Solved Windows 11 optional Driverupdate has a bios 1720 for my board - Seems wrong?

[DudeDK]

Hi.
Been lurking in the forums for years, now I need your help.
My computer is 4+ years old and have this optional bios update just sitting there as a trap waiting to brick the computer.
The bios update has been sitting there from the very start, and I occasionally are worrying about MS to accidently push it to my device at some point.

MB = TUF Gaming z690-PLUS + Bios v 4101

Should I be worried? how do I block/remove it?

Any help is appreciated - THANK you in advance.

/Old guy from Denmark.

 

[OAT]

Hi.
Been lurking in the forums for years, now I need your help.
My computer is 4+ years old and have this optional bios update just sitting there as a trap waiting to brick the computer.
The bios update has been sitting there from the very start, and I occasionally are worrying about MS to accidently push it to my device at some point.

MB = TUF Gaming z690-PLUS

Should I be worried? how do I block/remove it?

Any help is appreciated - THANK you in advance.

/Old guy from Denmark.

Latest Bios for your MoBo according to TUF GAMING Z690-PLUS｜Motherboards｜ASUS Global

Version 4505
11.38 MB
2025/12/15
SHA-256 ：80D748A98D17E6AA6B460B2DD1C213F7F000746E4A31FDF6E91388EF60A37F5A
"1.Enhance overall system security.
2.Update the ME Firmware version to 16.1.38.2676.

Updating this BIOS will simultaneously update the corresponding intel ME to version 16.1.38.2676. Please note after you update this BIOS, the ME version remains the updated one even if you roll back to an older BIOS later."

 

[DudeDK]

Latest Bios for your MoBo according to TUF GAMING Z690-PLUS｜Motherboards｜ASUS Global

Version 4505
11.38 MB
2025/12/15
SHA-256 ：80D748A98D17E6AA6B460B2DD1C213F7F000746E4A31FDF6E91388EF60A37F5A
"1.Enhance overall system security.
2.Update the ME Firmware version to 16.1.38.2676.

Updating this BIOS will simultaneously update the corresponding intel ME to version 16.1.38.2676. Please note after you update this BIOS, the ME version remains the updated one even if you roll back to an older BIOS later."

I know, but my computer is rocksolid with 4101. So I'll leave it as is.
My concern is Microsoft having this "trap" sitting in optional and could it be applied by a mistake, MS do make mistakes occasionally.

And how do I block/remove that v1720 bios from the system suggestions.

 

[bobkn]

Seems odd that Windows Update is offering firmware that is older than what you have installed.

I suggest using the Group Policy Editor to block all automatic driver updates. (A BIOS update is treated as a driver update.)

Enable or Disable Include Drivers with Windows Updates in Windows 11

This tutorial will show you how to enable or disable including drivers with Windows Updates in Windows 10 and Windows 11. Windows Update will include drivers when available in Windows 11 by default. You can enable the Do not include drivers with Windows Updates policy to not include drivers...

www.elevenforum.com

 

[OAT]

I know, but my computer is rocksolid with 4101. So I'll leave it as is.
My concern is Microsoft having this "trap" sitting in optional and could it be applied by a mistake, MS do make mistakes occasionally.

And how do I block/remove that v1720 bios from the system suggestions.

The site says this about 1720.

TUF GAMING Z690-PLUS BIOS 1720
Version 1720
9.21 MB
2022/08/16
"1. Improve system stability
2. Update Microcode for next generation Intel Processors."

It's optional and quite dated but you are taking risks by not keeping your BIOS up to date.
Those types of updates are not from MS but are passed on to MS via the manufacturer.
What is your current BIOS version?

 

[DudeDK]

Seems odd that Windows Update is offering firmware that is older than what you have installed.

I suggest using the Group Policy Editor to block all automatic driver updates. (A BIOS update is treated as a driver update.)

Enable or Disable Include Drivers with Windows Updates in Windows 11

This tutorial will show you how to enable or disable including drivers with Windows Updates in Windows 10 and Windows 11. Windows Update will include drivers when available in Windows 11 by default. You can enable the Do not include drivers with Windows Updates policy to not include drivers...

www.elevenforum.com

It's very odd and I'm a bit worried that MS at some point decide that it's good for my system.
I did look into that blocking all driverupdates, but this old and dangerous bios v1720 is the only one I fear could be a problem down the road.

 

[OAT]

It's very odd and I'm a bit worried that MS decide that it's good for my system.

I think you worry too much.
MS offers it as an optional update based on the manufacturer's suggestion. You don't want it, leave it.
Keep in mind that if you upgrade your CPU, that update that you fear so much, will be required as it updates the microcode for future CPUs.(as of 2022)
Good luck

 

[DudeDK]

I think you worry too much.
MS offers it as an optional update based on the manufacturer's suggestion. You don't want it, leave it.
Keep in mind that if you upgrade your CPU, that update that you fear so much, will be required as it updates the microcode for future CPUs.(as of 2022)
Good luck

First, my bios is version 4101 a much newer version actually the third last from Asus, only 4301 and 4505 are newer, so I guess it will work just fine with a newer CPU.
The 1720 on the other hand would probably brick my computer if MS tried to install it as it's a rollback out of this world.

