SCCM with iPXE UEFI boot without WDS server

This is a long post….hope you have energy to read. 😀

Dell has a really nice post about How to configure PXE booting over UEFI without using Server 2012 and Windows Deployment Services, you can read this here.
In that post, sample is MDT.

I am going to do a SCCM scenario. You can watch this video see how my scenario of iPXE works. Just remember, secure boot is not supported, unless you sign your efi file.
Video is on YouTube. Part 1  and Part 2

Before you start build up your iPXE, I want you to think why you need iPXE, where are you going to put your iPXE server?
Usually in a big organization, you have lots of ip ranges, different subnets, so are you going to put a iPXE server in each subnet? What do you do after machines are boot up from iPXE? I guess you are using MDT or SCCM deploy OS, so where are you going to put those contents?

You can test iPXE any way your want, it is very flexible with embedded scripts. When you plan to use iPXE in production, first you need to have good knowledge about the infrastructure of your environments, how to you want iPXE to work and how to get benefits out of it. That is most difficult part.

In this post. I will present a scenario:

1. You have multiple subnet ip range
2. Using SCCM deploy Full OS.
3. You might have local subnet DP in some of those ip ranges, but not all subnet has its own DP
4. you don’t want to use usb boot media or offline installation media.
5. Use http download boot.wim from iPXE server, it is faster than TFTP

Remember, everything you need will be attached end of this post, just not the SCCM boot file, and I won’t post you a windows 10 machine. 🙂

Prepare the boot.wim

(you can read also from http://ipxe.org/howto/sccm)

1. Create a x64 boot media iso file from your SCCM Admin console.
2. Mount the SCCM boot media iso file or unzip it.
3. Copy sources\boot.wim to C:\wim\boot.wim
4. You need to have ADK installed. Run “Deployment and Imaging Tools Environment” as Administrator.
5. Use images mount C:\wim\boot.wim to c:\mount folder

   imagex /mountrw C:\wim\boot.wim 1 c:\mount

6. Mount the SCCM boot iso file or unzip it. Copy sms\data folder to c:\mount\sms folder, so it should look like this

   

7. Create bootstrap.vbs file

   Set os = WScript.CreateObject ( "WScript.Shell" )
   os.Run "%COMSPEC%", 7, false
   os.Run "%COMSPEC% /c title Initialising... && wpeinit " & "&& net start dnscache", 1, true
   os.RegWrite "HKLM\SYSTEM\CurrentControlSet\Control\PEBootType", "Ramdisk:OpticalDrive", "REG_SZ"
   os.Run WScript.ScriptFullName & "\..\TsmBootStrap.exe /env:WinPE " & "/configpath:%SYSTEMDRIVE%\sms\data", 1, true

8. Create winpeshl.ini file.

   [LaunchApps]
   "wscript.exe","%SYSTEMDRIVE%\sms\bin\x64\bootstrap.vbs"

9. copy winpeshl.ini to c:\mount\windows\system32
10. copy bootstrap.vbs to c:\mount\sms\bin\x64
11. copy c:\mount\sms\bin\x64\cmtrace.exe to c:\mount\windows\system32
12. commit and unmount

    imagex /commit /unmount c:\mount

 

Prepare Tiny PXE Server (example Windows 10)

1. Download Tiny PXE server. http://reboot.pro/files/file/303-tiny-pxe-server/   (the link is quite slow, maynot work sometimes)
2. Create C:\TFTPD folder, copy unziped tiny pxe server files to C:\TFTPD
3. Create C:\TFTPD\iPXE folder
4. Mount the SCCM boot media iso file or unzip it, copy everything to C:\TFTPD\iPXE
5. copy modified boot.wim from “Prepare the boot.wim” to C:\TFTPD\iPXE\sources folder, overwrite the original boot.wim
6. Download http://git.ipxe.org/releases/wimboot/wimboot-latest.zip, unzip it, copy only wimboot file to C:\TFTP\iPXE folder
7. Create install.ipxe file in C:\TFTPD\iPXE folder

   #!ipxe
   
   :start
   menu Please choose an operating system to install
   item --gap Windows
   item Windows10  Windows 10 Enterprise 64-bit
   item --gap ipxe shell
   item shell       Drop to iPXE shell
   
   choose target && goto ${target}
   
   :shell
   echo Type 'exit' to get the back to the menu
   shell
   set menu-timeout 0
   set submenu-timeout 0
   goto start
   
   :Windows10
   set boot-url http://${next-server}
   kernel ${boot-url}/wimboot
   initrd ${boot-url}/BOOTMGR          BOOTMGR
   initrd ${boot-url}/boot/bcd BCD
   initrd ${boot-url}/Boot/BOOT.SDI BOOT.SDI
   initrd ${boot-url}/SOURCES/BOOT.WIM BOOT.WIM
   boot
   boot || prompt --key s --timeout 10000 Chainloading failed, hit 's' for the iPXE shell; reboot in 10 seconds && shell || reboot
   

 

Prepare DHCP

Because we are doing ipxe boot cross different ip subnet, so you will have to manual put the boot server and boot file in DHCP
(Maybe can use iphelper with ipxe, I am not sure, but sorry I didn’t test iphelper. )

You can configure this with at least two options, they both works. Choose what is best for you or you can read more from ipxe.org and figure your own way.

