> For the complete documentation index, see [llms.txt](https://documentation.2pintsoftware.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://documentation.2pintsoftware.com/2pxe-server/4.0/configuration/2pxe-config-file.md). # Configuring 2PXE Server {% hint style="danger" %} **Configuration Manager compatibility** Configuration Manager integration is not currently supported by 2PXE Server 4.0. The MEMCM settings and examples on this page are retained for reference only. {% endhint %} 2PXE Server 4.0 changes how the server is configured. Earlier versions kept their settings in the `` section of the **2Pint.2PXE.Service.exe.config** file, which you edited by hand. Starting with 4.0, that file is no longer used. Settings are stored in the registry under `HKEY_LOCAL_MACHINE\SOFTWARE\2Pint Software\2PXE`, and you change them with the **Configure 2PXE** configuration editor. The configuration editor: * Shows every supported setting, with its current value, grouped by area. * Hides settings that do not apply to your configuration. For example, the ConfigMgr settings only appear when the integration mode is set to ConfigMgr. * Validates values (required fields, URLs, certificate thumbprints, and so on) before they are saved. * Encrypts the content access password with the machine key, so it is never stored in plain text. {% hint style="warning" %} Do not edit the 2PXE registry values directly. Use the configuration editor so that values are validated, and passwords are encrypted, before they are saved. {% endhint %} {% hint style="warning" %} In-place upgrades from 2PXE Server 3.x to 4.0 are not supported. For upgrade and migration instructions, see [Upgrading to 2PXE Server 4.0](/2pxe-server/4.0/whats-new-and-upgrades/upgrading-to-2pxe-server-4.0.md). {% endhint %} ## Opening the configuration editor The installer adds a **Configure 2PXE** shortcut to the Start menu, in the **2Pint Software** folder. The shortcut runs the configuration editor, which is installed in the **TwoPint.ConfigEditor.Wpf** folder inside the 2PXE installation folder: ``` "C:\Program Files\2Pint Software\2PXE\TwoPint.ConfigEditor.Wpf\TwoPint.ConfigEditor.Wpf.exe" TwoPint.TwoPxe.Configuration.editor ``` The editor also opens automatically at the end of a manual installation, as long as the **Launch Configuration Editor** checkbox on the **Completed** page of the installer is selected. Run the editor as a local administrator, because it writes to `HKEY_LOCAL_MACHINE` and manages the **2Pint 2PXE Server** service. ## Using the configuration editor 1. Open **Configure 2PXE** from the Start menu. 2. Review the settings in each section. Only the most commonly used settings are shown by default. To see all of the settings, turn on the **Show advanced** toggle. 3. Change the settings that you need. Some settings show or hide other settings. For example, choosing an **Integration mode** shows only the settings for that mode, and turning off **Use HTTPS** hides the certificate settings. 4. Click **Verify** to check the configuration. Fix any values that are flagged as invalid or missing. 5. Click **Save** to save the configuration. If you are prompted to restart the **2Pint 2PXE Server** service, click **Yes**. Changes do not take effect until the service restarts. ## Licensing 2PXE can be licensed in two ways: * **License key.** Enter the key in the **License key** setting (General settings). 2PXE checks it each time the service starts. If the key is invalid or has expired, an event is written to the 2PXE event log and the service stops. * **Through StifleR.** Leave **License key** empty, and turn on **Use Infrastructure** (Infrastructure settings) with the URL of your StifleR server. 