Resolve PXE Boot Errors in Configuration Manager: A Troubleshooting Guide

Table of Contents

This guide is designed to assist administrators in diagnosing and resolving common and complex issues encountered when performing Preboot Execution Environment (PXE) boots within a Microsoft Configuration Manager environment. PXE booting is a fundamental process for deploying operating systems across a network, and failures can halt deployment workflows. Understanding the underlying mechanics and systematic troubleshooting steps is crucial for efficient issue resolution.

For administrators seeking foundational knowledge regarding the operational aspects of PXE within Configuration Manager, it is highly recommended to first gain familiarity with the core concepts of how PXE requests are initiated, processed, and responded to across the network infrastructure. This understanding forms the basis for effective troubleshooting when problems arise.

Before delving into advanced diagnostic methods on the PXE Service Point itself, two primary solutions often resolve the vast majority of PXE boot issues. Attempting these solutions sequentially is advised, as success with the first negates the need to proceed to the second, significantly streamlining the troubleshooting process. These initial checks address common configuration oversights and environmental factors.

Solution 1: Verify IP Helpers Configuration¶

IP Helpers, also known as DHCP Relay Agents, play a critical role in facilitating network communications when key components of the PXE boot process reside on different network subnets or VLANs. Their necessity arises from the broadcast nature of the initial PXE discovery messages sent by client computers.

When IP Helpers are Not Required:

IP Helpers are generally not needed in simple network configurations where all the following components are located on the same logical network segment (subnet or VLAN):

• The Dynamic Host Configuration Protocol (DHCP) server issuing IP addresses.
• The client machine attempting to PXE boot.
• The Configuration Manager Site Server or a dedicated server hosting the Windows Deployment Services (WDS) role.
• The specific Distribution Point (DP) role instance that has been configured and enabled to respond to PXE requests.

In such a confined network setup, the initial PXE broadcast from the client can directly reach the DHCP server and the WDS/PXE-enabled DP because they are all listening on the same local broadcast domain.

When IP Helpers Are Required:

Conversely, in most enterprise network environments, it is commonplace for client computers, DHCP servers, and Configuration Manager infrastructure roles (like DPs with WDS/PXE) to reside on distinct subnets or VLANs. In these distributed scenarios, IP Helpers must be meticulously configured on the network routers or Layer 3 switches that interconnect these different network segments. The primary function of an IP Helper in this context is to intercept the broadcast PXE request originating from the client’s subnet and forward it as a directed unicast message to specific IP addresses: the DHCP server(s) and the WDS/PXE-enabled DP(s).

The process for configuring IP Helpers varies significantly depending on the specific brand and model of router or Layer 3 switch being used. Administrators should consult the documentation provided by their network hardware manufacturer for precise instructions. However, the general principle involves configuring the router interface connected to the client’s subnet to forward DHCP (typically UDP port 67 for server, 68 for client) and PXE (typically UDP port 4011) broadcast traffic to the known IP addresses of the relevant servers on other subnets. Without this forwarding mechanism, the broadcast packets originating from the client will be contained within its local subnet and will never reach the necessary servers to receive a bootable image and subsequent instructions.

Using DHCP Options is Not Recommended¶

It is critically important to understand that configuring DHCP options 60 (PXEClient), 66 (Boot Server Host Name), and 67 (Bootfile Name) to direct PXE clients is not the recommended or supported method for use with Configuration Manager. While these options can be used in certain legacy PXE environments (like standalone WDS), they often cause conflicts and unpredictable behavior when Configuration Manager’s PXE service point is involved. Configuration Manager’s PXE service leverages WDS but manages the PXE boot process dynamically, selecting the appropriate boot image and task sequence based on client identity and deployment rules, a function that is disrupted by static configurations in DHCP options.

Using DHCP options 60, 66, and 67 can lead to various issues, including:

• Duplicate Responses: Both the DHCP server and the Configuration Manager PXE service point might attempt to respond to the client’s initial DHCPDISCOVER or PXE discover request, leading to unpredictable outcomes.
• Incorrect Boot File: DHCP Option 67 specifies a static boot file. Configuration Manager dynamically determines the correct Network Boot Program (NBP), which varies based on client architecture (x86 vs x64, BIOS vs UEFI). A static option 67 cannot accommodate this dynamic selection.
• Lack of Dynamic Service Location: Configuration Manager’s PXE service can inform clients about available boot images and management points. Using static DHCP options bypasses this dynamic communication channel.