Option 1 (I don’t write too much details for this one):

1. Download http://erwan.labalec.fr/other/ipxe-snponly-x86-64.efi , or http://boot.ipxe.org/ipxe.efi, save the efi file to C:\TFTP\iPXE folder
2. Break the infinite loop using DHCP (not script, because you are using the efi file from step 1). Read this http://ipxe.org/howto/chainloading and http://ipxe.org/howto/msdhcp#pxe_chainloading
   if you don’t do these settings in DHCP, you will have an infinite loop like this:

   

 

Option 2 : (Use embedded script, I use this one, everything you need will be attached end of this post)

1.  Generate your own boot file form this website https://rom-o-matic.eu  (this moment when I am writing this, that server is down)
   Advanced settings can read from https://wiki.fogproject.org/wiki/index.php?title=IPXE#rom-o-matic.eu
2.  Embedded script (Noted, netboot chain tftp filename is install.ipxe, same name as we created earlier. Just make sure the name is same)

   #!ipxe
   ifopen
   isset ${net0/mac} && dhcp net0 || goto dhcpnet1
   echo Received DHCP answer on interface net0 && goto proxycheck
   
   :dhcpnet1
   isset ${net1/mac} && dhcp net1 || goto dhcperror
   echo Received DHCP answer on interface net1 && goto proxycheck
   
   :dhcperror
   dhcp || prompt --key s --timeout 10000 DHCP failed, hit 's' for the iPXE shell; reboot in 10 seconds && shell || reboot
   
   :proxycheck
   isset ${proxydhcp/next-server} && isset ${next-server} && echo Duplicate option 66 (next server) from DHCP proxy and DHCP server && echo Using IP sent by DHCP proxy ${proxydhcp/next-server} && prompt --timeout 5000 || goto nextservercheck
   
   :nextservercheck
   isset ${proxydhcp/next-server} && set next-server ${proxydhcp/next-server} ||
   isset ${next-server} && goto netboot || goto setserv
   
   :setserv
   echo -n Please enter tftp server: && read next-server && goto netboot || goto setserv
   
   :netboot
   chain tftp://${next-server}/install.ipxe ||
   prompt --key s --timeout 10000 Chainloading failed, hit 's' for the iPXE shell; reboot in 10 seconds && shell || reboot
   

3. I want to prepare my efi file to support https, I created my ipxe_x64.efi file using advanced settings.
4. Copy ipxe_x64.efi file to C:\TFTP\iPXE folder
5. Configure your DHCP like this:
   066 Boot Server Host Name, put your ipxe server name here, or it’s ip.
   067 Bootfile Name, ipxe_x64.efi

   With these settings, if there is PXE enabled Distrubution Point on same subnet, machine will use the normal PXE boot from your PXE DP.
   But if there is no PXE enabled Distribution Point on same subnet, machine will boot from the iPXE server and use http download boot.wim.
   

 

Tiny PXE Server

1. Modify config.ini

   

2. Fire up pxesrv.exe, it should look like as this picture shows. Click “Online”
   
3. And…. you might see httpd error, Socket Error # 10013, Access denied. WHAT????  Trust me, you won’t find much answers from google or bing. 🙂

   

4. In my case, it was cause by BranchCache.
   Super much thanks for Phil Wilcock , he pointed out that I don’t need to disable BranchCache, just need to change the port, BranchCache use default port 80.
   Here is more information privided by Phil. Really good to read them!
   https://2pintsoftware.com/faq/
   http://code.avalon-zone.be/distributed-branchcache-change-default-tcp-port/

5. Then put Tiny PXE server online again. Boot up your client machine without secure boot.

   

 

So, that’s all. Here are some screenshots

 

You can download the package from my OneDrive. Click here.

Please don’t ask me about embedded scripts, I didn’t write that script, found it from github, too bad didn’t mark down the link.

Have fun test iPXE, you will like it!

PS. You can make it work with Legacy and UEFI boot. You just need to configure DHCP policy. Read this https://2pintsoftware.com/whitepaper-using-dhcp-uefi-bios-pxe-booting/