[wds] Locking PXE?

[GRitchie]

Hello,

Some of the machines in our network are set to boot from PXE by default - we want to find a way (from the WDS server) to ensure you have to type a password to launch the lite-touch?

 

Or secure it, so that students can't just image a machine!

 

 

As there are a lot of machines like this, we can't unfortunately just adjust the boot preference - hence why we'd like to do it from the server end ideally!

[Duke5A]

Honestly, I don't think there is a way to stop them from PXE booting a known computer from WDS. WDS is very dumb in this regard. The only thing you can do is alter permissions on the image folder inside the WDS folder.

 

Do this:

 

 

Disable inheritance on the permissions for this folder and ensure it looks something like the above. Make sure WDSServer, (local server)\Administrators, and System have full control. The completely blanked out name in the image is a special account I made so that our student helpers can image machines; set it to read. Before the prompt comes up to select an image it'll ask for credentials and as long as you feed it something that has read to the images folder it'll go. This is the best you're going to get for a stock WDS setup.

 

My WDS is tweaked though in that it loads a Linux PXE boot menu first that has the WDS server as an option along with other utilities that are all password protected. This was a pain to setup though and I doubt it will work with UEFI enabled devices.

Edited November 19, 2014 by Duke5A

[plexer]

You can do it by booting first into syslinux and creating a menu which can be password protected and have a default of boot to hard disk.

 

Ben

 

- - - Updated - - -

 

http://www.schrankmonster.de/2010/03/10/using-windows-deployment-services-wds-to-install-linux-over-network-pxe/

 

some additional info:

 

http://c-nergy.be/blog/?p=4661

 

I have done this and it works well.

 

Ben

Edited November 19, 2014 by plexer

[Blue_Cookeh]

Do you use HP or Dell machines? You could deploy a BIOS configuration to them remotely to require a password on BIOS boot menu or to remove PXE as first boot option.

 

Otherwise can you not disable WDS when not in use? Alternatively, if you're using SCCM you can easily set a password on the task sequence...

[Boredguy]

We went for a Linux boot image as @plexer suggested, but based off of this site

 

From there it loads our normal WDS image list which has our litetouch and any other deployment options

[plexer]

@Boredguy that's the one I used as well I recognised the background image.

 

Ben

[free780]

With MDT you can set it up to prompt for credentials. Thou can easily disable this in the summer by editing bootstrap.INI. You can also disable the f8 command prompt.

 

http://www.windowsnetworking.com/kbase/WindowsTips/Windows7/AdminTips/Migration/DisableF8duringLTIinstall.html

Edited November 20, 2014 by free780

[sted]

just disable wds service on the server until you need it?

[clockend25]

That's generally what I do, or set it to require administrator approval.