2PXE then gets its license from the StifleR infrastructure service, which must report a valid 2PXE license. If the license becomes unavailable, or 2PXE cannot reach the infrastructure service, 2PXE writes an event to the event log and keeps running for a grace period. If the license still cannot be confirmed when the grace period ends, the service stops. The license type and expiry date are shown in the boot menu on devices that PXE boot. ## Settings reference The tables below list the settings shown by the configuration editor, grouped by the section they appear in. Settings marked **Advanced** are only shown when **Show advanced** is turned on. Settings that do not have a friendly label are shown in the editor by their setting name. ### General settings | Setting | Default | Description | | -------------------------------------------------------------- | ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Respond to PXE requests** (`RespondToClients`) | On | Controls whether 2PXE answers PXE boot requests. Turn this off to install and configure 2PXE without it responding to clients yet, for example while another PXE solution (WDS, ConfigMgr PXE) is still in use. | | **Integration mode** (`IntegrationMode`) | Set by the installer | The request handler that decides how each client boots. **PowerShell** uses PowerShell scripts to control the boot process. **MEMCM** integrates with Configuration Manager and requires 2PXE to be installed on a ConfigMgr distribution point. **WebServiceOnly** redirects all requests to the iPXE Anywhere Web Service, which also handles licensing. **DeployR** integrates with DeployR. See [Configuring the 2PXE Request Handlers](/2pxe-server/4.0/configuration/2pxe-config-file/configuring-the-2pxe-request-handlers.md). | | **Bind to IP** (`BindToIP`) | `0.0.0.0` (all addresses) | The local IP address that 2PXE uses to send and receive PXE traffic, and the address it sends in proxy DHCP responses. When left at `0.0.0.0`, 2PXE works out the address from the DHCP requests it receives on port 67. Set it on servers with more than one IP address, and whenever 2PXE only receives proxy DHCP traffic on port 4011 (for example with IP helpers that only forward to port 4011), otherwise 2PXE cannot work out the address and logs errors. | | **External FQDN override** (`ExternalFQDNOverride`) | Empty | Overrides the host name used in the URLs that iPXE uses to connect to 2PXE (and, on a distribution point, to download content). Leave empty to use the server's FQDN. | | **License key** (`LicenseKey`) | Empty | The 2PXE Server license key. If a key is entered, 2PXE checks it when the service starts, and stops if it is invalid or expired. If left empty, 2PXE gets its license from the StifleR infrastructure service instead (see [Licensing](#licensing)). The license key is also used to request certificates from 2Pint Software Online Services (see [Certificate Considerations](/2pxe-server/4.0/planning/certificate-considerations.md)). | | **iPXE Bootloader binary to use** (`UseiPXEBinary`) — Advanced | `Default` | The iPXE boot loader build to send to clients. **Default** uses the firmware's network driver (snponly) and works for most devices. **Native** uses iPXE's own drivers for supported network cards instead of the firmware's. **USB** uses iPXE's own USB driver stack, for devices that boot from a USB network adapter whose firmware lacks the needed USB support. Replaces the 3.x `UseiPXENativeDrivers` and `EnableiPXEUSBSupport` settings. | ### HTTPS settings | Setting | Default | Description | | ----------------------------------------------------------------------------------- | -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Use HTTPS** (`RunOnHttps`) | On | Controls whether 2PXE uses HTTPS for its web service. When turned off, the certificate settings below are hidden. | | **Certificate location mechanism** (`CertificateLocateBy`) | `Auto` | How 2PXE finds the certificate to bind to the HTTPS port. **Auto** lets 2PXE choose the certificate (for example, a self-signed certificate it creates, or the distribution point certificate). **CertificateThumbprint** uses the certificate with the thumbprint you specify. **CertificateSubjectName** uses the certificate with the subject name you specify, which avoids having to update the configuration each time the certificate is renewed. | | **Use certificate with specified thumbprint** (`HostCertificateThumbprint`) | Empty | The thumbprint (40 hexadecimal characters) of the certificate to use. Shown when the location mechanism is **CertificateThumbprint**. | | **Use certificate with specified subject name (CN)** (`HostCertificateSubjectName`) | Empty | The subject name (CN) of the certificate to use. Shown when the location mechanism is **CertificateSubjectName**. | | **HTTPS certificate store name** (`HostCertificateStoreName`) | `My` | The certificate store that contains the certificate. Not used when the location mechanism is **Auto**. | | **HTTPS certificate store location** (`HostCertificateStoreLocation`) | `LocalMachine` | The location of the certificate store. Not used when the location mechanism is **Auto**. | | **CustomCAThumbprint** (`CustomCAThumbprint`) — Advanced | Empty | The thumbprint of a custom (internal PKI) root CA certificate, for use when you are not using Configuration Manager. 