@88fingerslukee Yop mate, are you on discord or something ? Would be easier to talk about this docker images !

@JYost With agent 0.1.23 or later, you do not need to stop or disable it before Sysprep, and you do not need the SetupComplete.cmd line. The agent waits until Windows setup has finished before it enrolls, checks in, or reboots. It starts on its own after OOBE completes.

On an older agent, update it on the reference machine first. Or use the same steps as before with the new service name: sc config fog-agent start= disabled before Sysprep, then sc config fog-agent start= delayed-auto and sc start fog-agent in SetupComplete.cmd.

You also do not need to clear the agent’s key before capture. Each deployed machine has different firmware IDs, so the agent drops the captured key and enrolls as itself. A deploy from your server approves it automatically.

No firewall rule is needed. The agent opens no listening port. It only connects out to the FOG server over HTTPS.

Details: https://docs.fogproject.org/installation/client/install-fog-agent#capturing-an-image-with-the-agent-installed

@Tom-Elliott Okay, thank you for the information.

I ran this command on the host, and then restarted the FogService., but my issue might have been slightly different.

reg add “HKLM\System\CurrentControlSet\Control\Lsa” /v NetJoinLegacyAccountReuse /t REG_DWORD /d 1 /f

Then it joined to AD with no issues.

Are those exisiting machines in AD that you re-imaged with FOG, or were they new devices?

This only happened to us with exisitng machines in AD that we re-imaged and then couldn’t join AD again after.

@sgennadi Thanks for the write-up. It matches what I found. --addcert first appears in sbsigntools 0.9.4, so 0.9.4 is the minimum. EPEL 8 ships 0.9.2, so this affects every EL8 install, not only Oracle Linux. The Rocky Linux Core SIG package you used is a good way to get a newer version.

A dev-branch change (PR #2081) makes the installer test for --addcert before it signs. When the option is missing, the installer now names the required version instead of printing a bare “Failed”.

@sgennadi Thanks for the detailed report. Your diagnosis is right.

Cause: FOG 1.5, and 1.6 builds from before July 2026, stored FOG_MESSAGES in the session as a string. Current code stores a list and appends to it. When a browser still carries one of those old sessions, the inactivity notice tries to append to the string, and every request from that browser returns a 500.

Fix: https://github.com/FOGProject/fogproject/pull/2080, merged to dev-branch. setMessage() now resets a non-list queue, and getMessage() drops old string entries. Pull dev-branch and re-run the installer to pick it up.

If you cannot update right away, clear the FOG cookie in the affected browser, or delete that browser’s session file. The error stops for that browser.

@Shuttleu Thank you for testing on the HP. That confirms the fix on real firmware.

The task error after a menu enrollment. This is a FOS bug, not the agent. The menu item runs the enrollment with no task scheduled. When the enrollment finishes, FOS tries to close the task. The server answers “No Active Task found”, and FOS shows an error. The enrollment itself succeeded. The fix is in FOS release 20261106-134043. After a menu run, FOS now says that no task is scheduled and ends normally. The server records the enrollment on the host only when you schedule the task from the web UI.

FOG Agent. You found the cause. Uninstall keeps C:\ProgramData\FOG on purpose. It holds the machine’s key, its certificate and the trusted CA, so a reinstall keeps the same identity. The reinstall kept the CA of your earlier server, so every connection failed and the token was never used. Agent v0.1.21 fixes this. Setup now checks the stored trust against the server. If it no longer verifies, setup settles trust again like a first install, and the host enrolls again with the token. Until you install v0.1.21, deleting C:\ProgramData\FOG before the reinstall is the right workaround.

Your server certificate comes from your company CA, which Windows already trusts. So no fingerprint is needed, as the probe said. Leave CAFINGERPRINT out on these machines.

@Tom-Elliott

Hopefully I’ll have the answer to that question within the next two weeks!

@fgaudin Good to hear it works.

UEFI alone does not need secureboot=1. The setting is only for computers that have Secure Boot turned on in the firmware. With secureboot=0, FOG does not sign its boot files, and a computer with Secure Boot on refuses to boot them.

If Secure Boot is off on your computers, keep secureboot='0'. If Secure Boot is on, set secureboot='1' and run ./installfog.sh -y. Do not use -C or -K. Each computer then enrolls the FOG key one time at its first PXE boot.

Install sudo before you set it to 1. The Secure Boot signing helper needs /etc/sudoers.d.

