Updated: 6/1/2019

Operating System Deployment over PXE boot

Operating system deployment is a core functionality of SCCM. While there are other ways to deploy Windows 10, all the tools we need to configure the OS are already in SCCM. Being able to bring it all together makes OSD in SCCM flexible, powerful, and simple.

In this post we’ll do a minimalistic configuration of OSD over PXE. This means we can boot a workstation directly into the task sequence over the network. Eventually, after we cover more SCCM fundamentals, we will revisit this idea in a series more advanced posts to really highlight the potential of OSD.

Windows and Office Deployment Lab Kit does a couple convenient configurations if we’re using the Current Branch lab we configured in the previous post. If we’re using the tech preview lab we will need to do some additional set up.

The Requirements

  1. A Windows 10 Enterprise 64-bit ISO.

  2. The latest Windows Assessment and Deployment Kit and the Windows PE add-on for the ADK.

The Overview

For a no frills (non-MDT) OSD setup, I’m quite partial to Ricky Gao’s step-by-step guide. It provides the basic outline of our OSD configuration.

  1. Configure Active Directory and the ADK

  2. Enable PXE

  3. Create sources

  4. Create the Task Sequence

  5. Perform OSD over PXE

Active Directory and Windows ADK

Active Directory Users and Computers

We need an OU for our workstations to go. While we could use the builtin Computers OU, that doesn’t leave us any wiggle room later for things like applying Group Polices.

  1. Log into the domain controller, HYD-DC1.

  2. On the HYD-DC1, launch Windows Powershell ISE as administrator. Johan and Mikael have created a script to set permissions on the domain join account. This is so it can add computers to the Workstations OU during OSD.

  3. Below is a modified version of Johan and Mikael’s script to suit our lab. It will now create the account and OU if they haven’t been manually created already. Paste the code into the top script pane, and hit F5 to run.

  4. When it prompts for Account, type CM_DomainJoin. Hit enter.

  5. When it prompts for target OU, type Workstations. Hit enter.

    domainjoin_permissions_script.PNG

The Windows Assessment and Deployment Kit

We ended the SCCM lab setup by updating to the latest version of Current Branch (or the latest tech preview). So we’ll need to install the latest version of the Windows ADK so we’re fully compatible deploying the current version of Windows 10.

  1. Log into the SCCM server, HYD-CM1.

  2. Open the Programs and Features control panel, and uninstall the existing Windows Assessment and Deployment Kit - Windows 10.

    uninstall_adk.PNG

  3. Uninstall the existing Windows Assessment and Deployment Kit Windows Preinstallation Environment Add-ons - Windows 10. Reboot HYD-CM1.

    uninstall_adk_winpe.PNG

  4. On the host system, download the latest Windows ADK and Windows PE add-on for the ADK. Jonathan Lefebvre of the System Center Dudes has a great guide on setting up the ADK for SCCM. Copy adksetup.exe and adkwinpesetup.exe to HYD-CM1.

  5. Run adksetup.exe. Accept the defaults and click Next until we reach the Select the features you want to install section. Uncheck everything except Deployment Tools and User State Migration Tool (USMT). Click Install. When it completes, click Close.

    windows_adk_features.PNG

  6. Run adkwinpesetup.exe. Accept all defaults again at each screen and install. When the install completes, click Close.

    windows_adkwinpe_complete.PNG

  7. Once the install is complete, click Close. Reboot the SCCM server.

PXE

The Boundary

Boundaries and Boundary groups are how we logically define which sites (servers) workstations use. For the lab, we only need to configure one boundary and boundary group.

  1. Log into the SCCM server, HYD-CM1.

  2. In the SCCM console, expand the Administration -> Hierarchy Configuration node.

  3. Right-click Boundaries and select Create Boundary.

  4. General tab - Set description to PXE. Change Type to IP address range. We will use the DHCP range from the domain controller. Set Starting IP address to 10.0.0.100 and set Ending IP address to 10.0.0.200. Click OK.

    create_boundary.png

    For reference, here is what the DHCP address pool looks like:

    dhcp_scope2.PNG

  5. Expand the Administration -> Hierarchy Configuration node and select Boundary Groups. The current branch lab we set up has the boundary group configured already. If we’re using the tech preview lab, we need to create the boundary group manually.

  6. If the Corp Boundary Group doesn’t exist yet, click Create Boundary Group. Set the name and description to Corp Boundary Group. If it does exist, right-click it and select Properties.

