ActivCore Bios 03/14/18 Installation Instructions

Version 1.0
5/22/18

Warning: Bios Upgrade Requires 2 Reboots:

The bios install requires 2 reboots. The bios installation application will install a temporary bios and
then reboot. The temporary bios will either be bios 3/12/18 or 3/13/18. Once Windows is running
again, the Bios Installation Application will install bios 3/14/18 and reboot again. When the installation
is complete, please verify that bios 3/14/18 is installed. The temporary bios versions do not have any of
the fixes in them that are part of bios 3/14/18.

WARNING: Important Information: Ethernet

When installing the bios, please unplug all Ethernet Cables from the PC (there are 2 Ethernet ports on
the Voyager, please unplug cables from both) and then disable any firewall software that is running (See
Appendix A for instructions on how to disable the Symantec Firewall). It has been found that running
the install with a Symantec Endpoint Protection enabled and the computer connected to the network
can cause Windows 7 to crash (Blue Screen). It is possible to corrupt the bios if this happens, so it is very
important to follow this warning.

WARNING: Important Information: Bios Version

This bios install is intended to update from the following Bios versions:
 9/5/14
 4/18/16
 2/6/17
 2/24/17

It is NOT intended to update a bios version other than the ones listed above. If you are running a bios
version older than 9/5/14, you MUST upgrade to bios 9/5/14 before upgrading to 3/14/18. For
instruction to update to bios 9/5/14, please see the Tiger Alert here:

Diebold – All Rights Reserved May 23, 2018 Page 1 of 7

Version 1.0
http://usncsrv2.ad.diebold.com:19490/sites/supportportal/Lists/Tiger%20Alerts/DispForm.aspx?ID=13&
Source=http%3A%2F%2Fusncsrv2%2Ead%2Ediebold%2Ecom%3A19490%2Fsites%2Fsupportportal%2FLi
sts%2FTiger%2520Alerts%2FAllItems%2Easpx&ContentTypeId=0x010400D71DD80DE130434D8FC25E26
B2C502E5

WARNING: Bios is unable to be downgraded

In order to provide a secure Bios for the ActivCore, the ActivCore bios can NOT be downgraded, it can
only be upgraded. The bios can be upgraded to bios version 3/14/18, but it can NOT be downgraded to
bios versions 9/5/14, 4/18/16, 2/6/17, or 2/24/17.

Diebold – All Rights Reserved May 23, 2018 Page 2 of 7

Version 1.0
Introduction:
This document is intended to provide information on the ActivCore High End Bios 3/14/18 upgrade.

Bios Install Options:

There are 3 versions of the Bios installation application. All of the versions install bios 3/14/18. The
difference between the 3 installation versions is the default setting for the Boot Mode. This bios setting
can be found in the bios setup menu in the “Boot” Menu -> “UEFI Boot” Option. This bios option
controls the boot mode of the PC.

The 3 different Bios installation applications only control the default setting for the Boot Mode, but you
are free to change the setting after the bios is installed.

The options are:

1. Legacy Only – Legacy Only is intended for Windows 7 installations. Windows 7 can only boot
using the Legacy Boot Mode.
2. UEFI Only – UEFI only is intended for Windows 10 applications. It is recommended that all
Windows 10 applications run using UEFI because it supports more security features than Legacy
Boot mode allows. UEFI Only is what ships from the factory when a Windows 10 order is placed.
3. UEFI and Legacy – This mode allows either a UEFI or Legacy Boot device to boot. It is intended
to be installed in the field where the system could be either a Windows 7 or Windows 10
system. This allows you to switch between Windows 7 and Windows 10 without changing the
bios setting.

Bios 3/14/18 Legacy Only can be upgraded to Bios 3/14/18 UEFI Only and Bios 3/14/18 UEFI and Legacy.
Bios 3/14/18 UEFI Only can be upgraded to 3/14/18 UEFI and Legacy, but can not be upgraded to
3/14/18 Legacy Only. Bios 3/14/18 UEFI and Legacy can not be upgraded until a new version of bios
comes out.

Diebold – All Rights Reserved May 23, 2018 Page 3 of 7

Version 1.0
Bios Changes:
The Factory is currently shipping Bios 4/18/16. It is shipping bios 2/6/17 on Windows 10 machines and
Bios 2/24/17 on Voyager for Opteva units. The following are the bios changes from 4/18/16 to the new
bios 3/14/18

Changes made in 3/14/18:

1. Applied the Intel Microcode to fix the Spectre Vulnerability.

Changes made in 2/24/17 which are included in 3/14/18

2. Updated the ME Firmware to version 9.1.41.3024 to fix the AMT vulnerability

3. Fixed an issue that caused TS-HDE encrypted drives to not boot on a Voyager. TS-HDE is
Terminal Security – Hard Drive Encryption. It is a software based hard drive encryption.

