Internet-based PC provisioning and rebuild – aka ‘remote build’
Remote work is no longer a luxury — it’s essential, and isn’t about to change anytime soon.
Remote is the new normal
During the COVID-19 pandemic, a huge chunk of the global workforce went remote in the blink of an eye. Some of our customers added 240k new VPN users in three short days. The new normal is a 'hybrid' model of work that combines home and office.
New IT challenges
The new hybrid work model presents enterprises with new IT challenges. Corporate VPNs are stressed, and network management and security has become even more complex for IT teams stretched thin and operating under tremendous strain.
Key IT tasks designed to be on-premise only can no longer be managed in the same way. A prime example of this is PC rebuild and onboarding of PCs over the Internet.
New IT strategies
The COVID pandemic permanently changed the way we work, and IT management will never return to the old "normal."
New remote work habits are established. Companies are formulating strategies to protect their networks, operations and employees and guard against another unforeseen crisis that sends the workforce home.
With work from home arrangements now common, how can PCs be built and rebuilt when employees are not in the office?
Remote rebuild obstacles
Traditional PC rebuild scenarios like staff onboarding or break fix scenarios require networks and infrastructure to be available. They were never built to enable an entire workforce to work remotely all the time, or even for weeks and months at a time.
The problem is companies still need to maintain that provisioning and 'break fix' alongside key aspects of PC management for all computers and devices connected to the network.
PC management gets a whole lot more complicated when everyone's out of the office.
There are three major challenges:
How do we remotely start and build a device?
How do we securely re-establish connectivity with our home base?
How can we leverage existing infrastructure investments as much as possible?
Traditional USB-based installation media presents critical disadvantages in an enterprise setting:
Security – there is no way to guarantee the media has not been tampered with.
Update management – keeping media up-to-date is complicated but essential to securely re-initiate endpoints.
Compatibility – drivers for USB media must be tailored to the device.
If USB media isn't the best solution, what is?
Allowing home/remote users to build PCs from the cloud/internet is a solution, but there are challenges to overcome.
Remote build scenarios raise capability questions for IT:
How do we build over Wi-Fi only?
How we do build over the internet securely?
How do we make remote build simple enough for users to manage on their own?
How can IT monitor and shadow installations being done from home?
Introducing imaging from the cloud
Remote builds
A better approach to deploying PXE over the WAN
2Pint Software’s iPXE Anywhere is a next-generation network booting solution that enables secure, fast, and reliable operating system deployment. It operates in the most challenging environments, and the simplest.
iPXE Anywhere is built for maximum flexibility and can handle any remote build scenario with minimal management overhead. Extremely simple to set up and manage, iPXE Anywhere is unsurpassed as a solution to the challenges of Modern Windows Management.
For remote branches, the absence of remote servers often means there are no local PXE capabilities – a major obstacle to rebuilding machines remotely, securely, and efficiently.
iPXE Anywhere overcomes this challenge with remote over-the-WAN PXE booting which simplifies and speeds up enterprise-wide OS deployments of PCs.
Boot securely using either USB (iPXE binary only on the USB media) or PXE boot directly in your remote locations. You can even boot directly from the cloud, over the Internet, using secure HTTPS network booting.
The clean source principle
The clean source principle dictates that all security dependencies must be equally trustworthy as the object being secured.
This principle is key when deploying over the internet, as we are no longer playing in our own back yard.
An attacker that compromises the source media gains access to everything the device later controls (including user credentials), and everything the user controls (including high privilege user access).
Applying the clean source principle to installation media requires that it has not been tampered with since being released by the manufacturer. Software integrity must be validated throughout the possession lifecycle – including during acquisition, storage, and transfer up until use.
For 2Pint Software this means building over the wire using HTTPS, verifying the download media, and ensuring no access paths contain text files with passwords or other vulnerabilities.
Secure software and media acquisition
The source of the software is validated through a combination of protocols:
- Software packages that can be tampered with are never stored on media like USB sticks. This includes boot.wim files, which are always fetched from a verifiable (server) source.
- Boot.wim files are always downloaded over HTTPS with hash verification before trusts.
- All deployments are trackable and verified with user credentials.
- Trust is only escalated after successful user verification.
- Multifactor authentication can be configured for extra security.
- All software obtained from the internet is validated with vendor-provided file hashes.
2Pint Software remote build scenarios
Build over Internet infrastructure
You can build from the cloud with minimal infrastructure and setup using 2Pint Software tech.
iPXE 100% remote build
Yes, your OS deployments can be 100% remote and user driven!
Build at home with ethernet
Rebuild a broken PC from home? No problem - ask us how it's done, book a demo!
Phone tether expanded
You can even rebuild over a 4/5G connection using mobile phone tethering! Talk to one of our experts today.
How do we do it?
In a 4-step process we start by booting the machine with an iPXE binary that contains no customer information at all. The PC then queries the infrastructure for configuration, providing credentials to be verified.
Step 1: iPXE – where it all starts
The iPXE binary comes from one of the following sources:
- From the target machine (if still bootable and previously configured)
- A USB drive with only a 300KB stage binary on it
- PXE booted directly
By using iPXE as a starting point, we have a non-customizable source point that we can verify the integrity of.
Step 2: From iPXE to network
Once in iPXE, we query the device for industry standard protocols such as the SNP/NII drivers if using an Ethernet network card, or more likely the user's smartphone (which gives us access to WiFi or LTE type data sources). From this network connection, we then authenticate and take the actions determined by the customer – that’s you. Once all required checks are complete, we download WinPE and move to a higher level.
Step 3: From WinPE – the world is your oyster
As WinPE is always downloaded from a tamper-free source, we can guarantee no unwanted config is introduced in the process. Typically, the process in WinPE is entirely hands-off as well.
Step 4: From full OS – domain join and VPN set up
After leaving WinPE we do the actual domain join (offline) via Azure PowerShell automation services or via custom-based web services if required. Once that is completed, the machine is typically configured to set up VPN access with the appropriate configuration using certificates.
2Pint Software technology used
- iPXE Anywhere 2PXE Server – for initial boot configurations
- iPXE Anywhere Web Service – for custom scenarios
- OSD Toolkit – for the WinPE carrier
- StifleR – for operations and monitoring
Works with the following Microsoft technology
- Microsoft Configuration Manager (MEMCM)
- Microsoft Intune
- PSD – PowerShell Deployment