hagridsbeard Posted August 8, 2011 Posted August 8, 2011 Hi Guys, just moved to WDS from Ghost and am a bit concerned that students can F12 right to drive management (and therefore delete partitions etc). The only way around this is to stop the WDS service when we're not using it, but that seems incredibly clunky. Is there an inbuilt way to secure it a bit more? Sorry if this has been asked, but I couldn't find it on the tips section.
glennda Posted August 8, 2011 Posted August 8, 2011 Not sure you can according to this Windows Deployment Services - how to Password But I would go with protecting the BIOS and being prompted for password that way
morganw Posted August 8, 2011 Posted August 8, 2011 The BIOS route is pretty neat if you can bring up a password protected boot menu but most motherboards won't do this, depends if you want to network boot a lot of stuff in a hurry. I'm using MDT2010 and if you don't put a password in bootstrap file it prompts for it. Depending on your DHCP setup you might find it easier to make an alternate DHCP group that does PXE booting and add/delete MAC addresses as you need to.
6Foot2 Posted August 8, 2011 Posted August 8, 2011 I have been thinking about this too. Not a problem at the moment as the students are out but the best I can up with for term time is to stop the WDS service at the server and start it only when I need it. Still looking for better ideas...
nicklec Posted August 8, 2011 Posted August 8, 2011 Don't have your MDT password entered automatically and/or use a vlan for imaging (perhaps just term time)?
apeman Posted August 8, 2011 Posted August 8, 2011 Out of all the threads i have read about WDS on various forums you are the only person i have ever seen that has asked about security. so top bloke for thinking about it For our current desktop setup we have dell optiplex 960 which you are able to password protect when booting from anything other than the hard drive. but this doesnt help if someone forgets to set a password or when using a none dell machine. So we have the wds server set to only accept known clients and prompt for approval for unknown client. The boot image has SHIFT F10 disabled, so no access to the command prompt. Permissions on the images in the Reminst/deployment share are set so only the Domain admins and a special wds user can read them, this means no else can see any images if the log into WDS when pxe booting. The special wds user has rights only to modify certain parts of the computer object in AD and only in the OU's where our computer objects are i am sure we did a few other things as well but i cant remember them of the top of my head its been about 4 years since we set it up
plexer Posted August 9, 2011 Posted August 9, 2011 (edited) My boot image is pxelinux default is to boot hard drive, all the other options require a password. Ben Edited November 15, 2011 by ChrisH
glennda Posted August 9, 2011 Posted August 9, 2011 My boot image is pxelinux default is to boot gard drive, all the other options require a password. Ben Using fog though?
Arthur Posted August 9, 2011 Posted August 9, 2011 Still looking for better ideas... WDSLinux? Since this is based on PXELinux, you can use the MASTER PASSWD or MENU PASSWD commands to password protect WDS and add other programs such as PartEd Magic too.
plexer Posted August 9, 2011 Posted August 9, 2011 Using fog though? Nope wds to boot pxelinux as the boot image and then a menu allows me to boot whatever I want the wds deployment image, memtest86+ iso image, ghost iso whatever I want. Ben
6Foot2 Posted August 9, 2011 Posted August 9, 2011 I just went to image another room and remembered then that the admin password has to be entered before they can get to the point where they can delete partitions. Will still be stopping the WDS service when we are not imaging.
plexer Posted August 9, 2011 Posted August 9, 2011 WDSLinux That's what I have running really simple and cool. Ben
hagridsbeard Posted August 9, 2011 Author Posted August 9, 2011 Feel really rude here as I thought I would get an email when people replied, so I didn't check, but I didn't so missed all the replies. Sorry and hello! We did have it set up (by a clever student of all people) to boot to a splash screen on F12, which needed a password. Then there were a load of options, one of which was Ghost (which we were using). Think it was called tftpd32.exe. But we couldn't do Win 7 on our version of Ghost, so switched to WDS. Now I'm thinking that WDS could have been run from that app, keeping it behind the security, but the config for this stuff really confuses me.
plexer Posted August 9, 2011 Posted August 9, 2011 Look at the wdslinux guide linked to earlier and if you get stuck give me a shout. Ben
apeman Posted August 9, 2011 Posted August 9, 2011 I just went to image another room and remembered then that the admin password has to be entered before they can get to the point where they can delete partitions. Will still be stopping the WDS service when we are not imaging. This isnt true, once the boot image has loaded all the Student/Staff need to do is press SHIFT F10 and the get a unrestricted command prompt. which then all they need to type is format c:, hey presto one un-bootable machine.
6Foot2 Posted August 9, 2011 Posted August 9, 2011 This isnt true, once the boot image has loaded all the Student/Staff need to do is press SHIFT F10 and the get a unrestricted command prompt. which then all they need to type is format c:, hey presto one un-bootable machine. I will check this tomorrow. However if I stop the WDS service at the server they won't get that far.
hagridsbeard Posted August 10, 2011 Author Posted August 10, 2011 Look at the wdslinux guide linked to earlier and if you get stuck give me a shout. Ben Absolutely superb. Only took a few minutes as I was familiar with the config file setup, just didn't know how it all linked together. Got a nice password prompt, then a load of tools, including WDS and Ghost. Flipping brilliant, many many thanks.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now