Overview
The PXE imaging server images Shop Floor, Standard and Engineer PCs over an isolated imaging network, and wipes PCs with Blancco. A new site builds one from scratch: a Windows PC builds the installer USB, the server installs itself from it, and the images are loaded from Media Creator Lite. No Linux knowledge and no existing PXE server are needed.
Prerequisites:
- Server: UEFI firmware, a 500 GB+ disk, at least one wired NIC (two if it also joins the GE network)
- An unmanaged switch for the isolated imaging network (never connected to the GE network)
- A Windows 10/11 PC with local administrator rights and 25 GB free disk
- A USB stick of 32 GB (everything on it is erased)
- The pxe-usb build folder from the DT team (about 10 GB)
- A PC with Media Creator Lite, for the images (Part 3)
Objectives:
- Build and verify the installer USB on Windows
- Install the PXE server; the imaging port is picked automatically
- Load the Shop Floor, Standard and Engineer images and image a test PC
Part 1 - Build the Installer USB
Copy the build folder to the Windows PC
Copy the whole pxe-usb folder to a local disk, for example C:\pxe-usb. If the site has settings (admin subnets, Clonezilla password), add site-vars.yml now: see Site Settings.
Run the USB builder
- Plug in the USB stick.
- Start menu, type PowerShell, right-click Windows PowerShell, Run as administrator.
- Run:
cd C:\pxe-usb powershell -ExecutionPolicy Bypass -File .\scripts\Build-PxeUsb.ps1 -Interactive
- It lists the USB disks. Type the number of your stick and press Enter.
- It checks the build folder, shows the disk again and asks you to type the disk number once more to confirm.
It then erases the stick, creates one FAT32 partition labelled CIDATA, copies the installer, the payload and your site-vars.yml (if there is one), and reads every file back to verify it. It ends with USB build complete and verified and waits for Enter. Expect 10-20 minutes.
Eject the stick
Use Safely Remove Hardware before unplugging it.
Part 2 - Install the Server
Boot the USB stick
- Connect one server port to the imaging switch. Nothing else.
- Insert the stick, power on and open the one-time boot menu (F12 on Dell).
- Choose the USB stick under UEFI boot.
Ubuntu installs itself with no questions and reboots (about 10 minutes).
Let the first boot finish
The first boot picks the imaging port, checks it is isolated (no GE switch, no 802.1X, no other DHCP server), gives it 172.16.9.1 and sets up every service. This takes 15-30 minutes. It is done when the console shows a normal login prompt without a red banner.
Connect the GE network (optional)
Plug the GE cable into any other wired port. It gets an address by DHCP; SSH and the web interface then work from GE too. The server never serves DHCP or PXE on that port.
Open the web interface
From a PC on the imaging switch: http://172.16.9.1:9009 (from GE: http://<server GE address>:9009). The Overview page should show every service green.
Part 3 - Load the Images
The images come from Media Creator Lite (MCL). Each run of MCL caches one operating system; upload and import it, then repeat for the next image. Shop Floor uses Windows LTSC; Standard and Engineer use Windows Pro.
Build the MCL cache
On the MCL PC, run Media Creator Lite for the image you are loading and let it finish completely (it writes a -Production.tag file when done).
Upload it to the server
- Connect the MCL PC to the imaging switch (it gets a 172.16.9.x address).
- Copy scripts\Upload-Image.ps1 from the build folder to it and run:
powershell -ExecutionPolicy Bypass -File .\Upload-Image.ps1
It checks the MCL cache first (finished, consistent, every file matching MCL's own hashes), copies it to the server and has the server hash every file; files that arrived wrong are sent again. It ends with Upload complete: all N file(s) verified on the server. Add -IncludeDrivers to also send the hardware drivers MCL downloaded.
Import it
- In the web interface open Images > All images and import.
- Under From the network upload share the upload shows as verified, with the operating system MCL cached.
- Choose the image it is for (only the matching images are offered) and import.
Repeat Steps 1-3 for each image type.