 

[OAT]

First, my bios is version 4101 a much newer version actually the third last from Asus, only 4301 and 4505 are newer, so I guess it will work just fine with a newer CPU.
The 1720 on the other hand would probably brick my computer if MS tried to install it as it's a rollback out of this world.

Yes, you are right , it does not seem to make sense.
If you are up to date, just ignore it, how many people use your computer anyway?

But you could try to reset the Windows Update components to see if that makes the pesky reminder go away.

Reset Windows Update in Windows 11

This tutorial will show you how to completely reset Windows Update components and policies to default in Windows 10 and Windows 11. Windows Update keeps Windows 11 updated by automatically downloading and installing the latest updates, drivers, and hotfixes released by Microsoft. Sometimes you...

www.elevenforum.com

 

[bobkn]

It's very odd and I'm a bit worried that MS at some point decide that it's good for my system.
I did look into that blocking all driverupdates, but this old and dangerous bios v1720 is the only one I fear could be a problem down the road.

I've blocked driver updates via Windows Update. I get mine manually.

I also keep my firmware up-to-date, partly for FOMO, partly because of security issues. I have no idea whether that might prevent Windows Update from trying to update your PC with old firmware.

(I have had a couple of motherboards bricked by firmware updates, but that was roughly 20 years ago, with early EFI motherboards. Your Z690-Plus has a BIOS recovery mode, but I can't speak to its reliability. There is no manual button to perform that function, unfortunately.)

I wonder whether it'd be worthwhile to contact Asus support? They supplied the firmware update to Microsoft. I'm not optimistic, I admit. I've dealt with them in the past. I believe that their front line support is outsourced, to script readers.

 

[Ghot]

It's very odd and I'm a bit worried that MS at some point decide that it's good for my system.
I did look into that blocking all driverupdates, but this old and dangerous bios v1720 is the only one I fear could be a problem down the road.

After Disabling Include drivers... all the driver updates will still appear, but will be an Optional install.

ONLY use BIOS updates from the motherboard manufacturer's website.

Welcome to ElevenForum. Here's ten points, just for filling out your computer specs.

 

[Jorgen E]

In my MSI Z690 BIOS, I have a setting to present downgrade my BIOS ..

 

[DarkShadowMD]

DO NOT INSTALL A BIOS UPDATE OFFERED IN WINDOWS UPDATE

I've had terrible experiences with that, especially since they love to mess with secure boot settings and even set supervisor passwords that you need to reset after to get back control over your system.

Hide it using Windows Update Mini Tool, or block driver updates entirely, you are risking yourself to be left out of your BIOS configuration interface (Unless you reset the supervisor password with generators online... is a true mess).

If you absolutely need to update your BIOS, go to your vendor's site and install an update from there.

Do not let Microsoft handle that for you, they could even potentially brick your system.

 

[bobkn]

(snip)

ONLY use BIOS updates from the motherboard manufacturer's website.

(snip)

I've never used one, but I believe that Asus sometimes provides firmware updates to Microsoft.

Not sure how one would be applied. I'd expect the updater to reboot the PC and apply the update outside of Windows.

Regardless, I avoid issuing commands to other forumites.

 

[DarkShadowMD]

I've never used one, but I believe that Asus sometimes provides firmware updates to Microsoft.

Not sure how one would be applied. I'd expect the updater to reboot the PC and apply the update outside of Windows.

Regardless, I avoid issuing commands to other forumites.

The process is kind of seamless. First Windows installs updates, prompts for a reboot, goes 30% and reboots, in that exact reboot, Windows applies a firmware update (And shows progress under your manufacturer's logo), once that's done, reboots once more and boots into windows to continue installing the rest of the updates, reboots again if it applies, and you finally reach your desktop.

The process is not the problem, but somebody should tell Microsoft engineers to NOT set a supervisor password... or at least be SO KIND to leave a txt file with said value in case you need to access your BIOS settings... My surprise after I had such an update in my old Acer years ago was so big I almost had an stroke. I had to look for an online unlock key generator to reset the supervisor password and be able to change any settings in your BIOS if you ever need to.

Another point is doing this during normal updates... there's a chance they can potentially brick a system if for some reason power goes out or your battery runs out (I admit is risky to do updates when you run low on battery tho).

BIOS updates should be done only when you are ready, and they are necessary, or at least that's how I see it. A bad flashing process will just make you wish Thanos turned you into dust...

 

[bobkn]

DO NOT INSTALL A BIOS UPDATE OFFERED IN WINDOWS UPDATE

I've had terrible experiences with that, especially since they love to mess with secure boot settings and even set supervisor passwords that you need to reset after to get back control over your system.

