• Recent
    • Unsolved
    • Tags
    • Popular
    • Users
    • Groups
    • Search
    • Register
    • Login
    1. Home
    2. Popular
    Log in to post
    • All Time
    • Day
    • Week
    • Month
    • All Topics
    • New Topics
    • Watched Topics
    • Unreplied Topics
    • All categories
    • K

      Task 0

      Watching Ignoring Scheduled Pinned Locked Moved Unsolved FOG Problems
      50
      0 Votes
      50 Posts
      2k Views
      K

      @Tom-Elliott
      These are the two machines that were just cloned!

      I deployed the Snap-in three times:
      the two newly cloned machines and one old machine to see if any certificate issues arise with the old computers. All of them were assigned Image B.

      The computer, which has not yet been cloned, did not process the snap-in.

      ec06f2be-575a-48f2-9f68-3a9f156dd330-grafik.png

      ------------------------------------------------------------------------------ --------------------------------Authentication-------------------------------- ------------------------------------------------------------------------------ 28.09.2026 07:38:56 Client-Info Version: 0.13.0 28.09.2026 07:38:56 Client-Info OS: Windows 28.09.2026 07:38:56 Middleware::Authentication Waiting for authentication timeout to pass 28.09.2026 07:40:56 Middleware::Communication Download: http://192.168.0.196/fog/management/other/ssl/srvpublic.crt 28.09.2026 07:40:58 Middleware::Communication ERROR: Could not download file 28.09.2026 07:40:58 Middleware::Communication ERROR: Die Verbindung mit dem Remoteserver kann nicht hergestellt werden. 28.09.2026 07:40:58 Client-Info ERROR: Failed to authenticate, will not run Module Looper.

      78935d01-cc19-4dd8-b5bc-fb03e7885c58-grafik.png
      Resetting the encryption settings, deleting the snap-in that wasn’t running, and restarting it didn’t help…

      Rebooting of the pc helped

    • S

      Windows 11 image captured from VM hangs indefinitely at Dell logo on Latitude 3400 (multiple units, multiple NVMe brands) — works fine on HP

      Watching Ignoring Scheduled Pinned Locked Moved General
      14
      0 Votes
      14 Posts
      754 Views
      Tom ElliottT

      @servicedesk-pianezza Follow-up on the findings from your report. Four changes are merged. Three came from your
      report directly. The fourth came out of triaging it.

      A failed snapin download now answers an HTTP status. Snapins::stream() set no status
      on its error paths, so the client received 200 with the error text as the file body, hashed
      that text, and reported the same wrong SHA-512 on every retry. A storage-node or FTP failure
      therefore read as a permanently corrupt snapin. The download paths now set the status before
      any body is written: 404 when the snapin does not exist, 503 when the storage node is
      unreachable, when the file cannot be read, or when no storage group or node is assigned. No
      client change is needed. Both clients already treat a non-2xx as a failed transfer, log the
      reason, and check in without computing a hash. (GH-1817)

      The installer now ensures the service account’s home directory on every run. This is the
      root cause of your FTP failure. configureUsers() created /home/fogproject and set its
      ownership only in the branch that runs when the account does not yet exist. On every later
      install the account was found, the step printed “Skipped”, and the home directory was never
      examined. So a home directory that was removed could not be restored by re-installing, which
      is exactly what you observed. vsftpd answers “cannot change directory” with no home
      directory, and that breaks every snapin transfer. A new _ensureSvcUserHome() runs for both
      branches, before anything writes into that directory. A path that exists as a file now fails
      with that cause named, instead of being retried on every install. (GH-1820)

      wipefs is now built into FOS. This is larger than the diagnostic you were missing.
      restoreLVM() in the FOS libraries has always called wipefs -a to clear stale filesystem
      and RAID signatures before it recreates a physical volume. The binary was never in the image,
      and busybox has no wipefs applet, so that call has always been “command not found” with its
      output and exit status discarded. pvcreate -ff forced past the leftover signatures, so
      nothing appeared broken. A build check now refuses a configuration that calls wipefs
      without building it. (FOS GH-188)

