davidtgbe

davidtgbe

@theopenem_admin All pcs are W10 Home, included the one in which toems is installed.

davidtgbe

@theopenem_admin Thanks. I kept existing image and did what you pointed. I've dropped PS script below in case it could be useful to someone.

    Set-ExecutionPolicy Bypass -Scope Process -Force

    $NetworkPath = "\\server\share"
    $User = "XXX"
    $PWord = "XXXX"

    $logPath = "k:\Theopenem\logs\$env:computername.log"

    New-SMBMapping -LocalPath "K:" -RemotePath $NetworkPath -ErrorAction Stop -UserName $User -Password $PWord

    Start-Transcript -Path $logPath -Force -Append

    write-host 'Testing URLs'
    $(Invoke-RestMethod -Uri 'http://192.168.1.142:8888/Provision/VerifyDb') -eq "60"
    $(Invoke-RestMethod -Uri 'http://192.168.1.142:8888/Setting/VerifyDb') -eq "60"
    
    Get-Package -Provider Programs -IncludeWindowsInstaller -Name "Toec 1.4.4.0 x64" | Uninstall-Package -Force
    Remove-Item -Path "C:\Program Files\Toec" -Recurse -Force -ErrorAction SilentlyContinue
    
    Import-Certificate -FilePath "k:\Theopenem\toems - root CA.cer" -CertStoreLocation 'Cert:\LocalMachine\Root' -Verbose
    Import-Certificate -FilePath "k:\Theopenem\toems - intermediate.cer" -CertStoreLocation 'Cert:\LocalMachine\CA' -Verbose


    Start-Process 'c:\windows\System32\msiexec.exe' -ArgumentList "/i `"k:\Theopenem\Toec-1.4.4-x64.msi`" /quiet /passive" -Wait

    #get-service -DisplayName 'TOEC' | Stop-Service
    
    Start-Process 'C:\Program Files\Toec\toec.exe' -ArgumentList '--prepareimage' -Wait

    get-service -DisplayName 'TOEC' | Start-Service

    Remove-SmbMapping -LocalPath "K:" 

    Stop-Transcript

Now, every PC is registered, but, I'm having problems with TOEC-API site/app pool. It answers correctly to http://localhost:8888/Provision/VerifyDb just after I start it. But, then. If I perfom a client inventory task for example, it stops responding. I have to manually restart IIS and it starts working again, but it ends hanging again.

TOEC client log:

2021-07-10 01:09:39,841 ERROR [4] ApiRequest - Error Retrieving API Response: System.Net.WebException: Anulada la solicitud: Se excedió el tiempo de espera de la operación.
   en System.Net.HttpWebRequest.GetResponse()
   en RestSharp.Http.GetRawResponse(HttpWebRequest request)
   en RestSharp.Http.GetResponse(HttpWebRequest request)

I've enabled full log ("ALL" log4net level in web.config for TOEC-API backend), but can't see any error. Only debug info.

Only things I've done after image deployment:

disabled tftpd32 service and set service to disabled.
disabled proxy service and set service to disabled.

davidtgbe

@theopenem_admin if the GUID is generated as you describe, it is clear that at some point it has been installed in the master image (don't remember, but could be). What is certain is that TOEC has been installed after deployment (maybe again) on each machine.

I will then execute the command with the argument "--prepareimage" as, if I understand correctly, this way it generates a new installation ID, which is the only ID that matters.

Do I have to enforce registration after this command with "resetpartial"?

Thanks again for you answers.

davidtgbe

@jason-cline On my firs post you have a capture of 2 different PCs registration data (copied pasted between web refreshes, as they don't appear simultaneously). Differents IDs but same Hardware UUID and Installation ID.

FYI, in case anyone is wondering why I'm doing this way. It is because on every computer I have 3 different users (admin, alumn, teacher) with its own configuration (software, restrictions, polcies etc). If I only had one user, I could go with the copy profile and sysprep method. With 3 users, the only ways I know are this one, and the USMT profile restore after image deployment.

davidtgbe

@jason-cline Thanks for your answer.
I have installed TOEC through a poweshell script (winrm) after all PCs have been deployed with the master image. I mean, master image was not captured with TOEC installed.
I have also run this script on every PC, and, I can see on PC list how one PC appears, and, after a moment, it disappears and it is replacer by another.