Changes made in 2/6/17 which are included in 3/14/18

4. Adds Windows 10 support by adding UEFI Boot Mode.

5. Adds Dual Authentication (2-Factor) security to the Boot (F12) and Setup Menu (F2)
6. Eliminates XHCI (USB 3.0) 96 Endpoint Limitation which is needed for Windows 10.
7. Adds the Windows 10 Secure Boot Option
8. Fixes the 19” AMT Menu Screen (ctrl-p). The screen wasn’t formatted correctly with older bios
versions and made it illegible.
9. Fixed an issue that did not allow the Bios Serial Number or UUID (Universally Unique Identifier)
to be programmed in the factory. The Bios installer will program these numbers if they are
blank.
10. Fixed the Clear TPM Lockup issue in Windows 10
11. Add the Diebold Nixdorf Splash Screen Logo.
12. Disables the onboard video when running without an integrated LCD panel. This is used for
Voyager for Opteva.
13. Fixes issue when Bios splash screen shows on the screen, then goes away, then comes back. Fix
will keep bios splash screen on solid during boot.
14. Increases the max number of USB devices the bios looks for before booting into Windows.
15. Removed some Bios Menu options that were not needed or provided alternate boot
options. Example “Hard Drive BBS Priorities”.
16. Change to allow SSTC to display in 1024x768 when running Linux with SSTC (Vbios change to
5.5.1039)
17. Fixed issue in BIOS setup menu, CPU Temperature is reported too low under room temperature

Diebold – All Rights Reserved May 23, 2018 Page 4 of 7

Version 1.0
Bios Installation Instructions:
The Bios is being provided in a Diebold Media Kit.

1. Download the Media Kit from the GES Website.

2. Log into the Manage_ATM user account.
3. Disable Symantec Endpoint Protection if installed. See Appendix A: Disable the Symantec
Endpoint Protection (Firewall) for instructions.
4. Execute the Media Kit. Part 1 of the install will run for 20 seconds to 2 minutes.
Note: No USB devices will operate during the install, including the keyboard. Once the
Bios is installed, the keyboard will operate again.
5. Depending on the Bios installed before the Media Kit is run, the media kit will do the following:
a. If Bios 9/5/14, 4/18/16, 2/6/17, 2/24/17 is installed: The bios install will take 1 to 2
minutes and reboot. The install will continue after the reboot
b. If Bios 3/14/18 is installed and being upgraded: The bios install will take 1 to 2 minutes
and reboot. The installation is complete after the reboot.
c. If Bios 3/14/18 is installed and installing the same version: The install will take about 10
seconds. The PC will not reboot. The bios will NOT be installed because it is already up
to date.
6. After the reboot, if Bios 9/5/14, 4/18/16, 2/6/17, 2/24/17 was installed, the Media Kit will
execute Part 4. This could take 3 to 4 minutes.
7. The PC will reboot when finished. After the reboot, the bios installation will be complete.

Note: The Bios will not take effect until the PC reboots.
Note: After installation, the boot cycle immediately following the install will be slower and an
additional reboot may occur.

Bios Setup Menu (F2) Change with Dual Authentication:

Bios 3/14/18 support Dual Authentication. With Dual Authentication, the user has the option to use a
Supervisor/ATM password only, a Valitech Token only, or both together in order to access the boot
menu (F12) and the setup menu (F2). The default is both. In order for the Valitech token to work, it
must have a valid unexpired certificate loaded on it.

When Bios 3/14/18 is installed, there is no Supervisor Password installed (unless one was set by the
customer before the bios install, that password will still be valid after the install). If the PC is turned on
and F2 is pressed without a Supervisor Password or a Valitech eToken, all of the menu items will be
grayed out and unable to be changed. In order to change the bios settings, the user can either plug in a
Valitech token, or create a Supervisor password. If a Supervisor password is created, the PC must be
rebooted for it to take effect. The supervisor can be created by pressing F2 and setting the password.

Diebold – All Rights Reserved May 23, 2018 Page 5 of 7

Version 1.0
Appendix A: Disable the Symantec Endpoint Protection (Firewall)
1. Log into the Manage_ATM account.
2. In the taskbar on the bottom right side of the screen, click the up arrow (see image below)
3. Right click on the Symantec Icon (see image below)

4. When the options appear, click on “Disable Symantec Endpoint Protection”

5. Once the firewall is disabled, the icon will change as shown below.

6. When the ATM reboots, re-enable the firewall by the following the step above, but enable the
Symantec Endpoint protection instead of disabling it.
Diebold – All Rights Reserved May 23, 2018 Page 6 of 7
Version 1.0
Appendix B: How to Determine Current Bios Version:
In Windows:
1. Open up a command prompt.
2. Type systeminfo
3. Once complete, scroll to the top of the command prompt window.
4. Look for “Bios Version”. The current bios version should be “9/5/2014”, “4/18/16”, “2/6/17”,
“2/24/17” or “3/14/18” for High End Processor. See the following image from a High End ActivCore.

Figure 1 - High End Bios Version

In Bios Setup:
1. Power On or Reboot the ActivCore
2. Press “F2” when promoted to enter Bios Setup. (A Supervisor Password may be required).
3. Look at the “Build Date and Time”.

im

Figure 2 - Bios Setup Bios Version – High End

Diebold – All Rights Reserved May 23, 2018 Page 7 of 7

Version 1.0