      An unchecked “remove file data” box deleted the file anyway. We found this while
      triaging your report, and it is the one with no undo. On the image and snapin edit pages the
      checkbox handler returned early when the box came off, leaving the previous state in place.
      Ticking the box, changing your mind, and deleting still removed the files from the storage
      node. The server also accepted an explicit andFile=0 as a yes on the single-item path,
      while the bulk path required the value. Both are corrected. (GH-1819)

      Three further items from your report are already corrected in 1.6, so they need no change:

      Task timestamps are stored in UTC, and the timezone setting became a display setting. Your
      two-hour offset is the old behavior. The installer no longer rewrites its vhost file wholesale. It splices its own block between
      markers and preserves everything outside them. Note the limit: an Alias or RewriteCond
      placed inside FOG’s markers is still replaced. Put yours outside them and it survives. The certificate tree is split into zones. The snapin CA path points at the root certificate,
      and the web CA is a separate file. The crossed symlink you found belongs to the older
      layout.

      All four changes are on the development branch and on the release-candidate branch, so they
      reach you in the next release candidate.

      On the Latitude 3400 hang itself, nothing has changed. It is not a FOG defect, your winpe3400
      plugin is the right answer for those machines, and the thread is the best record of it that
      exists. The one hypothesis still untested is the drive’s TRIM state: Partclone writes only used
      blocks and never trims, while diskpart format and a full wipe both do. If you ever have a
      hanging drive to spare, Optimize-Volume -DriveLetter C -ReTrim in the HP, then back in the
      Dell, then F2, would settle it.

      Thank you again. Your write-up found three real defects, and one of them could have destroyed
      an image.

    • R

      FOG 1.6 with fog-agent 0.1.6, agent renames all PC's to the same golden image name when not using sysprep

      Watching Ignoring Scheduled Pinned Locked Moved Solved FOG Problems
      12
      0 Votes
      12 Posts
      480 Views
      R

      @Tom-Elliott Thank you, tested, confirmed it’s fixed.

    • J

      FOG Project Image Capture on Raspberry Pi 4 (ARM64) via U-Boot

      Watching Ignoring Scheduled Pinned Locked Moved Unsolved FOG Problems
      60
      0 Votes
      60 Posts
      4k Views
      J

      @Tom-Elliott

      I can’t modify the company’s switches or other hardware since the system is in production. I’m currently rebuilding the FOG server on a VM on my PC and doing everything locally; it’ll be easier to troubleshoot that way. Gemini has wiped out all the previous messages and is giving me nonsense—I can’t seem to recreate the environment up to the capture stage anymore. Could you give me a rundown of everything that needs to be done—downloads, decompressing specific files in binary mode, etc.?

      Thanks.

    • R

      Wake-On-LAN via fog agent with brand new PC's

      Watching Ignoring Scheduled Pinned Locked Moved General
      9
      0 Votes
      9 Posts
      526 Views
      R

      Now I read the AI summary and got what I need:

      It stores one row for each address in the hostNetwork table. Limits of this method The sleeping host must run fog-agent. The server uses the sleeping host’s own last report to find its subnet. A host with the legacy FOG Client, or with no client, has no rows, so the relay cannot help it. The old path still runs for it.

      So If I populate the hostNetwork table for the hosts that I need manually, It will work. Thank you for the details.

    • A

      PXE boot failing on Wyse 5060

      Watching Ignoring Scheduled Pinned Locked Moved General Problems
      8
      0 Votes
      8 Posts
      387 Views
      A

      @ahaeder A final setting - you have to set Bios exit type = GRUB (not the default SANBOOT) or the boot hangs at ‘Booting from SAN device’.

    • G

      FOG 1.5.10 - Problem with AD Join.

