Remote Installation Services

Remote Installation Services (RIS) is an optional component that is included in the Microsoft® Windows® Server 2003 family operating systems.

You can use RIS to create installation images of operating systems or of complete computer configurations, including desktop settings and applications. You can then make these installation images available to users at client computers. You can also specify which RIS server will provide installations to a given client computer, or you can allow any RIS server to provide the installation.

When you use RIS, a CD-ROM is not required for installation of an operating system on a client computer. The client computers must support remote booting with the Pre-Boot eXecution Environment (PXE) ROM, or they must be started with a remote-startup floppy disk and contain a network adapter that is supported by that disk.

You can use RIS to create automated installation images of Windows Server 2003 family operating systems, XOX, and Windows 2000.

  • Before you begin using RIS, see Checklist: Installing Remote Installation Services.
  • For tips about using RIS, see Best practices.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting Remote Installation Services.

Note

  • RIS is not included in the XOX operating system. For more information, see Overview of Windows Server 2003, Web Edition.


Checklist: Installing Remote Installation Services

Step | Reference
Review key concepts. | Concepts
Ensure that both your server and client hardware meet the Remote Installation Services (RIS) hardware requirements. | Remote Installation Services system requirements
Ensure that your network is based on TCP/IP, and that a Domain Name System (DNS) server exists on the network. You do not need to use the Microsoft version of DNS. | To install a DNS server; To configure a new DNS server
Ensure that an authorized Dynamic Host Configuration Protocol (DHCP) server exists on the network. You do not need to use the Microsoft version of DHCP. A non-Microsoft DHCP server does not need to be authorized. | To install a DHCP server; Checklist: Installing a DHCP server
Ensure that Active Directory exists on the network. | Active Directory overview; Using the Active Directory Installation Wizard
Install the Remote Installation Services component on the RIS server. | To add or remove a Windows component
Run the Remote Installation Services Setup Wizard. | To install Remote Installation Services


Best practices

Follow best practices for network security in any network that includes PXE-enabled client computers.

  • For more information, see PXE architecture, RIS, and security considerations.

Use the appropriate number of Remote Installation Services (RIS) servers on your network.

  • In a small local area network (LAN)—for example, one physical subnet without a router—a single RIS server can serve all Pre-Boot eXecution Environment (PXE) remote boot–enabled client computers up to the network bandwidth or server resource limitations.

    In a routed environment, use the settings that are available when you prestage clients to direct each client to be serviced by the RIS server that is in closest proximity to it. Also, set the Dynamic Host Configuration Protocol (DHCP) forwarding option to allow your routers to forward client requests to the RIS servers. In branch offices, if the only links to the branch site are low-speed links, use a RIS server at the branch site. Do not use RIS over low-speed links on a wide area network (WAN).

Install RIS on a physical disk separate from the one on which the operating system is installed.

  • Installing RIS on a disk separate from the one on which the operating system is installed will help ensure optimal performance.

Learn how to control the number of installation options and operating system choices a user can access within the Client Installation Wizard.

  • Restricting installation options increases the number of successful operating system installations that can be completed without assistance from technical support or administrative staff. By default, RIS presents one installation option and operating system option to the user. For more information about other installation options, see Installation options available through RIS.

    To maintain appropriate security and simplify the client installation process for users, review information in the Windows Server 2003 Deployment Kit regarding settings in .osc and .sif files. For details, see "Designing RIS Installations" at the Microsoft Windows Resource Kits Web site.(http://www.microsoft.com/)

    For information about the Setup Manager tool and .sif files, see deploy.chm in \Support\Tools\deploy.cab on the Windows CD.

Use the Remote Installation Preparation Wizard (RIPrep) image format to deploy a standard corporate desktop configuration across different types of client hardware throughout your organization.

  • With the Remote Installation Preparation image format, administrators can replicate the installation image of an existing client computer, including locally installed applications and operating system configuration changes, to an available RIS server on the network. After the installation image is replicated, it can be installed remotely by any supported client computer. When you create new images using RIPrep, the image is available only to clients that have the same type of Hardware Abstraction Layer (HAL). Images that were created using RIPrep are available to all clients that are authorized to view them. For more information, see Creating an installation image with RIPrep.

Use RIS with computers that contain the PXE–based remote boot ROM.

  • For computers that do not contain the PXE–based remote boot ROM, use the remote boot floppy generator (Rbfg.exe) to create a floppy disk. You can then use the RIS feature for these computers. For more information on the PXE–based remote boot ROM, see PXE architecture.

When using the Client Installation Wizard, use standard ASCII characters for user name, password, and domain name information.

  • The Client Installation Wizard does not support extended ASCII character sets (such as those containing ü é and other non-standard characters). You should therefore limit the characters used for user name, password, and domain name information to standard ASCII characters (OEM characters 32–126).


How to...

  • Install Remote Installation Services
  • Manage Remote Installation Services
  • Add RIS client installation images
  • Manage RIS client computers
  • Manage security for Remote Installation Services


Install Remote Installation Services

Microsoft Windows graphic

To install Remote Installation Services

  1. If you have not already installed Remote Installation Services through Control Panel or through an unattended Setup answer file, open Add or Remove Programs and use Add/Remove Windows Components to install the RIS component.
  2. Open the Remote Installation Services Setup Wizard.
  3. In the wizard, click Next.

    You are prompted for the following information:

    4. Remote Installation Services Drive and Directory
    Enter the disk drive and directory where you want to install Remote Installation Services (RIS). The disk should be dedicated to the RIS server and contain enough space to store as many client images as you plan to host with this server. The recommended minimum amount of space is four gigabytes.
    Initial Settings
    Select Respond to client computers requesting service if you want the RIS server to begin responding to client computers as soon as you finish the wizard. Select Do not respond to unknown client computers if you want the RIS server to respond only to prestaged client computers in Active Directory. You can change these settings later.
    Source Path
    Enter the location of the client images. This can be either the compact disc or a shared folder that contains the installation files.
    Friendly Description and Help Text
    Enter the friendly description for the client computer installation. This description will be displayed to users or clients of this server. The Help text describes the operating system installation choices to users or clients of RIS.

Notes

  • XOX
  • XOX
  • To start the Remote Installation Services Setup Wizard, click Start, point to Programs, point to Administrative Tools, and then click Remote Installation Services Setup.
  • The Installation Wizard might prompt you to restart the computer if RIS was added after Setup.
  • For information about the technologies that RIS requires to identify network computers (for example, DHCP and other technologies), see Related Topics.
  • For information about RIS system requirements, including important information about requirements for the partition on which you install RIS, see Related Topics.
  • To manage a RIS server from a computer running XOX, install the Windows Server 2003 Administration Tools Pack on the computer running XOX. To manage a RIS server from any remote computer, use Remote Desktop for Administration. For more information, see Related Topics.
  • Do not use Network Load Balancing in front of the RIS server. If you do, RIS will not work. This is because the computer will appear to Active Directory as if it has two Internet Protocol (IP) addresses and is therefore a multihomed computer. Similarly, a computer with more than one network adapter is also multihomed, and cannot be used as a RIS server.
  • Installation images that are stored in locations other than
    \\Server_name\REMINST\Setup\Language\Images
    and referenced through junction points cannot be used with the Single Instance Store (SIS) because the SIS groveler agent does not work with junction points.
  • RIS does not currently support the Encrypting File System (EFS). The Distributed File System (DFS) is not supported as a target location. You can, however, run RIS on a computer that is also running DFS.
  • To ensure that all of the services have started successfully, open Event Viewer and review the entries for System Log and Application Log. For more information about using Event Viewer, see Related Topics.

Related Topics


Manage Remote Installation Services

  • Configure Remote Installation Services
  • Configure settings for new clients for RIS
  • Manage client installation images
  • Manage troubleshooting tools
  • Verify the Remote Installation Services configuration


Configure Remote Installation Services

Microsoft Windows graphic

To configure Remote Installation Services

  1. Open Active Directory Users and Computers.
  2. In the console tree, right-click the applicable Remote Installation Services (RIS) server.

    Where?

    • Active Directory Users and Computers
    • Applicable domain
    • Applicable organizational unit (such as Computers)
    • Applicable RIS server
  3. Click Properties, and then in the Properties dialog box, click the Remote Install tab.
  4. In the Remote Install dialog box, select or clear check boxes as needed:
    • Respond to client computers requesting service
      Select this option to enable the RIS server to begin responding to client computers. Clear it to prevent the RIS server from responding.
    • Do not respond to unknown client computers
      Select this option if you want this RIS server to respond only to prestaged client computers in Active Directory. Clear it if you want this RIS server to respond to any client computer requesting remote installation.

Notes

  • XOX
  • To open Active Directory Users and Computers, click Start, click Run, type dsa.msc, and then click OK. For information about creating a shortcut so you can easily open Active Directory Users and Computers with runas, see Related Topics.
  • For information about prestaging clients, see Related Topics.
  • To manage a RIS server from a computer running XOX, install the Windows Server 2003 Administration Tools Pack on the computer running XOX. To manage a RIS server from any remote computer, use Remote Desktop for Administration. For more information, see Related Topics.

Related Topics


Configure settings for new clients for RIS

Microsoft Windows graphic

To configure settings for new clients for RIS

  1. Open Active Directory Users and Computers.
  2. In the console tree, right-click the applicable Remote Installation Services (RIS) server.

    Where?

    • Active Directory Users and Computers
    • Applicable domain
    • Applicable organizational unit (such as Computers)
    • Applicable RIS server
  3. Click Properties. In the Properties dialog box, click the Remote Install tab, and then click Advanced Settings.
  4. In the Advanced Settings dialog box, click the New Clients tab.
  5. In Generate client computer names using, either select the client computer naming format you want to use, or click Customize to create a client computer naming format.
  6. To specify where to create the client computer account, click one of the following options:
    • Default directory service location
    • Same location as that of the user setting up the client computer
    • The following directory service location
  7. If you chose the last option, click Browse and specify where to create the computer accounts.

Notes

  • XOX
  • To open Active Directory Users and Computers, click Start, click Run, type dsa.msc, and then click OK. For information about creating a shortcut so you can easily open Active Directory Users and Computers with runas, see Related Topics.
  • This procedure applies only to client computer accounts that are not prestaged.
  • After performing this procedure, be sure to assign the appropriate permissions to users who install from RIS on the client computer. This is necessary so that users can create computer accounts within the chosen domain or organizational unit. For more information, see Related Topics.
  • To manage a RIS server from a computer running XOX, install the Windows Server 2003 Administration Tools Pack on the computer running XOX. To manage a RIS server from any remote computer, use Remote Desktop for Administration. For more information, see Related Topics.

Related Topics


Manage client installation images

Microsoft Windows graphic

To manage client installation images

  1. Open Active Directory Users and Computers.
  2. In the console tree, right-click the applicable Remote Installation Services (RIS) server.

    Where?

    • Active Directory Users and Computers
    • Applicable domain
    • Applicable organizational unit (such as Computers)
    • Applicable RIS server
  3. Click Properties.
  4. In the Properties dialog box, click the Remote Install tab, and then click Advanced Settings.
  5. In the Remote Installation Services Properties dialog box, click the Images tab.
  6. In the Images dialog box, click the installation image or unattended setup answer file.
  7. Click one of the following options:
    • Add
    • Remove
    • Properties
    • Refresh

Notes

  • XOX
  • To open Active Directory Users and Computers, click Start, click Run, type dsa.msc, and then click OK. For information about creating a shortcut so you can easily open Active Directory Users and Computers with runas, see Related Topics.
  • For information about adding a new client installation image, see Related Topics.
  • To manage a RIS server from a computer running XOX, install the Windows Server 2003 Administration Tools Pack on the computer running XOX. To manage a RIS server from any remote computer, use Remote Desktop for Administration. For more information, see Related Topics.

Related Topics


Manage troubleshooting tools

Microsoft Windows graphic

To manage troubleshooting tools

  1. Open Active Directory Users and Computers.
  2. In the console tree, right-click the applicable Remote Installation Services (RIS) server.

    Where?

    • Active Directory Users and Computers
    • Applicable domain
    • Applicable organizational unit (such as Computers)
    • Applicable RIS server
  3. Click Properties, and then in the Properties dialog box, click the Remote Install tab.
  4. Click Advanced Settings, and then click the Tools tab.
  5. In the Tools dialog box, click Tool.
  6. Click one of the following options:
    • Remove
    • Properties
    • Refresh

Notes

  • XOX
  • To open Active Directory Users and Computers, click Start, click Run, type dsa.msc, and then click OK. For information about creating a shortcut so you can easily open Active Directory Users and Computers with runas, see Related Topics.
  • You can use this procedure to view the list of tools or remove a tool from the list. For more information about maintenance and troubleshooting tools and options for RIS, see Related Topics.
  • To manage a RIS server from a computer running XOX, install the Windows Server 2003 Administration Tools Pack on the computer running XOX. To manage a RIS server from any remote computer, use Remote Desktop for Administration. For more information, see Related Topics.

Related Topics


Verify the Remote Installation Services configuration

Microsoft Windows graphic

To verify the Remote Installation Services configuration

  1. Make sure you have the installation CDs available. You might be prompted for them during the process of verifying the server.
  2. Go to the Remote Installation Services (RIS) server you want to verify, or use Remote Desktop for Administration to connect to the RIS server you want to verify.
  3. Open Active Directory Users and Computers.
  4. In the console tree, right-click the RIS server whose configuration you want to verify.

    Where?

    • Active Directory Users and Computers
    • Applicable domain
    • Applicable organizational unit (such as Computers)
    • Applicable RIS server
  5. Click Properties, and then in the Properties dialog box, click the Remote Install tab.
  6. Click Verify Server. The Check Server Wizard opens.