Hide it using Windows Update Mini Tool, or block driver updates entirely, you are risking yourself to be left out of your BIOS configuration interface (Unless you reset the supervisor password with generators online... is a true mess).

If you absolutely need to update your BIOS, go to your vendor's site and install an update from there.

Do not let Microsoft handle that for you, they could even potentially brick your system.

In my ignorance, I'm surprised that MS modifies a firmware update that it is passing through from Asus.

 

[retiredat44]

Hi.
Been lurking in the forums for years, now I need your help.
My computer is 4+ years old and have this optional bios update just sitting there as a trap waiting to brick the computer.
The bios update has been sitting there from the very start, and I occasionally are worrying about MS to accidently push it to my device at some point.

MB = TUF Gaming z690-PLUS + Bios v 4101

Should I be worried? how do I block/remove it?

Any help is appreciated - THANK you in advance.

/Old guy from Denmark.

yes, I hate it very bad when MS windows stick their nose in my motherboard files... stay out! you can't do anything right, stay out of my motherboard! they try b.s. like that with my Asus motherboard.

 

[Scott]

First, my bios is version 4101 a much newer version actually the third last from Asus, only 4301 and 4505 are newer

I have the exact same board. BIOS v. 4505 will give you every updated Secure Boot certificate. Just something to consider.
And I've never had Windows Update offer me a bios update, so I'm surprised they offered you one, and a very old one at that.

PS D:\Scripts\SecureBoot-CA-2023-Updates.v2026.06.24> .\Check_UEFI-CA2023.ps1 -verbose
Windows 11 25H2 (26200.8737)

Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

BIOS Firmware
-------------
    ASUS System Product Name
    Version: 4505
    Date: 2025-11-28

Factory Default UEFI PK Cert
----------------------------
    ASUSTeK MotherBoard PK Certificate

UEFI PK Cert
------------
    ASUSTeK MotherBoard PK Certificate

Factory Default UEFI KEK Certs
------------------------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023
    ASUSTeK MotherBoard KEK Certificate

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023
    Canonical Ltd. Master Certificate Authority
    ASUSTeK MotherBoard KEK Certificate

Factory Default UEFI DB Certs
-----------------------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023
    ASUSTeK MotherBoard SW Key Certificate
    ASUSTeK Notebook SW Key Certificate

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023
    Canonical Ltd. Master Certificate Authority
    ASUSTeK MotherBoard SW Key Certificate
    ASUSTeK Notebook SW Key Certificate

Factory Default UEFI DBX Certs
------------------------------
    (NONE)
    EFI_CERT_SHA256_GUID Signatures: 430

UEFI DBX Certs
--------------
    Microsoft Windows Production PCA 2011
    Windows BootMgr SVN 9.0
    EFI_CERT_SHA256_GUID Signatures: 452

UEFI Variables
--------------
    Credential Guard: ON
    SBAT (Linux only): sbat,1,2024010900 / shim,4 / grub,3 / grub.debian,4

EFI Files
---------
    Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        \\.\HarddiskVolume1\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.342, SVN 9.0

    Registry: "WindowsUEFICA2023Capable" = 2
        [Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

    SkuSiPolicy.p7b is CURRENT.
        \\.\HarddiskVolume1\EFI\Microsoft\Boot\SkuSiPolicy.p7b
        Version: 3.0.0.15
    NOT RECOMMENDED for dual-boot setups.


STATUS REPORT
-------------
    Registry: "UEFICA2023Status" = Updated

    SUCCESS: UPDATES ARE FINISHED.
    UEFI CA 2023 certs are present, PCA 2011 cert is revoked.

PS D:\Scripts\SecureBoot-CA-2023-Updates.v2026.06.24>

 

[DudeDK]

I've blocked driver updates via Windows Update. I get mine manually.

I also keep my firmware up-to-date, partly for FOMO, partly because of security issues. I have no idea whether that might prevent Windows Update from trying to update your PC with old firmware.

(I have had a couple of motherboards bricked by firmware updates, but that was roughly 20 years ago, with early EFI motherboards. Your Z690-Plus has a BIOS recovery mode, but I can't speak to its reliability. There is no manual button to perform that function, unfortunately.)

I wonder whether it'd be worthwhile to contact Asus support? They supplied the firmware update to Microsoft. I'm not optimistic, I admit. I've dealt with them in the past. I believe that their front line support is outsourced, to script readers.

I'm an old dude, been using computers since z80. This bios updating has always scared the living daylight out of me :). Never had a bricked MOBO yet and I fear my turn could be just right around the corner xD I don't think contacting Asus Support will do anything.

 

[DudeDK]

After Disabling Include drivers... all the driver updates will still appear, but will be an Optional install.

ONLY use BIOS updates from the motherboard manufacturer's website.

Welcome to ElevenForum. Here's ten points, just for filling out your computer specs.

Sounds great, I might go that route after all.