Part 4 - Site Content
The build folder carries no site content. Add these in the web interface; each one can be replaced later the same way.
Enrollment package (Shop Floor)
Shop Floor PCs enroll with a provisioning package. Open Tools > Enrollment packages, click Upload SFLD package and upload the current GCCH_Prod_SFLD_v<version>.ppkg. The package you upload becomes the active one (shown on that page); upload a newer version the same way when one is released.
Engineering Layer (Engineer)
Engineer PCs install the Engineering Layer at first logon. Without it they still image, but with no engineering applications. Open Images > Engineer, tab Engineering Layer, and upload one of:
- the whole payload as a .zip, with the folders engineering_layer\ (holding Engineering_Install_v<version>.exe) and prereqs\ (VC++ and .NET 3.5) at its top, or inside one extra_engineering\ folder. Use this the first time.
- only a newer Engineering_Install_v<version>.exe. It replaces the installer and keeps the prerequisites.
The page shows the installer version in use and the status Ready once both parts are present. The two previous uploads are kept under Previous versions, with a Restore button. The Engineer image must be imported (Part 3) first.
Blancco site settings
Open Updates > Blancco releases and fill in Site settings:
- Business location: your site, as it should appear on every erasure report.
- Wi-Fi network (SSID) and Wi-Fi password: the internet-only Wi-Fi Blancco joins to license each erasure in the GE Blancco cloud. Usually INTERNETACCESS; the password differs between sites, so get yours from the site network team.
Click Save. The settings go into the active Blancco release at once and into every release staged later.
Shop Floor apps (optional)
A Shop Floor PC gets the provisioning package and the ShopFloor auto-logon and lockdown, and nothing else. To install your own applications on it, see Adding Shop Floor Apps.
Part 5 - Image a Test PC
- Connect a test PC to the imaging switch and PXE boot it (F12, network boot).
- Pick the image in the boot menu and follow the prompts.
- Follow it on Operate > Imaging floor in the web interface.
Site Settings
Site settings live in one small text file, site-vars.yml, in the build folder. The USB builder copies it onto the stick and the server reads it while it installs. Without the file the defaults are used: fine for a test, but every production site should set at least site_name and clonezilla_smb_password.
Create the file
- In Explorer turn on View > Show > File name extensions (so the file does not end up named site-vars.yml.txt).
- In C:\pxe-usb, copy site-vars.example.yml and rename the copy to site-vars.yml.
- Right-click it, Open with > Notepad, change the values (see the table below), save.
Follow the format
- One setting per line: name: value, with a space after the colon.
- Put text in double quotes: site_name: "Example Site".
- Lists go in square brackets: corp_admin_cidrs: ["10.12.34.0/24", "10.12.40.0/24"].
- A line starting with # is a note and is ignored. Remove the # to turn a setting on.
- Start every setting at the beginning of the line. No tabs.
Build the USB
Build as in Part 1. The builder checks the NIC addresses; the server checks everything else while it installs. If a value is wrong it stops before changing anything; the console banner points at /var/log/first-boot.log, which names the setting. Fix the file on the stick (playbook\site-vars.yml) and reboot: setup runs again.
