PXE test request failed, status code is -2147467259, Error receiving replies from PXE server

Recently OSD on my primary site server stopped working – but only when connecting via PXE. If I was using an existing boot disk, I could connect and start the imaging process. The PXE control log had the following entry over and over:

“PXE test request failed, status code is -2147467259, Error receiving replies from PXE server”

I assumed that the Windows Deployment Services Server (WDS) service had stopped and all I had to do was restart it and it would start responding to PXE requests. I was correct on one thing, the WDS service had stopped however when I tried to restart the service I got a very similar error in the event viewer as references in this forum post:

Log Name: System
Source: Service Control Manager
General: The Windows Deployment Services Server service terminated unexpectedly.  It has done this 2 time(s).  The following corrective action will be taken in 600000 milliseconds: Restart the service.

Log Name: Application
Source: Application Error
General: Faulting application name: svchost.exe_WDSServer, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: wimgapi.dll, version: 6.1.7600.16385, time stamp: 0x4a5be09a
Exception code: 0xc0000005
Fault offset: 0x0000000000032a8e
Faulting process id: 0x1338
Faulting application start time: 0x01cbfecfb154f4f3
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\system32\wimgapi.dll
Report Id: f089f975-6ac2-11e0-9ddc-005056970055

After rebooting the server the same error was logged and WDS would not start. Even after removing the boot image from my distribution points and then adding them back - WDS would still not start. I tracked them problem down to recent driver addition to the WinPE boot image. It looked like when ConfigMgr was recompiling the WIM file it corrupted the image. To resolve this issue I did the following:

·         Remove the boot image from all distribution points (monitoring the distmgr log file)

·         Removed all drivers from the WinPE image

·         Added all our drivers back to the image and allowed it to recompile

·         Added the boot image back to the distribution points (monitoring the distmgr log file)

·         When everything had replicated successfully I was able to restart the WDS service

ConfigMgr PXE Certificate Renewal

When I originally setup my ConfigMgr environment setting up my OSD PXE certificaates was kind of a set and forget process so when my deployment team started getting a prompt about an expiring cert I thought "Oh ya I forgot about those."

In order to update your PXE certifcate you need to locate the site system that hosts the PXE Service Point where you want to update the certificate, double click the PSP role, on the database tab select create a self-signed PXE certificate and specify an appropriate date range and then click apply. As soon as you create your new certificate your old one will be blocked. It's just that simple but it's one of those tasks that you probably don't do that frequently.

If you are running in Native mode will have to import your new certificate from your root certificate authority. (CA)

Windows Update Error Code 80072F8F

From time to time patch installations will fail during our OS deployment process leaving the workstation not fully patched. Once a machine has finished imaging someone from the deployment group will usually do a spot check and connect to Windows Update just to ensure that the workstation is fully patched. Last week I started to notice that many of the new Windows 7 workstations would not connect to Windows Update and get the following error:

An error occurred while checking for new updates for your computer.
Error(s) found:
Code 80072F8F

Checking online I found a Microsoft article that explained that this error usually results from a time mismatch between your machine and the Windows Update servers. However, these workstations were members of our domain and all of the time settings were correct. I found another post referencing root cert problems and the Windows Update error 80072F8F which reminded me of my post about Windows 7 failing to update its root certificates and causing Windows Live Messenger sign-in to fail. After updating to the latest root certificates (KB931125) Windows Update connected just fine.

ConfigMgr OSD App Tree

There are many ways of deploying applications during a task sequence but I wanted to give my deployment guys the ability to assign applications on the fly and from within the task sequence. This is especially handy for bare metal deployments. Thanks to Jason Sandys and his OSD App Tree utility this can be done very easily. The OSD App Tree is a small utility that provides user interaction during the task sequence by referencing an XML file to assign applications. You have the ability to set up application groups, organize them in a tree view, make them optional or mandatory, use conditions, etc. Check it out here…

http://myitforum.com/cs2/blogs/jsandys/pages/osdapptree.aspx

Setting Broadcom NICs to 100/FULL during an OSD Task Sequence

In our environment we require all our workstation NICs to be set to 100/FULL. Currently this is a manual step at the time of deployment and from time to time it can be missed. As I was migrating all of our images to Config Manager my goal was to automate as much as possible - such as NIC speed and duplex. Hard coding a NIC for a Windows PE boot image is pretty straight forward – extract the driver, open up the INF file, locate the section were the default speed is listed, set it to whatever value you require and then inject the driver into your boot image. However if you use the same approach when installing drivers during an OS deployment task sequence and you are using a Broadcom NIC your NIC driver will fail to load correctly causing the task sequence to error out. Once you edit the INF file you break WHQL driver signing therefore Windows XP will not install the driver. A quick way around this is to leave the INF file untouched and set it 100/FULL by calling the following script during your task sequence.

Dim WSHShell, RegLocate, RegLocate1
Set WSHShell = WScript.CreateObject("WScript.Shell")
On Error Resume Next

'Locate registry setting for media type
RegLocate = "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001\RequestedMediaType"

'Change media type to 100/Full Duplex
WSHShell.RegWrite RegLocate,"6","REG_SZ"

'Exit
WScript.Quit 

1. Create a package in Config Mgr containing your script - no program necessary
2. In your task sequence add a command line step after your driver installs
3. Name this step something like "Set Broadcom NIC to 100/FULL" (helps for future reference) 
4. Add the following command line - cscript.exe script name.vbs
5. Enable the package check box and browse for the package containing your script

Add a condition to this step and enter the following WMI query to ensure that your script only runs on Broadcom based NICs.

