OS Deployment - Freeze

[clafon]

Yes, it does exist

Screenshot 2026-01-22 151939.png (13.38 KB) Viewed 12859 times

My DHCP:

Screenshot 2026-01-22 152350.png (10.02 KB) Viewed 12857 times

[sfonteneau]

In the DHCP settings, what about the `snponly_custom` option that was just manually created?
Did you correctly re-enter the " -UserClass NE,iPXE -VendorClass NE,legacy_bios*"?

Alternatively, using PowerShell:

Code: Select all

Add-DhcpServerv4Policy -Name "snponly_custom.efi" -Condition AND -UserClass NE,iPXE -VendorClass NE,legacy_bios*
Set-DhcpServerv4OptionValue -PolicyName "snponly_custom.efi" -OptionID 67 -Value "snponly_custom.efi"

[clafon]

Created manually with the following options:
Conditions: AND
User Class NEq iPXE
Provider Class NEq PXEClient (BIOS x86 & x64)*
Option 066: @WAPT server IP
Option 067: snponly_custom.efi

[clafon]

Code: Select all

Add-DhcpServerv4Policy -Name "snponly_custom.efi" -Condition AND -UserClass NE,iPXE -VendorClass NE,legacy_bios*
Set-DhcpServerv4OptionValue -PolicyName "snponly_custom.efi" -OptionID 67 -Value "snponly_custom.efi"

I deleted my manual registration and tried to place your order:
Add-DhcpServerv4Policy: The specified Vendor legacy_bios class does not exist on DHCP server SRV-XX.
At character Line:1 : 1
+ Add-DhcpServerv4Policy -Name "snponly_custom.efi" -Condition AND -Use ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo: ObjectNotFound: (SRV-XX:root/Microsoft/...pServerv4Policy) [Add-DhcpServerv4Policy], CimException
+ FullyQualifiedErrorId: DHCP 20044,Add-DhcpServerv4Policy

[sfonteneau]

This means that your legacy_bios class does not exist (did you not follow the original documentation?)

Code: Select all

# Define DHCP Classes
Add-DhcpServerv4Class -Name "legacy_bios" -Type Vendor -Data "PXEClient:Arch:00000" -ErrorAction SilentlyContinue
Add-DhcpServerv4Class -Name "iPXE" -Type User -Data "iPXE" -ErrorAction SilentlyContinue

[clafon]

The DHCP declaration was made by the technician during the setup of the WAPT server by COMIT.

[sfonteneau]

Perhaps it's simply that the "vendor" class doesn't have the name "legacy_bios"

[sfonteneau]

After troubleshooting over the phone, it appears the problem stems from a PC lacking "Microsoft Windows Production PCA 2011" (secure boot)

You would need to confirm on the PC that this is indeed the case using the PowerShell command as administrator:

Code: Select all

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Microsoft Windows Production PCA 2011'

Can you check?

This was planned, and therefore the new version of Wapt allows you to create a WinPE with CA 2023 (latest version)


However, WinPE will not be visible on older models that do not have "Microsoft Windows Production PCA 2011"

This small package allows you to try and get the old PC to install CA 2023:

Code: Select all

def install():
    registry_set(HKEY_LOCAL_MACHINE,r'SYSTEM\CurrentControlSet\Control\SecureBoot','AvailableUpdates',64)
    run_task(r'\Microsoft\Windows\PI\Secure-Boot-Update')             

def audit():
    if not run_powershell("Confirm-SecureBootUEFI"):
        print("secure boot not enable")
        return "OK"
    if run_powershell(r"[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'"):
        return "OK"
    else:
        print('Windows UEFI CA 2023 not found')
        return "ERROR"

[clafon]

So, to summarize:

to be launched on one of the new positions:

Code: Select all

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Microsoft Windows Production PCA 2011'

on one of the old workstations, make a package with:

Code: Select all

def install():
    registry_set(HKEY_LOCAL_MACHINE,r'SYSTEM\CurrentControlSet\Control\SecureBoot','AvailableUpdates',64)
    run_task(r'\Microsoft\Windows\PI\Secure-Boot-Update')             

def audit():
    if not run_powershell("Confirm-SecureBootUEFI"):
        print("secure boot not enable")
        return "OK"
    if run_powershell(r"[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'"):
        return "OK"
    else:
        print('Windows UEFI CA 2023 not found')
        return "ERROR"

and see if it installs properly?

[sfonteneau]

Actually, the first step is just to check what it returns:

Code: Select all

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Microsoft Windows Production PCA 2011'

On your PC

I assume your new PC doesn't have "Microsoft Windows Production PCA 2011"