@rdr I see what you mean now. I thought FOG server saves the last IP address to its database and use it to determine if the powered off host is on the same subnet. If it is using live ARP lookups via agents to determine the subnets/agents matching then I can not customize or hardcode it.

@Tom-Elliott Thank you, tested, confirmed it’s fixed.

@gmaurice resetting the host encryption in the gui and then restart the fog service and it should be back up and running. You can also use the api for this, the FogApi powerhsell module (links in my signature) I have this Reset-HostEncryption function https://fogapi.readthedocs.io/en/latest/commands/Reset-HostEncryption/?h=reset+host which will also handle this reset.

Your other other option is to look into post download scripts, there’s some examples in the forums and the docs. If you’re using sysprep and unattend.xml you can inject domain join information into the unattend.xml after imaging and before windows launches for the first time, so the computer is joined to the domain before the fog service or any ui is reachable.

@Tom-Elliott I edited the sshd_config file and changed
/usr/lib/openssh/sftp-server
to
internal-sftp

I’m not sure how the installer failed to make this accomodation in the first place but I’m glad it appears to be working. I deployed the image to another laptop to make sure everything is working. It looks like the problem can be considered resolved now. Thanks for your help!

Glad you have a workaround. I think the cause is the Windows boot manager certificate change, not the image.

Your golden Optiplex installed Windows with Secure Boot on. Windows servicing then added the “Windows UEFI CA 2023” certificate to that machine’s db, and switched the boot files to a boot manager signed with it. The other Optiplex 3000s only trust the 2011 Microsoft certificates, so they reject that boot manager. bcdboot works because it copies the older 2011-signed boot manager.

Can you confirm with two checks, in admin PowerShell, on the golden machine and on one target?

[Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023' mountvol S: /s (Get-AuthenticodeSignature S:\EFI\Microsoft\Boot\bootmgfw.efi).SignerCertificate.Issuer

If the golden machine says True and the target says False, that is the cause. A newer Dell BIOS may include the 2023 certificate in its default keys. I am also looking at having FOS add it during the Secure Boot enrollment task.

@Jason89436 Thanks for the report. The agent had no snapin pack support, and on Windows it also dropped backslashes from snapin arguments. Both are fixed. Update the server to the latest working-1.6, then update the agent to 0.1.10. After that, [FOG_SNAPIN_PATH]\msoffice.ps1 resolves to the unzipped pack folder, as it did with the legacy client.

I want to close the loop on this in case other folks run into this. Although the Wyse 5060 thin client supports UEFI mode, it looks like it’s buggy enough that none of the pxe files included with Fog will boot it. Legacy mode works however, so that’s what I’m going with. I actually did a test on each file in /tftpboot and here are the results:

c68fa3c6-af25-4320-aa01-daf8263a7fc7-image.png

So I’m going with undionly.kpxe.

The other issue I’ve had is that once I did a Win 10 IoT install on a legacy-booted 5060, the fog capture process would fail, saying I needed to run fixparts. In the ‘capture - debug’ shell, the fixparts command wasn’t available, and I ended up accidentally nuking my Win10 boot partition. Oh well.

I’m retrying this again. I have a flash drive that’s MBR (not GPT) formatted with the Win10 IOT installer. I made sure the 5060 is in legacy mode, and when I started the install I hit Shift-F10 to drop to a cmd prompt and used these commands to ensure there were no linger gpt partitions on this disk:

diskpart
list disk
select disk 0
clean
convert mbr
exit

and I went ahead with the install. When windows updates finish, I’m going to attempt to capture the image and see if it works.

@mp12 Thanks for the logs. This is a bug in 1.5.10.2482, not your node passwords.

A security change in 2482 removes the storage node password from the node data that the API returns. The image and snapin replicators read their node list from that same data. So they now send an empty password, and every node rejects the login. The Undefined property: stdClass::$pass warning is that missing field.

The fix is merged to dev-branch: https://github.com/FOGProject/fogproject/pull/1770

To get it now, update from dev-branch:

cd /path/to/fogproject git checkout dev-branch git pull cd bin sudo ./installfog.sh -y

Or wait for the next stable release. Your stored passwords are correct, so you do not need to change anything on the nodes.

@GRISLET The task is only marked complete by one request: POST /fog/service/Post_Stage3.php, sent by fog.imgcomplete as the last step of the deploy. Your log shows it never went out, so the script exited before reaching it.

You see no error because S99fog prints * Rebooting system as task is complete and reboots whenever /bin/fog exits, for any reason. A silent early exit is indistinguishable on screen from a real completion.

The 48-second gap points at where. fog.statusreporter posts progress.php every 3 seconds for the whole task and stops only when killStatusReporter kills it — which is the first line of completeTasking. After that line, only three things run before the completion POST. One of them is /images/postdownloadscripts/fog.postdownload, which is sourced into the imaging shell. An exit or a reboot in that script, or in any script it calls with ., ends the task before FOG is told about it.

Two things would confirm it:

cat /images/postdownloadscripts/fog.postdownload, plus any script it sources. Look for exit or reboot. The last ten lines on the client screen before the reboot. Do Stopping FOG Status Reporter, * Task Complete and Updating Database appear? If they do not, the run ended early and the image type is not involved.

The image type is probably a red herring. Nothing between the end of the restore and the completion POST depends on Single Disk - Resizable.

@AUTH-IT-Center I do believe snponly would be the recommended, rather than iPXE’s driver.

The developers at iPXE wrote the driver on their own (of course using documentation and stuff, but for all intents/purposes it is still a handrolled driver) so anything is possible.

We shipped the native iPXE 2.0.0 mainly because of the feature it allows with actual Secureboot capabilities and instead of embedding everyfile with a custom script, a more dynamic approach for when iPXE releases new version we can upgrade more easily.

For what it’s worth, I would almost want more people to default to snponly.efi (or secureboot/snponly-shimx64.efi if using/wanting secureboot after enrolling your machines of course) because this is supposed to be using the generic driver for EFI boot protocols on the NIC rather then attempting to discover the NIC using a driver loaded.

@scottrayr I’m not able to replicate the issue you’re seeing.