The settings
| Setting | What it does | When to set it | Example |
|---|---|---|---|
| site_name | The site name stamped on Blancco erasure reports and the monthly CMMC evidence packs. Not set: Unnamed site. Letters, digits, spaces and . , - ( ) & / only. | Always | "Example Site" |
| site_timezone | Time zone of the server clock, of every time in the web interface, and of the evidence-pack month boundaries. | If the site is not on US Eastern time | "America/Chicago" |
| clonezilla_smb_password | Password of the share Clonezilla backs up to and restores from. The boot menu carries it, so it protects the share on the imaging network only. 8-64 characters from A-Z a-z 0-9 . _ ~ - | Always (the default is the same at every site) | "ExSite-Clone-2026" |
| corp_admin_cidrs | The GE subnets allowed to reach the web interface (port 9009) and SSH. Not set: all of GE. The imaging network always has access. | Recommended once the server is on the GE network | ["10.12.34.0/24"] |
| pxe_nic_mac corp_nic_mac | Pin the imaging port and the GE port by MAC address instead of picking the imaging port at install. Then both cables may be in from the start. | Only if the automatic pick is not wanted | "34:c8:d6:b1:10:10" |
| pxe_nic_allowed_switches | A managed imaging switch sends LLDP/CDP like a GE switch, and the server would refuse to serve on it. Its name (or MAC) here marks it as the imaging switch. Comma separated. | Only if the imaging switch is managed | "IMG-SW-01" |
| pxe_dhcp_start pxe_dhcp_end pxe_dhcp_lease | The addresses handed to PCs being imaged. Default 172.16.9.10 to .100 (91 PCs at once), 12 hour leases. | Only if more than about 90 PCs image at the same time | "172.16.9.250" |
Finding the values
Admin subnet (corp_admin_cidrs)
On each admin PC that should manage the server, run ipconfig and read the GE adapter's IPv4 address and subnet mask. Replace the last part of the address with 0 and add the suffix for the mask:
| Subnet mask | Suffix | Example: address 10.12.34.56 |
|---|---|---|
| 255.255.255.0 | /24 | 10.12.34.0/24 |
| 255.255.254.0 | /23 | 10.12.34.0/23 (third number even: 34 stays, 35 becomes 34) |
| 255.255.252.0 | /22 | 10.12.32.0/22 (third number rounded down to a multiple of 4) |
MAC address (pxe_nic_mac, corp_nic_mac)
From the label on the server or the network page of its firmware setup. Write it with colons and lower case: 34:c8:d6:b1:10:10.
Time zone (site_timezone)
Common names: America/New_York, America/Chicago, America/Denver, America/Phoenix, America/Los_Angeles, Europe/London, Europe/Warsaw, Asia/Kolkata. The full list: the "TZ identifier" column of the tz database.
A complete example
# C:\pxe-usb\site-vars.yml # Name on Blancco erasure reports and the monthly evidence packs. site_name: "Example Site" # Time zone of the server clock and the web interface. site_timezone: "America/New_York" # Password of the Clonezilla backup share (8-64 characters from # A-Z a-z 0-9 . _ ~ -). clonezilla_smb_password: "ExSite-Clone-2026" # Who may reach the web interface and SSH from the GE network. # Remove the # once you know your admin subnet(s): # corp_admin_cidrs: ["10.12.34.0/24"]
Changing settings after the install
- On the USB stick, edit playbook\site-vars.yml (same format).
- Plug the stick into the server, log in as pxe and run the setup again:
sudo /opt/first-boot.sh
It re-applies every setting and changes only what differs. Run it when no PCs are imaging: while they are, it postpones restarting services, and a change to the network settings is refused until the floor is idle.
Adding Shop Floor Apps
A Shop Floor PC installs two app lists, both empty when the server is installed:
| List | When it installs | Use it for |
|---|---|---|
| preinstall.json | At first logon, in the same run as the provisioning package, before the PC restarts | Apps that must be present before the PC enrolls |
| postppkg.json | Once, after the restart that follows the provisioning package (as SYSTEM) | Everything else |
Both are in the pre-install folder of the enrollment share. The first list shows as a step on Operate > Imaging floor; each PC keeps its logs in C:\Logs\PreInstall\install.log and C:\Logs\PostPpkg\install.log.
Open the share
From a PC on the imaging switch, open \\172.16.9.1\enrollment\pre-install and sign in as pxe-upload (password pxe, the account Upload-Image.ps1 uses).
Copy the installer
Make a folder per app under installers\ and copy the installer into it, for example installers\exampleapp\ExampleApp.msi.