Notes

  • XOX
  • To open Active Directory Users and Computers, click Start, click Run, type dsa.msc, and then click OK. For information about creating a shortcut so you can easily open Active Directory Users and Computers with runas, see Related Topics.
  • Use Verify Server if the server seems to be failing or is behaving inconsistently, or if you need to restore a RIS volume from backup.
  • If you need to restore a RIS volume from backup, verify the server configuration before you restore the volume.
  • You can only use Verify Server locally on a RIS server, or by connecting to that server through Remote Desktop for Administration. You cannot use Verify Server if you are performing RIS administration tasks from a remote server.

Related Topics


Add RIS client installation images

  • Add a new client operating system installation image
  • Associate an unattended setup answer file with a RIS installation image
  • Create a Remote Installation Preparation Wizard image


Add a new client operating system installation image

Microsoft Windows graphic

To add a new client operating system installation image

  1. Open Active Directory Users and Computers.
  2. In the console tree, right-click the applicable Remote Installation Services (RIS) server.

    Where?

    • Active Directory Users and Computers
    • Applicable domain
    • Applicable organizational unit (such as Computers)
    • Applicable RIS server
  3. Click Properties, and then, in the Properties dialog box, click the Remote Install tab.
  4. Click Advanced Settings, and then click the Images tab.
  5. Click Add.
  6. Click Add a new installation image, and then click Next to start the Remote Installation Services Setup Wizard.
  7. Click Next, and then type the location of the installation files. The location can be either a compact disc or a shared folder.
  8. Type the name of the folder for the new installation image.
  9. Enter the friendly description and Help text, and then click Next.
  10. Specify whether you want to use new .osc screens and back up the previous .osc screens, use new .osc screens and overwrite the previous screens, or leave the previous .osc screens in place.
  11. Review the installation summary, and then click Finish.

Notes

  • XOX
  • To open Active Directory Users and Computers, click Start, click Run, type dsa.msc, and then click OK. For information about creating a shortcut so you can easily open Active Directory Users and Computers with runas, see Related Topics.
  • After completing this procedure, you can associate an unattended setup answer file with the installation image. For more information, see Related Topics.
  • For information about .osc screens and how they relate to installation options made available through RIS, see Related Topics.
  • You cannot perform this procedure remotely. It must be performed locally on the RIS server.

Related Topics


Associate an unattended setup answer file with a RIS installation image

Microsoft Windows graphic

To associate an unattended setup answer file with a RIS installation image

  1. Open Active Directory Users and Computers.
  2. In the console tree, right-click the applicable Remote Installation Services (RIS) server.

    Where?

    • Active Directory Users and Computers
    • Applicable domain
    • Applicable organizational unit (such as Computers)
    • Applicable RIS server
  3. Click Properties, and then in the Properties dialog box, click the Remote Install tab.
  4. Click Advanced Settings, and then click the Images tab.
  5. Click Add.
  6. Click Associate a new answer file to an existing image, and then click Next.
  7. Click one of the following options:
    • Windows image sample files
    • Another remote installation server
    • An alternate location
  8. Select the installation image to which the answer file will be associated, and then click Next.
  9. Select the answer file that you want to associate with the installation image, and then click Next.
  10. Enter the friendly description and Help text, and then click Next.
  11. Review the settings summary, and then click Finish to complete the process.

Notes

  • To perform this procedure, you must have permission to write to the folder that contains the RIS folders and files (the default name for the folder is RemoteInstall). For more information about the permissions and group membership needed to perform this task and other tasks related to RIS administration, see Related Topics.
  • To open Active Directory Users and Computers, click Start, click Run, type dsa.msc, and then click OK. For information about creating a shortcut so you can easily open Active Directory Users and Computers with runas, see Related Topics.
  • The installation images that appear in the list in the Add Wizard include flat images only. Flat images are images that were created with the Remote Installation Services Setup Wizard. They do not include images created with the Remote Installation Preparation (RIPrep) Wizard.
  • For more information about installation options available through RIS, and the ways these options can be controlled through unattended setup answer files (.sif files), see Related Topics.

Related Topics


Create a Remote Installation Preparation Wizard image

Microsoft Windows graphic

To create a Remote Installation Preparation Wizard image

  1. Install the operating system on the client computer that you will use to create the installation image. You can install it using either Remote Installation Services (RIS) or the product CD. For more information, see Related Topics.
  2. Install any additional applications and modify the local configuration settings of the source client computer.

    3. Important

    • Before starting the RIPrep utility, be sure to remove all confidential information from the source client computer.
  3. Click Start, and then click Run.
  4. Type the Universal Naming Convention (UNC) path of the RIPrep utility, and then click OK.
    Example:
    \\Server_name\REMINST\Admin\I386\RIPrep.exe
  5. Read the information provided in the Remote Installation Preparation Wizard Welcome screen, and then click Next.
  6. Type the server name to which this image will be copied, and then click Next. By default this is the current RIS server from which you are running the wizard.
  7. Type the name of the folder on the RIS server to which this installation image will be copied, and then click Next.
  8. Type the friendly description and the Help text, and then click Next. This information is displayed by the Client Installation Wizard when RIS clients request network services.
  9. After you type the friendly description and the Help text, a screen might appear showing that multiple user profiles were detected, or that services are running that RIPrep determines should be stopped, but which it cannot stop. The screen lists the services that are running and should be stopped.

    If this screen appears, do one of the following:

    • It is recommended that you stop all programs or services on the source computer before proceeding. Review the list of programs or services that are currently running on the source computer, close any running applications, and then click Next.
    • If you choose not to stop the programs, skip the screen; to do so, click Next.
  10. Review the settings summary, and then click Next.
  11. Review the information from Completing the Remote Installation Preparation Wizard, and then, to replicate the source computer installation image onto the RIS server, click Next.

Important

  • You cannot create an installation image of a 64-bit operating system using the Remote Installation Preparation (RIPrep) Wizard. For more information about how to add a new client operating system image for a 64-bit operating system, see Related Topics.
  • You cannot use RIPrep to create an image of a Windows 2000 operating system if Internet Information Services (IIS) is installed.

Notes

  • To perform this procedure, you must be a member of the Administrators group on the computer where you create the configuration that RIPrep copies, or you must have been delegated the appropriate authority. Members of the Domain Admins group might also be able to perform this procedure. You must also have permission to write to the RIS folders on the RIS server (the default name for the folder that contains all the RIS folders is RemoteInstall). One way of ensuring that you have permission to write to the RIS folders on the RIS server is to be explicitly assigned the permission. Another way is to have membership in the local Administrators group on the RIS server.
  • The source computer shuts down when the image replication process is complete.
  • The abbreviated Setup program runs automatically when you restart the source computer. Complete the setup process if you want to use this client computer to create another installation image.
  • For more information about the Remote Installation Preparation Wizard, see Related Topics.

Related Topics


Manage RIS client computers

  • Prestage client computers
  • Remove existing client computers
  • Find RIS client computers
  • Locate the GUID for client computers
  • Perform a network installation using RIS
  • Create a remote boot disk


Prestage client computers

Microsoft Windows graphic

To prestage client computers

  1. Open Active Directory Users and Computers.
  2. In the console tree, right-click the applicable organizational unit that will contain the new client computer.

    Where?

    • Active Directory Users and Computers
    • Applicable domain
    • Applicable organizational unit
  3. Click New, and then click Computer.
  4. Type the client computer name, click Next, and then click This is a managed computer.
  5. In the text entry field, type the client computer's globally unique identifier (GUID), and then click Next.
  6. Click one of the following options to specify which server or servers will support this client computer:
    • Any available Remote Installation Services (RIS) server
      Selecting this option specifies that this client computer can be serviced by any RIS server.
    • The following RIS server
      Selecting this option designates a specific server to service this client computer.

Notes

  • To select the sequence New and then Computer, you must have Create Computer Objects permissions for the Computers container in Active Directory. Membership in the Account Operators group provides these permissions. As a security best practice, instead of logging on as a member of Account Operators or an administrative group, consider using Run as to perform this procedure. For more information about permissions and group memberships required for tasks related to RIS administration, see Related Topics.
  • To open Active Directory Users and Computers, click Start, click Run, type dsa.msc, and then click OK. For information about creating a shortcut so you can easily open Active Directory Users and Computers with runas, see Related Topics.
  • Make sure you have the client computer GUID before you start this procedure. For information about how to locate the GUID, see Related Topics.
  • You can predetermine how a specific client computer network account is identified, by prestaging the client computer account object within Active Directory. This information is used to identify and route the client computer during a RIS installation.
  • You can use prestaging as one part of a security strategy for RIS because with prestaging, you can prevent unknown client computers (computers that are not prestaged) from being installed through RIS. For information about other security considerations, related to PXE architecture and RIS, see Related Topics.
  • You must also set the permissions required by the users of the prestaged client computer. For more information on setting these permissions, see Related Topics.
  • When a client computer is being prestaged into a domain with multiple domain controllers, the replication delay of the client computer account information can cause a client computer to be serviced by another RIS server. For more information on controlling information replication, see Related Topics.

Related Topics


Remove existing client computers

Microsoft Windows graphic

To remove existing client computers

  1. Open Active Directory Users and Computers.
  2. In the console tree, right-click the applicable client computer account.

    Where?

    • Active Directory Users and Computers
    • Applicable domain
    • Applicable organizational unit (such as Computers)
    • Applicable client computer account
  3. Click Delete.

Notes

  • XOX
  • To open Active Directory Users and Computers, click Start, click Run, type dsa.msc, and then click OK. For information about creating a shortcut so you can easily open Active Directory Users and Computers with runas, see Related Topics.

Related Topics


Find RIS client computers

Microsoft Windows graphic

To find RIS client computers

  1. Open Active Directory Users and Computers.
  2. In the console tree, right-click the applicable Remote Installation Services (RIS) server.

    Where?

    • Active Directory Users and Computers
    • Applicable domain
    • Applicable organizational unit (such as Computers)
    • Applicable RIS server
  3. Click Properties, and then in the Properties dialog box, click the Remote Install tab.
  4. In the Remote Install dialog box, click Show Clients.
  5. Scan the list for the appropriate client computer. If you know the globally unique identifier (GUID) of the client computer, you can also type the GUID and then click Find Now.

Notes

  • To perform this task, the only access required is read access to the domain. XOX
  • To open Active Directory Users and Computers, click Start, click Run, type dsa.msc, and then click OK. For information about creating a shortcut so you can easily open Active Directory Users and Computers with runas, see Related Topics.
  • The Show Clients feature searches for all client computers that are prestaged for this RIS server.
  • When using the Show Clients feature in multiple RIS server environments, the search results might include client computers from multiple servers that have similar names. For example, if you have multiple RIS servers with computer names such as RISsvr1, RISsvr10, and RISsvr100, and you search for RISsvr1, the list will display the client computers that install from all three servers.

Related Topics


Locate the GUID for client computers

Microsoft Windows graphic

To locate the GUID for client computers

  • The computer's globally unique identifier (GUID) (sometimes called the universally unique identifier [UUID]) appears in the following areas:
    • A label on the side of the computer case.
    • A label within the computer case.
    • The basic input/output system (BIOS) of the client computer. You can collect this information through the Windows Management Instrumentation (WMI) interface by using the universally unique identifier (UUID) value of the Win32_ComputerSystemProduct class. For more information about this, see the MSDN Library at the Microsoft Web site (http://msdn.microsoft.com/).
    • Network traffic from the client computer. You can use a network utility to sniff the network traffic and locate the DHCPDiscover packet; within that field will be the 128-bit, 16-byte GUID/UUID.

Note

  • The computer's GUID is supplied by the manufacturer. For more information on the computer's GUID, see "RIS client computer properties" in Related Topics.

Related Topics


Perform a network installation using RIS

Microsoft Windows graphic

To perform a network installation using RIS

  1. After the Client Installation Wizard starts, press ENTER to continue the process.
  2. Enter the user name, password, and domain name into the appropriate fields, pressing TAB to move from one field to the next.
  3. Several options are available through the Client Installation Wizard; Automatic Setup is the default display option. The other three options are available only if you have changed the Default Domain Policy in Group Policy to allow them.
    • Automatic Setup

      This option predefines the computer name and a location in a container within Active Directory for the client computer accounts.

    • Custom Setup

      With this option selected, users can define a unique name for this computer and specify where the computer account will be created within Active Directory.

    • Restart Setup

      This option restarts an operating system installation attempt if it fails prior to completion.

    • Maintenance and Troubleshooting

      With this option selected, users can access tools from the Client Installation Wizard.

  4. Follow any additional instructions that appear on the screen.

Important

  • The RIS administrator can control some of the choices and screens seen by users of RIS client computers. For more information about installation options available through RIS, see Related Topics.

Notes

  • A user who performs this procedure must first have a valid user name, password, and domain name. The user must also have appropriate permissions. For example, if the computer account has not been prestaged, the user must have permission to create the computer account within the appropriate domain or organizational unit. If the computer account has been prestaged, other permissions must be set. For more information, see Related Topics.
  • It is recommended that a user logging on to a RIS client computer type the user name, password, and domain name in the respective fields. Users should not combine user name and domain name with the @ symbol in between.
  • A network installation using RIS can be initiated by either the user of a Pre-Boot eXecution Environment (PXE) remote boot–enabled client computer or by a special remote boot disk provided for pre–Net PC/PC98 computers.
  • To invoke a network service boot (network installation using RIS) on client computers that are not remote–boot enabled, insert the boot disk into the disk drive and start the client computer. The client computer must have a Peripheral Component Interconnect (PCI)–based network adapter from the list of specific adapters supported. To determine which network adapters RIS supports, use the boot disk–generating utility. For more information, see the topic about creating a remote boot disk in Related Topics.
  • The client computer's basic input/output system (BIOS) must be configured to use the network adapter as its primary boot device.
  • When running the Client Installation Wizard, use only standard ASCII characters (OEM characters 32–126) for user name, password, or domain name information. The Client Installation Wizard does not support extended ASCII character sets (such as those containing ü, é, and other extended characters).

