Hi Tom,

In my case the culprit was /images/postdownloadscripts/fog.postdownload.

echo "Activating boot partition..." sfdisk --activate /dev/sda 1 echo "Rebooting..." reboot -f

Fix was simply commenting out (or deleting) those lines. After cleanup the file looks like this:

cat /images/postdownloadscripts/fog.postdownload #!/bin/bash ## This file serves as a starting point to call your custom postimaging scripts. ## <SCRIPTNAME> should be changed to the script you're planning to use. ## Syntax of post download scripts are #. ${postdownpath}<SCRIPTNAME>

Thanks for the pointer, Tom — saved me from chasing GPT partition tables for a problem that had nothing to do with them.

@servicedesk-pianezza Confirmed, and your fix is the right one. Thanks for the clear report.

The check was using the 24-character Base24 alphabet. That set is what you use to decode an older key into its binary form, and N is not one of its digits. It is not the set of characters a key is printed with. Windows 8 and later put N in the key itself, so any key carrying one was refused at entry.

There was a second half of the same bug. The browser keeps its own copy of that character list, for the masked display of a saved key. So even where a key with an N got stored, the page showed it as five groups of dots instead of keeping the first and last group. Both copies now say the same thing, and a test compares them character for character so they cannot drift apart again.

The test also runs Microsoft’s published KMS client keys through the validator, and checks that the characters Windows leaves out (A E I O U L S Z 0 1) are still rejected and the length is still exactly 25.

It is in PR #1773 against working-1.6: https://github.com/FOGProject/fogproject/pull/1773

It will be in the next beta build. If you would rather not wait, the one-character edit you already made is exactly what landed.

@Tom-Elliott
Multicast
cb765515-1c91-406f-bac6-c30fd8dca2e3-grafik.png
7d927a7b-ff64-4544-bdc1-f166768eeb5c-grafik.png
deee65ea-e430-40ff-b5e9-732fd60bf0de-grafik.png WhatsApp Image 2026-09-22 at 10.31.53(1).jpeg WhatsApp Image 2026-09-22 at 10.31.53.jpeg

root@fog:~/FOG_SERVER_Updates_durchführen# tail -n 40 /opt/fog/log/multicast.log [09-08-26 9:49:42 pm] * No new tasks found [09-08-26 9:49:52 pm] * No new tasks found [09-08-26 9:50:02 pm] * No new tasks found [09-08-26 9:50:12 pm] * No new tasks found [09-08-26 9:50:22 pm] * No new tasks found [09-08-26 9:50:32 pm] * No new tasks found [09-08-26 9:50:42 pm] * No new tasks found [09-08-26 9:50:52 pm] * No new tasks found [09-08-26 9:51:02 pm] * No new tasks found [09-08-26 9:51:12 pm] * No new tasks found [09-08-26 9:51:22 pm] * No new tasks found [09-08-26 9:51:32 pm] * No new tasks found [09-08-26 9:51:42 pm] * No new tasks found [09-08-26 9:51:52 pm] * No new tasks found [09-08-26 9:52:02 pm] * No new tasks found [09-08-26 9:52:12 pm] * No new tasks found [09-08-26 9:56:33 pm] ===== FOG 1.5.10.2473 -- MulticastManager starting ===== [09-08-26 9:56:33 pm] Interface Ready with IP Address: 10.10.3.196 [09-08-26 9:56:33 pm] Interface Ready with IP Address: 127.0.0.1 [09-08-26 9:56:33 pm] Interface Ready with IP Address: 127.0.1.1 [09-08-26 9:56:33 pm] Interface Ready with IP Address: 192.168.0.196 [09-08-26 9:56:33 pm] * Starting MulticastManager Service [09-08-26 9:56:33 pm] * Checking for new items every 10 seconds [09-08-26 9:56:33 pm] * Starting service loop [09-08-26 10:00:14 pm] ===== FOG 1.5.10.2473 -- MulticastManager starting ===== [09-08-26 10:00:14 pm] Interface Ready with IP Address: 10.10.3.196 [09-08-26 10:00:14 pm] Interface Ready with IP Address: 127.0.0.1 [09-08-26 10:00:14 pm] Interface Ready with IP Address: 127.0.1.1 [09-08-26 10:00:14 pm] Interface Ready with IP Address: 192.168.0.196 [09-08-26 10:00:14 pm] * Starting MulticastManager Service [09-08-26 10:00:14 pm] * Checking for new items every 10 seconds [09-08-26 10:00:14 pm] * Starting service loop [09-08-26 10:08:36 pm] ===== FOG 1.5.10.2473 -- MulticastManager starting ===== [09-08-26 10:08:36 pm] Interface Ready with IP Address: 10.10.3.196 [09-08-26 10:08:36 pm] Interface Ready with IP Address: 127.0.0.1 [09-08-26 10:08:36 pm] Interface Ready with IP Address: 127.0.1.1 [09-08-26 10:08:36 pm] Interface Ready with IP Address: 192.168.0.196 [09-08-26 10:08:36 pm] * Starting MulticastManager Service [09-08-26 10:08:36 pm] * Checking for new items every 10 seconds [09-08-26 10:08:36 pm] * Starting service loop root@fog:~/FOG_SERVER_Updates_durchführen#