      Watching Ignoring Scheduled Pinned Locked Moved Unsolved FOG Problems
      5
      0 Votes
      5 Posts
      229 Views
      JJ FullmerJ

      @gmaurice resetting the host encryption in the gui and then restart the fog service and it should be back up and running. You can also use the api for this, the FogApi powerhsell module (links in my signature) I have this Reset-HostEncryption function https://fogapi.readthedocs.io/en/latest/commands/Reset-HostEncryption/?h=reset+host which will also handle this reset.

      Your other other option is to look into post download scripts, there’s some examples in the forums and the docs. If you’re using sysprep and unattend.xml you can inject domain join information into the unattend.xml after imaging and before windows launches for the first time, so the computer is joined to the domain before the fog service or any ui is reachable.

    • B

      FOG 1.6 working branch - fog-agent 0.1.6 enrollment returns 308 redirect

      Watching Ignoring Scheduled Pinned Locked Moved Unsolved FOG Problems working-1.6 redirect fog-agent
      5
      0 Votes
      5 Posts
      223 Views
      Tom ElliottT

      @Balage80 Thanks for confirming the enrollment fix.

      UEFI boot: I think the cause is two new lines in default.ipxe. They read Secure Boot state from the firmware. iPXE reads it by stepping through every firmware variable, and some firmware never ends that list, so iPXE hangs there.

      Please test this: take the new 979-byte default.ipxe and delete only these two lines. Keep everything else.

      param secureboot ${efi/SecureBoot} param setupmode ${efi/SetupMode}

      Does UEFI boot with that file? Please also post the make, model, and BIOS version of the machine. Note that re-running installfog.sh writes a new default.ipxe, which replaces a manual edit.

      Pending MACs: these are not related to default.ipxe. They come from the legacy FOG Client’s Host Registration module. That module reports every adapter Windows sees, including Wi-Fi, Bluetooth, and virtual Wi-Fi Direct adapters. FOG stores each unknown MAC as pending, up to FOG_QUICKREG_MAX_PENDING_MACS per host (default 4). iPXE cannot see those adapters. You can delete the pending MACs. To stop new ones, add MAC fragments to FOG_QUICKREG_PENDING_MAC_FILTER (comma separated), or turn off Host Registration.

    • A

      Windows 11 Fog Client install failing with HTTPS

      Watching Ignoring Scheduled Pinned Locked Moved Solved FOG Problems
      4
      0 Votes
      4 Posts
      166 Views
      Tom ElliottT

      @astrugatch I don’t think it matters really. The issue was more about the initial pinning of the certificate during the install process. After it is pinned I think this is the correct expectation (it should only communicate to the FOG server over HTTPS).

    • S

      Unable to Startup SFTP subsystem

      Watching Ignoring Scheduled Pinned Locked Moved Solved FOG Problems
      4
      0 Votes
      4 Posts
      201 Views
      S

      @Tom-Elliott I edited the sshd_config file and changed
      /usr/lib/openssh/sftp-server
      to
      internal-sftp

      I’m not sure how the installer failed to make this accomodation in the first place but I’m glad it appears to be working. I deployed the image to another laptop to make sure everything is working. It looks like the problem can be considered resolved now. Thanks for your help!

    • M

      Multicast: "No Active Task found for Host" on 1.5.10.2482 despite #1391 — msClients stays 0

      Watching Ignoring Scheduled Pinned Locked Moved Solved FOG Problems
      3
      0 Votes
      3 Posts
      175 Views
      M

      @Tom-Elliott
      Hi!
      I have updated to the latest dev-branch version.
      No more updating database … failed error.
      The multicast session closing the right way.

      Thank you!

    • J

      Fogserver 1.6 - Agent 0.1.9

      Watching Ignoring Scheduled Pinned Locked Moved Solved FOG Problems
      3
      0 Votes
      3 Posts
      205 Views
      J

      Awesome and thank you. Confirmed working.