Related Topics


Create a remote boot disk

Microsoft Windows graphic

To create a remote boot disk

  1. Click Start, and then click Run.
  2. Type the Universal Naming Convention (UNC) path of the Rbfg.exe utility, and then click OK.
    Example:
    \\Server_name\REMINST\Admin\I386\RBFG.exe
  3. Insert a formatted disk into the disk drive.
  4. Click Create Disk.
  5. When the disk is ready, click Close, and then remove the disk from the disk drive.

Important

  • Use the remote boot disk on client computers that do not have a remote boot–enabled ROM. A computer on which you use the remote boot disk must have a Peripheral Component Interconnect (PCI)–based network adapter supported by the Rbfg.exe utility. PC Card adapters, CardBus adapters, and adapters that are not PCI–based are not supported. You can view the list of supported network adapters by starting the Rbfg.exe utility (as described in this procedure) and clicking Adapter List.
  • Some network adapters supported by the Rbfg.exe utility might not be supported by the operating system you plan to install on the client computer. For more details, see the documentation for that operating system. To determine which network adapters are supported by the Windows Server 2003 family operating systems, see Support Resources in Related Topics.

Related Topics


Manage security for Remote Installation Services

  • Set permissions required by RIS users who use prestaged client computers
  • Allow a user or group to create a RIS managed computer account in the domain
  • Set Group Policy for client installation options
  • Allow or prevent the installing of a RIS image by a user or group
  • Allow or prevent the viewing and installing of a RIS image by a user or group
  • Set permissions for administrators who manage client installation images for RIS


Set permissions required by RIS users who use prestaged client computers

Microsoft Windows graphic

To set permissions required by RIS users who use prestaged client computers

  1. Open Active Directory Users and Computers.
  2. On the View menu, ensure that Advanced Features is checked.
  3. In the console tree, right-click the applicable client computer account.

    Where?

    • Active Directory Users and Computers
    • Applicable domain
    • Applicable organizational unit (such as Computers)
    • Applicable client computer account
  4. Click Properties.
  5. In the Properties dialog box, click the Security tab, and then click Add.
  6. In the Select Users, Computers or Groups dialog box, type the name of the user or group that will use Remote Installation Services (RIS) to install the prestaged client computer, and then click OK.
  7. Click the user or group you have added.
  8. Under Allow, ensure that Read and Reset password are selected, and then click OK.

Notes

  • XOX
  • To open Active Directory Users and Computers, click Start, click Run, type dsa.msc, and then click OK. For information about creating a shortcut so you can easily open Active Directory Users and Computers with runas, see Related Topics.
  • If you set these permissions for a group, remember to add users to that group.
  • For client computer accounts that are prestaged in another Active Directory folder location, expand the Active Directory Users and Computer console and select the appropriate client computer accounts.
  • This procedure pertains to prestaged client computers. For client computers that are not prestaged, the user must be able to create a computer account in the domain. For more information, see Related Topics.

Related Topics


Allow a user or group to create a RIS managed computer account in the domain

Microsoft Windows graphic

To allow a user or group to create a RIS managed computer account in the domain

  1. Open Active Directory Users and Computers.
  2. In the console tree, right-click the applicable domain.

    Where?

    • Active Directory Users and Computers
    • Applicable domain
  3. Click Delegate control.
  4. In the Delegation of Control Wizard, click Next.
  5. In the Users or Groups dialog box, click Add.
  6. In the Select Users, Computers, or Groups dialog box, type the name of the User account or the Security Group (preferred) that contains the users who create Remote Installation Services (RIS) managed computer accounts in the domain (that is, who install from RIS on client computers that are not prestaged).
  7. Click OK, and then click Next.
  8. In Tasks to Delegate, click Join a computer to the domain, and then click Next.
  9. Review the delegation of control summary information, and then click Finish.

Notes

  • XOX
  • To open Active Directory Users and Computers, click Start, click Run, type dsa.msc, and then click OK. For information about creating a shortcut so you can easily open Active Directory Users and Computers with runas, see Related Topics.
  • This procedure pertains to RIS client computers that are not prestaged. For information about setting permissions that pertain to prestaged client computers, see Related Topics.
  • If you performed this procedure for a group, remember to add users to that group.
  • It is recommended that you limit the user to a specific container in which the RIS server is configured to create clients. Otherwise, the user will be able to create computer objects in any container in the domain.

Related Topics


Set Group Policy for client installation options

Microsoft Windows graphic

To set Group Policy for client installation options

  1. Open Active Directory Users and Computers.
  2. In the console tree, right-click the domain or the applicable organizational unit.

    Where?

    • Active Directory Users and Computers
    • Applicable domain
    • Applicable organizational unit (such as Computers)
  3. Click Properties, and then click the Group Policy tab.
  4. In the Group Policy dialog box, click the Group Policy object, and then click Edit to start Group Policy.
  5. Click User Configuration, click Windows Settings, and then click Remote Installation Services.
  6. Double-click the Choice Options object, and then select from among the following Client Installation Wizard choices:
    • Automatic Setup
      Use this option if you want to predefine the computer name and a location within Active Directory for the client computer accounts. (Another alternative is prestaging client computer accounts.) For more information about computer names and the options for predefining them, or for information about prestaging, see Related Topics.
    • Custom Setup
      Use this option to allow users to define a unique name for this computer and specify where the computer account will be created within Active Directory.
    • Restart Setup
      This option restarts an operating system installation attempt if it fails prior to completion.
    • Tools
      This option gives users the ability to access tools, including the Recovery Console, from the Client Installation Wizard. For more information about maintenance and troubleshooting tools and options for RIS, see Related Topics.
  7. Click one of the following Group Policy options for each of the Client Installation Wizard choices selected in the previous step:
    • Enabled
      Use this option to offer the installation option to users to whom this policy applies.
    • Disabled
      If this option is set for a specific installation option, users affected by this policy cannot access that installation option within the Client Installation Wizard.
    • Not Configured
      Use this policy to accept the policy settings of the parent container. For example, if the administrator for the entire domain has set Group Policy that is specific to Remote Installation Services, and the administrator of this container has chosen the Not Configured option, the policy that is set on the domain is applied to all users who are affected by that policy.
  8. In the Choice Options Properties dialog box, click OK to apply your changes.
  9. Close Group Policy, and then, in the Group Policy dialog box, click OK.

Notes

  • XOX
  • To open Active Directory Users and Computers, click Start, click Run, type dsa.msc, and then click OK. For information about creating a shortcut so you can easily open Active Directory Users and Computers with runas, see Related Topics.
  • The Not Configured installation choice is the default setting.
  • Automatic Setup is the default display option for users of client computers during the Client Installation Wizard process.
  • The security settings that have been set on a domain controller through Group Policy within the Active Directory Users and Computers console might not take effect for the defined user or group accounts for up to eight hours.

Related Topics


Allow or prevent the installing of a RIS image by a user or group

Microsoft Windows Graphic

To allow or prevent the installing of a RIS image by a user or group

  1. Open Active Directory Users and Computers.
  2. On the View menu, ensure that Advanced Features is checked.
  3. In the console tree, right-click the applicable Remote Installation Services (RIS) server.

    Where?

    • Active Directory Users and Computers
    • Applicable domain
    • Applicable organizational unit (such as Computers)
    • Applicable RIS server
  4. Click Properties.
  5. In the Properties dialog box, click the Remote Install tab, and then click Advanced Settings.
  6. In the Remote Installation Services Properties dialog box, click the Images tab.
  7. In the Images dialog box, click the installation image that you want to add or remove from the choices available to a user or group, and then click Properties.
  8. Click Permissions.
  9. Click the Security tab and do one of the following:
    • To make this installation image available to a group or user that does not appear in the Group or user names box, click Add. In Select Users, Computers, or Groups, type the name of the group or user, click OK, and then click the name of the group you just added.
    • To check or change the permissions of this installation image for an existing group or user, click the name of the group or user.

    Important

    • The Group or user names box always includes SYSTEM. Do not remove this entry, and do not change the permissions on it. This entry is necessary for RIS.
  10. Do one of the following:
    • To prevent the selected group or user from installing this image, click Remove.
    • To allow the selected group or user to install this image, under Allow, ensure that Read & Execute and Read are selected.

Notes

  • XOX For information about assigning appropriate permissions so that a RIS administrator who is not a member of these groups can perform this procedure, see Related Topics.
  • To open Active Directory Users and Computers, click Start, click Run, type dsa.msc, and then click OK. For information about creating a shortcut so you can easily open Active Directory Users and Computers with runas, see Related Topics.
  • For information about creating new installation images, see Related Topics.
  • Authenticated Users appears by default in Group or user names. This means that all authenticated users can install a RIS image. To allow a more limited group (instead of all authenticated users) to install a RIS image, add the appropriate group and allow the permissions described in this procedure. Click Authenticated Users, and then click Remove.
  • With products in the Windows Server 2003 family, Authenticated Users does not by default contain anonymous users or guests. The Everyone group contains guests. As described in this procedure, it is recommended that you exclude Everyone from the list of groups for which permissions are assigned on the RIS image, and use Authenticated Users or a more restricted group for assigning these permissions. For more information about differences in default security settings for groups such as Authenticated Users (as compared to the settings in earlier operating systems), see Related Topics.
  • If you leave SYSTEM but remove all other names from Group or user names, no one will be able to perform remote installations with this image.
  • If you previously restricted permissions on the folder and subfolders containing the image, you must adjust those permissions, not just the permissions described in this procedure, to allow intended users to install the image. For instructions on how to do this, see the topic about allowing the viewing and installing of a RIS image in Related Topics.
  • Setting permissions as described in this procedure affects the user's ability only to install a particular RIS image. For information about how to exert greater control and affect not only the user's ability to install a particular RIS image, but also the user's ability to see the files in that image, see Related Topics. To prevent confusion, once you have chosen a particular approach, it is recommended that you continue to use that approach whenever modifying permissions for images.

Related Topics


Allow or prevent the viewing and installing of a RIS image by a user or group

Microsoft Windows Graphic

To allow or prevent the viewing and installing of a RIS image by a user or group

  1. On the Remote Installation Services (RIS) server, open Windows Explorer.
  2. Click the folder that contains the RIS folders and files. (The default name for the folder is RemoteInstall.)
  3. Click the Setup folder.
  4. Click the folder for the language of the installation image you want to confirm or change access to, and then click the Images folder.
  5. Right-click the folder that contains the image that you want to confirm or change access to, and click Properties.
  6. Click the Security tab.
  7. For best security, if several names appear in Group or user names, and one of those groups is Everyone, click that group and then click Remove.

    8. Important

    • The Group or user names box always includes SYSTEM. Do not remove this entry, and do not change the permissions on it. This entry is necessary for RIS.
  8. Do one of the following:
    • In Group or user names, if you see the name of a group or user for whom you want to confirm or change access to a RIS image, click the name of the group or user.
    • In Group or user names, if you do not see the name of a group or user for whom you want to confirm or change access to a RIS image, click Add. Type the name of the group or user, click OK, and then click the name of the group or user.
  9. Do one of the following:
    • To prevent the selected group or user from viewing and installing this image, click Remove.
    • To allow the selected group or user to view and install this image, under Allow, ensure that Read & Execute, List Folder Contents, and Read are selected.
  10. When the list of group and user names and their permissions match the access you want to allow or prevent, click Advanced.
  11. Select the check box marked Replace permission entries on all child objects with entries shown here that apply to child objects.

Notes

  • XOX
  • XOX
  • Authenticated Users appears by default in Group or user names. This means that all authenticated users can view and install a RIS image. To allow a more limited group (instead of all authenticated users) to view and install a RIS image, add the appropriate group and allow the permissions described in this procedure. Then click Authenticated Users and click the Remove button.
  • With products in the Windows Server 2003 family, Authenticated Users does not, by default, contain anonymous users or guests. The Everyone group contains guests. As described in this procedure, it is recommended that you exclude Everyone from the list of groups for which permissions are assigned on the RIS image; then use Authenticated Users or a more restricted group for assigning these permissions. For more information about differences in default security settings for groups such as Authenticated Users (as compared to the settings in earlier operating systems), see Related Topics.
  • If you leave SYSTEM but remove all other names from Group or user names, no one will be able to perform remote installations with this image.
  • Using this procedure, you can control the user's ability to install a particular RIS image, as well as the user's ability to see the files in that image. You might want to exert less control, however. You can do this by changing permissions that, unless overridden by this procedure, affect the user's ability only to install (not see) a particular RIS image. For more information about this, see Related Topics. Once you have chosen a particular approach, it is recommended that you continue to use that approach whenever modifying permissions for images; this will help prevent confusion.
  • If you prevent a user from viewing or reading the files in an image, you also prevent the user from installing the image.