    $app = 'C:\Program Files\Toec\toec.exe'
    $SERVER_KEY = 'XXXXXXXXXXXXXXXXXXXXX' 
    $CA_THUMBPRINT = 'XXXXXXXXXXXXXXXXXXXXX'
    $COM_SERVERS = '--comservers http://192.168.1.142:8888/'
    $RESETKEYS = "--resetkey $SERVER_KEY $CA_THUMBPRINT"
    $RESETPARTIAL = '--resetpartial'
    $RESETFULL = '--resetfull'

    get-service -DisplayName 'TOEC' | Stop-Service

    Start-Process $app -ArgumentList $RESETFULL
    Start-Process $app -ArgumentList $RESETKEYS
    Start-Process $app -ArgumentList $COM_SERVERS
    #Start-Process $app -ArgumentList $RESETPARTIAL

    get-service -DisplayName 'TOEC' | Start-Service

davidtgbe

Hello,
I successfully deployed 20 computers in a classroom using multicast. So far so good.
Now, I have deployed TOEC to every PC, but they are not registering properly. Only one computer appears in the computer list at a time. They seem to be overwriting themselves. I mean, they have different identifiers, but the same hardware UUID and InstallationID:

Name:PC-16
Identifier:9a801bfc-f9a6-4f81-8f92-1918663669cb
Synced From Active Directory:False
Active Directory GUID:
Active Directory Disabled:False
Installation Id:a254d36d-491f-4263-8990-bda02122e1b5
Hardware UUID:27D35943-70BE-11E8-B37B-7440BB273232
Provision Status:Provisioned
Provision Date:09/07/2021 11:38:32
Last Checkin:09/07/2021 11:38:14
Last Known IP:192.168.1.243
Client Version:1.4.4.0
Last Inventory Time:09/07/2021 11:38:25

Name:PC-20
Identifier:6dcbaec9-ffa1-43a4-a7a3-243457e5cb14
Synced From Active Directory:False
Active Directory GUID:
Active Directory Disabled:False
Installation Id:a254d36d-491f-4263-8990-bda02122e1b5
Hardware UUID:27D35943-70BE-11E8-B37B-7440BB273232
Provision Status:PendingConfirmation
Provision Date:09/07/2021 11:40:32
Last Checkin:09/07/2021 11:38:14
Last Known IP:192.168.1.228
Client Version:1.4.4.0
Last Inventory Time:09/07/2021 11:38:25

It suppose it is so because I have not sysprepped the images. I wanted to keep users and machine configuration and intialization state.

https://techcommunity.microsoft.com/t5/windows-blog-archive/the-machine-sid-duplication-myth-and-why-sysprep-matters/ba-p/723859

PCs are activated and work ok, but would like to know if someone knows a workaround to register TOEC correctly (or may be a newsid alternative for W10, as I think this is the problem).

Thanks!

davidtgbe

Ok, I definitely think there is a problem with UEFI PXE network booting on these new PCs.

My setup:
-Secure boot disabled
-I am using toems DHCP proxy.
-DHCP server and TOEMS on the same server

Tests I have tried:

Working fine on these new machines:

USB boot. (winpe and linux images) with the secure boot option disabled from the iso/usb generator page.
PXE with Winpe as boot option.

Not working on these new machines:

PXE with iPXE -> Does not work. It acquires IP from DHCP, TFTP successfully loads iPXE and shows "Configuring (net0 mac)....". It then times out and falls back to IPv6 PXE and reboots. As you have pointed, this will probably be resolved with a new iPXE version which will be included in the next TOEM release
PXE with Syslinux -> Does not work. TFT transfers files correctly but no menu is displayed. It just restarts.
PXE with Grub -> Does not work. The Grub menu loads correctly, but after selecting the "theopenem" menu, the TFT transfers complete successfully on initrd and kernel, but then nothing else happens. Only the message "Please wait while the boot image is transferred...".

Working on an EFIx64 hyper-v machine:

PXE, all boot methods.

