PXE Deployment with Surface Pro

PXE support has been added to Surface Pro as part of the May firmware update.  This means that as long as you have the Surface Pro Ethernet Adapter and installed the firmware update you can now perform PXE based deployments to Surface Pro. For detailed guidance on updating firmware on Surface pro please refer to my previous blog post – http://blogs.technet.com/b/deploymentguys/archive/2013/05/14/deploying-drivers-and-firmware-to-surface-pro.aspx.

To perform a deployment from your existing Windows Server 2008 R2 or Windows Server 2012 WDS server you need to do the following:

  1. Attach the Surface Pro Ethernet Adapter to the Surface Pro.
  2. Press and hold the volume down button and then press the power button, continue to hold the volume down button until the Surface starts to boot from the USB key.

           A dialog box will appear that states that it is “Checking Media Presence……”. Then it will “Start PXE over IPv4”.

       3. When prompted press Enter for network boot service.

The Surface Pro should now connect to your PXE server and allow you to perform a normal deployment.

For further details on Surface Pro deployment please refer to the Surface Pro – Enterprise Deployment Quick Start Guide within the Surface Pro firmware and driver pack that I worked with the Surface Team create.

This post was contributed by Ben Hunter, a Solution Architect with Microsoft Consulting Services.

Disclaimer: The information on this site is provided "AS IS" with no warranties, confers no rights, and is not supported by the authors or Microsoft Corporation. Use of included script samples are subject to the terms specified in the Terms of Use.

Comments (59)

  1. Ben Hunter says:

    Hi James,

    After you see "Start PXE over IPv4" you should then be prompted to press enter, if you don't press enter it  will try IPv6.

    Are you seeing the enter prompt?



  2. Ben Hunter says:

    Hi James,

    What type of PXE server are you using, UEFI deployment is supported by the servers that are listed at this link: support.microsoft.com/…/en-us

    I have used a Windows Server 2012 WDS server.



  3. Ben Hunter says:

    Hi James,

    This issue is covered in this KB article – support.microsoft.com/…/EN-US. Essentially you will need to use IP Helpers rather than specifying a boot file via DHCP.



  4. Anonymous says:

    I am having same issue Surface Ethernet driver not found. i have enabled command line support, ip address is not assigned to machine. Can you please advise Surface Ethernet Adapter drivers?

  5. Ben Hunter says:

    Hi James,

    I am using the default WDS configuration with a Windows PE 4.0 boot image. I have not made any changes to DHCP.



  6. Ben Hunter says:

    Hi Steve,

    You will need to perform the update process from running OS, this means that you will need to perhaps boot to the OS that is delivered with the device and then perform the update. This could be done via Windows Update or Manually as described in this post – blogs.technet.com/…/deploying-drivers-and-firmware-to-surface-pro.aspx. Please not that the firmware updates are not available via WSUS, only Windows Update or via the Firmware and drivers pack.



  7. Ben Hunter says:

    Hi Rob,
    You must have the official Surface NIC.

  8. Anonymous says:

    Hi James

    What you do exactly on the switch

    The Helper Address from the DHCP Server or the PXE Boot Server

    Do you have me an exemple?

    Thanks in advanced.

  9. Anonymous says:

    do you know if the last firmware update allows to PXE install in proxyDHCP mode using i.e. Serva ?

  10. Ben Hunter says:

    Hi Ryan,

    The official Surface Pro Ethernet Adapter is required.



  11. S1m0nB says:

    Hi Chris, we do exactly this – use one adapter for build of multiple surfaces. Create a device collection based on the MAC of the adapter, then after each surface is built delete the record from this collection. Sometimes there is a wait of around 5-15
    minutes for the delete to complete, but after that it will be an unknown device again and you can move on to the next one. Assuming you then join the network via wireless SCCM will create another record for the client based on the wireless MAC. No issues with
    this approach so far. Cheers, Simon

  12. S1m0nB says:

    Jay J – you mean not getting IPv4 pxe? Try going into bios (volume up while power on), disable tpm and secure boot, save, then go in again and enable them both, delete and recreate secure boot keys, save then try the pxe again. I had some devices where this made them work again. For 32bit drivers try the softpedia link above.