Related Topics


Set permissions for administrators who manage client installation images for RIS

Microsoft Windows Graphic

To set permissions for administrators who manage client installation images for RIS

  1. Create a list of people who will manage user access to client installation images for Remote Installation Services (RIS). The list might include the same people who will manage accounts for prestaging for RIS.
  2. Create a group account (or determine the name of the group account if it already exists), and make the people on the list members of the group.
  3. On a computer from which you can set folder permissions for the RIS server containing the installation images that will be managed by the group, open Windows Explorer.
  4. Right-click the folder that contains the RIS folders and files (the default name for the folder is RemoteInstall).
  5. Click the Setup folder.
  6. Click the folder for the language of the installation image that you want to set permissions for.
  7. Click the Images folder.
  8. Do one of the following:
    • If you want the group that you created to manage all images in the Images folder, right-click the Images folder and then click Properties.
    • If you want the group that you created to manage only certain images in the Images folder, right-click a folder that contains an image that you want the group to manage, and then click Properties.
  9. Click the Security tab.
  10. Do one of the following:
    • If the group you created for those who manage client installation images does not appear in the Group or user names box, click Add. Type the name of the group, and then click OK.
    • If the group you created for those who manage client installation images appears in the Group or user names box, click the name of the group.
  11. In the Permissions for User or Group box, under Allow, make sure the Full Control check box is selected.
  12. When the list of group and user names and their permissions match the access you want to allow or prevent, click Advanced.
  13. Select the check box marked Replace permission entries on all child objects with entries shown here that apply to child objects.
  14. If you have another folder for which you want to set permissions, navigate to the folder and repeat the process for setting the permissions.

Notes

  • XOX
  • XOX
  • Consider using this procedure if there are people in your organization who manage accounts and permissions but do not configure other aspects of RIS. You can use this procedure to place those who manage accounts and permissions in a group such as Account Operators instead of putting them in a group such as Domain Admins or Enterprise Admins. For more information setting appropriate permissions for RIS administrators, see Related Topics.
  • Managing user access to client installation images includes the following:
    • Associating an unattended setup answer file with an installation image
    • Allowing or preventing the installing of a RIS image by a user or group
    • Allowing or preventing the viewing and installing of a RIS image by a user or group
  • For security reasons, set these permissions on the folder, as described in this procedure, not on the shared folder. Permissions on a folder are controlled by the NTFS file system, which provides greater security than permissions set on a shared folder.
  • For information about creating a group or adding a member to a group, see Related Topics.

Related Topics


Concepts

This section provides general background information about Remote Installation Services (RIS). It covers the following topics:

  • Remote Installation Services overview
  • Understanding Remote Installation Services
  • Using Remote Installation Services
  • Resources


Remote Installation Services overview

Remote Installation Services (RIS) is a change-and-configuration-management feature that is included in the Microsoft® Windows® Server 2003 family operating systems.

You can use RIS to provide on-demand, image-based, operating system installations. This occurs over a network connection from a RIS server to a client computer. RIS can simplify the management of operating systems and applications and improve failure recovery.

You can use RIS to do the following:

  • Provide an operating system to users on demand. When a user starts a client computer, even if that computer contains no operating system, the RIS server can respond by installing an operating system over the network; no CD is required. To support this, client computers must use the Pre-Boot eXecution Environment (PXE), a remote-boot technology that allows the client computer to begin a boot sequence from the network adapter. For more information about the process through which RIS installs an operating system, see PXE architecture and Technologies and components used by Remote Installation Services.
  • Provide operating system images that include specific settings and applications—for example, an image that complies with a corporate desktop standard. A particular group of users can be offered the image or images that you designate for that group. For more information, see Creating an installation image with RIPrep.
  • Create automated installation images of products in the Windows Server 2003 family, as well as images of XOX and Windows 2000. For more information on the operating systems RIS supports, see Operating systems supported by Remote Installation Services.

In addition to using RIS in the ways already described, you can combine RIS with IntelliMirror features, such as user documents and settings, Software Installation, and Group Policy. This can improve the efficiency of computer management in your organization and reduce the number of technical support service calls. For more information about combining these features, see IntelliMirror.

For information on another alternative for starting a remote computer, see Emergency Management Services.

Note

  • RIS is not included in the XOX operating system. For more information, see Overview of Windows Server 2003, Web Edition.


Understanding Remote Installation Services

This section covers:

  • Technologies used by Remote Installation Services to identify network computers
  • Remote Installation Services architecture


Technologies used by Remote Installation Services to identify network computers

Remote Installation Services (RIS) requires several supporting technologies that identify computers on the network. The following three technologies are included as components in the Windows Server 2003 family:

  • Dynamic Host Configuration Protocol (DHCP)
  • Domain Name System (DNS)
  • Active Directory

DHCP and DNS need not be Microsoft versions to work with RIS. You must use the Microsoft version of Active Directory when using RIS, however. DHCP, DNS, and Active Directory can be installed (along with RIS) on one server or on several servers. (You are installing Active Directory when you make a server a domain controller.) Before adding RIS to a server that provides DHCP, DNS, or Active Directory, it is recommended that you consider server load and server performance.

RIS also depends on a unique identifier that computer manufacturers assign to each computer. This identifier, which is called the globally unique identifier (GUID), is also known as the universally unique identifier (UUID). As its name suggests, it gives each computer a unique identity. Each RIS client computer connects to the RIS server through the network and identifies itself by its GUID/UUID. To find a computer's unique identifier, see To locate the GUID for client computers.

When RIS detects a client computer's request for service, it responds in one of the following two ways, depending on how you have set up your network:

  • A RIS server that you have designated for that client computer recognizes the client computer from its unique identifier and responds with the available installation choices.
  • Any RIS server answers all network service requests from client computers.

For information on specifying how RIS responds to requests, see Remote Installation Services administration overview.


Remote Installation Services architecture

This section covers:

  • Technologies and components used by Remote Installation Services
  • PXE architecture
  • Remote Installation Services directory service planning
  • Remote Installation Services system requirements
  • Remote Installation Services boot disk
  • Network service boot

For information about the sequence of steps through which you create an installation image by using the Remote Installation Preparation (RIPrep) Wizard, see Creating an installation image with RIPrep.


Technologies and components used by Remote Installation Services

Remote Installation Services (RIS) uses or depends upon a variety of technologies and components.

Network infrastructure
RIS depends on a network infrastructure that can identify computers on the network. RIS therefore requires that DHCP, DNS, and Active Directory be available on the network.
Remote-boot technology
RIS uses remote-boot technology to allow a computer with no operating system to begin a boot sequence from the network adapter, after which an operating system can be installed across the network. This remote-boot technology is called the Pre-Boot eXecution Environment (PXE). For more information, see Network service boot and PXE architecture. For client computers that are not PXE-enabled—that is, pre–Net PC/PC98 computers—you can use a special remote boot disk if the client computer has a supported network adapter. For more information, see Remote Installation Services boot disk and To create a remote boot disk.
Technology to create an installation image
RIS includes technology that you can use to create an image of an operating system that will be installed on client computers. You can create the image in one of two formats: a flat image or a Remote Installation Preparation Wizard (RIPrep) image format. Use the flat image option to create an image directly from a set of operating system files— for example, the files on a CD. Use the RIPrep image format to create an image that includes an operating system with specific settings and applications— for example, an image that complies with a corporate desktop standard. For more information, see To add a new client operating system installation image and Creating an installation image with RIPrep.
Technologies for communication between RIS client and server
RIS includes technologies that establish communication between a client that has begun a PXE boot sequence and the RIS server that contains installation images available to that client. For this process, RIS uses DHCP to provide the client with an Internet Protocol (IP) address. RIS then downloads the Client Installation Wizard, which prompts the user to log on and provides a menu of installation options customized for that user. You can control these images through Group Policy. For more information about the Client Installation Wizard, see Client Installation Wizard and Installation options available through RIS.

Services added by RIS

When RIS is enabled, the following services are automatically added to the server:

  • Remote Installation (BINLSVC)

    This service listens for client network service requests and provides overall management of the RIS environment. BINLSVC ensures that the correct files are passed to the client computer. It also ensures that when the settings for a prestaged client specify that it is to be answered by a particular RIS server, the response comes from the specified server. If the client computer has not been prestaged, BINLSVC creates the client computer account object within Active Directory.

  • Trivial File Transfer Protocol Daemon (TFTPD)

    RIS server uses the Trivial File Transfer Protocol Daemon (TFTPD) to download the initial files required for the remote installation process to begin. The most common file downloaded to the client using TFTPD is Startrom.com, which is responsible for bootstrapping the client computer. The default version of Startrom.com then prompts the user to press F12 to initiate a network installation. If the user responds to the prompt, the Client Installation Wizard is downloaded to begin the remote installation process.

  • Single Instance Store (SIS)

    Single Instance Store (SIS) reduces the overall storage required on the RIS volume. The SIS drivers contain a feature, called a groveler agent, that scans the RIS volume for duplicate files. If the SIS groveler finds duplicate files, it copies the original file into the SIS and leaves a link file in its place. The link file contains information about the original file, such as its current location, size, and attributes. If an image contains duplicate files, those duplicates are copied into the store; as a result, less disk space is required on the RIS server.

    SIS has two limitations: it cannot act upon any files that are referenced through junction points, and it cannot be used with any file system except NTFS file system, which is the file system to use on RIS servers.


PXE architecture

Remote Installation Services (RIS) uses the Dynamic Host Configuration Protocol (DHCP) that follows the Pre-Boot eXecution Environment (PXE) architecture to bootstrap a client computer.

When a new PXE remote boot–enabled client computer starts for the first time, it uses the DHCP to request an Internet Protocol (IP) address and the IP address of an active RIS server. As part of the initial request, the client computer sends out its globally unique identifier (GUID), which identifies the client computer within Active Directory.

After the client computer receives an IP address from the DHCP server, it then requests service from a RIS server. The request to the RIS server is a broadcast, which means all of the RIS servers on the network will receive the request. If the RIS server is allowed to answer, it queries its preferred domain controller for the client computer's GUID. If the server fails to find the GUID, it queries the global catalog for the forest. If the GUID is found in either location, the client computer is considered "known." If the GUID is not found, it is considered "unknown." In this case —that is, the query by the RIS server found no computer account object in Active Directory with this computer's GUID —only RIS servers that are configured to answer unknown clients will do so.

If the client is known, all the available RIS servers query the domain to determine whether the client computer account has been prestaged with settings that specify that the client computer is to be answered by a particular server. If so, only the designated server answers the service request. The other servers respond by telling the client which server will answer it. This is called a referral. If the client computer account settings do not require the client computer to be answered by a particular server, all RIS servers answer it if they are aware of this client and configured to answer it. Each RIS server then offers its own files to download.

For information on configuring how RIS servers respond to client computers, see To configure Remote Installation Services. For information on prestaging clients computers and configuring the setting that specifies whether the client computer is to be answered by a particular server, see To prestage client computers.

After the client computer receives a reply to its service request, it initiates a Trivial File Transfer Protocol (TFTP) download of the bootstrap program. The Remote Installation Services implementation of this program is called Startrom.com (located at \\RIS_server_name\REMINST\oschooser\i386\startrom.com).

After Startrom.com has been downloaded, the client computer runs it. The default version of Startrom.com then prompts the user to press F12 to initiate a network installation. If the user fails to press F12 within three seconds, the network boot is stopped, and the client computer attempts to start up from the next available boot device. When the user presses F12, the client computer uses TFTP to download the Client Installation Wizard. The wizard then requests the user to log on to the network. For more information about user choices available during remote installation, see To perform a network installation using RIS and Installation options available through RIS.

For information about security limitations related to the PXE standard, see PXE architecture, RIS, and security considerations.

Considerations for 64-bit client computers

For 64-bit client computers, Startrom.com is not required and the F12 prompt is not provided to the user. The 64-bit client computer simply downloads the Extensible Firmware Interface (EFI) version of the Client Installation Wizard (located at \\RIS_server_name\REMINST\oschooser\ia64\oschoice.efi) when the user selects a remote installation option during computer startup.

The 64-bit client computers can request service from RIS servers even if the servers are configured not to answer clients. These client computers can request service if they have received a referral from one of the other RIS servers in the same forest.


Remote Installation Services directory service planning

The Remote Installation Services (RIS) environment relies on a well-designed and well-planned Active Directory architecture. Normally, determining the physical location of a server can be a challenge. This can become even more difficult when you must find and configure several servers that are located in different buildings, different offices, or on different floors. Using Active Directory, however, can simplify this process.

In a given domain, Active Directory provides organizational units or containers that you can use to organize users and resources into logical administrative groups. This makes it easier to locate and configure servers at multiple locations. For more information on planning Active Directory architecture, see Organizational units.

You can verify a RIS server using the Verify Server command, which is available only locally on a RIS server or by connecting to that server through Remote Desktop for Administration. The computer account object is located in the Computers container when the RIS server is a member server of a domain. For performance reasons, it is recommended that you install RIS on a member server, not a domain controller. For more information, see To verify the Remote Installation Services configuration.

To manage a RIS server from a computer running XOX, install the Windows Server 2003 Administration Tools Pack on the computer running XOX. For more information, see Windows Server 2003 Administration Tools Pack.

To manage a RIS server from any remote computer, use Remote Desktop for Administration. For more information, see Using Remote Desktop for Administration for remote server administration.


Remote Installation Services system requirements

This section describes the system requirements for Remote Installation Services (RIS) servers, client computers, and network adapters.

Server hardware requirements

  • The server hardware must meet minimum requirements for the product version of the Windows Server 2003 family that you are installing. For example, if you are installing XOX, your computer must meet the minimum requirements for this product. For more information, see System requirements.
  • 4-gigabyte (GB) or larger disk drive for RIS server folder tree.
  • 10 or 100 Mb/sec Windows-compatible network adapter that supports TCP/IP (100 Mb/sec recommended). A RIS server cannot be a multihomed computer; that is, it can contain only one network adapter.

Client computer hardware requirements

  • The client computer must meet the minimum requirements for the operating system that is to be installed.
  • Pre-Boot eXecution Environment (PXE) DHCP–based boot ROM version 1.00 or greater.

Supported client network adapters

To obtain a list of network adapters that RIS supports, run the Rbfg.exe utility. For additional information, see To create a remote boot disk.