@Tom-Elliott All is working now

Hey Tom, updated to 1.6.0.97 this morning and everything checks out:

Exports: migrated to /etc/exports.d/fog.exports, and my kubuntu.exports came through untouched.
SSH keys: fog@fogger key landed in authorized_keys, works on my custom port. Pulled the Match password exception, so the box is key-only again.
Dashboard: 1.5 history is back, and the Nov 3 runs are on Nov 3 now.
Capture: new capture shows local time, no asterisk, and moved out of /images/dev over the key with no errors in the log.
Ports: FOG_SSH_PORT now shows up under FOG Settings → General Settings with my 2416, and the per-node fields are blank, so it falls back to that.

Seriously impressive turnaround. Thanks for taking the reports seriously and running with them!

@Tom-Elliott Hey Tom, updated to 1.6.0.97 this morning and everything checks out:

Exports: migrated to /etc/exports.d/fog.exports, and my kubuntu.exports came through untouched.
SSH keys: fog@fogger key landed in authorized_keys, works on my custom port. Pulled the Match password exception, so the box is key-only again.
Dashboard: 1.5 history is back, and the Nov 3 runs are on Nov 3 now.
Capture: new capture shows local time, no asterisk, and moved out of /images/dev over the key with no errors in the log.
Ports: FOG_SSH_PORT now shows up under FOG Settings → General Settings with my port, and the per-node fields are blank, so it falls back to that.

Seriously impressive turnaround. Thanks for taking the reports seriously and running with them!

@Tom-Elliott All good! Thank you and keep up the awesome work!

@astrugatch Short answer: no, the existing FOG Client does not pull the agent by itself. You push the agent with the tool you already use to deploy software.

What happens when you upgrade the server

Your legacy FOG Client installs keep working against 1.6. The server still serves the legacy client endpoints, so you can run both while you migrate. Nothing on the server needs to change first. Hosts, groups, snapins, printers, power schedules and module settings all carry over. The legacy Client Updater module is gone in 1.6. So the old client cannot update itself into the agent. The FOG server does not host the agent installer. It comes from the GitHub releases page: https://github.com/FOGProject/fog-agent/releases/latest

How to move a machine to the agent

Install the agent MSI on the machine. The MSI finds the legacy “FOG Service” and removes it for you. Do not run the two side by side.

For a silent push (GPO, PDQ, SCCM/Intune, or a script):

msiexec /i fog-agent-<version>-x64.msi /qn SERVER=https://your-fog-server/fog CAFINGERPRINT=<fingerprint> TOKEN=<token> /l*v C:\fog-agent-install.log SERVER is your web UI address with /fog on the end. Old scripts that use WEBADDRESS and WEBROOT still work. CAFINGERPRINT is the SHA-256 on the Root row of FOG Configuration → Certificates. Leave it out if your web UI uses a public or corporate certificate that the machines already trust. TOKEN is optional. Create one under Hosts → Agent Enrollment Tokens. With a token, the host enrolls with no click. Without one, each host waits under Hosts → Pending Agents until you approve it.

The FOG Client page in the 1.6 main menu shows the same command with your server address already filled in.

Images

You can put the agent in your image. Capture the machine as it is, no sysprep needed. A deployed clone detects that it is a different machine and enrolls as itself. If FOG deployed to that host in the last 24 hours, the server approves it automatically.

Docs

Install and migrate: https://docs.fogproject.org/en/latest/installation/client/install-fog-agent (see “Moving from the legacy client”) What changes for an admin (printers, AD join, user tracking): https://docs.fogproject.org/en/latest/management/web/fog-agent Reference: https://docs.fogproject.org/en/latest/kb/reference/fog-agent-reference Troubleshooting: https://docs.fogproject.org/en/latest/kb/troubleshooting/fog-agent-troubleshooting

If an install fails, post C:\ProgramData\FOG\fog-agent.log and the msiexec log here.

@rogalskij Glad to be of help and your finding did notice an issue that was also addressed on the dev-branch so thank you!

@Tom-Elliott As always, thanks for the answer and quick fix 😊

@sgennadi Thanks for this, and for the detail. You were right: the check matched no_root_squash anywhere in /etc/exports, not just on the /images/dev export.

It is fixed now, much the way you proposed. The new nfsDevExportHasNoRootSquash() checks only the <share>/dev export. It ignores comments, other exports, and look-alike paths such as /images/dev2. Your ISO export with no_root_squash no longer triggers the warning.

Issue: https://github.com/FOGProject/fogproject/issues/1988 1.6 (working-1.6): https://github.com/FOGProject/fogproject/pull/1989 (merged) 1.6 RC: https://github.com/FOGProject/fogproject/pull/1990 (merged) 1.5 dev-branch: https://github.com/FOGProject/fogproject/pull/1991 (merged)

To get it now, pull dev-branch (1.5) or rc-1.6.0 (1.6) and re-run the installer. It reaches the 1.5 stable branch with the monthly roll-up on November 11th.

The warning was only a message, so your exports were never changed. If /images/dev is already all_squash, you can ignore it until then.