  7. General Tab - Under Boundaries… click Add… and check our PXE boundary. Click OK. Select the References tab.

    create_boundary_group.png

  8. References Tab - If there are not Site system servers listed, click Add and check CHQ. Click OK. Make sure Use this boundary group for site assignment is checked and click OK.

    confirm_boundarygroup_references.png

    confirm_boundary_group2.png

The Distribution Point

In SCCM, distribution points are where workstations get their content. This is true for OSD as well, and we need our DPs to function as PXE servers.

  1. In the SCCM console, navigate to the Administration -> Distribution Points node.

  2. Right-click CM1.CORP.CONTOSO.COM and select Properties.

  3. General tab - If we’re using SCCM Current Branch, leave HTTP selected and check Allow clients to connect anonymously.

    dp_general_tab.png

  4. Communication tab - If we’re using the Tech Preview, the Allow clients to connect anonymously option is on the Communication tab. Check it.

    dp_general_tab.png

  5. PXE tab - To automatically install WDS and configure PXE, check Enable PXE support for clients and click Yes when the Review Required Ports for PXE warning dialog pops up.

    Additionally check Allow this distribution point to respond to incoming PXE requests AND Enable unknown computer support, click OK when the Configuration Manager dialog box pops up.

    Uncheck Require a password when computers use PXE. Click OK.

    dp_pxe_tab.png

Sources

The package source share

We’ll use Odd-Magne’s script to create the folder structure, share it, and grant permissions to our network access account.

  1. On the SCCM server, launch Windows Powershell ISE as administrator.

  2. In the top script pane, paste the following code. The script is customized to our folder path and network access account name. Press F5 to run.

    package_source_script.png

The Operating System Image

We need an operating system image as the basis of OSD. There are several guides on creating a fully patched reference image, but we’re just going to use the WIM file off of the ISO for now and revisit reference images in a later tutorial.

  1. On the host system, mount the Windows 10 Enterprise ISO. If your host system is Windows 10 you can just double click the ISO.

  2. Right-click the drive letter of the mounted ISO, and select Properties.

    mounted_iso_properties.png

  3. Sharing tab - Click Advanced Sharing. Check Share this folder and note the Share name. Click OK. Click Close.

    mounted_iso_sharing.png

  4. On HYD-CM1 (the SCCM server) navigate to \\<host system name>\<share name>\sources. Right-click install.wim and select copy.

    install_wim.png

  5. Navigate to C:\PackageSource\OSD\OSImages and paste the install.wim to this folder.

    install_wim_on_sccm.png

  6. From the SCCM console expand the Software Library -> Operating Systems node.

  7. Right-click Operating System Images and select Add Operating System Image.

  8. Data Source - In the path field type \\cm1\PackageSource\OSD\OSImages\install.wim. Check Extract a specific image index from the specified WIM file and select image index 3 - Windows 10 Enterprise. If we’re using the Tech Preview, select x64 and click Next.

    os_image_datasource.png

  9. General - Set the name to Windows 10 Enterprise. Type the Windows 10 build in the Version field. Optionally we can add a comment. Click Next.

    os_image_wizard.png

  10. At the Summary screen, click Next. At the Completion screen, click Close.

  11. Right-click the OS image we just created and select Distribute Content. At the General screen click Next.

  12. Content Destination - Click Add -> Distribution Point, and check CM1.CORP.CONTOSO.COM. Click OK, then click Next.

    os_image_distribute_content.png os_image_distribute_content2.png

  13. At the Summary screen, click Next. At the Completion screen, click Close.

The Boot Image

SCCM requires a WinPE image to initiate the task sequence. This is a low level Windows OS that runs in the beginning of a task sequence when we PXE boot.

  1. From the SCCM console, expand the Software Library -> Operating Systems node.

  2. Click on Boot Images. If we’re using the Tech Preview lab, right-click the boot image and select Distribute Content. Just like with the OS image, at the Content Destination wizard click Add and select Distribution Point. Check CM1.CORP.CONTOSO.COM and click OK. Click Next. At the Summary screen click Next. At the Completion screen click Close.

    If we’re using the Current Branch lab the boot images are already distributed. Right-click Boot image (x64) and select Update Distribution Points.

    Check Reload this boot image with the current Windows PE version from the Windows ADK. Click Next. At the Summary screen click Next. At the Completion screen click Close.

    boot_image_update_wizard.PNG

  3. General tab - Right-click Boot image (x64) and select Properties. Set the Version to the ADK OS Version.

    boot_image_version.PNG

  4. Customization tab - Check Enable command suppport (testing only). This allows us to press F8 during the task sequence to bring up the command prompt, which is useful for troubleshooting.

    boot_image_customization.png

  5. Data Source tab - Confirm that Deploy this boot image from the PXE-enabled distribution point is already checked. If we’re using the Tech Preview lab, select x64. Click OK.

    boot_image_confirm_pxe.PNG

  6. We’ll be prompted to update the distribution points. Click Yes, and the Update Distribution Points Wizard will launch.

    boot_image_update_distribution_points.png

  7. When the wizard launches, click Next. At the Summary screen click Next again. At the Completion screen click Close.

  8. Repeat steps 2-8 with Boot image (x86).

Optionally Ricky Gao’s guide creates a new Configuration Manager Client package. We will skip for our lab.