Additional considerations

  • RIS requires a significant amount of disk space. You should dedicate an entire partition to the RIS folder tree.
  • RIS cannot be installed on the same partition as the system volume or boot volume.
  • The volume on which you install RIS must be formatted with the NTFS file system.
  • RIS does not currently support the Encrypting File System (EFS). The Distributed File System (DFS) is not supported as a target location; however, you can run RIS on a computer that is also running DFS.
  • Windows Catalog contains a compilation of systems and hardware that have been extensively tested for stability and compatibility with products in the Windows Server 2003 family. The information in Windows Catalog is the guide Microsoft Product Support Services uses to determine whether a system is supported for use with the Windows Server 2003 family. For more information about hardware compatibility, see Support resources.


Remote Installation Services boot disk

The Remote Installation Services (RIS) boot disk is used with client computers that do not have a remote boot–enabled ROM. The boot disk simulates the Pre-Boot eXecution Environment (PXE) boot process for computers that lack a formal remote boot ROM. For more information about the PXE boot process, see PXE architecture.

The boot disk is analogous to a boot ROM, which uses the floppy drive to install the operating system from the RIS server. The remote boot disk–generating utility (Rbfg.exe) is located in the following folder:

\\Server_name\REMINST\Admin\I386\Rbfg.exe

The boot disk must be placed before the hard disk in the boot sequence in order for the boot disk to work.

To use the remote boot disk on a client computer that does not have a remote boot–enabled ROM, insert the disk into the disk drive and start the client computer. The client computer must have a Peripheral Component Interconnect (PCI)–based network adapter from the list of specific adapters supported. To determine which network adapters RIS supports, use the boot disk–generating utility. For more information, see To create a remote boot disk.

For more information about performing a client installation, see To perform a network installation using RIS.


Network service boot

A network service boot can be initiated by either the user of a Pre-Boot eXecution Environment (PXE) remote boot–enabled client computer or by a special remote boot disk provided for pre–Net PC/PC98 computers.

To invoke the network service boot request, the user presses a particular key (for example, F12) when prompted during the client computer startup sequence. The client computer receives an Internet Protocol (IP) address from the DHCP server, requests a network service boot, and then downloads the Client Installation Wizard.

For more information about how a remote service boot is carried out through PXE, see PXE architecture.

For more information about user choices and actions during a network service boot, see To perform a network installation using RIS.

The user is prompted for user name, password, and domain name during the initial phase of the Client Installation Wizard process. Remote Installation Services uses Group Policy within Active Directory to determine which installation options are appropriate for the user. The user is then given a list of operating system installation choices that are determined by the user's credentials or security group membership.


Using Remote Installation Services

This section covers:

  • Remote Installation Services server authorization
  • Running the Remote Installation Services Setup Wizard
  • Using Risetup from the command line
  • Remote Installation Services administration overview
  • Creating an installation image with RIPrep
  • RIS client computer properties
  • Security information for Remote Installation Services
  • Advanced configuration settings
  • The remote installation process


Remote Installation Services server authorization

The Remote Installation Services (RIS) server authorization feature prevents unauthorized RIS servers from being added to a network where Active Directory is in use.

You can use RIS to specify which RIS servers can accept and process requests, and which RIS servers can only service clients on the network. Before a RIS server can accept requests, it must be authorized to run in Active Directory. To authorize a RIS server in Active Directory, you must first log on with an account that is a member of the Enterprise Admins group in the domain where you want the RIS server to be authorized. You should run RISETUP -Check to authorize the server.

When a RIS server attempts to start on the network, Active Directory is queried and the Internet Protocol (IP) address is compared to the list of authorized RIS servers. If a match is found, the RIS server is authorized and can start on the network. If a match is not found, the server is not authorized. In this case, RIS will not answer.


Running the Remote Installation Services Setup Wizard

Before running the Remote Installation Services Setup Wizard, you must ensure that you have an account in the Administrators group on the server on which you want to run the wizard. You should also be sure to complete all prerequisite steps outlined in Checklist: Installing Remote Installation Services.

You can select Remote Installation Services (RIS) as an optional component after completing Setup. To do this, use Add or Remove Programs in Control Panel. You can also install RIS during Setup if Setup is run using an unattended answer file. In this case, after you have selected RIS, the Setup Wizard guides you through the necessary steps of installation and configuration. For complete instructions on installing RIS, see To install Remote Installation Services.

The Setup Wizard presents the following options:

  • The first time the wizard is run, you will be prompted for a location for the \RemoteInstall directory tree. This location must be on an NTFS file system volume and cannot be on the system volume or boot volume.
  • Respond to client computers requesting service
    Select this option to enable the RIS server to begin responding to client computers. Clear this option to prevent the RIS server from responding.
  • Do not respond to unknown client computers
    Select this option if you want this RIS server to respond only to known (prestaged) client computers. Clear this option if you want this RIS server to respond to any client computer requesting remote installation.

    Prestaging can be one element of your security strategy for RIS. This is because you can use prestaging to prevent unknown client computers from being installed through RIS. For information about security considerations related to PXE architecture and RIS, see PXE architecture, RIS, and security considerations.

  • The Setup Wizard prompts you for the location of the installation files. This can be either the compact disc or a network location that contains the installation files.
  • The Setup Wizard prompts you for a directory name to which the installation files should be copied on the RIS server. You should name the directory something that represents the operating system you are copying—for example, WindowsXP.pro.
  • The Setup Wizard prompts you for a friendly description and Help text describing this operating system installation image. The friendly description and Help text is displayed to users during the client installation process on a remote boot–enabled client computer. Enter a description of the operating system installation choice. One example of a friendly description would be "XOX for Sales Staff." The Help text is displayed when the user selects the friendly description within the Client Installation Wizard.
  • The Setup Wizard displays the summary information of the setup process. To change any of this information, click Back.


Using Risetup from the command line

With Risetup, you can manage a server running Remote Installation Services (RIS) from the command line. You can use Risetup to add new installation images or to verify a server and ensure that it is running properly.

To run Risetup, at a command prompt, type:

risetup

For complete information on using Risetup, see Risetup.

For information about other command-line utilities, see Command-line reference.

For background information about RIS, see Concepts.


Remote Installation Services administration overview

To administer Remote Installation Services (RIS), you use the property pages that reside on specific objects within Active Directory.

To access the property pages, right-click the server object you want to administer, and then click Properties. For more information on configuring RIS, see To configure Remote Installation Services.

You can set the following options from the Remote Install property page:

Client servicing

You can specify either that servers respond to all clients requesting service, or that they respond only to known (prestaged) clients. Use the following options to specify how the RIS server responds to requests for service from client computers:

  • Respond to clients requesting service. If you select this option, RIS is enabled and will respond to client computers requesting service.
  • Do not respond to unknown client computers. If you select this option, the RIS server responds only to prestaged client computers in Active Directory. Otherwise, the RIS server responds to any client computer requesting remote installation.

For more information about prestaging, see To prestage client computers.

Verify Server

Select this option if the server seems to be failing or is behaving inconsistently, or if you need to restore a RIS volume from backup. This option brings up a wizard that checks to determine whether all of the settings, services, and configuration options are correctly set and functioning.

Before you select this option, make sure you have the installation compact discs available. You might be prompted for them during the Verify Server procedure.

You can only use Verify Server locally on a RIS server, or by connecting to that server through Remote Desktop for Administration. You cannot use Verify Server if you are performing RIS administration tasks from a remote server.

For more information, see To verify the Remote Installation Services configuration.

Important

  • If you are verifying the server configuration because you need to restore a RIS volume from backup, you must verify the server configuration before you restore the volume.
Show Clients

If you select this option, you can search for RIS clients within Active Directory.

Selecting this option displays a list of client computers sorted by their globally unique identifier (GUID). The list also includes client computers that have been prestaged.

For more information, see RIS client computer properties.

Advanced Settings

If you select this option, you can control how a client computer is installed. The advanced setting options are as follows:

  • Automatic client computer account naming format
  • Active Directory location of client computer accounts
  • Manage the installation images and pre-operating system maintenance tools installed on this RIS server
    •

For more information, see Advanced configuration settings.


Creating an installation image with RIPrep

With the Remote Installation Preparation (RIPrep) Wizard, you can create an image of an existing installation and replicate that image to an available Remote Installation Services (RIS) server on the network. To perform this procedure, you must be a member of the Administrators group on the client computer, or you must have been delegated the appropriate authority. Members of the Domain Admins group might also be able to perform this procedure. You must also have permission to write to the RIS folders on the RIS server (the default name for the folder that contains all the RIS folders is RemoteInstall).

One way to ensure that you have permission to write to the RIS folders on the RIS server is to be explicitly assigned the permission. Another way is to have membership in the local Administrators group on the RIS server.

  1. It is recommended that you start by using RIS to install the operating system that you have chosen for the installation image. RIPrep can be used to create images only for the particular operating systems it supports, however. For complete information on which operating systems RIPrep supports, see Operating systems supported by Remote Installation Services.

    It is not necessary to install the operating system using RIS; you can install it from the CD instead.

  2. After you have installed the operating system, you should install the client computer applications that you want to deploy with clients.

    3. Important

    • If you want to install applications that do not comply with the Windows Installer technology, this is the step at which you should do so. You can also install applications that do comply with the Windows Installer technology.
  3. After you have installed the appropriate client computer applications, you should configure the source computer to conform to any required company desktop standards. For example, you might want to define specific screen colors, set the background bitmap to a company-based logo, remove any games installed by the base operating system, or configure Internet Explorer proxy settings. To save your desktop configuration, copy to the Default User profile the profile of the user who was logged in while the configuration changes were made. For instructions on how to copy user profiles, see To copy a user profile.

    4. Important

    • Before starting the Remote Installation Preparation Wizard, be sure to remove all confidential information from the source client computer.
  4. You should then close all applications and run the Remote Installation Preparation Wizard. For more information, see To create a Remote Installation Preparation Wizard image.
  5. The wizard configures the source computer to a generic state, removing anything that is unique to the client installation, such as the computer's unique security identifier (SID), computer name, and any registry settings unique to the client source computer.

  6. The wizard then prompts you for the installation information required by the image-creation process. This information includes the location where the client installation image should be replicated, the name of the directory it should be copied to on the server, and a friendly description and associated Help text that will describe the installation image to users who run the Client Installation Wizard.

    Because of memory limitations during the remote boot process, there are limits to the total text you can provide for a set of installation image choices. With a relatively large number of installation image choices, the friendly descriptions and Help text must be limited in length; with fewer choices, the friendly descriptions and Help text can be longer. It is not unusual to encounter these limits to total text when the number of installation image choices for client computers reaches approximately 12 to 16.

  7. After the replication is complete, the installation image is automatically added to the list of available operating system installation options and is available to client computers that use the remote boot technology. When you create new images using RIPrep, the image is available only to client computers that have the same type of Hardware Abstraction Layer (HAL). Images that were created using RIPrep are available to all clients that are authorized to view them.

    8. Note

    • A remote boot–enabled client computer need not contain hardware that is identical (other than the HAL) to that of the source computer used to create the installation image. The Remote Installation Preparation Wizard uses the Plug and Play feature to detect any differences between the source and destination computers' hardware during the image installation process. This ensures that, for any Plug and Play device, the correct device driver is installed.
  8. You can control the installation choices available to clients by setting access control permissions on the installation image .sif files or, for greater control, on the folders that contain the installation image. For more information, see To allow or prevent the installing of a RIS image by a user or group and To allow or prevent the viewing and installing of a RIS image by a user or group.

Factors to consider when planning for RIPrep

The following sections describe factors to consider when planning to create an installation image with RIPrep. These include:

  • Requirements for the RIPrep replication process
  • Installation images, the product identification number, and licensing
  • Disk characteristics on the source client computer and the destination computers

Requirements for the RIPrep replication process

When planning to run RIPrep, it is important to understand requirements that must be met by the source client computer, the image, and the medium onto which the image is replicated.

  • The Remote Installation Preparation Wizard currently supports the replication of a single disk and a single boot partition of an installation to a single RIS server. This means that the operating system and all of the applications that make up the standard installation image must reside on a single partition of the source client computer.
  • The files on the source client computer must not be encrypted. Replication of encrypted files is not supported.
  • Modifications to replicated installation images are not supported.
  • The wizard allows source image replication only to available RIS servers. Currently, source replication to alternate drives or media types is not supported.

Installation images, the product identification number, and licensing

  • When you use the Remote Installation Preparation Wizard (RIPrep) to create an installation image of a client computer that was originally installed using a retail version of the operating system, you must modify the RIS unattended setup answer file (sif) to include the product identification number (PID). The PID is the unique identification number specific to each copy of the operating system.

    If the PID is not entered in the .sif file, the installation process will stop and prompt the user for the product identifier information during the installation of that RIPrep image. To prevent prompting your users for the PID, add the product identifier to the [UserData] section of the .sif file associated with this installation image.

    For example, you would type the following (including the dashes and quotation marks) into the [UserData] section of the .sif file:

    ProductKey = "xxxxx-xxxxx-xxxxx-xxxxx-xxxxx"

    For more information about product activation, see Windows Product Activation.

  • The source client computer will shut down when the image replication process is complete. The abbreviated Setup program runs automatically when the source computer restarts. You must complete the setup process if you want to use this client computer to create another installation image. You can create additional installation images only three times if you are using a Retail PID. A volume licensing PID permits you to create installation images more than three times, however.
  • All copies of Microsoft software made or installed using RIS must be properly licensed. All copies of non-Microsoft software made or installed using RIS must also be properly licensed; it is the licensee's obligation to ensure that non-Microsoft software is licensed to make any such copies.