  13. S1m0nB says:

    Hi, try this link… still cant find one on MS site but these worked for us.

  14. Anonymous says:

    can anybody help with the above issue ^^^ ?. Thanks in advance.

  15. engstromr says:

    Is the Surface Pro Ethernet Adapter required, or can other usb Ethernet adapters be used?  I have attempted to boot to an HP usb adapter and it just continues to boot to Windows.

  16. More to the point, for a new just unboxed Surface Pro, how can we get the firmware update on it to allow PXE booting without having to go through the process of setting it up, connecting to the internet and downloading via wsus?



  17. James Jamerson says:


    We followed the instructions in the PDF referenced in this article.  When we try to PXE boot the Surface Pro, the device says "Start PXE over IPv4" then "Start PXE over IPv6" then it boots into Windows.

    PXE boot is working will all machines in our organization except the Surface Pro.  We have installed the May 2013 firmware on the Surface Pro, created the PE boot file on the Server 2012 WDS server (using MDT 2012), and are using the Microsoft Surface Ethernet adapter.

    Is there something we are missing?

    Thank you.

  18. James Jamerson says:

    We are not prompted for To press enter… it just moves on to IPv6 then WIndows.

    On the DHCP server, we changed the bootfile (Option 67) from wdsnbp.com to wdsmgfw.efi.  After making the changes, it boots staright into the bootfile menu and displays the IP address of our WDS server but it never establishes a connection.

    What bootfile are you using?


  19. James Jamerson says:

    We are using WIndows Server 2012 for WDS (and PXE).

    What bootfile are you using?  It's listed in the DHCP scope options (Option 67)

  20. James Jamerson says:

    Do you have WDS running on your DHCP server?  We have the two services on separate servers – which is why we need to specify option 066 (Boot Server Host Name) and option 067 (Bootfile Name).  Option 066 points to our WDS server.  Option 067 points to the bootx86wdsnbp.com file on the WDS server.

    Without configuring these options in the DHCP server, clients do not know what server to connect to when booting form the network.

    Do you have any suggestions?  We have contacted Microsoft's Surface Support but they have not been helpful.

  21. James Jamerson says:

    We removed the DHCP options and configured the switch with a helper address and it worked!  Thank you, Ben!

  22. Rodger Rau says:

    James, I am running into the exact same situation.  Did you add the helper address on the vlan interface of the switch the client is connecting to?

  23. Steve Kish says:

    I wonder if the Surface 2's docking station will also allow for PXE booting?

  24. Carson says:

    Now that I've added the SCCM server as a helper IP, the process no longer waits for a few minutes on IPv4, it flashes something so fast I can't read then moves to IPv6, then onto boot locally.  This is with the dock.

  25. Steve says:

    The Surface 2 dock DOES allow pxe boot. Just got mine the other day and I am in the middle of imaging from MDT via PXE right now!

  26. JJ J0nes says:

    Does anyone know if it is possible to image the Surface RT with the Surface Pro Ethernet adapter?

    -Thanks for any guidance.

  27. Patrick Rowley says:

    Are there 32-bit Surface Ethernet drivers available somewhere? The only drivers I can see won't inject into a 32-bit boot.wim (for SCCM 2012 PXE boot)

  28. Patrick Rowley says:

    By the way, the .pdf links for the Quick Start Guide as supplied by MS are currently invalid. Any way to get them locally from you?

  29. Patrick Rowley says:

    Steve: Did you have an issue with Secure Boot? Did you have to turn it off?

  30. Ben Hunter says:

    Hi Patrick,

    There are no 32 Bit drivers for Surface Pro, you could download 32-bit drivers from Marvell directly. The link points to the Surface driver pack which includes the PDF.



