A boot is a boot, unless it doesn’t boot….

Question:

Why can’t I just network boot this new hardware and image it like I’ve always done? What in the “farfrommovin” (or insert your own expletive here) is going on here?!

Answer:

New computers (tablets, laptops, desktops, etc) all have secure boot enabled these days. I know… this only begs another question by some of us. “What is secure boot, and why do I care?”

I hear questions like this more often that you might think. So, let’s break it down so that everyone is on the same page…

A Tale of Two Boots…

Network BIOS Boot (Legacy PXE Boot)

Let’s start simple with the boot type that everyone understands.

BIOS Boot is the old school boot-up method that everyone has been using since cavemen walked the earth with my dad (not really, but you get it). It’s tried and true, it works.

BIOS boot leverages 16-bit code that is used to enable the network interface and reads the first sector of the hard disk before running additional code, like a Network Boot Program (NBP).

UEFI Boot (Secure PXE Boot)

What is UEFI?

UEFI stands for Unified Extensible Firmware Interface. It’s a specification that defines a software interface between the operating system and the platform firmware. It was developed by Intel Corporation initially back in the last century (feel left behind yet?), when they were working on their Itanium processors. It was called EFI then. In or around 2005 or so, they stopped and began contributing to the Unified version specification. Version 2.1 of UEFI added cryptography, network authentication, and user interface architecture back in 2007. Today, the version is 2.7; not sure what was added or tweaked, but I’ll look that up later…

So, as you might have deduced already, we call UEFI “Secure Boot” because of these two gems that allow us to protect against unknown image snatchers and evil doers…

• Cryptography
• Network Authentication

Summary

In an age of “OH MY GOD! SOMEONE COULD STEAL MY DATA?!” we tend to lean toward the secure side of things so that we can move on to other more pressing matters instead of chasing data (and our tails) when data gets hijacked. This is why UEFI is the mainstream boot process we use now.

Keeping the lights on while changing the bulb…

This leads us to the reason for this write-up… or main question…

How do I enable UEFI boot for my new devices, while making sure that the older devices can still be imaged?

To get everything working we need to do a couple of things.

1. Create/ Define DHCP Vendor Classes
2. Create/ Set DHCP Server Policies

Requirements

• DHCP Server running Windows Server 2012 or higher
• Windows Deployment Services
• Client that will boot using Legacy BIOS PXE
• Client that will boot using UEFI PXE
• DHCP Administrator rights on the DHCP Server(s)

Assumptions

• DHCP is installed and functional within your environment
• You have the appropriate permissions within DHCP

Create/ Define DHCP Vendor Classes

First, we’ll define our vendor classes. To do this, log onto your DHCP server and perform the following actions:

1. Open the DHCP Snap-in
2. Connect to the DHCP Server
3. Navigate to DHCP > SERVERFQDN > IPv4

   

4. Right-click on IPv4 and select “Define Vendor Classes…” from the menu

   

5. Click the “Add…” button

   

6. Enter the following information, then click “OK”
   • Display Name = PXEClient (UEFI x64)
   • Description = PXE:Arch:00007
   • ASCII = PXE:Arch:00007

   

7. Click “Add…” again

   

8. Perform step 6 & 7 above two more times to add the classes for 32bit UEFI and Legacy BIOS
   • 32bit UEFI
     • Display Name = PXEClient (UEFI x86)
     • Description = PXE:Arch:00006
     • ASCII = PXE:Arch:00006
   • Legacy BIOS
     • Display Name = PXEClient (BIOS x86 & x64)
     • Description = PXE:Arch:00000
     • ASCII = PXE:Arch:00000
9. Once completed, you should see something like the screen shot below with our three shiny new classes…

   

Create/ Set DHCP Server Policies

1. In the DHCP console, right-click on the “Policies” container.
   • For ALL SCOPES, choose the “Policies” container at the “IPv4” level.
   • For SINGLE SCOPE, choose the “Policies” container for the specific DHCP scope

   

