[wds] MDT/WDS across multiple sites

[jmak]

New to me, but I know others do it: I've had MDT/ WDS working for years now, but only on one site. I now want to deploy to clients located at a site remote to the deployment server. Now I'm asking for help with firewall settings - which I don't manage, so ideally I want to ask for the correct chances first time round.

 

I found this for inbound roles on the server and they're in place: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/mt670791(v=ws.11)

 

But I'm still getting network issues, so I'm guessing I need to slow inbound connections at the client end too. Can anyone point me in the direction of the correct documentation?

 

As a test, I tried to map the deployment share from a client and I get a network problem with that too - I would expect the rules I set inbound in the server would cover everything I need at that end, so I have proved a network issue.

[Davit2005]

I know you can do it with SCCM but have you thought about a distribution point at each site rather than each client talking cross the link. Sorry if miss-understood your question.

 

We had similar issues and put a DP on subnets with large number of clients as the performance hit on our firewall was drastic, our server is separated from the clients by the firewall.

Edited March 5, 2025 by Davit2005

[mbedford]

+1 for the multiple DP's with them being local to the machines site.

 

What link speeds are you looking at between these sites? A classroom of reloads with a base image of 20-30GB is going to hammer your bandwidth. We used to do this over a microwave link between two buildings, 1gbps link, once 5+ machines were downloading the image, we used to get all sorts of trouble just getting the other clients to download the boot image, never mind the OS image.

[jmak]

It's not a school - it's a relatively small number of clients at any particular site. I don't have anywhere to host a DP, but I do have 10Gbps to the desktop.

[Davit2005]

It's not a school - it's a relatively small number of clients at any particular site. I don't have anywhere to host a DP, but I do have 10Gbps to the desktop.

 

A DP can even run on a suitable desktop, does not need to be a server. It would save the bandwidth across the link. Does not matter if you are not a school the process is no different :-)

 

The other option as you say is to limit the clients down so it does not effect the network as a whole.

Edited March 6, 2025 by Davit2005

[jmak]

Just realised there was a small typo from auto correct that significantly changed the meaning of my original post 🤦🏻

It's nothing to do with a slow network - the network connection isn't allowed. Sorry to waste everyone's time.

 

I appreciate the technical issues are the same whether it's a school or not - that's why I stuck around - it's the most helpful forum around! The reason I mentioned it is because from my school days we were imaging significant numbers of clients at the same time which I don't need to do.

 

Still playing with firewall rules - I have rules to allow all the ports listed on the page I linked inbound at both ends. It does say it's not kept up to date and I think I need 445 open as well.

 

If I find the answer, I'll report back.

[mbedford]

I dont know if SCCM works in a similar way, but MDT and WDS (The MS alternative to SCCM's deployment method) just uses an SMB share and WinPE connects to that and applies the image using DISM. So, at its most basic level, the firewall rules for allowing SMB shares should be enough.

 

But SCCM, in its nature of being a horrible beast, probably has some additional requirements, like the custody of your first born...