Add it to a list
Open the list in Notepad and add one entry per app to Applications. Each list contains an _example entry to copy; it is ignored. Apps install in list order, and an app already detected on the PC is skipped, so a PC can be re-imaged safely.
| Field | Meaning | Required |
|---|---|---|
| Name | Shown in the log | Yes |
| Installer | Path under installers\. In JSON, write every \ as \\ | Yes |
| Type | MSI (run with msiexec /i) or EXE (run directly) | Yes |
| InstallArgs | Silent-install switches, e.g. /qn /norestart for an MSI | Usually |
| DetectionMethod | Registry (a registry key, optionally one value) or File (a file or folder exists) | Recommended |
| DetectionPath | The registry key (HKLM:\\SOFTWARE\\...) or file path that proves the app is installed | With DetectionMethod |
| DetectionName DetectionValue | Registry only: a value under the key, and the data it must have | No |
| PCTypes | Limit the app to these PC types, e.g. ["gea-shopfloor-standard"]. Not set: every Shop Floor PC | No |
| LogFile | EXE only: the installer's own log, copied into the install log when it fails | No |
Example
{
"Version": "1.0",
"Applications": [
{
"Name": "Example App 1.2",
"Installer": "exampleapp\\ExampleApp.msi",
"Type": "MSI",
"InstallArgs": "/qn /norestart",
"DetectionMethod": "Registry",
"DetectionPath": "HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{00000000-0000-0000-0000-000000000000}"
},
{
"Name": "Example Tool 4.0",
"Installer": "exampletool\\setup.exe",
"Type": "EXE",
"InstallArgs": "/S",
"DetectionMethod": "File",
"DetectionPath": "C:\\Program Files\\Example Tool\\tool.exe"
}
]
}
Reinstalling the server (sudo /opt/first-boot.sh) keeps both lists and the installers.
Script Options
Only needed for special cases. Run the script from an elevated PowerShell in C:\pxe-usb with options instead of -Interactive:
powershell -ExecutionPolicy Bypass -File .\scripts\Build-PxeUsb.ps1 -DiskNumber 1 -SiteVars .\site-vars.yml
| Option | Effect |
|---|---|
| -DiskNumber N | The USB disk to erase and build. Without it the script lists USB disks. |
| -SiteVars FILE / -NoSiteVars | Per-site values, or the defaults. |
| -SkipEnrollment, -SkipBios, -SkipDrivers, -SkipBootTools | Leave that payload off the stick. |
| -QuickVerify | Read back by size only instead of SHA-256 (faster, weaker). |
Troubleshooting
Issue: "cannot be run because it contains a #requires statement for running as Administrator"
Resolution: the PowerShell window is not elevated. Close it and open Windows PowerShell with Run as administrator (Part 1, Step 2).
Issue: "Cannot find path" for the build folder
Resolution: an administrator window cannot see network drives mapped in your normal session. Copy the pxe-usb folder to C:\pxe-usb (Part 1, Step 1) and run it from there.
Issue: The USB build stops with "does not match" or "was built for ISO"
Resolution: the build folder is incomplete or out of date. Delete the local copy and copy a fresh pxe-usb folder.
Issue: "The stick is NOT good"
Resolution: the read-back found missing or different files. Rebuild on a different USB port or stick. Never boot a stick that failed verification.
Issue: The server does not boot the stick
Resolution: the stick boots in UEFI mode only. In the firmware setup set the boot mode to UEFI (not Legacy/CSM) and pick the UEFI entry for the stick in the F12 menu.
Issue: Console banner "Could not pick the imaging port"
Symptoms: no port had a link, two ports had a link, or the port looked like the GE network.
Resolution: log in on the console as pxe and run the picker. When asked, pull the imaging switch cable out and plug it back into the same port; the port that blinked becomes the imaging port and setup runs again.
sudo pxe-pick-nic
Issue: Setup failed for another reason
Resolution: the reason is on the console banner and in the log. Setup retries at every reboot (5 attempts).
sudo less /var/log/first-boot.log
Issue: Upload-Image.ps1 reports files NOT verified
Resolution: run it again; it re-sends only the files that differ. Files that are bad in the MCL cache itself must be downloaded again by MCL (delete the cache and run MCL again).