2. Select “New Policy…” from the menu to open the policy wizard.

   

3. In the wizard, enter the following information and then click “Next”.
   • Policy Name = PXEClient (UEFI x64)
   • Description = Set correct server and file name for UEFI x64 PXE

   

4. Ensure that the radio button next to “OR” is selected, then click “Add…”

   

5. Using the drop-down menu next to “Value”, select “PXEClient (UEFI x64)” from the list.

   

6. Click “Add…”, then click “OK”

   

7. Click “Next” on the wizard
8. Select “No”, then click “Next”

   

9. For the options, we will be setting the following under “DHCP Standard Options” in the wizard:
   • Option 60
     • PXEClient
   • Option 66
     • IP Address of the PXE Boot Service Point (the SCCM DP for you ConfigMgr types)
   • Option 67
     • “smsboot\x64\wdsmgfw.efi”
10. Click “Next”, then review the settings summary information. If all of it looks right, click “Finish”

    

11. You should now have the first of the three policies needed.

    

12. Repeat steps 2 through 10 above for the remaining policies. Below are the tables with the information you’ll need.

Policy Information – UEFI 32bit PXE

Policy Information – Legacy Boot PXE

After you’ve completed all the policies, you should see something like I have below…

Save yourself some time… AKA – I’ve got more than this to do today!

If you’re like me, then you might rather use some PowerShell to get this done in a hurry. Especially if you have multiple servers or DHCP scopes to update.

Below is some code that you can copy and save to do the work for you. The first snippet will enable the boot on a single DHCP server or scope at a time.

If you want a little more time to relax, use the second one. It leverages a CSV input file and can update multiple DHCP Servers/ Scopes in a single pass.

Both versions and a sample CSV file can be downloaded here.

Special thanks to @skatterbrainz for the assist in validating the code.

# Usage:
#   Scope Specific -
#         .\UEFI-Me.ps1 -DHCPSvr dc02 -DHCPFqdn dc02.adventuresinsysctr.net -PXESvr 192.168.0.23 -Scope_ID 192.168.0.0
#
#   All Scopes -
#         .\UEFI-Me.ps1 -DHCPSvr dc02 -DHCPFqdn dc02.adventuresinsysctr.net -PXESvr 192.168.0.23
#
#############################

# Argument List
param (
    [parameter(Mandatory=$true)][string]$DHCPSvr,
    [parameter(Mandatory=$true)][string]$DHCPFqdn,
    [parameter(Mandatory=$true)][string]$PXESvr,
    [parameter(Mandatory=$false)][string]$Scope_ID = ""
)

$PXE64Name = "PXEClient (UEFI x64)"
$PXE86Name = "PXEClient (UEFI x86)"
$PXEBName = "PXEClient (BIOS x86 & x64)"
# Write-Host "DHCP Server: $DHCPSvr, FQDN: $DHCPFqdn, PXE: $PXESvr, SCOPE: $Scope_ID"

# Add DHCP Option 60 if it doesn't exist
If (-not(Get-DhcpServerv4OptionDefinition -OptionId 060 -ComputerName $DHCPSvr -ErrorAction SilentlyContinue)){
  Add-DhcpServerv4OptionDefinition -ComputerName $DHCPSvr -Name PXEClient -Description "PXE Support" -OptionId 060 -Type String
}
# Set Vendor Classes:
Add-DhcpServerv4Class -Name "$($PXE64Name)" -Description "PXE Client - 64bit UEFI" -Type Vendor -Data "PXE:Arch:00007" -Computer "$($DHCPSvr)"
Add-DhcpServerv4Class -Name "$($PXE86Name)" -Description "PXE Client - 32bit UEFI" -Type Vendor -Data "PXE:Arch:00006" -Computer "$($DHCPSvr)"
Add-DhcpServerv4Class -Name "$($PXEBName)" -Description "PXE Client - Legacy BIOS" -Type Vendor -Data "PXE:Arch:00000" -Computer "$($DHCPSvr)"