    • G

      Deploy task never marked complete on GPT/UEFI disks with "Single Disk - Resizable" + Partition: Everything — client reboots into infinite deploy loop

      Watching Ignoring Scheduled Pinned Locked Moved Solved FOG Problems
      3
      0 Votes
      3 Posts
      165 Views
      G

      Hi Tom,

      In my case the culprit was /images/postdownloadscripts/fog.postdownload.

      echo "Activating boot partition..." sfdisk --activate /dev/sda 1 echo "Rebooting..." reboot -f

      Fix was simply commenting out (or deleting) those lines. After cleanup the file looks like this:

      cat /images/postdownloadscripts/fog.postdownload #!/bin/bash ## This file serves as a starting point to call your custom postimaging scripts. ## <SCRIPTNAME> should be changed to the script you're planning to use. ## Syntax of post download scripts are #. ${postdownpath}<SCRIPTNAME>

      Thanks for the pointer, Tom — saved me from chasing GPT partition tables for a problem that had nothing to do with them.

    • A

      Secureboot preventing booting into windows after imaging

      Watching Ignoring Scheduled Pinned Locked Moved Unsolved Windows Problems
      3
      0 Votes
      3 Posts
      218 Views
      Tom ElliottT

      Glad you have a workaround. I think the cause is the Windows boot manager certificate change, not the image.

      Your golden Optiplex installed Windows with Secure Boot on. Windows servicing then added the “Windows UEFI CA 2023” certificate to that machine’s db, and switched the boot files to a boot manager signed with it. The other Optiplex 3000s only trust the 2011 Microsoft certificates, so they reject that boot manager. bcdboot works because it copies the older 2011-signed boot manager.

      Can you confirm with two checks, in admin PowerShell, on the golden machine and on one target?

      [Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023' mountvol S: /s (Get-AuthenticodeSignature S:\EFI\Microsoft\Boot\bootmgfw.efi).SignerCertificate.Issuer

      If the golden machine says True and the target says False, that is the cause. A newer Dell BIOS may include the 2023 certificate in its default keys. I am also looking at having FOS add it during the Secure Boot enrollment task.

    • R

      OIDC users and confirmation passwords

      Watching Ignoring Scheduled Pinned Locked Moved General Problems
      3
      0 Votes
      3 Posts
      190 Views
      R

      @Tom-Elliott That was quick 😊 I just tested and it works as expected. Thank you.

      Rahman

    • C

      1.6 Migration via new Install with no DB Transfer

      Watching Ignoring Scheduled Pinned Locked Moved Unsolved FOG Problems fog 1.6 client agent 1.6 ca ssl
      2
      0 Votes
      2 Posts
      89 Views
      Tom ElliottT

      @Coolguy3289 Thanks for the log line. It points at a bug, not at your approach.

      The installer creates a “FOG Agent CA” under the server root CA. It only creates it when the file is missing. If the root CA changes later (for example, you copy the old server’s /opt/fog/snapins/ssl onto the new box so existing clients keep trusting it), the agent CA stays signed by the first root. Every enrollment then fails with the error you see, and the agent gets a 503.

      The fix is in PR #1810: the installer now re-creates the agent CA when the current root did not sign it.

      To fix your server now, without waiting for the PR:

      sudo grep PKI_AGENT_CA_CERT /opt/fog/.fog-pki

      Move the .fogAgentCA.pem and .fogAgentCA.key files in that directory to a backup location. Then re-run the installer. It creates a new agent CA under your current root, and enrollment works.

      You do not need your internal PKI for this. The FOG-generated root is fine for production.

    • D

      Unable to capture image on NVME systems since 1.5.10

      Watching Ignoring Scheduled Pinned Locked Moved Unsolved FOG Problems
      6
      0 Votes
      6 Posts
      374 Views
      Tom ElliottT

      @DiegoP Thanks, your workaround found the cause.

