markwilson.it

Comment from Mark Wilson
Time: Friday 18 July 2008, 8:41

As it happens, I did save a copy. I didn’t publish it here originally because I’m not sure of the copyright status of this, but it’s useful information and it’s been missing for a couple of years now.

“Microsoft Windows 2000 Remote Installation Services

How to use RIS to bootstrap other operating systems using PXELinux
Read Microsoft’s official RIS documentation here:
http://www.microsoft.com/windows2000/techinfo/administration/management/remosadmin.asp

Read about PXELinux here:
http://syslinux.zytor.com/pxe.php

Why use RIS?
In an enterprise environment there is a clear need for PXE booting as a convenient method to access backup and diagnostic tools, and to deploy operating systems and applications to new machines. UNDI to NDIS2, and UNDI to packet wrappers are available from Intel, 3Com and Symantec - effectively removing reliance on a diverse set of MSClient network drivers. Also laptops and indeed many desktops are no longer equipped with a floppy drive as standard.

Using PXELinux allows both Linux and MS-DOS to be bootstrapped but there is no user authentication. Typically this must be built into the disk images via a network logon. RIS requires authentication immediately the client contacts the server so curious users are unable to cause damage.

Installation
These notes are from memory and take a certain knowledge of RIS for granted.

Install RIS using the Windows Components section of Add/Remove Programs.

You need to install it on a partition other than the system partition.

You also need to be running in a user context that has permission to write to the server’s machine account object in Active Directory.

Run through the wizard and point it at a Windows 2000 i386 folder to create a first installation.

Once the wizard has finished, set your DHCP server to direct PXE requests to the RIS server if you don’t use Windows 2000 DHCP in your enterprise. The clients need to be told to get the file ‘OSChooser/i386/startrom.com’. By sniffing network traffic we were able to notice that the ntldr file (the second file the client requests) needs to be manually copied to the root of the REMINST share. This is presumably not an issue if you use Windows 2000 DHCP server.

You will need to authorize your RIS server in Active Directory if you are using Windows 2000 DHCP (see MS documentation).

Edit your default domain policy Group Policy Object and navigate to User Configuration -> Windows Settings -> Remote Installation Services. In here you need to enable the Tools menu. I disabled all the other options because I want to use unattended installations of Windows 2000 and XP rather than classic RIS ones.

Customization
Now install either 3Com’s RIS Menu Editor (ftp://ftp.3com.com/pub/lanworks/) or emBoot’s version which is basically the same but possibly more mature (http://www.emboot.com/RISME.htm).

With this you can add entries to the Tools menu on the RIS server (which will be the root menu if the others are disabled) and associate them with a floppy image. I suggest you have such an image ready, even if you intend to boot Linux so that you can familiarize yourself with the layout of the template .SIF files and so on.

It seems that even if you follow the file layout and add new options manually the RIS server will be unaware of them unless you use the RIS Menu Editor Tool. Since I was unable to snapshot any registry changes during the addition of a new option, I’m assuming that they are stored in Active Directory.

You will notice that RISME bootstraps the floppy images using its own 3K bootloader called toolx.ldr. This only seems to boot MS-DOS, but we can substitute toolx.ldr for pxelinux.0 in our .SIF template. There is one pitfall however – if you subsequently edit that option in RISME you’ll see a cross icon next to it. If you browse it and then exit, pxelinux.0 will be overwritten with the 3K loader, which can get pretty confusing.

The RISME program is very useful for editing DOS floppy images and, like PXELinux, it features the ability to keep the PXE/UNDI stacks in memory so you can use the universal network drivers. For simplicity I have avoided using PXELinux to display menu choices, instead calling several different instances of it from the RIS menu for each Linux image I use.

The text that the RIS client displays is all customizable and the MS document explains this in detail.

Security
To secure your RIS server I recommend removing all except read permissions from the System account throughout the REMINST share’s file permissions (forcing child objects to inherit). This is because the tftpd service runs as the System account. It does not work if you run it as another account. If you remove write access in this way you won’t be able to use the ‘resume’ feature, but at least people won’t be able upload files to your server.

Where the RIS method really pays off is that you can control which menu items users are able to see simply by adjusting the file permissions on the relevant .SIF file in Setup\English\Tools\emBoot\i386\templates.

Conclusion
Using RIS seems to cover most aspects that I was looking for an enterprise-wide solution. The only gripe so far is that during the domain logon the keyboard is set to US and there doesn’t seem to be a way of changing this. As a result, users with certain symbols in their passwords may well encounter difficulties.”

I certainly can’t offer this up as my own work (so it’s not covered by the creative commons license I use) but I’m hoping the original author won’t mind me republishing it here.