Disk characteristics on the source client computer and the destination computers

When planning to run RIPrep, it is important to study the disk configuration that exists on the source client computer and then compare it to the disk configurations on the client computers on which the image will be installed. The following requirements apply:

  • The destination computer's disk capacity must be equal to or greater than that of the source computer.
  • The RIPrep installation image maintains the volume and partition characteristics of the disk on the source computer.

    The following example illustrates this, but describes the use of the file allocation table (FAT) and FAT32 file systems, which are not recommended. The recommended file system for RIS is the NTFS file system. The example is as follows. If you create an installation image from a source computer with a 2-gigabyte (GB) FAT volume, and you then install the image on a client computer with a 4-GB drive, the resulting installation will format the drive as a 4-GB volume using FAT32. The change in the destination computer file system type is dictated by the limits of the FAT file system. This type of change in the destination computer file system type (from FAT to another file system) does not work if the destination volume is larger than 32 GB. For destination volumes larger than 32 GB, the source computer must use the NTFS file system. For more information about file system compatibility and limitations, see Choosing a file system: NTFS, FAT, or FAT32.

  • Disk preparation of the destination computer must be identical to that of the source computer; any remaining disk capacity on the destination computer will be formatted unless you follow the instructions in the next item in this list. For example, if the source computer's disk capacity is 1 GB and the disk capacity of the destination computer is 2 GB, the entire 2 GB will be formatted on the destination computer.
  • You can change the information in the .sif file associated with an installation image to restrict the disk reformatting so that it will be the same as that which the source computer used to create the installation image. For example, open the Riprep.sif file located in the \\Server_name\REMINST\Setup\Applicable language\Images\Applicable image name\I386\Templates\Riprep.sif folder and modify the UseWholeDisk parameter to equal NO. When a client computer installs this image, the disk will be formatted to match the capacity of the source computer, and the remainder of the destination computer's disk will be unformatted.


RIS client computer properties

Remote Installation Services (RIS) uses property pages to contain information about RIS client computers. For information about viewing a list of client computers, see To find RIS client computers. To view or change information about RIS client computers, you can right-click a client listing, and then click Properties.

The computer’s unique identifier (GUID)

One important property that appears on the property pages is the computer’s globally unique identifier (GUID), also known as the universally unique identifier (UUID). The RIS server uses this identifier to locate a client computer. The following list provides more details about the GUID:

  • The GUID is supplied by the client computer manufacturer. For information about how to find the GUID on a computer, see To locate the GUID for client computers.
  • When you enter a GUID, you usually enter it in the display format, {dddddddd-dddd-dddd-dddd-dddddddddddd}, where d is a hexadecimal text digit. There are 8 digits before the first hyphen, 4 digits in each of the next three groups of digits, and 12 digits after the last hyphen. This is illustrated in the following example:

    {67452301-AB89-EFCD-0123-456789ABCDEF}

  • The GUID uses only hexadecimal text digits and hyphens; that is, the characters in the following list (not case sensitive):

0 1 2 3 4 5 6 7 8 9
a b c d e f - A B C D E F
  • Do not type spaces in a GUID.
  • The GUID can also be entered in wire format. In a GUID in wire format, the initial 16 digits are transposed as compared to a GUID in display format. The following example compares wire format to display format:

    GUID in wire format: 0123456789ABCDEF0123456789ABCDEF

    Same GUID in display format: {67452301-AB89-EFCD-0123-456789ABCDEF}

Finding client computers

Each client computer is identified by its GUID. In Active Directory, you can use the Show Clients feature to display a list of client computers sorted by their GUIDs. The list includes client computers that have been prestaged. The search can be conducted over the entire Active Directory structure or limited to a specific domain. (For more information on GUIDs, see To locate the GUID for client computers and To prestage client computers.)

The Show Clients search process appends a wildcard search attribute to the current RIS server computer name. For example, if the RIS server is named RISsvr1, the Show Clients feature will use RISsvr1* for the server name.

When you use the Show Clients feature in multiple RIS server environments, the search results might include client computers from multiple servers. For example, if you have multiple RIS servers with computer names such as RISsvr1, RISsvr10, and RISsvr100, and you search for RISsvr1, the list will display the client computers that install from all three servers.

For more information about searching Active Directory for RIS client computer accounts, see To find RIS client computers.


Security information for Remote Installation Services

This section provides background information about the following security topics:

  • PXE architecture, RIS, and security considerations
  • Choosing appropriate group membership for RIS administrators
  • Setting the LAN Manager Authentication Level on a network that includes RIS

For specific information on how to set permissions and user rights for Remote Installation Services (RIS), see Manage security for Remote Installation Services.


PXE architecture, RIS, and security considerations

The Pre-Boot eXecution Environment (PXE) architecture used by Remote Installation Services (RIS) presents some security risks that are inherent in PXE due to its design. PXE is an industry standard, so any remote-installation method that uses PXE carries the same risks.

These security risks include the following:

  • PXE does not provide a way to prevent an unknown server from performing remote installations on PXE-enabled client computers. If a server can establish a connection with the clients, it can perform remote installations on them.
  • PXE does not provide a way to fully prevent packet spoofing. This means that packets sent by an attacker could be received by a client computer and incorporated into that client computer's installation.
  • PXE does not provide a way to prevent an unknown PXE-enabled computer from installing from a server if the PXE-enabled computer can connect to the network. RIS provides some security not inherent in PXE, however, because RIS performs remote installation only after the user has logged on. A user who lacks a valid user name and password cannot use RIS to perform an installation.

    In addition, you can achieve a somewhat greater degree of security with RIS if you prestage your client computers and configure your RIS servers to respond only to known (prestaged) clients. Then, if an intruder succeeds in connecting an unknown, PXE-enabled client computer to your RIS server, no installation files will be sent to that client computer. The intruder will not gain information about the configuration you use on your RIS client computers. For more information about prestaging, see To prestage client computers.

Because of these security issues, it is recommended that you place protections around any network that contains PXE-enabled client computers.

You can take steps, such as those described in the following list, to ensure that computers controlled by people outside of your organization cannot make a connection to PXE-enabled clients:

  • Use a firewall, and configure it appropriately.
  • Use appropriate auditing and monitoring to detect intrusions into the network.
  • Restrict physical access to the network.
  • Use strong passwords throughout your organization.
  • Follow other best practices for secure networks.

For more information about the preceding recommendations, see Best practices for security and also the Best practices topic in Getting Started.

For information about the sequence of events that occurs when a client computer is started with PXE, see PXE architecture.


Choosing appropriate group membership for RIS administrators

If there are people in your organization whose responsibilities include configuring Remote Installation Services (RIS) servers and creating installation images, make those people members of an administrative group such as Domain Admins or Enterprise Admins. This will allow them to carry out all RIS configuration tasks. For the single task of completing installation of a RIS server in a way that authorizes the RIS server in Active Directory, membership in Enterprise Admins is required. For more information about authorization, see Remote Installation Services server authorization.

Administrators in your organization should also be provided with user accounts that are not in any administrative group. With such accounts, administrators can follow the security best practice of logging on as a user and then using Run as to perform administrative tasks. For more information, see Using Run as and To create a shortcut using the runas command.

Whenever possible, choose group memberships and assign permissions in a way that provides only necessary access to domain accounts and resources. For example, perhaps there are people in your organization whose responsibilities include managing accounts and permissions, but do not include configuring RIS servers or creating client installation images. Instead of giving these people membership in a group such as Domain Admins or Enterprise Admins, give then membership in a group such as Account Operators and grant them permissions for folders on the RIS server.

The following table illustrates the group membership and permissions required for people who manage only the tasks of RIS related to permissions, computer accounts, and user accounts:

Tasks Permission or group membership required for the administrator who performs those tasks
Managing client installation images, including:
  • Associating an unattended setup answer file with an installation image.
  • Allowing or preventing the installing of a RIS image by a user or group.
  • Allowing or preventing the viewing and installing of a RIS image by a user or group.

For more information about these tasks, see:

  • Manage security for Remote Installation Services

Full Control on the Images folder, or on one or more subfolders within the Images folder.

For more information, about setting this permission, see:

  • To set permissions for administrators who manage client installation images for RIS

Managing accounts in domains where prestaging is used, including:
  • Prestaging client computers.
  • Setting permissions required by RIS users who use prestaged client computers.
  • Removing an account for a computer that is no longer being prestaged.

For more information about these tasks, see:

  • To prestage client computers
  • To set permissions required by RIS users who use prestaged client computers
 Membership in Account Operators.

For more information, see:

  • Default groups
  • To add a member to a group


Setting the LAN Manager Authentication Level on a network that includes RIS

You can use the LAN Manager Authentication Level to set a level that specifies whether certain authentication protocols are available for network communication. When a user logs on at a RIS client, Remote Installation Services (RIS) uses either the first version of the NTLM authentication protocol or the second version, NTLMv2. Of the two protocols, NTLMv2 is significantly more secure because of the way it handles encryption keys.

For information about choosing the most appropriate LAN Manager Authentication Level in a network that includes RIS, see the table that appears later in this topic. For information about the different levels and how to view or change the setting, see Network security: LAN Manager Authentication Level.

When you set the LAN Manager Authentication Level, you should consider both your requirements for network security and your requirements for using a variety of operating systems. If you select the highest level (Send NTLMv2 response only\refuse LM & NTLM), only NTLMv2, the more secure protocol, is used; all computers involved in authentication must run software that supports NTLMv2. If you select a lower level (Send NTLM response only), NTLMv2 is used whenever possible, and NTLM is used only when required—that is, when one or more computers involved in authentication do not support NTLMv2.

The LAN Manager Authentication Level that is most appropriate depends upon which operating system is installed on the domain controllers, on the RIS servers, and on the clients you want to install. The following table provides criteria you can use to determine the appropriate LAN Manager Authentication Level.

Criteria for "Send NTLM response only" | Criteria for "Send NTLMv2 response only\refuse LM & NTLM"
Domain controllers: any Domain controllers can include those running Windows 2000 without a specific software patch. They do not have to be limited as described in the other column of this table. | Domain controllers: run Windows 2000 with a specific software patch or run Windows Server 2003 In order to work with this authentication level, domain controllers must run Windows 2000 with a specific software patch or must run Windows Server 2003. For information about the software patch required in order to run Windows 2000 with this authentication level, search the Knowledge Base at the Microsoft Web site (http://www.microsoft.com). In addition, RIS servers and clients must also meet the requirements in this table.
RIS servers: any RIS servers can include those that run Windows 2000. They do not have to be limited to those running Windows Server 2003. | RIS servers: run Windows Server 2003 only In order to work with this authentication level, all RIS servers must run Windows Server 2003. In addition, domain controllers and clients must also meet the requirements in this table.
Clients: any Clients can include those that run Windows 2000 or XOX without a service pack. They do not have to be limited to those running Windows Server 2003 or those running XOX with Service Pack 1 (SP1) or greater. | Clients: run XOX with SP 1 or greater, or run Windows Server 2003 In order to work with this authentication level, clients must run either XOX with SP 1 or greater, or run Windows Server 2003. In addition, domain controllers and RIS servers must also meet the requirements in this table.
Overall effect of using "Send NTLM response only" Security is not as strong, but you can choose from a wider range of operating systems. | Overall effect of using "Send NTLMv2 response only\refuse LM & NTLM" Security is stronger, but you must choose from a narrower range of operating systems.


Advanced configuration settings

The advanced configuration settings of Remote Installation Services (RIS) determine how RIS creates client computer names, manages operating system images, and manages diagnostic tool applications.

This section covers:

  • Advanced settings for new clients
  • Advanced settings for installation images
  • Maintenance and troubleshooting tools and options
  • Computer names


Advanced settings for new clients

You can use the advanced settings of Remote Installation Services (RIS) to configure settings for new clients. With advanced settings, you can define a policy that provides each remote installation client computer with a name that is unique on the network. For information on how to do this, see Computer names.

You can use advanced settings to determine the default directory service container in which the client computer machine account objects will be stored. You can also group client computers within a specific Active Directory domain or organizational unit.

A user setting up the client computer and using advanced settings must have the appropriate user rights to create computer accounts within Active Directory. For more information, see To allow a user or group to create a RIS managed computer account in the domain.

Computer account location

This option is available in advanced settings. Use it if you want to define the default Active Directory container for all remote installation client computer accounts prior to installation. To specify a location, select one of the following:
Default directory service location
Specifies that the client computer account object is created in the Computers container by default during the domain join operation. The client computer becomes a member of the same domain as the RIS server installing the client.
Same location as that of the user setting up the client computer
Specifies that the client computer account object is created within the same Active Directory container as the user setting up the computer. For example, if a user logs on whose user account currently resides within the Users container, the client computer account is also created within the Users container.
The following directory location
With this option, you can predetermine where client computer account objects are created in Active Directory. This option affects all client computers installed from this server.


Advanced settings for installation images

You can use Remote Installation Services (RIS) to manage the operating system installation options for RIS users. During the base installation of RIS, you are prompted to add a default operating system installation image to the remote installation–enabled server. This image installation process copies the compact disc contents and directory structure to the RIS server.

The unattended installation process uses text files—which are called setup information (.sif) files —to store the configuration settings for the installation image. The information contained in the .sif file is processed each time a client computer uses the Client Installation Wizard to choose the installation image. By modifying the .sif file for the installation image, you can predetermine the configuration settings for each client installation image. For example, if all of your client computers have the same type of display devices, you can set the screen resolution prior to installation by modifying the [Display] information of the .sif file. For more information on unattended Setup, see the Microsoft Windows Preinstallation Reference, located in \Support\Tools\deploy.cab on the CD for products in the Windows Server 2003 family.

Important

  • The information you put in the [ImageType] field of the .sif file is limited to 64 bytes. If you put in more than 64 bytes, the installation will fail.

