hours) and no longer silently kills a long-running build partway through, skipping cleanup, telemetry and the Teams notification. (maurice-daly#950) - Scheduled builds — package retention (removing superseded ConfigMgr packages) now actually runs under the headless/SYSTEM task; it previously always read as disabled. (maurice-daly#947) - Intune uploads — a transient Graph 401 immediately after creating an app no longer disables Intune authentication for the rest of the run; affected models now retry with a backoff instead of failing outright. - Catalog downloads — a 401 from the Driver Automation Tool API now explains the reason (clock skew, invalid timestamp, etc.) instead of a bare "Unauthorized". - Update prompts — an update or BIOS-flash toast that times out unanswered is now correctly treated as declined rather than as consent to install.
…tionTool Reconciles two independent push-to-prod snapshots that both descended from 10.2.7: local's "Version 10.2.9 is live" and origin's earlier "Version 10.2.8 is live", pushed by a prior session and never pulled locally before this one. Resolution: - psd1/psm1/MainWindow.xaml/Rev.txt: took local (10.2.9), which is a strict content superset of the 10.2.8 snapshot for every conflicting hunk (newer HPCMSL shadow-detection logic, version strings). - Release notes: kept the full historical blocks for both 10.2.9 and 10.2.8 (10.2.8 genuinely shipped and deserves its own changelog entry). - MainApplication.ps1 What's New modal: merged both release's item lists under version 10.2.9.0, since the self-updater always jumps straight to the latest Rev.txt version and never installs an intermediate release -- an operator updating from 10.2.7 would otherwise never see the 10.2.8-only items (Panasonic, scheduled build limit, retention, Teams reports/header, HPCMSL reporting, Lenovo BIOS, telemetry timing). - FileHashes.md: regenerated the Entry Points/Core Module/UI Layer sections (the ones push-to-prod owns) from actual file hashes, verified all 13 rows against disk. Left the Deployment Scripts section as the auto-merge produced it; Scripts\ is managed outside push-to-prod (docs/AdminServiceAuthRewrite.md) and was already stale before this merge (3 of its 6 listed files don't exist in prod's Scripts folder). Dev repo (DriverAutomationToolDev) was updated in parallel with the same What's New merge so the source of truth doesn't regress on the next push. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
What's New & Fixed - Security — removed the TLS certificate-validation bypass from the OSD deployment scripts; connecting to a self-signed AdminService now requires a pinned certificate thumbprint instead of trusting any certificate on the network. This is a breaking change for anyone relying on the old bypass — see docs/AdminServiceAuthRewrite.md. - Security — the OSD scripts no longer depend on the retired PSIntuneAuth/AzureAD module chain to authenticate to the AdminService (AzureAD stopped working in October 2025); they request the token directly, and a failed sign-in now names the actual reason (bad credentials, MFA required, Conditional Access) instead of a bare "Unauthorized". - Security — catalog-supplied baseboard/SKU values written into the generated Intune detection and requirement scripts are now validated against an allow-list before being emitted, closing a code-injection risk from a compromised or malformed catalog entry. - Security — the BIOS install log no longer records the plaintext flash password, its length or its first and last characters. - Security — SYSTEM cleanup during headless and scheduled builds now refuses to delete outside an approved content root and will not follow a reparse point planted in the temp folder. - Security — driver and BIOS downloads that fail their catalog hash check after every retry are no longer packaged; archive extraction (driver/BIOS payloads and the tool's own updater) now validates every entry path before writing, closing a directory-traversal