I attach some logs and wireshark captures.
logs-efi64-pxe.zip

I have had another issue. Deploying multicast with winpe does not work in many cases. It boots ok, but it somehow closes de session seconds after starting deployment. It has happened using hyper-v test machines as well as physical ones.

Lastly, JFYI: when using winpebuilder, the latest adk version in which you can build x86 and x64 pe images is the v.2004. Later ones can't be used to build x86 images. Web ui want the two images to be available. If not, when the boot method is changed it warns you and seems it does not store the settings correctly.

davidtgbe

@theopenem_admin said in Unable to boot:

It seems that maybe an updated version of ipxe may be needed for this model which is planned for the next release. When using the usb / iso, make sure you have the secure boot support option disabled from the iso / usb generator page.

Ok, thanks! the secure boot support option disabled from the iso / usb generator page did the trick.

Now I'm wondering.... I have been trying to complete the setup to boot from network/pxe. I can set the proxy efi64 bootloader to grub instead of ipxe to bypass the ipxe version problem with those new PCs. With this configuration, pxe booting shows grub menu, but it is like if I were booting the secure boot enabled version with the iso/usb. I mean, it only shows the message of "Plase Wait While The Boot...." and hangs.

I can see that there are two folders in Toec-API/private/client_iso/grub_binaries/{signed|unsigned} and I my guess is that signed is used to build the secure boot enabled version of the iso and the other for the secure boot disabled one. I'm trying to understand if the PXE process does something similar...

Am I missing something else? If I boot through PXE UEFIx64 with secure boot enabled, BIOS stops the boot process (as expected) because grub signature is not trusted (I guess).
If I boot through PXE UEFIx64 boot with secure boot disabled, PC hangs after grub selection is made.

Thanks again.

davidtgbe

Hello,
I have a running TOEM installation (last version) which has been used to upload/deploy images on HP computers through PXE/BIOS.
I now have 20 new computers (HP M01-F2006ns) to add to the classroom. These new HP PCs can't be configured with a legacy BIOS boot. Instead, UEFI boot must be used.
I have disabled secure boot and enabled network boot.

First problem I faced were that PXE is not working. PCs load ipxe, but enter in a "configuring (net0 .... )" state which, when finishes (I suppose there is a timeout there), falls back to IPv6 PXE boot (not enabled on server side) and finally to a reboot.

I then tried to build an ISO and boot from USB. I then faced another problem. Grub boot menu appeared and I could select Theopenem, but only the "Please Wait While The Boot Image Is transferred..." message was shown and the boot process stopped there (PC got hanged up).

I have tried all the kernels provided and debug initrd with the same result.

I can see in tftp logs and wireshark how the kernel and initrd files are trasnferred correctly.

My last resort has been to build the winpe environment, from which I can boot using an USB as PXE is not working with UEFI as I said.

Can anyone shed some light here?
Thanks!

davidtgbe

Just to help with this. What happened to me is that I missed the step of setting the organization name. Once set, I could generate the certificates.

davidtgbe

@theopenem_admin Thanks for the answer.
I will try with 7zip as you suggest. Any ideas regarding the other topics?
-remotely organization ID parameter
-default remotely login
-how to access to remotely database file?

davidtgbe

Hello,
I have been trying to deploy remotely through policy, following the videotutorial instructions.

I have installed the addon on the server, with its certificate, and can access to ports 444 and 8000 from the clients.

The problem is that remotely is not being installed on clients. This is a client log example.

