@Tom-Elliott

i updated the uefi bios and i got more options under “secure boot” all the options before i got were just “enable ms uefi ca key”, i clicked on all uefi ca’s and i can now boot into windows

Hi all,

I’m deploying an image I captured using fog and trying to deploy it to a pc with secure boot on but when fog deploys the image using partclone and it reboots after it’s imaged it I get a secure boot error,
I did do enroll secure boot keys to this pc using the fog pxe menu

SECURE BOOT
Selected boot image did not authenticate

Is there another setting on uefi i need to change as i do know hp z workstations are a nightmare as they have a lot of settings on the uefi ie vmd ie raid and hp sure start

Thanks,
Rob

@Tom-Elliott tbh ive found in my own experience if you install windows with secure boot on or off and then after if you change secure boot you get the blue screen

@Tom-Elliott

am i right in thinking i could capture the image using uefi non secure boot but i can deploy it to either uefi secure boot (need to enroll to fog) or non secure boot but then if it installs the image on secure boot on or off i then cant change the secure boot setting in bios as thats when windows will blue screen

@Tom-Elliott thanks Tom, you have been very helpful!!!

@Tom-Elliott

ok so if I want to use fog with a host with secure boot on, I need to “enroll secure boot key” and once the keys been burnt in the FW of the host it’s good to work with fog so it’s a one off thing you do and then you don’t have to enrol that specific host anymore ie a one time thing

@Tom-Elliott makes sense

as going forward we do need secure boot on for sophos endpoint for bitlocker

so does that mean if i delete the host from the web portal i need to re register it if i want to deploy or capture a new image?

@Tom-Elliott lovely

what i did once i registered the host i clicked on “task” and clicked “enroll secure boot”

and now i see all the info now once its enrolled secure boot, i see all the info once i refresh the host on fog web portal

so tom, tbh i dont get it, why do you have to “enroll secure boot” on a host, do i need to to capture or deploy images?

as my main goal is to capture/deploy images to hosts when “secure boot” is on/ticked in bios

@Tom-Elliott ok ive got somewhere

so i did “quick enrollment” and now i see it on the web portal

after i did “enroll secure boot key”

went back on the host on the web portal and i dont see the key its enrolled

answer to your questions

curl -s -o /dev/null -w '%{http_code} %{size_download}\n' http://10.110.10.60/fog/service/ipxe/bzImage
200 11063696

cant do the other one as now its registered the host on fog

@Tom-Elliott

i get this now when i do a quick enrollment

very wierd, when i pxebooted i got a black screen cli (different from the usual white gui one)

i restarted again (got the correct white screen gui), clicked on “quick enrollment”, went back to the web portal and cliked “all hosts” and i could see the host it added

@Tom-Elliott but do i need to enroll the machine to capture/deploy an image?

@Tom-Elliott the file isnt there

ls -l /var/www/html/fog/service/secureboot/mmx64.efi
ls: cannot access '/var/www/html/fog/service/secureboot/mmx64.efi': No such file or directory

reran the install and now when i do a ls the file is there

now what please tom

EDIT - ok ive enrolled the key, i had to select “iPXE”

how do i know its working/enrolled?

hi all,

i get this

i have a windows DHCP server and ive added the right boot options

let me know

thanks,
rob

@Tom-Elliott
thanks it was lighttpd so i purged it

hi all,

trying to install fog 1.6 on ubuntu 24.04 but i get this error on the install script

the exact version im trying to install is

https://github.com/FOGProject/fogproject/archive/refs/tags/1.6.0-RC-10.tar.gz

Starting and checking status of web services................Failed!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!! The installer was not able to run all the way to the end as   !!
!! something has caused it to fail. The following few lines are  !!
!! from the error log file which might help us figure out what's !!
!! wrong. Please add this information when reporting an error.   !!
!! As well you might want to take a look at the full error log   !!
!! in /tmp/fogproject-1.6.0-RC-10/bin/error_logs/fog_error_1.6.0-RC-10.log !!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

             ├─87893 "php-fpm: pool www"
             └─87894 "php-fpm: pool www"

Oct 14 12:57:09 lon-c-clonezilla01 systemd[1]: Starting php8.3-fpm.service - The PHP 8.3 FastCGI Process Manager...
Oct 14 12:57:09 lon-c-clonezilla01 systemd[1]: Started php8.3-fpm.service - The PHP 8.3 FastCGI Process Manager.

and when i look at the log

AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1. Set the 'ServerName' directive globally to suppress this message
Syntax OK
Job for apache2.service failed because the control process exited with error code.
See "systemctl status apache2.service" and "journalctl -xeu apache2.service" for details.
× apache2.service - The Apache HTTP Server
     Loaded: loaded (/usr/lib/systemd/system/apache2.service; enabled; preset: enabled)
     Active: failed (Result: exit-code) since Wed 2026-10-14 12:57:09 UTC; 59ms ago
       Docs: https://httpd.apache.org/docs/2.4/
    Process: 87882 ExecStart=/usr/sbin/apachectl start (code=exited, status=1/FAILURE)
        CPU: 51ms