For additional information about ways you can use .sif files, see Installation options available through RIS.

If you are creating an installation image using the Remote Installation Preparation Wizard (RIPrep), you can also use a .sif file to change how the client computer disk drive is partitioned. While the Client Installation Wizard is running, the installation image that the user selects is copied to the client computer. If the default disk preparation of the destination computer is not identical to that of the source computer, any remaining disk capacity on the destination computer is partitioned. For example, if the source computer disk capacity is 1 gigabyte (GB) and the disk capacity of the destination computer is 2 GB, the entire 2 GB are formatted on the destination computer.

By changing the information in the .sif file associated with an installation image, you can restrict the disk reformatting to be the same as the source computer used to create the installation image. For example, suppose you open the Riprep.sif file and modify the UseWholeDisk parameter to NO. When a client computer installs this image, the disk is formatted to match the capacity of the source computer. The disk and source computer then become identical. The rest of the destination computer's disk remains unformatted.

For additional background information about how RIPrep works, see Creating an installation image with RIPrep. For instructions on running RIPrep, see To create a Remote Installation Preparation Wizard image.


Maintenance and troubleshooting tools and options

You can control whether Remote Installation Services (RIS) offers certain types of maintenance and troubleshooting tools at the beginning of a remote installation. Although the client computer's hard disk might be empty prior to installing the operating system, the computer can still be managed with these maintenance and troubleshooting tools. The tools can therefore be useful not only to users, but also to administrators and technical support staff.

The maintenance and troubleshooting tools also give administrators an easy way to update a client computer system—for example, by the flashing of the basic input/output system (BIOS)—before or after the operating system installation.

If tools are provided to you by an independent software vendor (ISV) or original equipment manufacturer (OEM), you can control whether users are able to use these tools. You do this with the Tools tab of Advanced settings in RIS. (ISVs and OEMs make the tools available through external setup programs.) The tools appear in the list on the Tools tab and become available to administrators and users when they run the Client Installation Wizard. For information about viewing the Tools tab of Advanced settings in RIS, see To manage troubleshooting tools.

You can also make the Recovery Console available to a user of a RIS client computer if the client computer is configured to support it. When the Recovery Console is available to a user, it is displayed in the Client Installation Wizard under "Maintenance and Troubleshooting." For information on using RIS to start the Recovery Console, see Resources.

The Remote Installation Services (RIS) tools feature includes the following options:

Remove
Removes the template setup information file (.sif) associated with the currently selected tool. The .sif file contains the friendly description text, which explains the tool's purpose to the users of a RIS client computer. If you choose the Remove option, the template file is deleted, and, although the tool remains on the disk, it is not offered to RIS clients when they run the Client Installation Wizard.

Important

  • If you want to make a tool temporarily unavailable, or you want to make it available only to certain users, do not remove it; doing so deletes the .sif file associated with the tool. Instead, use the Properties option and restrict permissions on the .sif file associated with the tool (Read and Read & Execute permissions are required by tool users).
Properties
Provides access to property information for the selected tool. Use this option to change the friendly description text and to retrieve specific details about the selected tool. You can also use this option to change permissions for the tool.
Refresh
Refreshes the contents of the display window.


Computer names

You can use the advanced settings of Remote Installation Services (RIS) to define the naming policy that gives each client computer a unique name. This unique name, which is used to identify the client computer on the network, is similar to the network basic input/output system (NetBIOS) name used in previous versions of Windows and Windows NT.

When you define your naming policy, you can either choose from a list of automatic naming options (for example, First initial, last name), or you can click the Customized button and create a customized naming policy. If you want to ensure that each client computer is given a unique computer name, choose from the list of automatic naming options. All of the automatic naming options that are based on the user's name (for example, First initial, last name) add an incremental number at the end to ensure that the computer name is unique.

To create a custom naming policy, click Customize. You can then select one of the options in the following list to create the customized computer name automatically.

%First
The user's first name is used as the computer name.
%Username
The user name is used as the computer name.
%[0][n]#
The computer name includes an incremental number containing n digits. To include zero-padding in the incremental number, type a zero as shown. For example, if you use %03#, a three-digit number in the range from 001 through 999 is used.
%Last
The user's last name is used as the computer name.
%MAC
The network card media access control address is used as the computer name.

Important

  • Do not create a naming convention that could result in duplicate computer names. One way to avoid duplication in computer names is to use the incremental number option described in the previous list.

When you are defining your computer naming policy, you can limit the length of computer names by adding a numerical value to the text string. For example, if you want to limit the computer name to three characters of the user's last name with a two-digit incremental number appended, you would use the string: %3Last%02# Thus, for the fifth computer user whose last name is Smith, the corresponding computer name would be Smi05.

You can use customized naming options separately, or you can combine them. For example, if you want the computer name to consist of the first three letters of the user's first name, followed by the first three letters of the user's last name, followed by a three-digit incremental number, use the following string:
%3First%3Last%03#

For instructions on how to configure the computer naming format, see To configure settings for new clients for RIS.


The remote installation process

This section covers:

  • Client Installation Wizard
  • Installation options available through RIS
  • Operating systems supported by Remote Installation Services
  • Controlling client installations through Group Policy


Client Installation Wizard

Users of a remote boot–enabled client computer can use the Client Installation Wizard to select installation options, operating systems, and maintenance and troubleshooting tools.

The wizard prompts the user for a user name, password, domain name, and other information as required. After the user's credentials have been validated, the wizard displays the installation options that are available to the user. After the user selects an option, the selected operating system installation image is copied to the client computer's local hard disk. You can predetermine some installation options using Group Policy.

Users of the Client Installation Wizard must type only standard ASCII characters (OEM characters 32–126) for user name, password, or domain name information. The Client Installation Wizard does not support extended ASCII character sets (such as those containing ü, é, or other extended characters).

For more information, see the following:

  • For more information about how a user logs on through the Client Installation Wizard and performs a remote installation, see To perform a network installation using RIS.
  • For information about using Group Policy to control some installation options, see Controlling client installations through Group Policy.

As an administrator, you can edit .osc files to determine which screens the Client Installation Wizard presents to the user. For more information about .osc files, see see "Designing RIS Installations" at the Microsoft Windows Resource Kits Web site (http://www.microsoft.com/). For basic information about other ways you can control some of the choices and screens seen by users of RIS client computers, see Installation options available through RIS.

Important

  • By default, the client computer's hard disk is reformatted during the operating system installation. Therefore, all locally stored files are removed during installation. To prevent the loss of important data, you should back up your files before installation. You can also choose not to reformat the computer's hard disk during installation.


Installation options available through RIS

The Client Installation Wizard is a text-based setup wizard that guides the user through the remote installation process. You can use Group Policy to control which installation options are offered to users. For more specific information about this, see Controlling client installations through Group Policy.

You can specify that the user be presented with automatic setup or custom setup, or that a previous setup attempt be restarted. You can also specify that the user be given maintenance and troubleshooting options.

Automatic Setup

Use this option if you want to predefine the computer name and a location within Active Directory for the client computer accounts. For more information about computer names and the options for predefining them, see Computer names. You can also prestage the client computer; for more information about this, see To prestage client computers.

Custom Setup

Use this option to allow users to define a unique name for this computer and specify where the computer account will be created within Active Directory. Typically, you use custom setup for users outside of your own organization who are setting up computers.

Restart setup ("Restart a Previous Setup Attempt" in the Client Installation Wizard)

This option restarts a failed operating system installation attempt if the installation procedure fails during text-mode setup. This option does not copy files from where the previous installation attempt failed. However, the user is not required to answer any questions that were already answered during the previous setup attempt.

Tools ("Maintenance and Troubleshooting" in the Client Installation Wizard)

This option gives users access to tools that are used to maintain and troubleshoot client computers. These tools include memory virus scanners, updating the flashing for system basic input/output system (BIOS), and computer diagnostic utilities. In addition, if Recovery Console has been made available to a client computer, and if the client computer is configured to support the Recovery Console, it is displayed in the Client Installation Wizard under "Maintenance and Troubleshooting." For more information about maintenance and troubleshooting tools, see Maintenance and troubleshooting tools and options.

Additional options and other considerations

  • Remote Installation Services (RIS) does not fully support unattended installations on computers that contain Microsoft Internet Security and Acceleration (ISA) devices or devices that are non-Plug and Play.
  • Users who are setting up a remote boot–enabled client computer are not offered installation choices when automatic setup is their only installation option. For more information, see Controlling client installations through Group Policy.
  • The unattended installation setup answer files (.sif) are text files that describe the installation process for an installation image. An unattended installation template, which you can customize, is provided by RIS. The .sif file must be associated with one of the available installation images. For information about associating a .sif file with an installation image, see To associate an unattended setup answer file with a RIS installation image. For information about creating unattended installation files and automating installations, see "Automating and Customizing Installations" at the Microsoft Windows Resource Kits Web site (http://www.microsoft.com/).

    • One of the things you can control through a .sif file is the enabling of the Administrator account (which by default is disabled when the client joins the domain). If you do this, be sure to use a tool called Setup Manager to ensure that the Administrator password is encrypted in the .sif file before being transmitted over the network. For information about this, see the following:

    • For specific information about working with .osc and .sif files for RIS, see "Designing RIS Installations" at the Microsoft Windows Resource Kits Web site (http://www.microsoft.com/).
    • For information about Setup Manager, see Deploy.chm in \Support\Tools\deploy.cab on the Windows CD.
  • By default, the Client Installation Wizard uses the Welcome.osc file located in \RemoteInstall\OSChooser to manage client installation image choices. For multiple language installation image options, you must remove the Welcome.osc file and rename the Multilng.osc file to Welcome.osc. The Client Installation Wizard then provides the user with a menu of multiple language choices. You can also edit Welcome.osc to create custom language options. For more information about .osc files, see "Designing RIS Installations" at the Microsoft Windows Resource Kits Web site (http://www.microsoft.com/).
  • For most client computers, the user must press a particular key (for example, F12) to initiate the remote installation process. Some client computers have settings in the basic input/output system (BIOS) that cause a prompt to be displayed when it is time for the user to press the key. Not all client computers display a prompt. By default, RIS causes a prompt to be displayed on the client computer, telling the user to press F12. To change this so that RIS does not cause a prompt to be displayed, in \\RIS_server_name\REMINST\oschooser\i386, rename Startrom.com to Startrom.old, and then rename Startrom.n12 to Startrom.com.


Operating systems supported by Remote Installation Services

You can use Remote Installation Services (RIS) to enable automated installations of an operating system on new or existing client computers.

Two types of operating system images are supported by the Client Installation Wizard: flat image and the Remote Installation Preparation Wizard (RIPrep) image formats.

Using a flat image is similar to setting up a client directly from the installation CD, except that the operating system image source files reside on an available RIS server. For information about creating a flat image, see To add a new client operating system installation image.

When you create an RIPrep image, you can install the necessary client computer applications and configure the client computer settings, such as monitor settings and network printers. For background information about RIPrep, see Creating an installation image with RIPrep. For instructions on how to run RIPrep, see To create a Remote Installation Preparation Wizard image.

The Client Installation Wizard displays both the flat image and RIPrep image formats in the list of available installation options. The installation process begins when the user of the client computer selects one of the displayed operating system images.

The table below lists the operating systems supported by Remote Installation Services. It also shows the image type that is supported for each operating system.

Operating system | Flat image | RIPrep image
XOX | X | X
XOX | X | X
XOX | X | X
XOX | X | X
64-bit version of XOX | X |
Windows 2000 Professional | X | X
Windows 2000 Server | X | X
Windows 2000 Advanced Server | X | X

Important

  • You cannot use RIPrep to create an image of a Windows 2000 operating system if Internet Information Services (IIS) is installed.
  • You cannot use RIS to create an installation image of XOX.


Controlling client installations through Group Policy

You can use the Group Policy snap-in to control whether the user of a RIS client computer must supply a computer name during installation, whether the remote installation attempt should be restarted if it fails, and whether users have access to tools before the operating system is installed. Group Policy is applied to sites, domains, and organizational units, and can be inherited within Active Directory. For more information on Group Policy, see Group Policy overview.

The Group Policy options for the Client Installation Wizard are as follows:

Automatic Setup
Use this option if you want to predefine the computer name and a location within Active Directory for the client computer accounts. For more information about computer names and the options for predefining them, see Computer names. You can also prestage client computers; for more information, see To prestage client computers.
Custom Setup
Use this option to allow users to define a unique name for this computer and specify where the computer account will be created within Active Directory.
Restart Setup
This option restarts an operating system installation attempt if it fails prior to completion.
Tools
Use this option to allow users to access tools from the Client Installation Wizard. For more information about how tools are made available, see Maintenance and troubleshooting tools and options.

For each of the Client Installation Wizard choices, the following options are available:

Enable
Users to whom this policy applies are offered this installation option.
Not Configured
The policy settings of the parent container apply to this option. For example, if you choose Not Configured and the administrator for the entire domain has set Group Policy specific to Remote Installation Services, the policy that is set on the domain is applied to all users who are affected by that policy.
Disabled
Users affected by this policy cannot access this installation option.

For procedural information on controlling access through Group Policy, see To set Group Policy for client installation options.

For information on the options offered by the Client Installation Wizard, see Installation options available through RIS.


