After-Hours Patching Failed: Machines Asleep During Maintenance

LIMEHAWK - Managed IT

Home>Incident Reports>After-Hours Patching Failed: Machines Asleep During Maintenance

Incident

Law firm with 85 workstations, critical security patches that had to ship that week, and partners who bill in six-minute increments and lose their minds if a patch restart interrupts a redline. We scheduled the maintenance window for 2 AM to stay out of everybody's way. Morning-after report came in: 34 of 85 machines patched. The rest never phoned home because they were either powered off at the wall or asleep under the desk, and the RMM agent has no way to wake a machine that isn't online.

The challenge

Fleet was mixed vendor, which is where WoL gets annoying. Wake-on-LAN has two layers: the BIOS has to be configured to allow wake packets, and Windows has to be configured to let the NIC respond to them. Each vendor exposes BIOS settings differently, and none of them let you touch the BIOS through a regular Windows session without a vendor-specific tool. Doing 85 machines by hand with F2 at boot would have been a week of after-hours work.

- Dell OptiPlex: 45 machines
- HP EliteDesk: 28 machines
- Lenovo ThinkCentre: 12 machines
- WoL status: unknown across the fleet

Solution

We built one script that auto-detects the manufacturer via Win32_ComputerSystem and calls the right vendor tooling for each. Dell gets the DellBIOSProvider PowerShell module. HP gets the HP Client Management Script Library (CMSL). Lenovo gets direct WMI calls against the Lenovo_SetBiosSetting class. After BIOS is handled, the script configures Windows-side wake on all physical NICs using the MSPower_DeviceWakeEnable WMI class and enables the matching "Allow this device to wake the computer" and "Only allow a magic packet to wake the computer" settings.

Manufacturer handling

The script installs the required PowerShell module or library if it's missing, then sets the BIOS parameter by the vendor-specific name (Dell calls it "WakeOnLan", HP calls it "Wake on LAN", Lenovo uses "WakeOnLAN"). For Dell and Lenovo the BIOS password can be passed in as a parameter if the fleet has a shared admin password — HP's CMSL handles the BIOS setup PIN similarly. After BIOS is set, the Windows NIC side gets configured the same way across all three vendors because that part is OS-level, not firmware.

- Dell: DellBIOSProvider PowerShell module
- HP: HP Client Management Script Library (CMSL)
- Lenovo: WMI (Lenovo_SetBiosSetting class)
- Windows NIC: MSPower_DeviceWakeEnable WMI class
- all of it driven from a single deployment

One thing worth calling out — BIOS changes don't take effect until reboot. The script applies the setting, then flags the machine for a reboot on next maintenance window. If you try to send a magic packet before the reboot, nothing happens and you'll think the script failed.

Outcome

Deployed to the whole fleet through the RMM. 85 of 85 reported successful configuration. We coordinated a single reboot cycle during the next lunch hour to apply the BIOS changes — nobody noticed because laptops get rebooted all the time. The following maintenance window: RMM sent magic packets at 1:55 AM, every machine came up, patches installed, and the RMM put them back to sleep at 4 AM. Next morning report: 85 of 85 patched. Zero user disruption, zero billable time lost to "why is my computer on this morning."

- machines configured: 85 of 85
- next patch window: 100% reached
- deployment time: about 15 minutes running in parallel
- patches installed on next overnight window: 85 of 85

Key takeaways

Takeaway

WoL needs both BIOS and OS-level configuration to work.

Takeaway

every manufacturer exposes BIOS settings differently — plan for it.

Takeaway

reboot required after BIOS changes; magic packets won't work until then.

Takeaway

done right, this turns after-hours maintenance into a non-event.

Need help with something like this? Contact us

• Automating CrushFTP Upgrades and In-Place Updates (Automation)

• PC Replacement: Zero Data Loss User Profile Migration (Automation)

• Winget for RMM: Silent Software Deployment at Scale (Automation)