Note: In August of 2018, Lenovo joined the Linux Vendor Firmware Service, which enables installing firmware updates from within Linux. You should use fwupdmgr to update the various firmware components of your ThinkPad, and the WinPE hackery below is no longer required. My original post follows below, it might still be applicable to other manufacturers.

Lenovo only provides Windows installers for Intel Management Engine (ME) firmware updates. Since ME occasionally has embarrassing security issues, this is pretty bad for Linux users and everyone else not using Windows. However, it is possible to install these updates using Windows PE (WinPE). But the process of doing so isn’t particularly well-documented. The following steps should apply to any new-ish ThinkPad. I have personally used it on an X1 Carbon 5th-gen (2017). I’ll assume you’re using Linux; it’s probably easy enough to adapt the instructions for BSD etc.

First, you need to download a Windows 10 installer image from Microsoft’s download page. Don’t worry, we’re not going to install it. Windows 10 is required for newer machines (Kaby Lake and newer, for laptops that’s the Core i3/i5/i7 7xxx series), on older machines you can also use that old Windows 7 image you still have lying around somewhere. Mount the installer image:

sudo mount -o loop,ro Win10_1709_English_x64.iso /mnt

Next, you’ll have to download the Intel ME firmware update from Lenovo’s support page. Enter your model number, go to the “Drivers & Software” page, and select “Chipset”. From the various updates available you’ll have to download two. First, get the “Intel Management Engine 11.8 Firmware for Windows” (version number might differ for your machine). This is the update you actually want to install. However, you need Intel’s Management Engine Interface (MEI) driver to install the update, and WinPE doesn’t ship those. So you also need to download the “Intel Management Engine 11.7 software for Windows” (again, the version number might differ), which contains the driver.

Once you’ve got the firmware and software packages, unpack them with wine. When running them, don’t forget to de-select the option to immediately run the update at the end—that won’t work. You can check that the unpacking worked by looking at your ~/.wine/drive_c/DRIVERS/WIN directory. It should contain two directories, ME and AMT. cd into the latter and extract SetupME.exe with cabextract SetupME.exe (you might have to install the cabextract tool using your package manager). The only thing you need is the HECI_REL directory, which contains the MEI driver—you can delete the rest.

Now you’re ready to create your WinPE image! Do so with the following command, which you can install from the wimtools package in Debian. You might require additional tools, which mkwinpeimg it will tell you about.

mkwinpeimg --windows-dir=/mnt \
   --overlay=$HOME/.wine/drive_c_DRIVERS winpe.img

This will take a few seconds, and you will end up with a file called winpe.img which will be a bit above 300MB (or 400MB if you didn’t delete the AMT driver setup files before). You can write this file to a USB thumb drive, substituting your USB drive’s device ID for sdx. This will irrecoverably delete all files on your thumb drive, so backup your files before doing this!

sudo dd if=winpe.img of=/dev/sdx bs=1M

Wait for this to complete, then reboot your ThinkPad and choose the USB drive as boot device (press F12 during the UEFI/BIOS screen). After a minute or so, you’ll see a Windows command prompt. Move into the ME driver directory with cd /WIN/AMT/HECI_REL/win10 (assuming you used a Windows 10 image, use win7 if you used Windows 7) and execute drvload heci.inf to load the MEI driver. Now move to the firmware update installer directory with cd /WIN/ME and run the updater with MEUpdate.cmd. Wait for a bit until it’s finished. If it complains about not finding shutdown.exe at the end, that’s fine. Reboot by clicking the close button at the top right of the command prompt window (yup, really). Done!


tl;dr: You can get the short version at