Microsoft’s strong recommendation and the only supported method for directing PXE boot traffic, especially across subnets, is the proper configuration of IP Helpers on network routing devices. This method ensures that the client’s initial broadcast reaches the Configuration Manager PXE service point, allowing it to manage the boot process correctly.

Verify that DHCP Options 60, 66, and 67 Are Not Configured¶

Given the issues associated with using DHCP options for Configuration Manager PXE, a crucial troubleshooting step is to meticulously verify that options 60, 66, and 67 are not configured on your DHCP servers. This check must be performed at both the server level (global options) and the scope level (specific subnet options) within your DHCP management console.

If any of these options are present and active, they must be removed. Even if configuring these options appears to move the PXE boot process further initially, it is likely guiding the client down an incompatible path, potentially leading to errors later in the boot or task sequence execution process. A common scenario is the client receiving a static boot file name from Option 67 that does not match the dynamic boot file provided by the Configuration Manager PXE service point, resulting in a “PXE-M0F: Exiting PXE ROM.” error or similar failures.

Ensuring a clean DHCP configuration, free from these problematic options, is fundamental for reliable PXE booting with Configuration Manager. All direction of the client towards the PXE service point should be handled by network infrastructure (IP Helpers) and the PXE service itself.

Solution 2: Reinstall PXE on the Distribution Point¶

If verifying IP Helper configuration and confirming the absence of problematic DHCP options does not resolve the PXE boot issues, the problem may stem from the Configuration Manager PXE component installation or configuration on the Distribution Point. Installation or configuration errors, corrupted files, or incorrect settings can be difficult to diagnose individually. In such cases, a clean reinstallation of the PXE service on the affected Distribution Point often proves to be the most efficient troubleshooting step.

This process involves several steps to ensure that all components of the existing, potentially problematic, PXE installation are removed before a fresh installation is initiated. Follow these steps carefully:

1. Disable PXE: On the Distribution Point experiencing issues, access its properties within the Configuration Manager console. Locate and clear the checkbox labeled “Enable PXE support for clients.” A prompt will appear asking if you want to remove the Windows Deployment Services (WDS) role. Select “Yes” to confirm the removal of WDS, as Configuration Manager integrates its PXE service tightly with WDS. This action initiates the uninstall process for the PXE role and the associated WDS components.

2. Verify PXE Uninstall: It is absolutely crucial to ensure that the PXE role and WDS have been completely uninstalled before proceeding. Monitor the relevant Configuration Manager logs on the server where the DP is installed.

   • If the Distribution Point role is installed directly on the Site Server, consult the Distmgr.log file. Look for entries indicating the successful removal of the PXE role and WDS.
   • If the Distribution Point is installed on a separate, standalone server, examine the Smsdpprov.log file. This log tracks the actions performed by the DP provider, including role installations and removals. Confirm that the logs show successful completion of the PXE and WDS uninstall tasks.
   • Important: Do not proceed with the reinstallation until these logs explicitly confirm that the uninstall process is finished and successful. Prematurely attempting to reinstall can lead to further configuration issues.

3. Verify WDS Uninstall in Server Manager: After monitoring the Configuration Manager logs, independently verify the removal of the Windows Deployment Services role using Server Manager on the Distribution Point server. Open Server Manager and check the list of installed roles. If WDS was successfully uninstalled, it should no longer appear in the list of installed roles. Often, a server restart is pending after the WDS removal, which is a good indicator the uninstall was completed.

4. Restart the Server: Perform a full restart of the Distribution Point server. This step ensures that any pending operations from the WDS uninstall are completed, any locked files are released, and the server is in a clean state for the subsequent reinstallation.