I use two network cards—the “192” network is the one with the PCs, and the “10” network contains only servers and my backup servers …

@ahaeder A final setting - you have to set Bios exit type = GRUB (not the default SANBOOT) or the boot hangs at ‘Booting from SAN device’.

Now I read the AI summary and got what I need:

It stores one row for each address in the hostNetwork table. Limits of this method The sleeping host must run fog-agent. The server uses the sleeping host’s own last report to find its subnet. A host with the legacy FOG Client, or with no client, has no rows, so the relay cannot help it. The old path still runs for it.

So If I populate the hostNetwork table for the hosts that I need manually, It will work. Thank you for the details.

@Jason89436 Thanks for the report. The agent had no snapin pack support, and on Windows it also dropped backslashes from snapin arguments. Both are fixed. Update the server to the latest working-1.6, then update the agent to 0.1.10. After that, [FOG_SNAPIN_PATH]\msoffice.ps1 resolves to the unzipped pack folder, as it did with the legacy client.

@mp12 Thanks for the logs. This is a bug in 1.5.10.2482, not your node passwords.

A security change in 2482 removes the storage node password from the node data that the API returns. The image and snapin replicators read their node list from that same data. So they now send an empty password, and every node rejects the login. The Undefined property: stdClass::$pass warning is that missing field.

The fix is merged to dev-branch: https://github.com/FOGProject/fogproject/pull/1770

To get it now, update from dev-branch:

cd /path/to/fogproject git checkout dev-branch git pull cd bin sudo ./installfog.sh -y

Or wait for the next stable release. Your stored passwords are correct, so you do not need to change anything on the nodes.

@AUTH-IT-Center I do believe snponly would be the recommended, rather than iPXE’s driver.

The developers at iPXE wrote the driver on their own (of course using documentation and stuff, but for all intents/purposes it is still a handrolled driver) so anything is possible.

We shipped the native iPXE 2.0.0 mainly because of the feature it allows with actual Secureboot capabilities and instead of embedding everyfile with a custom script, a more dynamic approach for when iPXE releases new version we can upgrade more easily.

For what it’s worth, I would almost want more people to default to snponly.efi (or secureboot/snponly-shimx64.efi if using/wanting secureboot after enrolling your machines of course) because this is supposed to be using the generic driver for EFI boot protocols on the NIC rather then attempting to discover the NIC using a driver loaded.

Glad you have a workaround. I think the cause is the Windows boot manager certificate change, not the image.

Your golden Optiplex installed Windows with Secure Boot on. Windows servicing then added the “Windows UEFI CA 2023” certificate to that machine’s db, and switched the boot files to a boot manager signed with it. The other Optiplex 3000s only trust the 2011 Microsoft certificates, so they reject that boot manager. bcdboot works because it copies the older 2011-signed boot manager.

Can you confirm with two checks, in admin PowerShell, on the golden machine and on one target?

[Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023' mountvol S: /s (Get-AuthenticodeSignature S:\EFI\Microsoft\Boot\bootmgfw.efi).SignerCertificate.Issuer

If the golden machine says True and the target says False, that is the cause. A newer Dell BIOS may include the 2023 certificate in its default keys. I am also looking at having FOS add it during the Secure Boot enrollment task.

@Tom-Elliott I edited the sshd_config file and changed
/usr/lib/openssh/sftp-server
to
internal-sftp

I’m not sure how the installer failed to make this accomodation in the first place but I’m glad it appears to be working. I deployed the image to another laptop to make sure everything is working. It looks like the problem can be considered resolved now. Thanks for your help!

