Does Windows Update Include BIOS Updates? How to Check Yours

Does Windows Update include BIOS updates? Sometimes, yes, but there's no blanket rule guaranteeing your specific machine will ever see one arrive next to a routine monthly patch. Windows Update can carry certain firmware updates to certain PCs, and in at least one documented case that firmware really does travel through Microsoft's own delivery pipeline. Whether you get one depends on your PC maker, the exact model you own, the firmware support that model shipped with, and whether the manufacturer actually published a compatible package through that channel.

Part of the confusion starts with terminology. Modern PCs generally use UEFI firmware rather than the old legacy BIOS, though the two terms still get used interchangeably in plenty of places. Windows interfaces still label that firmware setup screen "the BIOS" out of old habit, so most people never learn the two aren't technically the same thing (TechTarget).

A real delivery mechanism for Windows Update firmware updates does exist. Microsoft documents a Windows UEFI firmware-update platform that lets hardware makers submit signed firmware packages for distribution through Windows Update (Microsoft Q&A). That documents the pipeline for at least one component. It doesn't prove your motherboard's BIOS specifically travels through it, which is the distinction most explanations skip.

This piece covers what that evidence actually shows, how to verify whether Windows Update delivered anything firmware-related to your PC, what to weigh before installing a firmware update, and how this differs from the Secure Boot certificate updates Microsoft has been rolling out on a separate track.

Does Windows Update include BIOS updates on your PC?

The mechanics work like this. A hardware maker packages a firmware binary along with a driver-style INF file describing how to install it, optionally adding a .cap file and bundling everything into a .cab for distribution. That package follows Microsoft's Windows UEFI firmware-update platform spec, and before it can reach a PC through Windows Update, the manufacturer has to submit it to Microsoft for certification and signing (Microsoft Q&A). Once that signed package lands on a PC, Windows uses a function called UEFI UpdateCapsule to hand the firmware payload off to the platform firmware for processing (Microsoft Q&A). That's the plumbing behind "update your firmware without booting into setup manually."

The clearest documented walkthrough of that pipeline, published earlier this year, involves a touchscreen component, not a motherboard's main system firmware (Microsoft Q&A). That confirms the mechanism is real and functional for at least that category of hardware. It doesn't establish that full-system BIOS updates travel this same route as a matter of routine, or how often PC makers choose it for motherboard firmware specifically versus smaller components.

That gap matters for the question in the headline. Microsoft documents the delivery mechanism itself, and TechTarget reports that OS-level firmware updates exist on some Lenovo, HP, and Dell PCs (TechTarget). The supplied evidence doesn't establish how widely manufacturers actually use Windows Update to deliver full system BIOS updates versus smaller components. Treat system-level firmware delivery through Windows Update as something that happens on supported models, not something guaranteed to happen on yours.

This distinction matters partly because Windows Update doesn't visibly label the two differently. System or platform firmware is the system-level code that runs before Windows starts. Component firmware covers smaller chips inside the machine, such as the touchscreen example Microsoft documents, each capable of its own firmware updates independent of the motherboard. An update labeled "firmware" in Windows Update isn't automatic proof your motherboard's BIOS version changed. It's worth checking what the specific package actually targets before assuming anything about the system firmware.

TechTarget reports that some Windows 11 PCs from Lenovo, HP, and Dell support simplified, OS-level firmware updates, letting a Windows 11 BIOS update happen without the older process of manually booting into firmware setup (TechTarget). That's brand-level reporting, not a confirmed list of exact participating models, so read it as "possible on some devices from these brands," not "standard across everything they currently sell."

How to check for BIOS updates in Windows

Windows doesn't publish one documented, fixed location where firmware packages always surface, so the OEM's own support page is the more reliable check rather than Windows Update's display alone. Still, a quick pass through Windows Update is worth doing first. Here's a workable sequence:

1. Confirm your exact model number and currently installed BIOS/UEFI version. System Information's "BIOS Version/Date" field or a PowerShell BIOS query will show the version string the machine is running right now.
2. Look up that exact model, not just the general product line, on the manufacturer's support page.
3. Compare the installed version against whatever the OEM lists, and read the release notes for what actually changed.
4. If Windows Update's history or optional updates list shows a firmware-related entry, treat it as evidence of an actual BIOS update only if the entry names the system firmware specifically, or if the manufacturer confirms what that package updates. An entry naming a component, the touchscreen example Microsoft documents, for instance, rather than the system BIOS, is firmware for that part only.

That last step is the one most people skip, and it's the one that prevents a false sense of security. A firmware item sitting in your update history doesn't automatically mean your motherboard's BIOS changed. Confirming what the package actually targets is the only way to know for certain.

Before you install any firmware update

Firmware sits closer to the hardware than a typical app, which is reason enough to treat it with more care than an ordinary patch. Match the downloaded package to your exact model number before installing anything, and follow whatever precautions the manufacturer lists on that specific download page rather than assuming every firmware install behaves the same way across a product line.

The decision gets simpler once the version check above is done. If Windows Update already shows a firmware item pending or installed, letting it finish is the straightforward move. If the manufacturer's support page lists something newer for the exact model, with release notes describing an actual security, stability, or compatibility fix, getting it through that manufacturer's own update tool is worth doing rather than waiting indefinitely for Windows Update, since there's no guarantee it will ever offer that package for every model. A newer-looking release sitting on a support page isn't, by itself, a reason to flash anything. Reading what it actually fixes comes first.

Letting firmware go stale carries its own cost over time. TechTarget notes that neglected BIOS or UEFI firmware can contribute to security vulnerabilities, performance problems, missing functionality, operating-system incompatibility, and compliance-audit failures in managed environments (TechTarget). Those are reasons to stay reasonably current over months and years, not reasons to install every available update the moment it appears without reading what it changes.

Secure Boot certificate updates aren't the same thing

A separate update has been moving through Windows Update, and it's easy to confuse with a firmware flash since both touch boot security. Microsoft has been automatically delivering updated 2023 Secure Boot certificates through Windows Update to consumer devices and some business devices, starting earlier this year (Microsoft Support). This status doesn't tell you whether the BIOS version changed. It's a certificate update that happens to share the same general subject, boot security, without implying anything about system firmware.

The Windows Security app shows whether a given device has received these certificate updates, its current status, and whether further action is still needed (Microsoft Support). That check answers one specific question: where that device stands on Secure Boot certificates. A clean result there shouldn't be mistaken for confirmation that firmware is current.

Skipping the certificate update doesn't stop a PC from booting or installing ordinary Windows updates (Microsoft Q&A). What it does cost a device is newer boot-level protections, including updates to Windows Boot Manager, Secure Boot database changes, revocation lists, and fixes for newly disclosed boot vulnerabilities (Microsoft Q&A). Completing that certificate update is worth doing as soon as it's available wherever the hardware and firmware support it, a recommendation Microsoft describes as strong given what's at stake if it's skipped (Microsoft Q&A).

What to do now

Start by confirming what's actually installed using System Information or a PowerShell BIOS query, then pull up the manufacturer's support page for your exact model number and compare versions and release notes. Check Windows Update's history and optional updates list too, but don't treat an entry there as proof your system BIOS changed unless it names the system firmware specifically or the OEM confirms what it updates.

If Windows Update already has a relevant package pending, let it run. If the manufacturer's page lists something newer with release notes describing a genuine fix and Windows Update hasn't offered it, use that manufacturer's own update tool rather than waiting for Windows Update to eventually catch up.

Check Secure Boot certificate status in the Windows Security app as a separate task. It answers a narrower question than "is my firmware current," and the two checks belong on different parts of the list.