2021-07-15 02:32:59,678 INFO [23] ServiceTriggerAction - Trigger Action: Checkin. Complete.
2021-07-15 02:34:43,206 INFO [3] ServiceTriggerAction - Manual Checkin Request Received
2021-07-15 02:34:43,206 INFO [3] ServiceTriggerAction - Checking For Checkin Policies
2021-07-15 02:34:43,472 INFO [3] PolicyCacher - Caching Policy 2722d4a8-d79c-409a-9cfc-f838174c49e6 (Enable Remote Access)
2021-07-15 02:34:43,472 DEBUG [3] PolicyCacher - Creating directory for cached files
2021-07-15 02:34:43,472 DEBUG [3] ServiceFileSystem - Creating Directory C:\Program Files\Toec\AppData\99999999-9999-9999-9999-999999999999
2021-07-15 02:34:43,486 DEBUG [3] PolicyCacher - Download File Remotely_Installer.exe
2021-07-15 02:34:43,486 DEBUG [3] ApiRequest - ProvisionedComm/Policy/GetFile/
2021-07-15 02:34:43,565 ERROR [3] PolicyCacher - Could Not Cache Module: Remote Access
2021-07-15 02:34:43,565 INFO [3] PolicyCacher - Finished Caching Policy 2722d4a8-d79c-409a-9cfc-f838174c49e6 (Enable Remote Access)
2021-07-15 02:34:43,565 DEBUG [3] PolicyRunner - Releasing The Download Connection.
2021-07-15 02:34:43,565 DEBUG [3] ApiRequest - Policy/RemoveDownloadConnection/
2021-07-15 02:34:43,627 INFO [3] PolicyExecutor - Executing Policy 2722d4a8-d79c-409a-9cfc-f838174c49e6 (Enable Remote Access)
2021-07-15 02:34:43,627 DEBUG [3] PolicyExecutor - Evaluating Conditions For Enable Remote Access
2021-07-15 02:34:43,627 DEBUG [3] PolicyExecutor - No Conditions Found For Module
2021-07-15 02:34:43,643 INFO [3] ModuleRemoteAccess - Running Remote Access Module: 
2021-07-15 02:34:43,643 INFO [3] ModuleRemoteAccess - Installing Remote Access Service
2021-07-15 02:34:43,643 DEBUG [3] ApiRequest - ProvisionedComm/Policy/GetRemotelyInstallArgs/
2021-07-15 02:34:43,752 INFO [3] ModuleCommandManager - Running Command Module: Install Remotely
2021-07-15 02:34:43,752 DEBUG [3] ServiceProcess - Starting Command: cmd.exe /c  "C:\Program Files\Toec\AppData\99999999-9999-9999-9999-999999999999\Remotely_Installer.exe" -install -quiet -organizationid  -serverurl http://192.168.1.142:8000/ -path 'C:\Program Files\Toec\AppData\99999999-9999-9999-9999-999999999999\Remotely-Win10-x64.zip'
2021-07-15 02:39:43,795 DEBUG [3] ServiceProcess - Process has exceeded the timeout value
2021-07-15 02:39:43,795 INFO [3] ModuleCommandManager - {"ExitCode":0,"StandardError":"Process has exceeded the timeout value","StandardOut":""}
2021-07-15 02:39:43,795 INFO [3] ModuleCommandManager - Command Module: Install Remotely Finished
2021-07-15 02:39:43,953 ERROR [3] ServiceSystemService - El servicio Remotely_Service no se encontró en el equipo '.'.
2021-07-15 02:39:43,953 ERROR [3] ModuleRemoteAccess - Could Not Change Remotely Startup Type
2021-07-15 02:39:43,953 DEBUG [3] ServiceFileSystem - Reading Remotely Connection File
2021-07-15 02:39:43,968 ERROR [3] ServiceFileSystem - Could Not Read Connection File
2021-07-15 02:39:43,968 ERROR [3] ServiceFileSystem - No se puede encontrar una parte de la ruta de acceso 'C:\Program Files\Remotely\ConnectionInfo.json'.
2021-07-15 02:39:43,968 INFO [3] PolicyExecutor - Finished Executing Policy 2722d4a8-d79c-409a-9cfc-f838174c49e6 (Enable Remote Access)
2021-07-15 02:39:43,968 INFO [3] PolicyRunner - Policies Complete.  Starting Policy Cleanup.
2021-07-15 02:39:43,968 INFO [3] PolicyRunner - Submitting Policy Results
2021-07-15 02:39:43,968 INFO [3] PolicyRunner - Completed Submitting Policy Results
2021-07-15 02:39:43,968 INFO [3] PolicyRunner - Cleaning Policy Cache

File "C:\Program Files\Toec\AppData\99999999-9999-9999-9999-999999999999\Remotely_Installer.exe" does exist on the client, but its size is 0KB. File "Remotely-Win10-x64.zip" does not exists on the client. It seems is not being copied.