  31. Simon B says:

    Hi, I am attempting Surface Pro PXE boot with SCCM 2012 R2 using MDT 2013 boot disk.  It loads the entire PE environment to the stage where it should display the SCCM Password dialog, however the dialog is not displayed and the system reboots.  Any ideas?

  32. S1m0nB says:

    Hi Ben, I am successfully PXE booting using SCCM MDT 2013 boot image, however when it gets to the stage where our SCCM password screen should appear the Surface reboots.  Any ideas?  I tried disabling secure boot but this had no effect.  Have also tried a MDT 2012 boot disk, same result.

  33. Ben Hunter says:

    Hi Simon,

    You should not need to disable secure boot. I would suggest that you enable the F8 option in ConfigMgr and then bring up the cmd prompt using F8 from within Windows PE. Once you have the CMD prompt you should search for the SMSTS.log file, this will show you what is wrong. I would also check to see if you have got an IP address from the CMD prompt and if you can she the hard drive using Diskpart, this will tell us if the drivers are correctly included within Windows PE.


  34. PatRick says:

    So here's the scenario:

    Surface Pro 2, Surface Pro Ethernet Adapter or Dock

    SCCM 2012R2 w/PXE Hotfix

    PXE booting from the same VLAN as the SCCM Server (no forwarding or DHCP options configured)

    Verified that PXE Boot works for a laptop.

    Surface Pro 2 PXE boot, "PXE Booting from IPv4," quick popup regarding NBP Filename and NBP File Size, "Downloading NBP File…" and then it instantly switches to PXE Booting from IPv6.

    So we're seeing PXE and trying to download the NBP file, and then an error. This is probably Carson's issue as well. Any ideas?

  35. S1m0nB says:

    Hi Ben, cheers but now I'll have to ask some potentially silly questions!  I feel I am missing something here 🙂  SO the Enterprise deployment guide says 'you'll need to install the Ethernet driver into your PE boot disk' (download from manufacturer), but MS is the manufacturer and there is no Ethernet driver in the October pack or on the MS site for this Surface Pro Ethernet device.  I assumed that I wouldn't need it, but found it today on Softpedia (no luck finding it anywhere else), but sadly I still have the reboot issue in WinPE with it loaded, so maybe it is not needed.  I do have the F8 option enabled but on a touchscreen Surface Pro 2 I have no keyboard so I cant press F8?  Nobody else seems to be complaining about these issues hence my suspicion I'm missing something fairly crucial here… how can I press F8, do I need an external keyboard?

  36. S1m0nB says:

    Ahem… so my colleague just showed me the keyboard that came with the Pro 2 – DOH!! (sheepish grin)… let's try that again =)

  37. S1m0nB says:

    Eventually realised I could still pxe boot using a hub with keyboard plugged in – the driver I found was 32bit – found 64bit and all is well…

  38. ChrisG says:

    I am having some of the same issues as listed here. Originally our Surface Pro 2s wouldn't PXE boot at all and we had to disable Spanning Tree and configure IP helpers – DHCP options just didn't work at all with the Surface Pros for some reason. After
    doing this, I was able to PXE boot the Surface Pros but found that the latest WinPE doesn't have native driver support for the Surface Pro 2 official MS Ethernet adapter and the driver pack provided by MS didn't include the driver for the official MS Ethernet
    adapter, so had to find the driver at a random site on the internet and add it to the boot image. Then, the PXE-initiated builds were working for a day, although the build took over 2 and a half hours over the USB 2 100 mb Ethernet adapter. However, today
    none of the Surface Pros will PXE boot, including the one that built fine yesterday, despite the fact that I have been told that there haven't been any changes. Meanwhile, PXE boot is working fine for all other models. Right now, as much as I like the Surface
    Pros for general use, I wish the Surface Pros hadn't been selected due to the headaches that they cause for enterprise deployment.