risk. - Security — the scheduled build task now refuses to register if the install folder is writable by anyone other than the account running the build, SYSTEM, Administrators or TrustedInstaller, and Intune packaging locks down its staging folders and verifies IntuneWinAppUtil.exe's signature before running it. - Security — Settings/BuildConfig.json (which can hold the Teams webhook and Intune app secret) is no longer copied into standalone release packages, and packaging now fails outright if a credential is detected in the staged files. - OEM Support — Panasonic TOUGHBOOK models with a variant-series name such as "FZ-G2[N/P] (mk3)" can be packaged again; the model name previously produced an invalid folder path and blocked Intune script generation for effectively the whole catalog. (maurice-daly#956) - OEM Support — Fujitsu builds no longer crash on a blank SystemSKU on some models (e.g. ESPRIMO D757), and the value read now actually matches the driver package's own detection rule. (maurice-daly#945) - Latest Drivers reliability — an incomplete Dell/Lenovo Latest Drivers build (a component that staged no files) no longer parks the model for a full cadence period; the next run retries it automatically. (maurice-daly#948) - Latest Drivers diagnostics — a "Windows long path support is disabled" failure reason is now shown only when there is real evidence of a path-length failure, not just because the host setting happens to be off. (maurice-daly#949) - Lenovo BIOS — devices already on the catalog's BIOS version are no longer repeatedly prompted to reflash; version comparison now reads the correct field for both BIOS and System Firmware package types. - Build summary — the completion dialog and Teams notification no longer count packages skipped as already-current toward "Succeeded"; a separate Skipped figure is shown for each. (#19) - Build summary — a per-model table (manufacturer, model, OS, driver/BIOS status) is now written to the log on every run and shown in the completion dialog. - Teams notification — build cards now include per-model driver and BIOS version tables alongside the existing counts, and the optional custom header text dropped since 10.2.3 is restored. (maurice-daly#955) - Telemetry — the package hash computed only for the optional telemetry report is now skipped entirely when telemetry is off, saving 15-25 minutes on large builds; the ConfigMgr driver and BIOS package hash no longer runs while ConfigMgr is still distributing the content, which could previously time out and fail the package. (maurice-daly#951, maurice-daly#952) - Telemetry — users who have never opted in are now invited to enable it from the interface, at most twice a year, with a clear list of what is and is not sent. - HPCMSL — the tool now reports the HPCMSL version actually loaded rather than the highest version installed anywhere, and warns when a newer install is being shadowed by an older one; update checks correctly report when an update did not apply instead of claiming success. (maurice-daly#953, maurice-daly#958) - Scheduled builds — the fixed 4-hour run limit is now configurable (0-72 hours) and no longer silently kills a long-running build partway through, skipping cleanup, telemetry and the Teams notification. (maurice-daly#950) - Scheduled builds — package retention (removing superseded ConfigMgr packages) now actually runs under the headless/SYSTEM task; it previously always read as disabled. (maurice-daly#947) - Intune uploads — a transient Graph 401 immediately after creating an app no longer disables Intune authentication for the rest of the run; affected models now retry with a backoff instead of failing outright. - Catalog downloads — a 401 from the Driver Automation Tool API now explains the reason (clock skew, invalid timestamp, etc.) instead of a bare "Unauthorized". - Update prompts — an update or BIOS-flash toast that times out unanswered is now correctly treated as declined rather than as consent to install.