5. Delete the RemoteInstall Folder: Configuration Manager and WDS use a shared directory, typically named RemoteInstall, located at the root of the drive where WDS was installed (often C:\). Even after uninstalling WDS, this folder and its contents might persist. Manually locate and delete the entire RemoteInstall folder. This step is important because residual files or corrupted data within this folder from the previous installation can interfere with a clean reinstallation. Ensure you have appropriate permissions to delete this folder.

6. Renew Self-Signed Certificate (if applicable): Configuration Manager PXE points use a certificate for secure communication. If the DP is using a self-signed certificate (default for HTTP DPs), changing the date property on the certificate in the DP properties within the ConfigMgr console can trigger the creation of a new certificate upon reinstallation. This is a minor step but can sometimes resolve certificate-related communication issues. This step is not applicable if your DP is configured for HTTPS communication, as it would use a PKI certificate managed separately.

7. Add the PXE Point Again: Return to the properties of the Distribution Point in the Configuration Manager console. Re-select the checkbox labeled “Enable PXE support for clients.” This action instructs Configuration Manager to reinstall the PXE role and configure WDS accordingly on this server.

8. Monitor PXE Installation: Just as you monitored the uninstall, closely monitor the installation process.

   • For DPs on a Site Server, check Distmgr.log.
   • For standalone DPs, check Smsdpprov.log.
   • Look for entries confirming that the PXE role is being installed and successfully configured. This process can take some time.

9. Verify New RemoteInstall Folder: Once the logs indicate successful installation, verify that a new RemoteInstall folder has been automatically recreated on the Distribution Point server. The presence of this folder confirms that WDS was reinstalled and configured by Configuration Manager.

10. Verify Boot Image Distribution and PXE Enabling: Ensure that you have distributed at least one x86 (32-bit) boot image and one x64 (64-bit) boot image to this specific PXE-enabled Distribution Point. Even if your environment consists solely of 64-bit computers, a 32-bit boot image is required for BIOS-based systems and UEFI systems configured in Legacy mode, as the initial network boot program might be 32-bit. For each boot image intended for PXE use, right-click the boot image in the Configuration Manager console, go to its properties, navigate to the “Data Source” tab, and ensure that the option “Deploy this boot image from the PXE-enabled distribution point” is checked. Redistribute the boot images if necessary to ensure this setting is applied correctly on the DP.

11. Verify WDS Service Status: Open the Services console (services.msc) on the Distribution Point server and verify that the “Windows Deployment Services Server” service is running. This service is essential for handling incoming PXE requests.

12. Verify SMS Subfolders: Navigate into the newly created RemoteInstall folder. Within RemoteInstall, Configuration Manager creates specific subfolders to manage boot images and files for PXE. Verify the existence of the following folders:

    • SMSBoot: Contains the Network Boot Programs (NBP) and boot files for different architectures (x86, x64).
    • SMSImages: Contains copies of the boot images distributed to the PXE DP, referenced by their Configuration Manager Package ID.
    • SMSTemp: A temporary folder used during the PXE process.
    • SMSTempBootFiles: Another temporary folder related to boot file preparation.

13. Verify SMSBoot Subfolder Population: Enter the SMSBoot folder. You should find subfolders named x86 and x64. Navigate into each of these and verify that they are populated with files (e.g., wdsmgfw.efi, pxeboot.com, boot.sdi, boot.wim). The presence of files here indicates that Configuration Manager has correctly prepared the boot files from the distributed boot images.

14. Verify SMSImages Population: Enter the SMSImages folder. You should see folders named after the Package IDs of the boot images you distributed to this DP and enabled for PXE. Inside each Package ID folder, you should find the boot.wim file for that specific boot image. This confirms the boot image content was correctly placed for WDS/PXE access.

15. Attempt a PXE Boot: With all the reinstallation and verification steps completed, attempt to PXE boot a client machine targeting this Distribution Point. Hopefully, the clean reinstallation process will have resolved any underlying configuration or file issues.

Following these detailed steps for reinstalling the PXE service often resolves persistent PXE boot problems by ensuring a fresh, correctly configured instance is running.