  39. ChrisG says:

    OK, I owe the Surface Pro an apology. It turns out that most of the issues that we were having were related to the way that we were trying to build the Surface Pros and not a performance issue with them. I thought that I should post this by way of apology
    to those responsible for the Surface Pro (and especially Ben 🙂 ) and also as a cautionary word of warning to anyone who might try to build them the same way as we did. The flaw in our plan seems obvious, in hindsight, but you can easily get caught out if
    you don't think the scenario through. The situation is that the Surface Pro doesn't come with an Ethernet port and so, in order to PXE boot them, you need the official MS Ethernet adapter. As the customer doesn't really want an Ethernet adapter for these machines
    for general use, they had just bought a few to do builds with, with the intention that once a build had completed then the Ethernet adapter would be reused for the next Surface Pro. Meanwhile, we haven't advertised the Windows 8.1 task sequence to All Systems
    yet – it is only getting deployed to Unknown Computers and a Windows 8.1 Deployment collection. And now to explain the problem: As OSD recognises the computer by MAC address… When you attach the same Ethernet adapter that has already been used to the second
    Surface Pro and then try and PXE boot it, SCCM queries for a client record with the MAC address that you are reusing, finds the client record for the computer that you have already built, and no longer recognises it as an Unknown computer. So, we could either
    advertise the deployment to All Systems (but we aren't ready for migration yet, and we don't have a build yet that has been sufficiently tested), or we could add the MAC addresses for all the Ethernet adapters to the Windows 8.1 Deployment collection, but
    we are concerned that sharing MAC addresses may cause other SCCM issues. Once a network card and MAC address has been discovered and associated with a client, will SCCM register if the network card is taken away again and disassociate the MAC address from
    the client record? If so, wouldn't you have to wait for the next hardware inventory cycle for this to take place? I would be interested in hearing whether Ben, or anyone else from MS, has developed ways of sharing the Ethernet adapter for PXE build purposes,
    while still being able to limit deployment to a specific custom collection, and not causing any other issues for SCCM.

  40. Collin says:

    Can you use the official Microsoft surface doc and PXE boot with the built in NIC?

  41. Jay J says:

    Im having the same issue's as Patrick and Carson, was there any solution to this?

  42. Mark says:

    the February driver downloads at the same address now include a "Surface Ethernet Adapter Driver" zip file that has the driver for the USB-ethernet adapter for PXE booting/adding to your boot wim.

  43. ChrisG says:

    For anyone not getting the IPv4 PXE option – if you can't see any other explanation for why it might be happening, try a hard reset as per these instructions. This has solved a lot of my IPv4 PXE problems, where I couldn't find any other explanation – as soon as I did this they were able to PXE boot.
    Step 1: Press and hold Volume Up (located on the left side) and the Power button at the same time for at least 15 seconds, then release both.
    The screen may flash the Surface logo, but continue holding the buttons down for at least 15 seconds.
    Step 2: After you release the buttons, wait 10 seconds.
    Step 3: Press and release the Power button to turn your Surface back on.

  44. miro says:

    In a following scenario where the Surface Pro does not have a type-cover or a USB keyboard attached, would you please give us some pointers on how to load the on-screen keyboard application (part of Ease of Access utilities) or the TabTip.exe (Tablet input panel accessory)?

  45. MEMORY_ERROR says:

    Have a Surface Pro 2 with a docking station and it's letting me boot via PXE.

  46. Dean White says:

    Hi, I hope someone can help I am using an MDT deployment over PXE for Surface Pro 2. I can boot into PXE and get the MDT menu and can start the process just after the Operating Install the unit reboots and then gets stuck on the boot file menu where you can change the TPM and secure boot settings and cannot go any further? Any suggestions

  47. Rob says:

    Do you have to use the MS nic? I have a Belkin NIC and my Surface Pro 2 will not boot from it.

