[wds] PXE Boot security

[fiza]

This is probably a really silly question and the answer is staring me in the face but here goes ;

 

Just got MDT working and using WDS PXE boot to get the clients to network boot. I have set it so that I have to press F12 on the client to get it to PXE boot. Once the machine is built what do you do about the PXE boot and the F12 option? What is to stop students pressing F12 on boot up? Is there a way to secure the PXE boot so only authorised people can use it?

Is there a tick box somewhere which would require a password to be input before it goes off looking for the server?

[Norphy]

I don't know about MDT so much but with raw WDS, you can put an ACL on the operating system that you're deploying so that only certain users can see it. With SCCM, you can put a password on the Windows PE Image itself so that while you can boot it, you won't be able to deploy anything without the password. I'd be surprised if there isn't something similar in MDT!

[FN-GM]

Setup your BIOS on your machines so it requires a password to network boot.

 

Can be done on Toshiba, Dell, HP, Intel motherboards etc. Can be done on loads of them.

[fiza]

Setup your BIOS on your machines so it requires a password to network boot.

 

Can be done on Toshiba, Dell, HP, Intel motherboards etc. Can be done on loads of them.

 

Just looking in thr BIOS and the only passwords I can find are System and Administrator. Dont want to set system as that asks for a password on every boot. I have set the Administrator one but it seems to still be able to get into the PXE boot.

 

Its a Dell Optiplex 760. Any ideas how to set it so it asks for a password before initiating PXE boot?

[ChrisH]

Replace the standard boot loader with a PXE linux one or similar. We have a full menu of applications such as memtest, DBAN and WDS and all need a password, once selected.

[fiza]

Replace the standard boot loader with a PXE linux one or similar. We have a full menu of applications such as memtest, DBAN and WDS and all need a password, once selected.

 

Ive got 450 machines to image. I need something simple to stop students using F12 once we are done.

[X-13]

I just turn off PxE boot when I'm done...

[fiza]

I just turn off PxE boot when I'm done...

 

Yep i did think of that but what about the odd occasion when we need to reimage a machine or 2 and have to enable PXE boot. Students could then press F12 whilst they are booting.

[X-13]

Yep i did think of that but what about the odd occasion when we need to reimage a machine or 2 and have to enable PXE boot. Students could then press F12 whilst they are booting.

 

Ours have the option to select a one-time boot option in the bios. I just pop in and use PxE as and when I need it.

 

It makes the computers boot faster.

[fiza]

Ours have the option to select a one-time boot option in the bios. I just pop in and use PxE as and when I need it.

 

It makes the computers boot faster.

 

Good point

[X-13]

Good point

 

A phrase very rarely heard in response to one of my posts...

[plexer]

Ive got 450 machines to image. I need something simple to stop students using F12 once we are done.

 

We also boot into pxe Linux and display a menu, the default option is to boot the hard drive which is does after a short delay otherwise the other boot options windows deployment, memtest86+ etc... all require a password to access them.

 

Ben

[fiza]

A phrase very rarely heard in response to one of my posts...

 

Another valid point

[ChrisH]

WDSLINUX - Syslinux Wiki Your only replacing a few files its worth the effort. The only thing was I had to use a linux machine to produce the password hash for the menus.

[Duke5A]

Replace the standard boot loader with a PXE linux one or similar. We have a full menu of applications such as memtest, DBAN and WDS and all need a password, once selected.

 

This is the route I took with WDS; PXE Linux gets passed out first and WDS is an option in its menu along with various other utilities. Getting it all setup is a PITA though. It was easier with WDS on 2003 and 2008 since the boot program could be changed in the management snap-in, but starting with 2008 R2 it needs to be done at the command line. Even though you can use an ACL to stop the kids from being able to deploy images in WDS, they can still boot the PE images I have in the list and access command lines. PXE Linux at least enables me to put the WDS option behind a password.

[MordyT]

Here is what we do. we have an extra flag in wds that if isn't greater then one it won't image. Each MAC address is in a list.

[sted]

could you just disable wds service or the boot image(s) on the server unless your using it?

[free780]

You could disable f8 in mdt boot. Require credentials in the wizard. Disable the command prompt when you click cancel. The reason why f12 isn't password protected is so users can ininnate a rebuild. If using sccm pxe password the image and disable f8.

[clod]

there's a small pxe bootstrap @

http://www.clod.pwp.blueyonder.co.uk/nbp.zip

that you can use to access a secondary pxe nbp with a simple password.

run the binary and save the patched nbp.0, boot this pxe (rename it to suit if need be).

if left-alt and shift are held down at boot, it asks for a pass then boots secondary nbp,

otherwise the default nbp is loaded.

it was written in a hurry nearly 10 years ago for use in a school, and not touched since.

(worked ok with zfd 4-7)

[dany2010]

I do two things.

 

First as mentioned use a menu, i used step 2 of this to figure it out,

deployvista.com > Home - Deploying Ubuntu 8.04.1 using WDS (Windows Deployment Services)

(Works for 2008r2 and win 7)

 

and the second thing is deny pupil account access to the MDT folder using the normal folder permissions.

 

If they then get past the menu and login to MDT they dont have any windows options so cant continue.

[steewy]

If you don't want to change the BIOS settings, simply change the rules of you MDT server. Go to option of you deploymentshare. Edit boostrap.ini and make sure that you have something like that. If student press F12 the PXE will load but ask for password to reimage. If they don't have it the computer will restart

 

 

UserDomain=your domain

UserID=Administrator

UserPassword= leave it empty

[free780]

Wont stop them hitting f8 and typing diskpart, sel disk 0,clean.

[steewy]

True. It took me quite a while, but every time I re image a computer I change the BIOS settings...

After less than 3 months I managed to secure the all school system.

[DellOughta]

We had the same problem at our Academy (we've been using WDS \PXE Booting for over 3 years and some clever d1ck had spotted how we did it, so we had to lock it down somehow), the easiest way I found was to open WDS right click on the server node \properties\PXE Response and select the following Require administrator approval......

 

 

You can then go to the machine that you want to reimage, select F12 and get it to PXE Boot

Pop back onto the server console, open WDS, go to the Pending Devices node (hit refresh) and you'll see your machine there waiting to be approved, right click approve and the image will continue.

 

Mike

[MYK-IT]

If Dell BIOS;

 

Within Security set an [Administrator] password

Ensure [Onboard NIC] is not selected as a device within [boot Sequence]

Ensure [integrated NIC] is [Enabled w/PXE]

 

When F12 is pressed, to boot via NIC the Administrator Password has to be entered.

 

As also mentioned, you can omit the credential details/password for the Deployment Share so that an image cannot be selected.

 

The next step would be ACL based on MAC Addresses via RADIUS etc. but I have not gone that far yet! but would stop users plugging in their own laptops and getting a nice new licensed image onto their own computer!