# Create DHCP Policies (Leaving out the “ScopeId” option will make the policy a server level policy):

if ($Scope_ID -eq "") {
    Add-DhcpServerv4Policy -Name "$($PXE64Name)" -Description "Set correct server and file name for UEFI x64 PXE" -Condition OR -VendorClass EQ, $PXE64Name -ComputerName "$($DHCPFqdn)"
    Add-DhcpServerv4Policy -Name "$($PXE86Name)" -Description "Set correct server and file name for UEFI x86 PXE" -Condition OR -VendorClass EQ, $PXE86Name -ComputerName "$($DHCPFqdn)"
    Add-DhcpServerv4Policy -Name "$($PXEBName)" -Description "Set correct server and file name for BIOS x86 & x64 PXE" -Condition OR -VendorClass EQ, $PXEBName -ComputerName "$($DHCPFqdn)"

    # Set Policy Options (If server level policy, do not specify the “ScopeId” option):
    # For UEFI x64 –
    Set-DhcpServerv4OptionValue -ComputerName "$($DHCPSvr)" -PolicyName "$($PXE64Name)" -OptionId 60 -Value PXEClient
    Set-DhcpServerv4OptionValue -ComputerName "$($DHCPSvr)" -PolicyName "$($PXE64Name)" -OptionId 66 -Value "$($PXESvr)"
    Set-DhcpServerv4OptionValue -ComputerName "$($DHCPSvr)" -PolicyName "$($PXE64Name)" -OptionId 67 -Value "smsboot\x64\wdsmgfw.efi"

    # For UEFI x86 –
    Set-DhcpServerv4OptionValue -ComputerName "$($DHCPSvr)" -PolicyName "$($PXE86Name)" -OptionId 60 -Value PXEClient
    Set-DhcpServerv4OptionValue -ComputerName "$($DHCPSvr)" -PolicyName "$($PXE86Name)" -OptionId 66 -Value "$($PXESvr)"
    Set-DhcpServerv4OptionValue -ComputerName "$($DHCPSvr)" -PolicyName "$($PXE86Name)" -OptionId 67 -Value "smsboot\x86\wdsmgfw.efi"

    # For BIOS x86 & x64 –
    Set-DhcpServerv4OptionValue -ComputerName "$($DHCPSvr)" -PolicyName "$($PXEBName)" -OptionId 66 -Value "$($PXESvr)"
    Set-DhcpServerv4OptionValue -ComputerName "$($DHCPSvr)" -PolicyName "$($PXEBName)" -OptionId 67 -Value "smsboot\x64\wdsnbp.com"
        }
    Else {  
    Add-DhcpServerv4Policy -Name "$($PXE64Name)" -Description "Set correct server and file name for UEFI x64 PXE" -Condition OR -VendorClass EQ, $PXE64Name -ComputerName "$($DHCPFqdn)" -ScopeId $Scope_ID
    Add-DhcpServerv4Policy -Name "$($PXE86Name)" -Description "Set correct server and file name for UEFI x86 PXE" -Condition OR -VendorClass EQ, $PXE86Name -ComputerName "$($DHCPFqdn)" -ScopeId $Scope_ID
    Add-DhcpServerv4Policy -Name "$($PXEBName)" -Description "Set correct server and file name for BIOS x86 & x64 PXE" -Condition OR -VendorClass EQ, $PXEBName -ComputerName "$($DHCPFqdn)" -ScopeId $Scope_ID

     # Set Policy Options (If server level policy, do not specify the “ScopeId” option):
    # For UEFI x64 –
    Set-DhcpServerv4OptionValue -ComputerName "$($DHCPSvr)" -ScopeId $Scope_ID -PolicyName "$($PXE64Name)" -OptionId 60 -Value PXEClient
    Set-DhcpServerv4OptionValue -ComputerName "$($DHCPSvr)" -ScopeId $Scope_ID -PolicyName "$($PXE64Name)" -OptionId 66 -Value "$($PXESvr)"
    Set-DhcpServerv4OptionValue -ComputerName "$($DHCPSvr)" -ScopeId $Scope_ID -PolicyName "$($PXE64Name)" -OptionId 67 -Value "smsboot\x64\wdsmgfw.efi"