  48. Chris S says:

    I'm having the strangest issue. My Enter Key doesn't see to work. Once I get the Media Present> Start PXE IPv4 I would hit enter, it would PXE boot like normal and all seems well. I'm trying to capture the image, and I guess I don't have the Capture Image
    setup correctly for Windows 8.1, so after some re-configuring my boot images, I'm now trying to PXE boot to try to capture the Surface's Image, and when the Media Present>Start PXE IPv4 shows, I press enter key and nothing happens. I used to get the downloading
    the NPB (or something like that), but it just moves on trying the IPv6 then boots back into windows. I've tried all other key combinations, nothing. I'm using the MS Ethernet dongle, it's a Surface Pro 3 with all the latest firmware and OS updates. When the
    OS loads, I get the correct IP address, everything seems to work. I've also tried a different keyboard. Any ideas?


    Chris S.

  49. Gary Lindner says:

    Having similar problems deploying Windows 8.1 to Surface Pros. I'm using WDS form Windows Server 2012 R2 and MDT 2013. I am using the Surface Ethernet adapter. I have two of them and am deploying about 45 Surface Pros and 5 Surface Pro 2s. It's worked
    for about 30 Surface Pros and all the Surface Pro 2s. However, I now have about 10 Surface Pros that fail to connect and through the 0xc0000022 error. I will try both Ethernet adapters on each of these. I do not use SCCM. Any idea how I might be able to work
    around it?

  50. Chris says:

    WDS Error 0xC0000022 when PXE booting @Surface Pro? Delete the Secure Boot Keys (Vol Up + Power), turn off, then retry PXE boot. Worked for me after applying all the damn updates….

  51. Todd says:

    Hold the volume down. NEVER EVER would have figured that one out! Thanks.

  52. Don says:

    Ben, PXE booted to my WDS but stopped the process to make a change in SCCM. I'm using the Surface Docking station vs the Surface Ethernet Adapter. When I try and boot it again from the network it blows right by to windows. Doesn't seem like holding the
    "Volume Down" button at power on is working any longer. All updates have been installed including the Firmware..


  53. DeanW says:

    Thx Chris in regards to "WDS Error 0xC0000022 when PXE booting @Surface Pro? Delete the Secure Boot Keys (Vol Up + Power), turn off, then retry PXE boot. Worked for me after applying all the damn updates…."
    Worked a treat for me, had it all working OK for Pro 2 and 3's but had a few old standard pros come back to me which needed cleaning and reimaging. Thanks again 🙂

  54. mniceguy81 says:

    Dear Ben, Thanks for all information but i'm having the same issue on one of our DP''s. The issue is it ipv4 skips fast and then goes directly to ipv6. I checked smsts pxe log on the Server and found the SP3 is looking for image "looking for PSXXXXXX"
    but our other devices boot correctly just SP3 skipping ipv. Any ideas would help.

  55. Falfonse says:

    I am having similar issue, all devices work/boot up fine except for SP3. I disabled UEFI, setup all the DHCP settings and ports (60, 66, 67) but I am still not able to boot the surface pro 3 into pxe. It goes to ipv4 gets the ip address and flashes package
    not received before trying ipv6. Dell/Lenovo works without any issue. Do you think the only work around is to setup IP and get rid or DHCP to control the traffic?. please advise as I am stuck on this one.

  56. Errol says:

    Surface Pro 3 doesnt support PXE using DHCP option 66/67. You need to add a IP Helper on the switch.

  57. Rodel says:

    Hello Ben,
    I just bought a Surface Pro for my user and want to install the Altiris Agent. In fact I saw the client installed on the device and it was trying to connect to our altiris server, but disconnected itself with a message unable to connect to server. Any idea
    what happened?

  58. Chauncey Helgeson says:

    We had to make sure it was booting from the 64bit boot image. Using SCCM, the last OS advertised must be 64bit.

  59. Eugene says:

    Hi, I have the Surfacebook with a docking station and LAN drivers from Surface 3 injected to the boot image (no lan drivers for surfacebook). PXE starts, however after the welcome screen Surface restarts, before asking for ConfigMgr password. I don't understand,
    why Microsoft Surfacebook with Microsoft docking station does not work with Microsoft ConfigMgr 2012 R2 🙂