The Task Sequence

Creating the task sequence

We can now create our Windows 10 task sequence and deploy it.

  1. From the SCCM console, expand the Software Library -> Operating Systems node.

  2. Right-click Task Sequences and select Create Task Sequence.

  3. Choose Install an existing image package and click Next.

  4. Set the Task sequence name to Windows 10 and click Browse. Select Boot image (x64) and click OK. Click Next

    ts_boot_image.PNG ts_information.png

  5. For the Image package click Browse and select the OS image we created earlier. If the image contains multiple indexes, choose Windows 10 Enterprise. Click Next.

    ts_install_windows.png

  6. Choose Join a domain. For Domain click Browse and select corp.contoso.com. Click OK.

    ts_select_domain.png

  7. For Domain OU click Browse. Expand CORP and choose the Workstations OU we created earlier. Click OK.

    select_workstations_OU.PNG

  8. For Account click Set. Set the User name to CORP\CM_DomainJoin and enter P@ssw0rd as the Password. Click Verify, and click Test connection.

    verify_domainjoin_account.PNG

  9. Click OK, click OK again, and click Next.

    ts_configure_network.PNG

  10. At the Install the Configuration Manager client wizard, leave the default and click Next.

  11. Since we’re doing a bare metal install, we don’t need USMT. Uncheck Capture user settings, uncheck Capture network settings, and uncheck Capture Microsoft Windows settings. Click Next.

  12. Click Next through the Updates, Applications, and Summary screens. We’ll cover all of that in a later post which we’ll eventually link from this one. At the Completion screen, click Close.

Deploying the task sequence

We need to deploy our task sequence to the All Unknown Computers collection so that we can image bare metal workstations.

  1. Right-click the Windows 10 task sequence we just created and select Deploy.

  2. For the Collection click Browse. Read the warning and click OK. Select All Unknown Computers and click OK. Click Next.

    ts_deploy_available_pxe.png

  3. Leave the purpose as Available. Set Make available to the following to Only media and PXE and click Next.

    ts_deploy_media_and_pxe.png

  4. Leave the rest of the wizard as default and click Next until you reach the Completion screen. Click Close.

Imaging

It’s time to test all our hard work. We’ll create a brand new VM and image it over PXE.

  1. On the host machine, open the Hyper-V console. Right-click your host machine and select New -> Virtual Machine.

    imaging_new_virtual_machine.PNG

  2. If New Virtual Machine wizard takes you to the Before You Begin screen, click Next. Name the VM HYD-WS1 and click Next.

    imaging_name.PNG

  3. Select Generation 2. This will make it UEFI based as opposed to BIOS, and allows us to do Secure Boot. Click Next.

  4. Set the Startup memory to 2048 or higher. Click Next.

    imaging_memory.PNG

  5. Change the Connection to our internal virtual switch HYD-CorpNet. Click Next.

  6. Set the Location to the large and fast drive where your other VMs are located. Change the Size to 64GB. Click Next.

    imaging_location.PNG

  7. Set the installation option to Install an operating system from a network-based installation server. Click Next.

  8. At the Summary screen click Finish.

  9. In the Hyper-V console, right-click our new virtual machine HYD-WS1 and select Settings. Click on Security, and check Enable Trusted Platform Module. Click OK.

    imaging_settings.PNG

  10. HIT THE SWITCH - Open HYD-WS1 and click Start. Since we’re using an Available deployment, we will need to press ENTER to PXE boot.

    imaging_pxe_boot.PNG

  11. The boot image will download and boot WinPE. At the task sequence Welcome screen, click Next.

    imaging_ts_wizard.PNG

  12. Select the Windows 10 task sequence we created earlier and click Next.

    imaging_ts_select.PNG

  13. Wait and watch as the task sequence performs each step.

    imaging_apply_os.PNG

  14. That’s it, we’ve successfully deployed a bare metal workstation over PXE with SCCM. Log into HYD-WS1 and verify that it’s on the domain, BitLocker is on, and the Configuration Manager control panel is there. Make note of the computer name, open the SCCM console on HYD-CM1 and confirm the new workstation shows up under Devices.

Congratulations again! Now, we have an SCCM environment we can populate with workstations to manipulate.

Next up - Patching with SCCM and WSUS