    # For UEFI x86 –
    Set-DhcpServerv4OptionValue -ComputerName "$($DHCPSvr)" -ScopeId $Scope_ID -PolicyName "$($PXE86Name)" -OptionId 60 -Value PXEClient
    Set-DhcpServerv4OptionValue -ComputerName "$($DHCPSvr)" -ScopeId $Scope_ID -PolicyName "$($PXE86Name)" -OptionId 66 -Value "$($PXESvr)"
    Set-DhcpServerv4OptionValue -ComputerName "$($DHCPSvr)" -ScopeId $Scope_ID -PolicyName "$($PXE86Name)" -OptionId 67 -Value "smsboot\x86\wdsmgfw.efi"

    # For BIOS x86 & x64 –
    Set-DhcpServerv4OptionValue -ComputerName "$($DHCPSvr)" -ScopeId $Scope_ID -PolicyName "$($PXEBName)" -OptionId 66 -Value "$($PXESvr)"
    Set-DhcpServerv4OptionValue -ComputerName "$($DHCPSvr)" -ScopeId $Scope_ID -PolicyName "$($PXEBName)" -OptionId 67 -Value "smsboot\x64\wdsnbp.com"
    }

The code below uses the CSV input file.

#
# Usage:
#   Scope Specific -
#         .\Enable-UEFI_ALL.ps1 -CSVFile .\UEFI_Me.csv
#
#############################

# Argument List
param (
    [parameter(Mandatory=$true)][string]$CSVFile
)

Function Create-VendorClass{
    #Get all of the Vendor Classes
    $PXEClasses = Get-DhcpServerv4Class -Type Vendor -ComputerName $DHCPSvr
    
    #Look for the PXE classes needed
    Foreach ($PXEClass in $PXEClasses){
        $ClassName = $PXEClass.Name
        $ClassType = $PXEClass.Type
        $ClassData = $PXEClass.Data
        $ClassAData = $PXEClass.AsciiData
        $ClassDesc = $PXEClass.Description
        Switch ($ClassAData){
            PXE:Arch:00000{
                Write-Host "   Vendor Class '$ClassName' already exists" -ForegroundColor Green
                $BIOSPXE = $True
                }
            PXE:Arch:00006{
                Write-Host "   Vendor Class '$ClassName' already exists" -ForegroundColor Green
                $X86PXE = $True
                }
            PXE:Arch:00007{
                Write-Host "   Vendor Class '$ClassName' already exists" -ForegroundColor Green
                $X64PXE = $True
                }
            Default{
                $BIOSPXE = $False
                $X86PXE = $False
                $X64PXE = $False
                }
        }    
    }

    #Create the classes if they don't exist
    If (-not($BIOSPXE)){
        Add-DhcpServerv4Class -Name "$($PXEBName)" -Description "PXE Client - Legacy BIOS" `
            -Type Vendor -Data "PXE:Arch:00000" -Computer "$($DHCPSvr)"
    }
    If (-not($X64PXE)){
        Add-DhcpServerv4Class -Name "$($PXE64Name)" -Description "PXE Client - 64bit UEFI" `
            -Type Vendor -Data "PXE:Arch:00007" -Computer "$($DHCPSvr)"
    }
    If (-not($X86PXE)){
        Add-DhcpServerv4Class -Name "$($PXE86Name)" -Description "PXE Client - 32bit UEFI" `
            -Type Vendor -Data "PXE:Arch:00006" -Computer "$($DHCPSvr)"
    }
}

$PXE64Name = "PXEClient (UEFI x64)"
$PXE86Name = "PXEClient (UEFI x86)"
$PXEBName = "PXEClient (BIOS x86 & x64)"