Release: - DriverAutomationToolRev.txt set to 10.3.0; release notes for 10.3.0 What's new: - Autopilot silent install for driver and BIOS packages - ConfigMgr Applications with toast notifications and Remind Me Later - Driver rollback on uninstall; Windows 11 26H1 and 26H2 - Add custom drivers to an existing ConfigMgr driver pack - Notification themes, install progress notification, toast test package - Build pause / resume and low disk space auto-pause - Custom Driver Pack additional drivers folder and Intune upload progress Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Integrity: - FileHashes.md regenerated for 10.3.0 (16 files); it still described 10.2.9 OSD scripts: - Invoke-CMApplyDriverPackage.ps1 and Invoke-CMDownloadBIOSPackage.ps1 brought up to the Dev versions (BIOS script 3.0.4 -> 3.0.9), including the 10.2.9 AdminService fixes: pinned certificate thumbprint instead of the TLS validation bypass, and token requests without PSIntuneAuth/AzureAD Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Release: - DriverAutomationToolRev.txt set to 10.3.1; release notes for 10.3.1 - Modules, UI and entry scripts promoted; Scripts: Invoke-CMApplyDriverPackage.ps1 updated and Test-ModernDriverManagement.ps1 added; FileHashes.md for 10.3.1.0 What's new: - Settings pages show one section at a time, with per-section counts and search, on Common Settings, both Package Options pages and Toast Notifications; Toast Behaviour is its own section - Collapsible menu: icons only, with names on hover, remembered between sessions - What's New dots mark new and changed features on the menu and settings sections - Light mode readability for status messages, warning buttons and Intune Environment notes; dialogs no longer show square corners - BitLocker re-checked immediately before the BIOS flash and before the restart; no flash or restart unless it is confirmed suspended - Tool folder permissions checked at startup and before builds, with a one-click fix (maurice-daly#965) - HP CMSL installs and updates work again with PowerShellGet 2.x (maurice-daly#962) - Lenovo System Firmware identified by type on any Windows language; no retry loop when the updater reports no update is required (maurice-daly#966) - Invoke-CMApplyDriverPackage.ps1: opt-in -AllowVirtualMachine and read-only driver WIM mounts (MSEndpointMgr/ModernDriverManagement#334, maurice-daly#339) - Test-ModernDriverManagement.ps1 ships in Scripts and only tests the scripts beside it - Custom Driver Pack Additional Drivers folder is no longer remembered between sessions Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Testimonial endpoint
What's New & Fixed - ConfigMgr hierarchy support — Invoke-CMApplyDriverPackage.ps1 and Invoke-CMDownloadBIOSPackage.ps1 gain a new -SiteCode parameter (or the 'MDMSiteCode' task sequence variable) so a hierarchy with a central administration site and multiple primary sites only considers driver and BIOS packages created at that site, instead of picking a package created at another site whose content may not be on reachable distribution points. (maurice-daly#967) - Testimonials — a new optional testimonial form (title bar button, and a one-time prompt after the first week of use) lets you share feedback about the tool; submissions are signed and encrypted at rest, and the install ID sent with them is never exposed outside the encrypted record.
Update to Configuration Manager scripts. Missed in the last commit.
What's New & Fixed - Driver package versions — when the driver catalog lists an older version than the package already in ConfigMgr or Intune (for example Dell A03 when A04 is packaged), the newer package is now kept and the model is skipped with a warning, instead of being rebuilt under the older version and the newer package being removed by package retention; Force Update still rebuilds on request. - HP CMSL — HPCMSL and its HP modules must now be signed by HP (their binaries by HP or Microsoft) before the tool loads them, and when the tool runs elevated it ignores any copy that standard users can change, so install HPCMSL for all users; installs and updates no longer skip the publisher check or mark the PowerShell Gallery as trusted for the whole machine. - HP SoftPaqs — every SoftPaq, freshly downloaded or cached, must carry a valid HP signature before any is extracted; an unsigned SoftPaq is deleted and the model fails instead of being packaged. - Models without baseboard IDs — models the catalog lists without baseboard or SKU IDs no longer fail packaging for ConfigMgr, ConfigMgr Applications, Intune or BIOS; Dell IDs are recovered from Dell's driver pack catalog where Dell publishes them, otherwise the package is matched on the exact computer model name and the BIOS package is skipped with a warning; Invoke-CMApplyDriverPackage.ps1 4.3.7 matches these packages by computer model. (maurice-daly#979) - Custom Driver Pack — on Dell and Surface devices the identifier is now filled from the system SKU that the catalogs and the task sequence match on, instead of the board part number, and the field is now labelled Baseboard / SKU. (maurice-daly#979) - WIM packaging on non-English Windows — the file ownership repair before WIM capture now answers takeown in the Windows display language, so it works on German, French and other non-English installations instead of silently doing nothing. (maurice-daly#975) - Toast notifications — Remind Me Later now honours a snooze that has not ended even when the device has reached its deferral limit, and the reminder no longer starts a ConfigMgr Application install while it is waiting for a maintenance window, already installing or waiting for a restart, or when no one is signed in. - BIOS updates — the BIOS install script refuses to run in WinPE, Surface firmware updates suspend BitLocker for two restarts as Microsoft recommends, and headless build configs without a restart delay now use 10 minutes instead of 3.