Advanced Troubleshooting Steps¶

If Solutions 1 and 2 do not resolve the issue, the problem may lie deeper within the Configuration Manager configuration, network environment, or server health. Advanced troubleshooting requires a more granular approach, focusing on logs and environmental factors.

Analyzing Configuration Manager PXE Logs (SMSPXE.log)¶

The primary log file for troubleshooting Configuration Manager PXE issues is SMSPXE.log. This log is located on the server hosting the PXE-enabled Distribution Point (in the SCCMInstallationPath\Logs directory). It provides detailed information about the PXE service’s activities, including:

• Listening for incoming PXE requests.
• Processing DHCP/PXE packets.
• Identifying the client machine.
• Communicating with the Management Point to determine task sequence deployments available to the client.
• Selecting the appropriate boot image.
• Instructing WDS to provide the Network Boot Program and boot image.

When a client fails to PXE boot, review SMSPXE.log in real-time while attempting the boot. Look for specific errors, warnings, or signs that the request is not even reaching the PXE service. Common issues revealed in this log include:

• No advertisements found: The client could not be associated with an advertised task sequence deployment enabled for PXE. Check collection memberships, deployment schedules, and deployment settings (especially “Make available to boot media and PXE”).
• No boot image: The PXE service failed to find an appropriate boot image for the client’s architecture or the specified task sequence. Verify boot image distribution and PXE enabling on the DP, as well as architecture compatibility.
• Database errors: Problems querying the Configuration Manager database for client or deployment information. Check SQL Server connectivity and health.
• WDS communication issues: The PXE service cannot communicate correctly with the local WDS instance. Check WDS service status and configuration.
• Certificate errors: Issues with the certificate used by the PXE service point.

Analyzing Windows Deployment Services (WDS) Logs¶

Since Configuration Manager’s PXE service integrates with WDS, examining WDS logs can also provide valuable clues, especially if the issue occurs after the client receives the initial Network Boot Program (NBP) but before or during the boot image loading phase. WDS logs are typically located under Event Viewer > Applications and Services Logs > Microsoft > Windows > Deployment-Services-Diagnostics. Look for errors related to:

• Client connection issues: Failures during the TFTP download of the NBP or boot image.
• Configuration problems: Errors related to WDS settings managed by Configuration Manager.
• File access errors: WDS unable to access the boot files or images in the RemoteInstall folder.

Correlating timestamps between SMSPXE.log and WDS logs helps pinpoint at which stage the failure is occurring.

Firewall Configuration¶

Firewalls (both on the server and network level) can block the necessary communication ports used during the PXE process. Ensure the following ports are open and allowed between clients, the PXE-enabled DP, DHCP servers, and Management Points:

• Client to DP/WDS:
  • UDP 67 (DHCP - initially used by client for discover, then potentially directed to DHCP server by IP Helper)
  • UDP 68 (DHCP - client port)
  • UDP 4011 (PXE - client initial request to DP/WDS)
  • UDP 69 (TFTP - for downloading NBP and boot image blocks from WDS)
  • Random high UDP ports (>1023, often Ephemeral ports) for TFTP data transfer.
• Client to DHCP Server:
  • UDP 67, UDP 68 (Standard DHCP ports)
• DP/WDS to Management Point:
  • TCP 80 (HTTP) or TCP 443 (HTTPS) - for communication between the PXE service point and the Management Point to retrieve policy and boot image information.
• DP/WDS to Site Server (if remote):
  • Various ports depending on configuration for content library access, package status updates, etc. (typically SMB/RPC related).

Windows Firewall on the PXE-enabled DP server should have exceptions configured automatically by Configuration Manager installation, but it’s worth verifying they are active and not being overridden by group policy.

