Files
gsadmin c3e75ceb5a feat: Add HTTP(s) boot BIOS configuration with dynamic tool staging
- Rename OSD-ScriptTemplate to Invoke-HTTPBootBiosConfiguration (script and bootstrapper)
- Configure Dell HTTPS boot via CCTK: enable HttpsBoot, set ManualMode, delete existing HttpBootProfile (avoids stale URL not applying), apply generated profile, and verify the applied URL via --Get
- Build the HttpBootProfile XML with XmlDocument/XmlWriter; embed the dynamically downloaded Let's Encrypt ISRG Root X1 root certificate; IntegrityInfo emitted with an intentionally empty digest (no hashing - values only)
- Default boot image file name snponly_x64.efi is appended when the boot URL does not end with a file name (trailing slash tolerant)
- Add Invoke-ToolStaging toolkit function: downloads and extracts tools into Toolkit\Tools (All/X86/X64/ARM64) regardless of manufacturer, so staged bits travel with the script folder and repeat executions use cached bits; supports RawFile, Archive (.zip/.7z), MSI (administrative extraction), and DellUpdatePackage (7z payload carved by binary signature, extracted with portable 7zr.exe)
- Add ARM64 support to the toolkit OS architecture calculation
- Automatic proxy resolution for downloads: user WinINET proxy, then machine WinHTTP proxy (binary WinHttpSettings parsing incl. per-protocol lists and bypass list), then direct
- Windows PE support; WinPE-MSI only needed for the direct DUP path (stage once from a full OS instead)
- --ValSetupPwd appended only on modification commands when a setup password is supplied; verified CCTK ignores it when no BIOS password is installed, so one command line works fleet-wide
- Git ignore staged tool binaries (cannot be redistributed); add README, Docs (CCTK acquisition, HttpBootProfile reference, WinPE guide), and PowerShell authoring rules under .claude/rules

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-18 22:09:36 -04:00

4.7 KiB

Windows PE Guide

The script runs inside Windows PE (WinPE) so that the HTTP(s) boot BIOS configuration can be performed as a step within an MDT/SCCM task sequence. WinPE is detected automatically by the toolkit (HKLM:\SYSTEM\ControlSet001\Control\MiniNT), and logs are redirected to the standard MDT/SCCM task sequence log locations when a task sequence is running.

Boot image requirements

Component Needed for Notes
WinPE-WMI Manufacturer detection, CCTK Included by default in MDT/SCCM boot images. Dell's own WinPE guidance starts the winmgmt service before running cctk
WinPE-NetFx + WinPE-PowerShell Running the script at all Standard for script-driven task sequence steps
WinPE-MSI Only the dynamic Dell Update Package extraction path (msiexec /a) Not needed when CCTK is pre-staged or downloaded as a portable archive
Network + TLS The dynamic downloads The script enables TLS 1.2/1.3 on the ServicePointManager itself; no OS configuration needed
Proxy (optional) Environments that require a proxy for internet access The script resolves the proxy automatically: user WinINET proxy first, then the machine WinHTTP proxy, then direct. In WinPE/SYSTEM contexts there is normally no user proxy, so configure the WinHTTP proxy when one is required: netsh winhttp set proxy proxy.example.com:8080 "<local>;*.example.com" (run it as a task sequence step before this script)

Dell Command | Configure 5.x needs no HAPI driver installation step in WinPE. Dell's own boot image integration script that ships inside the package simply copies the X86_64 folder into the image, so a copied/extracted cctk.exe folder works as-is (requires the WMI service, which WinPE task sequence environments already run).

Four ways to provide CCTK in WinPE

Pick one, in order of preference:

  1. Stage once from a full Windows operating system (recommended). Run the script once from a full OS out of the same script folder (for example the deployment share). The binaries are staged into Toolkit\Tools and travel with the folder, so every WinPE execution finds them already cached and downloads nothing.
  2. Pre-stage cctk.exe in the boot image (offline capable). Copy the extracted Command Configure\X86_64 folder into the boot image (e.g. X:\Command_Configure\X86_64) as Dell's integration script does, or include it via an extra-files directory / task sequence package. The script finds it automatically when the folder is on the process PATH.
  3. Self hosted portable archive (dynamic, no WinPE-MSI needed). Host a .zip/.7z of an extracted Command Configure tree on your content server and pass -CCTKDownloadURL. See CCTK-Acquisition.md for the required archive layout.
  4. Direct Dell Update Package download (fully dynamic, default). Works in WinPE only when the boot image contains the WinPE-MSI optional component, because expanding the MSI uses msiexec /a. Without it the script fails with a clear error that points at the options above.

ARM64 note: the portable 7zr.exe is an x86 binary. A full ARM64 Windows installation runs it through x86 emulation, but ARM64 WinPE cannot, so options 3 (with a .zip, which needs no 7-Zip) and 4 are unavailable within ARM64 WinPE when a .7z/DUP must be extracted - use option 1 or 2 there. The staged Toolkit\Tools\ARM64\CCTK folder from an x64 staging run covers ARM64 devices via option 1.

Task sequence step example

Run Command Line step (after a "Gather"/network is available, before the reboot that should HTTP boot):

powershell.exe -ExecutionPolicy Bypass -NonInteractive -NoProfile -NoLogo -File "%DEPLOYROOT%\Scripts\Invoke-HTTPBootBiosConfiguration\Invoke-HTTPBootBiosConfiguration.ps1" -BootURL "https://prod.ipxe.example.com/2PXE/boot/x64/snponly_x64.efi" -CCTKDownloadURL "https://contentserver.example.com/tools/CommandConfigurePortable.zip" -SetupPassword "%BIOSPWD%"

Notes:

  • The whole repository folder (script + Toolkit\) must travel together; the script dot-sources Toolkit\Toolkit.ps1 relative to itself.
  • The script auto-elevates in a full OS; in WinPE everything already runs as SYSTEM, so it executes directly.
  • The staging directory defaults to %WINDIR%\Temp\HTTPBootBios, which resolves to the RAM disk (X:) in WinPE. The DUP download plus extraction needs roughly 350 MB of scratch space - increase the WinPE scratch space to 512 MB, or prefer the much smaller portable archive (option 2), which needs about 50 MB.
  • On non-Dell hardware the script logs a warning and exits successfully, so the same step can run unconditionally in a mixed fleet.
  • Failure behavior: any CCTK error, download failure, or a post-apply verification mismatch fails the step (non-zero exit code) unless -ContinueOnError is specified.