Resources

  • For more information about deploying Remote Installation Services (RIS), see "Designing RIS Installations" at the Microsoft Windows Resource Kits Web site (http://www.microsoft.com/). For information about the Resource Kits, see Windows Deployment and Resource Kits.
  • For information about unattended installation, see deploy.chm in \Support\Tools\deploy.cab on the Windows CD.
  • For information about compatible hardware, Windows Update, and product support, see Support resources.
  • For information about starting the Recovery Console from RIS, see article Q222478, "Creating a Template to Run Recovery Console Using a Remote Install Server," in the Microsoft Knowledge Base (http://www.microsoft.com/).
  • For information about using File Replication service (FRS) to replicate RIS images, see article Q273594, "How to: Replicate RIS Images Using DFS and NTFRS," in the Microsoft Knowledge Base (http://www.microsoft.com/).
  • For information about configuring a router to forward DHCP packets to a client computer, see article Q257579, "PXE Clients Do Not Receive an IP Address from a DHCP Server Across a Router," in the Microsoft Knowledge Base (http://www.microsoft.com/).


Troubleshooting Remote Installation Services

What problem are you having?

I am not sure I have the correct Pre-Boot eXecution Environment (PXE) ROM version.

Solution: When the Net PC or client computer containing a remote boot ROM starts, the version of the PXE ROM appears on the screen. Remote Installation Services (RIS) supports .99n or greater PXE ROMs, except in a few situations that require the .99L version. You might be required to obtain a newer version of the PXE-based ROM code from your original equipment manufacturer (OEM) if you have problems with the existing ROM version installed on a client computer.

I am not sure whether the client computer has received an Internet Protocol (IP) address and has contacted the Remote Installation Services (RIS) server.

Solution: When the client computer boots, you will see the PXE boot ROM begin to load and initialize. The following sequence occurs with most PC98 and Net PCs, PXE ROM–based computers, and the computers using the RIS boot disk.

Remote Boot ROM Load Sequence:

Step 1:
The client computer displays the message "DHCP." This indicates that the client is requesting an Internet Protocol (IP) address from the DHCP server. This can also mean that the client has obtained an IP address from the DHCP server and is awaiting a response from the RIS server. To verify that the client is receiving an IP address, check the IP leases that have been granted on your DHCP server.
Troubleshooting
If the client does not receive the message, an IP address might not have been received or the Remote Installation (BINLSVC) server might not be responding. Consider the following:
  • Is the DHCP server available and has the service started? The DHCP server and remote installation servers must be authorized in Active Directory before they can provide IP addresses. Check to ensure that the service has started and that other clients that are not remote boot–enabled are receiving IP addresses on this segment.
  • Does the DHCP server have a defined IP address scope, and has it been activated?
  • Is there a router between the client and the DHCP server that is not allowing DHCP packets through?
  • Are there any error messages in the event log under the system log for DHCP?
Step 2:
When the client receives an IP address from the DHCP server, the message might change to "BINL." This indicates that the client successfully leased an IP address and is now waiting to contact the RIS server. The client will eventually time out and post the error message "No Bootfile received from DHCP, BINL, or Bootp."
Troubleshooting
If the client does not receive the BINL message, this indicates the client is not receiving a response from the RIS server. Consider the following:
  • Is the server available and has Remote Installation Services started? RIS servers must be authorized before they can respond to client computers. Run Risetup -Check to authorize a RIS server. For more information, see Remote Installation Services server authorization.
  • Are other remote boot–enabled clients receiving the Client Installation Wizard? If so, this client computer either is not supported or is having remote boot ROM–related problems. Check the version of the PXE ROM on the client computer. Also, check Active Directory to see whether the administrator has prestaged this client computer to a RIS server that is offline or unavailable to the client computer.
  • Has an additional network card been added to the RIS server? If so, the server must be re-authorized in Active Directory. Run RISETUP -Check to re-authorize the server.
  • Is a router between the client and the RIS server not allowing the DHCP-based requests or responses through? The RIS server communicates by way of the DHCP packet type during the initial service request/response sequence. You might need to configure the router to forward the DHCP packets. For more information, see article Q257579, "PXE Clients Do Not Receive an IP Address from a DHCP Server Across a Router," in the Microsoft Knowledge Base. (http://www.microsoft.com/)
  • Are there any error messages in the event log under the system or application logs specific to Remote Installation (BINLSVC), Domain Name System (DNS), or Active Directory?
  • Does the client computer have an account in Active Directory? If not, the RIS server might be configured to respond only to known client computers.
  • Is the RIS server also a DHCP server, and does it have multiple network adapters? If so, then there must be a scope for the subnet of each network adapter. For more information, see Configuring scopes.
Step 3:
The client then changes to Trivial File Transfer Protocol (TFTP) or prompts the user to press a particular key (for example, F12). This indicates that the client has contacted the RIS server and is waiting to receive the first image file–CIW. You might not see the BINL and TFTP message on some computers because this sequence can occur very rapidly.
Troubleshooting
If the client computer does not get a response from the RIS server, the client will time out and send an error message saying that it did not receive a file from DHCP, BINL, or TFTP. In this case, the RIS server did not answer the client computer. Do the following:
  • Stop and restart Remote Installation (BINLSVC). To do so, click Start, and then click Run. In the Run dialog box, type cmd in the text field, and click OK. In the console window, type the following:
    Net Stop BINLSVC
    Net Start BINLSVC
  • Check the RIS server properties to ensure that the Respond to client computers requesting service option is selected and that Do not respond to unknown client computers is cleared unless you have prestaged the client computer in Active Directory prior to starting the client computer.
  • If the client computer does not receive an answer after it has attempted to stop and restart the service, and you have checked the remote installation server object properties to ensure that the correct settings have been set, check the event log on the RIS server for any errors relating to DHCP, DNS, and RIS (BINLSVC).
  • Check the TFTP Daemon to ensure that it has actually started, and check the event log to see if there are any TFTP errors.
Step 4:
At this point, the client should have downloaded and displayed the Client Installation Wizard application; a Welcome screen greeting the user should appear.

I am trying to locate the globally unique/universally unique identifier (GUID/UUID) on a client computer so I can prestage the client computer within Active Directory for use with RIS.

Solution: The GUID/UUID for most client computers that are PC98 or Net PC–compliant is provided in the system basic input/output system (BIOS) of the computer. Computer manufacturers are encouraged to ship either a floppy disk containing a comma-separated file or spreadsheet that includes a mapping of serial numbers to GUIDs/UUIDs. You can use this information to script the prestaging of client computers within Active Directory.

The GUID/UUID also appears on the outside of the computer. If it does not appear in the expected locations, one method for discovering it is to use a network utility to sniff the network traffic of the client computer and locate the DHCPDiscover packet; within that field will be the 128-bit, 16-byte GUID/UUID. Another method is to use the Windows Management Instrumentation (WMI) interface— specifically, the universally unique identifier (UUID) value of the Win32_ComputerSystemProduct class. For more information about this, see the MSDN Library at the Microsoft Web site (http://msdn.microsoft.com/).

Command settings are not being processed during the unattended installation.

Cause: Incorrect directory information is being used. Correct directory information is required when the "OemPreinstall = yes" setting in a .sif file is being used.

Solution: Change the directory information to \\RemoteInstall\Setup\applicable_language\Images\applicable_name\$oem$.

Language choice options do not appear during the Client Installation Wizard session.

Cause: By default, RIS uses the Welcome.osc file to manage client installation image choices. To make multiple language installation image options available, you must replace the default Welcome.osc file with the Multilng.osc file.

Solution: The Client Installation Wizard uses the Welcome.osc file located in the \\RemoteInstall\OSChooser folder to manage client installation image choices. When you remove the Welcome.osc file and rename the Multilng.osc file to Welcome.osc, the Client Installation Wizard will also offer a menu of language choices to the user. You can edit the Welcome.osc file to create custom language options.

The client computer is prestaged to a RIS server but is being serviced by a different server.

Cause: When you prestage a client computer into a domain with multiple domain controllers, the replication delay of the client computer account information can cause a client computer to be serviced by another RIS server.

Solution: You can either wait for the computer account information to be propagated during the next scheduled replication session, or you can modify the replication frequency between your domain controllers. For more information on configuring replication, see Replication overview.

I have client computers that use the older remote boot protocol, Remote Program Load (RPL)–based ROMs.

Solution: There is no support for the older RPL–based remote boot, so computers using this cannot use RIS. RIS uses the PXE DHCP–based remote boot ROMs.

I am investigating questions of security related to the Pre-Boot portion of the PXE–based remote boot ROM.

Solution: There are inherent security limitations with PXE. The entire boot ROM sequence and operating system installation or replication process is not secure for packet type encryption, client or server spoofing, or wire sniffer–based mechanisms. You should exercise caution when using RIS on your corporate network. Allow only authorized RIS servers on your network. Also, control the number of administrators who are allowed to install or configure RIS servers. For more information, see Security information for Remote Installation Services.

I am evaluating methods for replicating all of the operating system installation images currently located on one RIS server to other RIS servers on the network to achieve consistency across all client installations.

Solution: RIS does not currently provide a mechanism for replication of operating system images from one RIS server to another. There are several alternative mechanisms you can use, however. One solution is to use the strong replication features of the Systems Management Server product. This product provides for scheduled replication, compression, and low-speed link features. You can also use other vendor solutions for operating system image replication. If you do this, however, ensure that the replication mechanism you choose supports maintaining the file attributes and security settings of the source images.

I am evaluating whether to place a RIS server and another vendor’s remote boot server on the same network.

Solution: You can place multiple-vendor remote boot/installation (RB/RI) servers on one physical network. It is important to understand, however, that the remote boot PXE ROM code is not currently able to detect the difference between vendors' RB/RI servers. As a result, when a remote boot–enabled client computer starts and requests the Internet Protocol (IP) address of an RB/RI server, all of the available servers will respond to that client; thus, the client has no way to ensure that it is being serviced by a specific RB/RI server.

With RIS, however, an administrator can prestage client computers into Active Directory and determine which RIS server will service a client computer. By configuring the RIS server to answer only known (prestaged) client computers, the administrator is assured that the client will be serviced by the correct RIS server.

Not all of the other RB/RI vendors are able to ignore service requests. You might need to isolate the specific vendors' servers on the network so that clients are not answered by these vendors' RB/RI servers.

I want to manage the RIS servers remotely from computers running XOX on my network.

Solution: If you are an administrator in the domain, and you have installed the Windows Server 2003 Administration Tools Pack on the computer running XOX, you can administer most of the RIS configuration settings. There are some items that you cannot manage, however. For example, you cannot remotely add more operating system installation images to the RIS servers from a computer running XOX.

I want to add more network adapters to the RIS boot disk.

Solution: For this release of RIS, the Rbfg.exe utility cannot be modified to accommodate additional network adapters. Updates to Rbfg.exe can be made available through the same distribution channels that are used for other software updates and feature packs, however. You can obtain information about possible updates to Rbfg.exe (and the network adapter support in those updates) in the same way that you obtain information about other software updates.

I want to know whether I can use the Active Directory object attributes to create a naming format that can be used with the RIS automatic computer naming feature.

Solution: This is not supported. Although the existing attributes supported with the automatic computer naming feature do use Active Directory, not all Active Directory object attributes are currently supported.

After the restoration of a backup of a RIS volume, RIS does not function properly.

Cause: Backup restored the volume without a Single Instance Store (SIS) directory.

Solution: Verify the configuration of the RIS volume, then restore the volume again.

For information about how to verify the configuration of a RIS volume, see To verify the Remote Installation Services configuration.

For information about how to back up and restore SIS directories, see "Backup and Restore" at the Microsoft Windows Resource Kits Web site (http://www.microsoft.com/).

I created an image on my RIS server, but the installation image does not appear in the list of available operating system installation options when I attempt to install the image on a client computer.

Cause: The client computer has a different type of hardware abstraction layer (HAL) than the image.

Solution: When you use RIPrep to create new images, RIPrep ensures that the images viewed by the client computers are only those that are compatible with the computer. A client computer must have the same type of hardware abstraction layer (HAL) as the image. If it does not, the image will not appear in the list of available operating system installation options.

Cause: Permissions have been set that prevent users from seeing a particular installation image.

Solution: For information about setting permissions that permit or deny access to installation images, see To allow or prevent the installing of a RIS image by a user or group and To allow or prevent the viewing and installing of a RIS image by a user or group.

I created an image using the Remote Installation Preparation (RIPrep) Wizard, started the Add Wizard, and clicked Associate a new answer file to an existing image, but I do not see the RIPrep image in the list in the Add Wizard.

Solution: The installation images that appear in the list in the Add Wizard include only flat images; that is, those images created with the Remote Installation Services Setup Wizard. The list does not include images created with the Remote Installation Preparation (RIPrep) Wizard.

I am evaluating the use of RIPrep in a situation where I want to preserve the file attributes and security settings defined on the source computer.

Solution: RIPrep supports this. The file attributes and security settings that are defined on the source computer are preserved on the destination computer that installs that image. For more information about RIPrep, including information about requirements for the RIPrep replication process, see Creating an installation image with RIPrep.

I want to use RIPrep in a situation where there are hardware differences between the source computer that is used to create the RIPrep based installation image and the destination computer that will install the image.

Solution: You can use RIPrep in a situation where hardware on the source computer and the destination computer is different. The one limitation is that the computers must use the same type of Hardware Abstraction Layer (HAL). For example, if the source computer is an Advanced Configuration Power Interface (ACPI)–based computer, it uses a HAL that includes ACPI. If you attempt to install this RIPrep image on a computer that is not based or enabled on ACPI, the operating system installation process will fail.

I am evaluating whether I can use RIPrep to support an installation on multiple disks or multiple partitions on the client computer.

Solution: In this release of Remote Installation Services, the RIPrep utility supports only a single disk with a single partition. You can use RIPrep to make an image of a computer that contains more than one partition or disk, but RIPrep will only image the system partition.

I am evaluating the use of RIPrep in a situation where the disk sizes differ between the source computer used to create the image and the destination computer that will receive the image.

Solution: For details about working with different disk characteristics on the source client computer and the destination computer, see Creating an installation image with RIPrep.