Oct 14 12:57:09 lon-c-clonezilla01 systemd[1]: Starting apache2.service - The Apache HTTP Server...
Oct 14 12:57:09 lon-c-clonezilla01 apachectl[87885]: AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1. Set the 'ServerName' directive globally to suppress this message
Oct 14 12:57:09 lon-c-clonezilla01 apachectl[87885]: (98)Address already in use: AH00072: make_sock: could not bind to address [::]:80
Oct 14 12:57:09 lon-c-clonezilla01 apachectl[87885]: (98)Address already in use: AH00072: make_sock: could not bind to address 0.0.0.0:80
Oct 14 12:57:09 lon-c-clonezilla01 apachectl[87885]: no listening sockets available, shutting down
Oct 14 12:57:09 lon-c-clonezilla01 apachectl[87885]: AH00015: Unable to open logs
Oct 14 12:57:09 lon-c-clonezilla01 systemd[1]: apache2.service: Control process exited, code=exited, status=1/FAILURE
Oct 14 12:57:09 lon-c-clonezilla01 systemd[1]: apache2.service: Failed with result 'exit-code'.
Oct 14 12:57:09 lon-c-clonezilla01 systemd[1]: Failed to start apache2.service - The Apache HTTP Server.

● php8.3-fpm.service - The PHP 8.3 FastCGI Process Manager
     Loaded: loaded (/usr/lib/systemd/system/php8.3-fpm.service; enabled; preset: enabled)
     Active: active (running) since Wed 2026-10-14 12:57:09 UTC; 22ms ago
       Docs: man:php-fpm8.3(8)
    Process: 87895 ExecStartPost=/usr/lib/php/php-fpm-socket-helper install /run/php/php-fpm.sock /etc/php/8.3/fpm/pool.d/www.conf 83 (code=exited, status=0/SUCCESS)
   Main PID: 87883 (php-fpm8.3)
     Status: "Ready to handle connections"
      Tasks: 6 (limit: 37986)
     Memory: 11.8M (peak: 12.3M)
        CPU: 89ms
     CGroup: /system.slice/php8.3-fpm.service
             ├─87883 "php-fpm: master process (/etc/php/8.3/fpm/php-fpm.conf)"
             ├─87890 "php-fpm: pool www"
             ├─87891 "php-fpm: pool www"
             ├─87892 "php-fpm: pool www"
             ├─87893 "php-fpm: pool www"
             └─87894 "php-fpm: pool www"

Oct 14 12:57:09 lon-c-clonezilla01 systemd[1]: Starting php8.3-fpm.service - The PHP 8.3 FastCGI Process Manager...
Oct 14 12:57:09 lon-c-clonezilla01 systemd[1]: Started php8.3-fpm.service - The PHP 8.3 FastCGI Process Manager.

let me know

thanks,
rob

@rodluz

ok scrap the local GPO done this and it works

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce /v firstlogon /t REG_SZ /d powershell -noexit -ep bypass c:\users\admin\sysprep\firstlogon.ps1 /f

@rodluz

solved…

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn789190(v=ws.11)

i used a computer startup script

script name:
C:\Users\admin\sysprep\firstlogon.ps1

script parameters:
powershell -ep Bypass

and heres the script (just made a rough one to test and every command ran as when i logged in after the pc syspreped all commands worked)

start-process 'C:\Users\admin\sysprep\Firefox Setup 138.0.exe' /S -wait

Remove-ItemProperty -Path "HKLM:\SOFTWARE\Wow6432Node\AdventNet\DesktopCentral\DCAgent\" -Name "ImagedComputer" -Force

Remove-Item -Path "HKLM:\SOFTWARE\Wow6432Node\AdventNet\DesktopCentral\DCAgent\SystemDetails" -Force

Set-LocalUser -Name "user01" -PasswordNeverExpires $true
Set-LocalUser -Name "it" -PasswordNeverExpires $true

remove-item -path C:\Users\admin\sysprep -recurse -force

@rodluz thanks but doesnt this need a VL key to run those scripts?

ok ive done this and it works

<component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="NonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <RunSynchronous>
                <RunSynchronousCommand wcm:action="add">
                    <Description>firstlogon</Description>
                    <Order>1</Order>
                    <Path>C:\Users\admin\sysprep\firstlogon.bat</Path>
                </RunSynchronousCommand>
            </RunSynchronous>
        </component>

and my bat is just this

@echo off

C:\Users\admin\sysprep\SophosSetup.exe --quiet

rmdir /Q /S C:\Users\admin\sysprep

this works but when i try to run a powershell command that needs admin it cant do it ie

powershell.exe -ExecutionPolicy Bypass -File path-to-ps1

in there i just have this

Set-LocalUser -Name “user” -PasswordNeverExpires $true

but everytime after the sysprep and it loads into windows it hasnt done it as it hasnt got admin privs

so how come cmd had admin but ps1 doesnt?

any idea please

thanks,
rob

hi all,

turned off “secure boot” obviously to use fog to deploy a image to a pc after windows is installed turned back on “secure boot” but now windows cant boot and going into automatic repair mode and cant boot windows

is there anyway to turn on secure boot after windows and windows still works?

thanks,
rob