What's New & Fixed - Code Signing — the setting has moved from Intune Package Options to Common Settings, under Build & Packaging, because it signs the scripts of ConfigMgr Applications as well as Intune apps; with it on, ConfigMgr clients that use the All Signed PowerShell execution policy (the client default) can run the detection and requirement scripts, and toast test packages now have their detection and requirement scripts signed too. - ConfigMgr Applications — Applications are now created when code signing is on, instead of failing with "Cannot use a signed PowerShell script as an argument for the parameter ScriptText"; an Application this left without a deployment type is completed and its content distributed on the next build, instead of being skipped as already existing. - Desktop Shortcut — a new Common Settings option, under General, puts the tool's desktop shortcut on the desktop of the account running the tool instead of the Public desktop that everyone who signs in sees; the shortcut moves the next time the tool starts, the one in the old location is removed, and a shortcut problem no longer stops the tool from starting. - Dell Latest Drivers — Dell's newer driver packages have changed how they unpack: they hand the work to a bundled 7-Zip helper that runs without administrator rights and first checks it can write to the destination, so they fail where that account cannot write to the build folder or where endpoint protection or AppLocker blocks the helper; the tool now retries in a short working folder under C:\ProgramData\DriverAutomationTool that the helper can write to (previously C:\Windows\Temp, where it could not), then unpacks the package with 7-Zip itself (if installed) without running it, and when a package still fails, the failure report names the step that failed instead of a generic exit code. - Incomplete builds — a Latest Drivers build that is missing drivers no longer replaces a package or app you already have; the existing one stays in use, the missing drivers are listed in View Failures, the next run tries again, and the run is reported as completed with warnings instead of successful; a model's first build is still published, with a warning. - Tool folder permissions — local administrators, including members of domain groups added to the local Administrators group, are no longer reported as accounts that can change the tool folder; Fix Permissions keeps your own access, so two administrators no longer undo each other's, and the message only suggests moving the tool under Program Files when that would help. (maurice-daly#985) - Duplicate BIOS packages — the prompt to clean up duplicate BIOS packages now appears when the tool connects to the site server at startup, instead of failing before the window opened. - Custom Driver Pack — the page introduction now refers to the renamed Baseboard / SKU field.
Version 10.3.5 What's New & Fixed - MMS Midway Edition — the console window that opens with the tool now shows the MMS logo and "MMS Midway Edition" under the Driver Automation Tool banner, and the About page names the edition under the version. - Fujitsu models — Fujitsu models are listed again when a Windows 11 build is selected; Fujitsu publishes one driver pack per model for Windows 11 rather than one per build, so they now appear with Build All, like Dell, and the package applies to every Windows 11 build. Packs Fujitsu lists for both Windows 10 and Windows 11 now appear for Windows 10 too.
Version 10.3.6 What's New & Fixed - Acer downloads — Acer driver packs are no longer downloaded again on every run, and download progress shows the real file size. - Fujitsu downloads — Fujitsu driver packs and BIOS updates download again from Fujitsu's new download site. - Fujitsu BIOS packages — Fujitsu BIOS updates are now found for each model, and a model never takes another model's BIOS. - Fujitsu BIOS installs — LIFEBOOK and CELSIUS H BIOS updates are packaged and installed silently with Fujitsu's DskFlash tool. - Invoke-CMApplyDriverPackage.ps1 4.3.7 — matches packages for models without baseboard IDs by computer model. (maurice-daly#979) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Record the reviewed upstream 10.3.6 history as a second parent while preserving Vartaxe application code. Correct the embedded-version notice and document the content comparison. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
masteratcda3d6275f81e003b900965b5f32587af2d53b6eas an ancestor of the Vartaxe maintained fork, without replacing Vartaxe's first-parent history or application code.Cross-check
This PR contains the ancestry-link merge commit. The repository currently enforces linear history and disables merge commits; those rules must be adjusted only for this PR's merge, while retaining the PR requirement and required status check, then restored immediately afterward.