@gmaurice resetting the host encryption in the gui and then restart the fog service and it should be back up and running. You can also use the api for this, the FogApi powerhsell module (links in my signature) I have this Reset-HostEncryption function https://fogapi.readthedocs.io/en/latest/commands/Reset-HostEncryption/?h=reset+host which will also handle this reset.

Your other other option is to look into post download scripts, there’s some examples in the forums and the docs. If you’re using sysprep and unattend.xml you can inject domain join information into the unattend.xml after imaging and before windows launches for the first time, so the computer is joined to the domain before the fog service or any ui is reachable.

@Tom-Elliott Thank you, tested, confirmed it’s fixed.

@scottrayr I’m not able to replicate the issue you’re seeing.

@Balage80 Thanks for confirming the enrollment fix.

UEFI boot: I think the cause is two new lines in default.ipxe. They read Secure Boot state from the firmware. iPXE reads it by stepping through every firmware variable, and some firmware never ends that list, so iPXE hangs there.

Please test this: take the new 979-byte default.ipxe and delete only these two lines. Keep everything else.

param secureboot ${efi/SecureBoot} param setupmode ${efi/SetupMode}

Does UEFI boot with that file? Please also post the make, model, and BIOS version of the machine. Note that re-running installfog.sh writes a new default.ipxe, which replaces a manual edit.

Pending MACs: these are not related to default.ipxe. They come from the legacy FOG Client’s Host Registration module. That module reports every adapter Windows sees, including Wi-Fi, Bluetooth, and virtual Wi-Fi Direct adapters. FOG stores each unknown MAC as pending, up to FOG_QUICKREG_MAX_PENDING_MACS per host (default 4). iPXE cannot see those adapters. You can delete the pending MACs. To stop new ones, add MAC fragments to FOG_QUICKREG_PENDING_MAC_FILTER (comma separated), or turn off Host Registration.

@Tom-Elliott That was quick 😊 I just tested and it works as expected. Thank you.

Rahman

@Tom-Elliott

I can’t modify the company’s switches or other hardware since the system is in production. I’m currently rebuilding the FOG server on a VM on my PC and doing everything locally; it’ll be easier to troubleshoot that way. Gemini has wiped out all the previous messages and is giving me nonsense—I can’t seem to recreate the environment up to the capture stage anymore. Could you give me a rundown of everything that needs to be done—downloads, decompressing specific files in binary mode, etc.?

Thanks.

@azm9s Good that legacy boot works now. For UEFI, your first tcpdump already shows one problem. It stops UEFI clients on every board, with Secure Boot on or off.

First: remove option 60 from your Windows DHCP server.
Your DHCP offer contains option 60 = “PXEClient”. UEFI firmware reads this as “this server is a PXE boot server”. It sends a second request to 192.168.65.35 on UDP port 4011 and waits. FOG does not listen on port 4011, so the firmware stops before it downloads any file. That is why no boot file worked. Legacy network boot does not do this, so legacy works. You only need option 60 if WDS runs on the same server as DHCP.

Second: set option 67 for UEFI to secureboot/snponly-shimx64.efi.
Your version (1.5.10.2253) installs this file. Check that it is there:

ls /tftpboot/secureboot/

It is signed by Microsoft, so it boots with Secure Boot on or off. You do not need to disable Secure Boot. Do not point option 67 at secureboot/ipxe.efi directly. With Secure Boot on, the firmware rejects it. If the menu loads but the network does not start, use secureboot/ipxe-shimx64.efi instead.

To keep legacy and UEFI working at the same time, use Windows DHCP policies. Vendor class PXEClient:Arch:00000 keeps your current legacy file, and PXEClient:Arch:00007 gets the file above:
https://docs.fogproject.org/en/latest/kb/how-tos/bios-and-uefi-co-existence

If UEFI still fails after these two changes, run this on the FOG server while the PC boots, and post the output:

tcpdump -i eth0 -n -vv ether host fc:9d:05:76:7c:00

FYI for anyone else running into this issue - I believe the problem was that I didn’t erase the /tftpboot images when I switched from http to https. I’m not really sure why that would matter, but when I did that, then re-ran the server reinstall and selected https, the images got but back in /tftpboot and my hosts didn’t see the mac error anymore.

@ahaeder No:

The idea of fog client is to rename the host based on what you name the computer within FOG, not the other way around.

If you want it to be a specific name, and you have the FOG Client installed, set the wanted name in the FOG UI, and the host will change automatically.