HP BIOS configuration

What it does

Applies BIOS/firmware settings on HP hardware using HP's BIOS Configuration Utility, in WinPE before Windows installs. Every setting is optional — leave a field blank to leave it unchanged on the device — and the step is skipped automatically on non-HP hardware, so it's safe to include in a mixed-fleet template.

Options

Each setting is Enable / Disable (unless noted); leave blank to leave it as-is.

Setting	Notes
Secure Boot	Enable to satisfy Windows 11 / BitLocker requirements.
Legacy Support / CSM	Usually disabled for modern UEFI installs.
TPM Device	Available (enabled) or Hidden (disabled).
TPM State	Enable / Disable.
Virtualization Technology (VT-x)	For Hyper-V, WSL2, sandboxes.
VT for Directed I/O (VT-d / IOMMU)	Directed-I/O virtualization.
Fast Boot	Enable / Disable.
Wake on LAN	Enable (boot to hard drive) / Disable.
Wireless LAN (Wi-Fi)	Enable / Disable.
Bluetooth	Enable / Disable.
Network Boot (PXE)	Enable / Disable.
BIOS admin password	Vault secret name. Leave blank to skip.

Good to know

⚠ Protected settings need the BIOS admin password. On many HP models, protected settings such as Secure Boot and TPM can only be changed when a BIOS setup password is set on the device and supplied here. If a change is rejected, the step fails with a clear message telling you a BIOS admin password is likely required — it no longer reports a silent success.

• Runs in WinPE, before the OS, so firmware is correct from the very first Windows boot.
• Non-blocking by default: it warns and continues rather than stopping the whole build.
• On Dell hardware, use Dell BIOS configuration instead.

Part of the step catalogue.