SCCM PXE Network Boot Process


Architecture detection using wdsnbp

A SCCM PXE-Handshake with architecture detection uses an additional step. Before sending the final bootstrap file, the SCCM server sends out a bootstrap file which has an included architecture detection. The file is called „“. This is necessary, because the architecture information provided by the smbios is not very reliable. The wdsnbp bootstrap file sends back a DHCP request reply which contains an additional DHCP option 250. This high option is normally not used by other tools and contains information concerning the architecture of the client system.


Client pre-boot check and bootfile check

Right after the first contact of the client, die SCCM server checks for the necessary bootfiles. If the bootfiles are not present in the boot-directory (normally Remoteinstall\SMSboot), the server will not send out a DHCP offer. Since the bootfiles are extracted of the WinPE wim files during the startup of the WDS service, you should make sure, that only WinPE WIM files are stored within the SMSPXEIMAGES$ share and not full-os WIM files.

Secondarily the SCCM server checks whether the client exists within the SCCM database. If the client is unknown, the SCCM server will not send out a DHCP offer.

Note, that there has been added an unknown computer support in SCCM 2007 R2:

About Unknown Computer Support for Operating System Deployment

The check of the client can be surveilled within the smspxe.log. Important are the stored procedures „lookupdevice“ and „getbootaction“ The first one checks, whether the client is known while the second one checks, what boot-file should be sent:

· (user has to press F12 to proceed – optional Advertisement)
· Pxeboot.n12 (TFTP download starts instantly - mandatory Advertisement)
· (stops the PXE Boot)


A SCCM PXE-DHCP handshake looks like that:

DHCP and PXE service run on different machines)

DHCP Discover
· Client broadcast asking for IP address and PXE-capable DHCP service
· DHCP discover package contains option 60
· DHCP discover uses port 67 UDP

SCCM site check
· SCCM server checks, whether client is known (lookupdevice)

DHCP Offer
· Reply of the DHCP server containing IP address offering on port 68 UDP
· Reply of the DHCP or PXE server containing option 60

DHCP Request
· Client broadcast, ready to acknowledge IP address and boot server (port 67 UDP)

· Server broadcast, acknowledge clients IP address and lease (port 68 UDP)

DHCP Request
· Client unicast request for options 66 (boot server) and option 67 (boot file) (port 4011 UDP)
· Unicast addresses server which offered option 60

· Server ack from PXE server including options 66 and 67 (send WDSNBP)
Start of the bootstrap file “wdsnbp” download using TFTP (UDP 69 and UDP highlevel ports)

DHCP Request
· Client unicast request for options 66 (boot server) and option 67 (boot file) (port 4011 UDP)
· Unicast addresses server which offered option 60
· Contains option 250 with architecture

SCCM site server check
· SCCM server checks for current boot action (getbootaction)

· Server ack from PXE server including options 66 and 67 (send pxeboot.n12 for example)

TFTP download of bootfile
TFTP download of WinPE

Screenshot of a sample boot:


Comments (14)

  1. In a standard configuration you won't be spefifying any file at all. And you should not configure any boot server. You should rather specify DHCP helper adresses on your gateways. Thus, the client can find the SCCM server themselves and negotiate the correct bootstrap file.

  2. Exactly as mentioned before. You need to have 1433 open on your FW.

  3. Davut EREN says:

    Good Post. Thank you

  4. G says:

    Do you need to configure the DHCP scope with option 60 to get this working?

  5. Dominik says:

    Only if WDS and DHCP server reside on the same machine.

  6. Chad says:

    When the PXE service is located on a secondary site server does it need access to the SQL server database?…/bb632618.aspx  Ports Used by Configuration Manager line item # 38 states that the PXE service point will also contact the SQL server on 1433.  Can you explan when and why this occurs.  Thank you.

  7. Dominik says:

    Yes, it does. As you say on def port 1433

  8. Chad says:

    SCCM site check · SCCM server checks, whether client is known (lookupdevice)

    If PXE is installed on a Secondary Site Server, when the "SCCM Server checks, whether client is known" does it verify directly against the SCCM database or does it forward the request to the Primary and then the Primary site verifies that the clients is "known"..  

    In otherwords, to use PXE at a secondary site would you have to open 1433 on the firewall and allow the secondary site direct access to the SQL database?

  9. nik says:

    currently im getting the following error:

    PXE-T01: The specified file was not found

    PXE-E3b: TFTP Error- File Not found

    PXE-M0F: Exiting Intel PXE ROM.

    I think may have the wrong file specified by DHCP.

    currently I'm telling it to give out "".

    It doesn't specify the exact path. Our DHCP server is running solaris.

    Is that the correct file that I should be specifying? Do I need to put the path? If yes what would that path be? I've post this on ms-connect site and nobdy there is responding.

  10. James McDonald says:

    What if everything goes well, until it tries to download the pxeboot.n12 file, and all it does is this:

    TFTP Download:  smsbootx64pxeboot.n12


    TFTP Download:  smsbootx64pxeboot.n12


    TFTP Download:  smsbootx64pxeboot.n12


    over and over, and it never downloads.

  11. sipp says:

    What if the DHCP Option 250 is missing from the DHCP Request going to the SCCM PXE SP? What could be the reason for this?

    We currently have this issue at one location. The SCCM PXE SP is used successfully at other locations as well as the client.

    Any help is appreciated….

  12. skyman says:

    The handshake is flawed.

    Everything below the following line look rushed and not correct, must have been a last minute deadline and nobody verified this as correct.

    "DHCP Ack

    · Server ack from PXE server including options 66 and 67 (send WDSNBP) "

    Since when do DHCP servers send files…or did they forget to mention this was sent via tftp?

  13. zhr says:

    I am having a problem with PXE booting at my secondary site. My config is as follows:

    1 Primary Site (Server 2008 R2 STD)

    1 Secondary Site (Server 2008 R2 STD)

    The secondary site has the following roles :

    Distribution point with PXE enabled & unknown computer support ticked

    Management point

    My DHCP options are the following :

    option 66 : IP of secondary site server

    option 67 :

    both X86 & x64 boot files have been distributed to the DP

    when i boot the machine i keep getting "Pending request id : (different number each time", i have checked my collections & there is no "Unknown" entry.

    in smspxe.log file  machine's MAC address doesnt even appear…

    please could someone help me figure this out

    thank you

  14. Robert says:

    Start WDS Service again…..

Skip to main content