SELECT * FROM Win32_NetworkAdapter WHERE Manufacturer LIKE 'Broadcom%'

Booting a WinPE RIS based image with an Intel NIC

Currently the way we deploy workstations at my company is we load a WinPE image via RIS and then we utilize SMS OSD. Why are we still using RIS you ask? RIS used to be our primary deployment tool but now it’s just used as a PXE server which will be retired once we move to SCCM 2007. Every once in a while a workstation would fail during the initialization of our WinPE boot image. We were able to determine that this only happened on machines that had an Intel based NIC and the error that we received had to do with parsing of the driver .inf file. We found a post that referenced a Microsoft KB article (http://support.microsoft.com/kb/923831) about problems parsing the Intel driver .inf file during the WinPE boot process. In the .inf file there is a section called Minihelp which has a series of entries that contain long strings. These long strings couldn’t be parsed correctly causing the imaging process to fail. The solution – replace these long strings with a single character, any character. I went in and made this change in all of my Intel .inf driver files and the problem has not surfaced since.

Before:

; Minihelp


FlowControlMiniHelp = "Pauses packet transmission on receipt of full flow control frame and sends full flow control frame to notify the other side to stop transmission."
AutoNegMiniHelp = "The adapter can either negotiate with its link partner or force the speed and duplex. The link partner must match the setting chosen!"
AutoNegAdvertisedMiniHelp = "This can be used to restrict the speeds and duplexes advertised to a link partner during autonegotiation."
ChecksumTxTcpMiniHelp = "Allows the adapter to compute TCP or UDP checksum of transmitted packets. May improve TCP and UDP transmit performance."
ChecksumRxTcpMiniHelp = "Allows the adapter to verify the TCP checksum of incoming packets. May improve TCP receive performance."
ChecksumTxIpMiniHelp = "Allows the adapter to compute IP checksum of transmitted packets. May improve IP transmit performance."
ChecksumRxIpMiniHelp = "Allows the adapter to verify the IP checksum of incoming packets. May improves IP receive performance."
TcpSegmentationMiniHelp = "Allows the adapter to offload the task of segmenting TCP messages. May improve CPU utilization."
NumRxDescriptorsMiniHelp = "Sets the number of buffers the driver uses when copying data to protocol memory. Increasing this value can enhance receive performance, but also consumes system memory. Use the default if performance is not an issue."
NumTxDescriptorsMiniHelp = "Sets the number of data segments that enable the adapter to track transmit packets. Increasing this value can improve transmit performance, but also consumes system memory. Use the default if performance is not an issue."
JumboFramesMiniHelp = "Enables sending larger Ethernet packets on gigabit networks."
TaggingModeMiniHelp = "Enables sending and receiving of IEEE Tagged frames (802.3ac/802.1p/802.1Q), which include priority and VLAN indicators."
LAAMiniHelp = "Allows you to configure a custom MAC address for the adapter."
EnablePMEHelp = "Enables/disables wake-up from Advanced Power Management (APM) sleep states."
WakeOnHelp = "Determines how to wake the system."
WakeOnLinkHelp = "Allows wake-up from APM power management when link is reconnected."
LogLinkStateMiniHelp = "Enables/disables recording of the link state message to the Event Viewer."
SmartPowerDownMiniHelp = "Minimizes power consumption by enabling the adapter to enter a deep sleep mode when it does not have a valid link or when the operating system is in Suspend mode."
ITRMiniHelp = "Determines rate at which the controller moderates interrupts. Default is optimized for common configurations. Changing this setting may improve performance for some configurations."
MasterSlaveModeMiniHelp = "Determines IEEE 802.3ab Master-Slave resolution during gigabit auto-negotiation. Default is recommended for most configurations. Forcing a setting can break link if partner is not configured correctly."
WaitAutoNegCompleteMiniHelp = "Determines whether the driver waits for link to be detected before finishing initialization. Select Auto Detect to let the driver control the setting for copper or fiber adapters."
RssModeMiniHelp = "Distribute packet receive processing over 2 processors."
 
After:
 
; Minihelp


FlowControlMiniHelp = "h"
AutoNegMiniHelp = "h"
AutoNegAdvertisedMiniHelp = "h"
ChecksumTxTcpMiniHelp = "h"
ChecksumRxTcpMiniHelp = "h"
ChecksumTxIpMiniHelp = "h"
ChecksumRxIpMiniHelp = "h"
TcpSegmentationMiniHelp = "h"
NumRxDescriptorsMiniHelp = "h"
NumTxDescriptorsMiniHelp = "h"
JumboFramesMiniHelp = "h"
TaggingModeMiniHelp = "h"
LAAMiniHelp = "h"
EnablePMEHelp = "h"
WakeOnHelp = "h"
WakeOnLinkHelp = "h"
LogLinkStateMiniHelp = "h"
SmartPowerDownMiniHelp = "h"
ITRMiniHelp = "h"
MasterSlaveModeMiniHelp = "h"
WaitAutoNegCompleteMiniHelp = "h"
RssModeMiniHelp = "h"