Network Configuration Issues¶

Beyond basic IP Helpers, other network configuration elements can impact PXE:

• Spanning Tree Protocol (STP): Aggressive STP settings like PortFast should be enabled on switch ports connected to client computers and the PXE DP. STP can cause ports to remain in a listening/learning state for 30-60 seconds after a device connects, which is longer than the PXE client will wait before timing out its network boot attempt.
• VLAN Tagging: Ensure that network switches are correctly configured for VLAN tagging if clients and servers are on different VLANs. The router handling the IP Helper functionality must be correctly configured to route between these VLANs and forward the necessary broadcasts/unicasts.
• Multiple DHCP Servers: If multiple DHCP servers exist on the network, ensure they are not all configured with conflicting or incorrect PXE options (if IP Helpers are not used, though IP Helpers are preferred). Their scopes and leases should be properly managed.
• Network Load Balancing (NLB): While Configuration Manager supports NLB for Management Points, using NLB for Distribution Points (especially PXE-enabled ones) adds complexity. Ensure the NLB configuration is compatible with WDS and PXE traffic handling.

Boot Image and Content Status¶

Verify the status of the boot images distributed to the PXE-enabled DP. In the Configuration Manager console, navigate to Software Library > Operating Systems > Boot Images. Check the Content Status for the relevant DP. It should show “Success.” If it shows “In Progress” or “Error,” redistribute the boot image to the DP. Also, re-verify that the PXE option is enabled for the boot image properties on the Data Source tab.

Task Sequence Deployment Issues¶

The client must be in a collection targeted by a task sequence deployment that is configured to be available via PXE.

• Check the deployment properties under the “Deployment Settings” tab. The “Make available to the following” setting must include “Only media and PXE” or “Only media and PXE (hidden)” or “Configuration Manager clients, media and PXE”.
• Verify the client is a member of the targeted collection and the collection membership has been updated on the Management Point.
• Ensure the deployment is active and within its schedule.

Analyzing Network Traffic with Wireshark¶

For complex network-related PXE issues, capturing network traffic on both the client side (if possible, using a span port or tapping the network cable) and the PXE-enabled DP side using a tool like Wireshark can be invaluable. Analyze the capture to see:

• Whether the client’s initial DHCP Discover/PXE request reaches the expected servers.
• Whether the DHCP server or the PXE DP responds.
• Whether the client receives an IP address.
• Whether the client attempts to download the NBP via TFTP from the correct IP address.
• Whether TFTP communication is successful or encounters errors.

This provides a granular view of the network conversation during the boot process.

Common PXE Error Messages¶

Specific error codes displayed on the client screen during PXE boot can quickly point towards the source of the problem. Some common ones include:

Error Code	Common Cause	Troubleshooting Step
PXE-E53: No boot filename received	Client received a DHCP offer but no boot file name from the server.	Check DHCP options 66/67 (should be absent in ConfigMgr) or IP Helper forwarding to DP.
PXE-E55: ProxyDHCP service did not reply to request on port 4011	Client broadcast on 4011 did not reach the PXE DP, or DP service is not running/blocked.	Verify IP Helpers forwarding 4011, firewall on DP, SMSPXE service status.
PXE-E77: Bad or missing discovery server list	Client could not find a Configuration Manager Management Point after booting NBP.	Check Management Point health, MP firewall, client communication with MP.
PXE-E78: Could not locate boot server	Client could not connect to the server indicated in the PXE response (usually the DP itself).	Verify connectivity to DP, firewall on DP, WDS service status.
PXE-M0F: Exiting PXE ROM.	Client failed to download or execute the Network Boot Program or boot image.	Check TFTP connectivity (UDP 69), firewall, WDS logs, file presence in RemoteInstall.
Error: TFTP Download failed	Failure during the TFTP transfer of boot files.	Check network connectivity/stability, firewall blocking UDP 69 & ephemeral ports.
NBP is too big or NBP checksum invalid	Issues with the Network Boot Program file itself.	Reinstall PXE service (Solution 2) to regenerate NBP files.

Systematically addressing these areas using log analysis and network tools will help isolate the root cause of PXE boot failures in complex Configuration Manager environments.

Resolving PXE boot issues often requires a methodical approach, starting with the fundamental checks (IP Helpers, DHCP options) and moving towards detailed log analysis and environmental verification if initial steps fail. By understanding the flow of the PXE process and knowing which logs and configurations are relevant, administrators can efficiently identify and rectify problems, ensuring smooth operating system deployments.

Do you have a specific PXE error code or scenario you’re struggling with? Share your details in the comments below, and let’s troubleshoot together!