$Scopes = Import-Csv -Path $CSVFile
Foreach ($Scope in $Scopes){
    $DHCPSvr = $Scope.Server
    $DHCPFqdn = $Scope.ServerFQDN
    $PXESvr = $Scope.PXEServer
    $Scope_ID = $Scope.ScopeID

    If ($Scope_ID){
        $ScopeArg = $True
        }
    Else{
        $ScopeArg = $False
    }

   # Add DHCP Option 60 if it doesn't exist
   If (-not(Get-DhcpServerv4OptionDefinition -OptionId 060 -ComputerName $DHCPSvr -ErrorAction SilentlyContinue)){
        Add-DhcpServerv4OptionDefinition -ComputerName $DHCPSvr -Name PXEClient -Description "PXE Support" -OptionId 060 -Type String
    }
    # Set Vendor Classes:
    Create-VendorClass

    # Create DHCP Policies (Leaving out the “ScopeId” option will make the policy a server level policy):
    $Names = $PXE64Name,$PXE86Name,$PXEBName
    Foreach ($Name in $Names){
        Switch ($Name){
            $PXE64Name{
                    If ($ScopeArg -eq $False){
                        If (-not(Get-DhcpServerv4Policy -ComputerName $DHCPSvr -Name $PXE64Name -ErrorAction SilentlyContinue)){
                            Add-DhcpServerv4Policy -Name "$($Name)" -Description "Set correct server and file name for $($Name) boot" `
                                -Condition OR -VendorClass EQ, $Name -ComputerName "$($DHCPFqdn)" # -ErrorAction SilentlyContinue
                            Set-DhcpServerv4OptionValue -ComputerName "$($DHCPSvr)" -PolicyName "$($PXE64Name)" -OptionId 60 `
                                -Value "PXEClient"
                            Set-DhcpServerv4OptionValue -ComputerName "$($DHCPSvr)" -PolicyName "$($PXE64Name)" -OptionId 66 `
                                -Value "$($PXESvr)"
                            Set-DhcpServerv4OptionValue -ComputerName "$($DHCPSvr)" -PolicyName "$($PXE64Name)" -OptionId 67 `
                                -Value "smsboot\x64\wdsmgfw.efi"
                        }
                    }
                    If ($ScopeArg -eq $True){
                        If (-not(Get-DhcpServerv4Policy -ComputerName $DHCPSvr -Name $PXE64Name -ScopeId "$($Scope_ID)" -ErrorAction SilentlyContinue)){
                            Add-DhcpServerv4Policy -Name "$($Name)" -Description "Set correct server and file name for $($Name) boot" `
                                -Condition OR -VendorClass EQ, $Name -ComputerName "$($DHCPFqdn)" -ScopeId $Scope_ID # -ErrorAction SilentlyContinue
                            Set-DhcpServerv4OptionValue -ComputerName "$($DHCPSvr)" -ScopeId "$($Scope_ID)" -PolicyName "$($PXE64Name)" `
                                -OptionId 60 -Value PXEClient
                            Set-DhcpServerv4OptionValue -ComputerName "$($DHCPSvr)" -ScopeId "$($Scope_ID)" -PolicyName "$($PXE64Name)" `
                                -OptionId 66 -Value "$($PXESvr)"
                            Set-DhcpServerv4OptionValue -ComputerName "$($DHCPSvr)" -ScopeId "$($Scope_ID)" -PolicyName "$($PXE64Name)" `
                                -OptionId 67 -Value "smsboot\x64\wdsmgfw.efi"
                        }
                    }
                }
            $PXE86Name{
                    If ($ScopeArg -eq $False){
                        If (-not(Get-DhcpServerv4Policy -ComputerName $DHCPSvr -Name $PXE86Name -ErrorAction SilentlyContinue)){
                            Add-DhcpServerv4Policy -Name "$($Name)" -Description "Set correct server and file name for $($Name) boot" `
                                -Condition OR -VendorClass EQ, $Name -ComputerName "$($DHCPFqdn)" # -ErrorAction SilentlyContinue