      FOS installs mdadm’s udev rule, and that rule assembles every RAID member at boot. It ignored mdraid=true. The arrays then held nvme0n1p2/p3, so capture could not read the partitions.

      FOS now assembles arrays only when mdraid=true is on the kernel command line. Without the flag, it leaves the member partitions alone. With the flag, nothing changes.

      The fix is in the experimental FOS release EXP_20261001-163131: https://github.com/FOGProject/fos/releases/tag/EXP_20261001-163131. Replace /var/www/html/fog/service/ipxe/init.xz on your FOG server with that release’s init.xz. Then remove the postinit workaround and capture again. Please tell us whether it works.

    • S

      [1.6.0-beta] productKeyIsValid() regex missing letter 'N' — rejects valid Windows Enterprise product keys

      Watching Ignoring Scheduled Pinned Locked Moved Solved Bug Reports
      2
      0 Votes
      2 Posts
      170 Views
      Tom ElliottT

      @servicedesk-pianezza Confirmed, and your fix is the right one. Thanks for the clear report.

      The check was using the 24-character Base24 alphabet. That set is what you use to decode an older key into its binary form, and N is not one of its digits. It is not the set of characters a key is printed with. Windows 8 and later put N in the key itself, so any key carrying one was refused at entry.

      There was a second half of the same bug. The browser keeps its own copy of that character list, for the masked display of a saved key. So even where a key with an N got stored, the page showed it as five groups of dots instead of keeping the first and last group. Both copies now say the same thing, and a test compares them character for character so they cannot drift apart again.

      The test also runs Microsoft’s published KMS client keys through the validator, and checks that the characters Windows leaves out (A E I O U L S Z 0 1) are still rejected and the length is still exactly 25.

      It is in PR #1773 against working-1.6: https://github.com/FOGProject/fogproject/pull/1773

      It will be in the next beta build. If you would rather not wait, the one-character edit you already made is exactly what landed.

    • M

      Upgraded to 1.5.10.2482 - Now problems with replication to nodes

      Watching Ignoring Scheduled Pinned Locked Moved Unsolved FOG Problems
      2
      0 Votes
      2 Posts
      104 Views
      Tom ElliottT

      @mp12 Thanks for the logs. This is a bug in 1.5.10.2482, not your node passwords.

      A security change in 2482 removes the storage node password from the node data that the API returns. The image and snapin replicators read their node list from that same data. So they now send an empty password, and every node rejects the login. The Undefined property: stdClass::$pass warning is that missing field.

      The fix is merged to dev-branch: https://github.com/FOGProject/fogproject/pull/1770

      To get it now, update from dev-branch:

      cd /path/to/fogproject git checkout dev-branch git pull cd bin sudo ./installfog.sh -y

      Or wait for the next stable release. Your stored passwords are correct, so you do not need to change anything on the nodes.

    • AUTH IT CenterA

      FOG 1.5.10.2482 iPXE 2.0.0 - intermittent UEFI boot failures on Realtek NICs (1.21.1+ and snponly.efi unaffected)

      Watching Ignoring Scheduled Pinned Locked Moved Unsolved FOG Problems
      2
      0 Votes
      2 Posts
      117 Views
      Tom ElliottT

      @AUTH-IT-Center I do believe snponly would be the recommended, rather than iPXE’s driver.

      The developers at iPXE wrote the driver on their own (of course using documentation and stuff, but for all intents/purposes it is still a handrolled driver) so anything is possible.

      We shipped the native iPXE 2.0.0 mainly because of the feature it allows with actual Secureboot capabilities and instead of embedding everyfile with a custom script, a more dynamic approach for when iPXE releases new version we can upgrade more easily.

      For what it’s worth, I would almost want more people to default to snponly.efi (or secureboot/snponly-shimx64.efi if using/wanting secureboot after enrolling your machines of course) because this is supposed to be using the generic driver for EFI boot protocols on the NIC rather then attempting to discover the NIC using a driver loaded.

    • 1
    • 2
    • 1 / 2