Server firmware update strategy and maintenance windows for Dell and HPE

Firmware updates fix security issues and hardware bugs, but an unplanned update on a production server can also cause the outage you were trying to avoid. The answer is not to stop updating; it is to update on purpose. This guide sets out a process that works for Dell PowerEdge and HPE ProLiant fleets: pick a tested baseline, read what changed, stage the update, know your rollback limits, and run it inside a maintenance window. The how-to steps for each tool are in the linked guides.

Step 1 — Choose a baseline instead of single updates

A baseline is a known set of versions you hold every server to.

• Dell: in OpenManage Enterprise a catalog is a bundle of firmware and drivers. The source can be Latest component versions on Dell.com or a Network Path where catalogs downloaded with Dell Repository Manager (DRM) are saved. A baseline links devices to a catalog, and Configuration > Firmware/Driver Compliance shows which devices are behind. Dell's iDRAC guide recommends building a repository with DRM so you control the versions iDRAC sees and avoid unintended firmware changes.
• HPE: the Service Pack for ProLiant (SPP) is a collection of firmware, drivers and system software tested together as a single-solution stack. HPE releases a Production SPP roughly two to four times a year for the latest and previous server generation and recommends updating those generations on a yearly cadence. Older generations get generation-specific Post-Production SPPs limited to bug fixes and security updates.

Step 2 — Read the release documentation

1. For HPE, each SPP comes with release notes, a server support guide, a contents report and component release notes. Component notes state the upgrade requirement (critical, recommended or optional), dependencies and problems fixed.
2. For Dell, check the release notes of each update package in the catalog. The iDRAC guide warns that a version marked Available is not always the latest, so confirm it is newer than what is installed.
3. Note any component that needs a full power cycle or special handling. The iLO 6 guide, for example, says System ROM and CPLD updates need a server reboot (a reboot after CPLD is converted to an AC power cycle), and Server Platform Services firmware must be installed with the server powered off.

Step 3 — Plan the update path

• HPE one-year window: HPE tests each SPP against the previous year of SPP releases. If you are further behind, HPE recommends intermediate updates; its example goes from 2018.11.0 to 2019.09.0, then to 2020.03.0.
• Dell iDRAC9 downgrades: the OME guide notes that to downgrade iDRAC9 to firmware from before February 2021, you must first downgrade to version 4.40.10.00.
• Order: Dell says that when several updates are applied out of band, iDRAC orders them to reduce unnecessary restarts. HPE SUM works from the SPP as a whole. Follow the tool rather than hand-ordering components, unless a release note says otherwise.

Step 4 — Stage, pilot, then roll out

1. Apply the baseline to one non-critical server of each model first and run it for a few days.
2. Use staging features to shorten the window. iDRAC scheduled updates can apply or stage updates; HPE install sets copy components to the iLO Repository for later installation.
3. Choose online or offline. HPE describes offline updates as booting the server to the SPP ISO, usually through iLO virtual media. The same document notes that the Gen12 SPP is not bootable and does not support offline updates.
4. Roll out to the rest of the fleet in groups, cluster nodes one at a time.

Step 5 — Know your rollback limits

• Dell iDRAC: rollback is supported for iDRAC with Lifecycle Controller, BIOS, NIC, PSU, RAID controller and backplane, but not for Diagnostics, Driver Packs or CPLD.
• Dell OME: rollback applies to firmware only; drivers cannot be rolled back, and only devices updated from the OME console are listed.
• HPE install sets: a saved install set keeps the components on iLO, so you can restore or roll back a component version without the original SPP.
• HPE Downgrade Policy: with a supporting licence, iLO offers Allow downgrades (default), Downgrade requires Recovery Set privilege, or Permanently disallow downgrades. HPE warns that the last option is permanent and is not reset by a factory reset.
• HPE flash limit: iLO allows 20 flashes per firmware type per day, counting failed attempts. Repeated retries can lock you out until the counter resets.

Maintenance window checklist

• Change approved, users told, window long enough for reboots of every component in the baseline.
• Backups verified; server configuration exported; cluster workloads moved off the host.
• Remote console tested so you can watch POST; physical access arranged as a fallback.
• Release notes read; components needing a power cycle or power-off identified.
• After the update: compliance report or SUM inventory shows the new versions; hardware logs clean; services tested.

Checklist

• One baseline per platform (OME catalog or SPP) recorded with its date.
• Update cadence agreed; HPE production generations at least yearly.
• Pilot server per model updated first.
• Rollback limits understood; downgrade policy reviewed before changing it.
• Tool guides at hand: OpenManage Enterprise, iDRAC9 updates, SPP and SUM and iLO Repository.

Skyline can supply, configure and maintain Dell, HPE and Huawei servers under an annual maintenance contract (AMC). Contact us.