Just to test it, I've manually copied the needed files to one client, and launch the install command, which seems to be:

"C:\Program Files\Toec\AppData\99999999-9999-9999-9999-999999999999\Remotely_Installer.exe" -install -quiet -organizationid  -serverurl http://192.168.1.142:8000/ -path 'C:\Program Files\Toec\AppData\99999999-9999-9999-9999-999999999999\Remotely-Win10-x64.zip'

If I launch that command without the "-quiet" flag, installer complains about not supplying an organizationid. I don't know where is that GUID. If I supply a GUID, remotely installs correctly and I can see the remote registration ID for that client on the server ui, but can't launch a remote session on that client.

On the other side, navigating to remotely portal on server (on port 444 or 8000) asks for a login. I don't know if there is a default login to manage settings here. I can see there is a sqlite db in "C:\Program Files\Theopenem\Remotely\remotely.db", but, I haven't been able to list its contents with dbeaver and its sqlite connector.

If anyone has any clues to debug the problem, I would appreciate it.

Thanks!

PD: I'm running these tests with IIS (not IIS Express) on W10 Home. Only one client at a time try to avoid concurrent connection limit.
I can run TOEC-API, TOEMS-API and TOEMS-UI sites without problems with IIS Express, but I'm trying to resolve a problem with remotely site not loading properly on IIS Express, most probably due to aspnetcore2 module.