                            Set-DhcpServerv4OptionValue -ComputerName "$($DHCPSvr)" -PolicyName "$($PXE86Name)" -OptionId 60 `
                                -Value PXEClient
                            Set-DhcpServerv4OptionValue -ComputerName "$($DHCPSvr)" -PolicyName "$($PXE86Name)" -OptionId 66 `
                                -Value "$($PXESvr)"
                            Set-DhcpServerv4OptionValue -ComputerName "$($DHCPSvr)" -PolicyName "$($PXE86Name)" -OptionId 67 `
                                -Value "smsboot\x86\wdsmgfw.efi"
                        }
                    }
                    If ($ScopeArg -eq $True){
                        If (-not(Get-DhcpServerv4Policy -ComputerName $DHCPSvr -Name $PXE86Name -ScopeId "$($Scope_ID)" -ErrorAction SilentlyContinue)){
                            Add-DhcpServerv4Policy -Name "$($Name)" -Description "Set correct server and file name for $($Name) boot" `
                                -Condition OR -VendorClass EQ, $Name -ComputerName "$($DHCPFqdn)" -ScopeId $Scope_ID # -ErrorAction SilentlyContinue
                            Set-DhcpServerv4OptionValue -ComputerName "$($DHCPSvr)" -ScopeId "$($Scope_ID)" -PolicyName "$($PXE86Name)" `
                                -OptionId 60 -Value PXEClient
                            Set-DhcpServerv4OptionValue -ComputerName "$($DHCPSvr)" -ScopeId "$($Scope_ID)" -PolicyName "$($PXE86Name)" `
                                -OptionId 66 -Value "$($PXESvr)"
                            Set-DhcpServerv4OptionValue -ComputerName "$($DHCPSvr)" -ScopeId "$($Scope_ID)" -PolicyName "$($PXE86Name)" `
                                -OptionId 67 -Value "smsboot\x86\wdsmgfw.efi"
                        }
                    }
                }
            $PXEBName{
                    If ($ScopeArg -eq $False){
                        If (-not(Get-DhcpServerv4Policy -ComputerName $DHCPSvr -Name $PXEBName -ErrorAction SilentlyContinue)){
                            Add-DhcpServerv4Policy -Name "$($Name)" -Description "Set correct server and file name for $($Name) boot" `
                                -Condition OR -VendorClass EQ, $Name -ComputerName "$($DHCPFqdn)" # -ErrorAction SilentlyContinue
                            Set-DhcpServerv4OptionValue -ComputerName "$($DHCPSvr)" -PolicyName "$($PXEBName)" -OptionId 66 `
                                -Value "$($PXESvr)"
                            Set-DhcpServerv4OptionValue -ComputerName "$($DHCPSvr)" -PolicyName "$($PXEBName)" -OptionId 67 `
                                -Value "smsboot\x64\wdsnbp.com"
                            }
                        }
                    If ($ScopeArg -eq $True){
                        If (-not(Get-DhcpServerv4Policy -ComputerName $DHCPSvr -Name $PXEBName -ScopeId "$($Scope_ID)" -ErrorAction SilentlyContinue)){
                            Add-DhcpServerv4Policy -Name "$($Name)" -Description "Set correct server and file name for $($Name) boot" `
                                -Condition OR -VendorClass EQ, $Name -ComputerName "$($DHCPFqdn)" -ScopeId $Scope_ID # -ErrorAction SilentlyContinue
                            Set-DhcpServerv4OptionValue -ComputerName "$($DHCPSvr)" -ScopeId "$($Scope_ID)" -PolicyName "$($PXEBName)" `
                                -OptionId 66 -Value "$($PXESvr)"
                            Set-DhcpServerv4OptionValue -ComputerName "$($DHCPSvr)" -ScopeId "$($Scope_ID)" -PolicyName "$($PXEBName)" `
                                -OptionId 67 -Value "smsboot\x64\wdsnbp.com"
                        }
                    }
                }
        }
    }
}