PC firmware and device management is the software that a PC maker writes for its own laptops and desktops. It has three parts: the firmware that starts the machine, the drivers that let the operating system use each part, and the tools with which a company's IT team sets up, updates, locks and tracks thousands of machines from one place.
Firmware comes first. When you press the power button, the processor does not start Windows straight away. It first runs firmware stored on a small flash memory chip on the motherboard. On today's PCs this firmware is called UEFI, short for Unified Extensible Firmware Interface. Older PCs called it the BIOS. The firmware tests the memory, finds the drive and then starts the operating system. Before it does so, it checks that the operating system's start-up code carries a valid digital signature, a mark that proves who wrote the code. This check is called Secure Boot. On many business laptops, a hardware root of trust, a separate security chip, first checks that the firmware itself has not been altered.
Drivers come next. A driver is a small program that lets the operating system use one part, such as the touchpad, the webcam or the Wi-Fi chip. The PC maker tests each driver with its own exact combination of parts. A wrong driver can leave the webcam undetected or the battery draining fast.
The management tools come last. With them, IT can see each laptop's serial number, warranty, battery health and firmware version. IT can set a firmware password, lock a stolen laptop, and install firmware updates on every machine. These tools usually connect to the company's unified endpoint management (UEM) console, so IT works from one screen. A firmware update that fixes a security flaw is handled like any other fix in patch management.
Consider an engineering services company in Chandigarh with 1,800 laptops of one make. The PC maker publishes a firmware update that fixes a security flaw in the start-up code. IT does not send it to all 1,800 laptops at once. A firmware update that goes wrong can leave a laptop unable to start, and then someone has to repair it by hand. So on Monday, IT sends the update to 50 laptops used by its own team. The tool installs it only on laptops that are plugged in or have at least 30% battery, because losing power halfway through the update is the main risk. All 50 laptops restart normally. On Wednesday and Thursday, IT sends the update to the other 1,750 laptops, in seven batches of 250. By Friday, the console shows 1,742 laptops updated. The remaining 8 have been switched off all week, and each will install the update the next time it connects.
Why does the PC maker write this software, and not the operating system company? Because firmware and drivers depend on the exact motherboard and parts, which only the PC maker knows. Much of this software is written by the PC makers' engineers in Bengaluru and Pune. The same need for start-up firmware and remote updates appears in servers, phones and cars; see laptops and desktops for how the whole machine is made.