Server logs

#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken
2021-07-15 09:50:06 192.168.1.142 GET /Provision/ComConnectionTest/ - 8888 - 192.168.1.248 RestSharp/106.3.1.0 - 200 0 0 3121
2021-07-15 09:50:06 192.168.1.142 POST /ProvisionedComm/Policy/GetClientPolicies/ - 8888 - 192.168.1.248 RestSharp/106.3.1.0 - 200 0 0 586
2021-07-15 09:50:06 192.168.1.142 POST /Policy/CreateDownloadConnection/ - 8888 - 192.168.1.248 RestSharp/106.3.1.0 - 200 0 0 129
2021-07-15 09:50:06 192.168.1.142 POST /Policy/RemoveDownloadConnection/ - 8888 - 192.168.1.248 RestSharp/106.3.1.0 - 200 0 0 98
2021-07-15 09:50:06 192.168.1.142 GET /ProvisionedComm/Policy/GetRemotelyInstallArgs/ - 8888 - 192.168.1.248 RestSharp/106.3.1.0 - 200 0 0 139
2021-07-15 09:50:06 192.168.1.142 GET /signalr/negotiate clientProtocol=2.0&connectionData=[%7B%22Name%22:%22ActionHub%22%7D] 8888 - 192.168.1.248 SignalR.Client.NetStandard/2.4.0.0+(Microsoft+Windows+NT+6.2.9200.0) - 200 0 0 288
2021-07-15 09:50:07 192.168.1.142 GET /signalr/start clientProtocol=2.0&transport=webSockets&connectionData=[%7B%22Name%22:%22ActionHub%22%7D]&connectionToken=RddD%2FqAPmczbiCYHBsGSCqEyHC9EBrN3wQg6yYnba4qFBxUY0MW26Ub%2BPlfNC00SzH7V0uq%2BGZbgBiDEhRPklWczF9%2BYZgOpTPRByLqkA0eoJL4zt25MjlpNnL1lcRxR 8888 - 192.168.1.248 SignalR.Client.NetStandard/2.4.0.0+(Microsoft+Windows+NT+6.2.9200.0) - 200 0 0 66
2021-07-15 09:50:11 192.168.1.142 GET /signalr/negotiate clientProtocol=2.0&connectionData=[%7B%22Name%22:%22ActionHub%22%7D] 8888 - 192.168.1.242 SignalR.Client.NetStandard/2.4.0.0+(Microsoft+Windows+NT+6.2.9200.0) - 200 0 0 69
2021-07-15 09:50:11 192.168.1.142 GET /signalr/start clientProtocol=2.0&transport=webSockets&connectionData=[%7B%22Name%22:%22ActionHub%22%7D]&connectionToken=d1MIu%2BPh%2FFdvnjXLjvWASwQ%2B8dYa9SLHFBJ9IIebYnP%2BO6%2FG6f65PoNdW9YqYqIWI4%2Fjcz6eeA64xM%2BAibiQOhuE7HE0thouTmK1pFoKAzBcIfnYfBPx0hL%2FHdXg1Km9 8888 - 192.168.1.242 SignalR.Client.NetStandard/2.4.0.0+(Microsoft+Windows+NT+6.2.9200.0) - 200 0 0 55
2021-07-15 09:50:35 192.168.1.142 GET /Provision/ComConnectionTest/ - 8888 - 192.168.1.242 RestSharp/106.3.1.0 - 200 0 0 31
2021-07-15 09:50:35 192.168.1.142 POST /ProvisionedComm/Policy/GetClientPolicies/ - 8888 - 192.168.1.242 RestSharp/106.3.1.0 - 200 0 0 106
2021-07-15 09:50:35 192.168.1.142 POST /Policy/CreateDownloadConnection/ - 8888 - 192.168.1.242 RestSharp/106.3.1.0 - 200 0 0 81
2021-07-15 09:50:35 192.168.1.142 POST /ProvisionedComm/Policy/GetFile/ - 8888 - 192.168.1.242 RestSharp/106.3.1.0 - 404 0 0 70
2021-07-15 09:50:35 192.168.1.142 POST /Policy/RemoveDownloadConnection/ - 8888 - 192.168.1.242 RestSharp/106.3.1.0 - 200 0 0 101
2021-07-15 09:50:35 192.168.1.142 GET /ProvisionedComm/Policy/GetRemotelyInstallArgs/ - 8888 - 192.168.1.242 RestSharp/106.3.1.0 - 200 0 0 152
#Software: Microsoft Internet Information Services 10.0
#Version: 1.0
#Date: 2021-07-15 09:58:42
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken
2021-07-15 09:58:41 192.168.1.142 POST /Storage/GetFreeSpace - 8888 - 192.168.1.142 RestSharp/106.3.1.0 - 200 0 0 202
2021-07-15 09:58:42 192.168.1.142 POST /Storage/GetFreeSpace - 8888 - 192.168.1.142 RestSharp/106.3.1.0 - 200 0 0 20
2021-07-15 09:58:52 192.168.1.142 POST /Socket/SendAction - 8888 - 192.168.1.142 RestSharp/106.3.1.0 - 204 0 0 77
2021-07-15 09:58:52 192.168.1.142 POST /ProvisionedComm/Policy/UpdateLastSocketResult/ - 8888 - 192.168.1.248 RestSharp/106.3.1.0 - 200 0 0 288
2021-07-15 09:58:52 192.168.1.142 GET /Provision/ComConnectionTest/ - 8888 - 192.168.1.248 RestSharp/106.3.1.0 - 200 0 0 43
2021-07-15 09:58:52 192.168.1.142 POST /ProvisionedComm/Policy/GetClientPolicies/ - 8888 - 192.168.1.248 RestSharp/106.3.1.0 - 200 0 0 298
2021-07-15 09:58:53 192.168.1.142 POST /Policy/CreateDownloadConnection/ - 8888 - 192.168.1.248 RestSharp/106.3.1.0 - 200 0 0 117
2021-07-15 09:58:53 192.168.1.142 POST /Policy/RemoveDownloadConnection/ - 8888 - 192.168.1.248 RestSharp/106.3.1.0 - 200 0 0 85
2021-07-15 09:58:53 192.168.1.142 GET /ProvisionedComm/Policy/GetRemotelyInstallArgs/ - 8888 - 192.168.1.248 RestSharp/106.3.1.0 - 200 0 0 153

davidtgbe

I've migrated the installation to an IIS Express and it is working great so far.

davidtgbe

@theopenem_admin OMG, I missed that one. Thanks!
10 concurrent connections for IIS on W10 Pro. I will take a look at IIS logs and investigate if there is a workaround (apart from paying a server license :/)

davidtgbe