2PXE uses it to build the cross-signed certificate that clients download during boot. See [Certificate Considerations](/2pxe-server/4.0/planning/certificate-considerations.md). | ### iPXE Anywhere Web Service settings | Setting | Default | Description | | ---------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Integrate with iPXE Anywhere Web Service** (`IntegrateWithiPXEAnywhereWebService`) | Off | Turns on integration with the iPXE Anywhere Web Service. The other settings in this section are only shown when this is turned on. | | **iPXE Anywhere Web Service IP address** (`IPXEAnywhereWebServiceIP`) | Empty | The IP address of the iPXE Anywhere Web Service. If empty, 2PXE resolves the host name in the web service URI. | | **Enabled iPXE Anywhere Web Service features** (`EnablediPXEAnywhereWebServiceFeatures`) | `BootRequest`, `ReportBootConfiguration`, `ReportDLStart`, `ReportDLComplete`, `ReportDLBoot`, `Config`, `ReportPEEnd` | The requests that 2PXE sends to the web service. **BootRequest** is the main boot request and is required when using authentication. **ReportBootConfiguration**, **ReportDLStart**, **ReportDLComplete**, **ReportDLBoot** and **ReportPEEnd** report progress. **RunCmdLineWinPE** and **RunCmdLineWinPEEnd** run the web service's WinPE start and end scripts. **ExtraFile**, **WinPEShl** and **Config** let the web service supply extra files, WinPEShl.ini content and configuration before WinPE starts. **Syslog** is not implemented yet. | | **iPXE Anywhere Web Service URI** (`iPXEAnywhereWebServiceURI`) | Empty | The address and port of the iPXE Anywhere Web Service, for example `https://server.contoso.com:8051`. Required when integration is turned on. | ### ConfigMgr settings {% hint style="danger" %} **Configuration Manager compatibility** Configuration Manager integration is not currently supported by 2PXE Server 4.0. The MEMCM settings and examples on this page are retained for reference only. {% endhint %} These settings are shown when **Integration mode** is set to **MEMCM**. | Setting | Default | Description | | ------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **SQL Server configuration method** (`SqlConnectionBy`) | `ServerInstanceAndDB` | How 2PXE connects to the Configuration Manager database. **ServerInstanceAndDB** builds the connection string from the instance and database name below. **Advanced** uses the full connection string you specify. **DoNotUseSQL** uses HTTP through the management point instead, which can only return one boot image per client. SQL is recommended. To allow access, add the 2PXE server's computer account to the **ConfigMgr\_DViewAccess** group on the site server. | | **SQL Server instance** (`ConnectionInstance`) | `.` | The SQL Server that hosts the ConfigMgr database, in the form `server` or `server\instance`. Use `.` for the local computer. Shown for **ServerInstanceAndDB**. | | **SQL Server database** (`ConnectionDB`) | Empty | The ConfigMgr database name, for example `CM_ABC`. Shown for **ServerInstanceAndDB**. | | **SQL Server connection string** (`AdvancedConnectionString`) | Empty | A full .NET SQL connection string, for example `Server=SQL01.contoso.com;Trusted_Connection=Yes;DATABASE=CM_ABC`. Use this to specify a port or other connection options. Shown for **Advanced**. | | **ConfigMgr management point override** (`ManagementPoint`) — Advanced | Empty | A specific management point to use, instead of finding one from the registry, Active Directory or DNS. For internet-based client management, use the same value as the clients' `InternetBasedManagementPointFQDN`. | | **Enable ConfigMgr unknown machine support** (`EnableSCCMUnknownMachinesSupport`) — Advanced | On | Allows computers that are not known to Configuration Manager to boot, using unknown computer deployments. | | **Custom variable data generation** (`CustomVarDataGeneration`) — Advanced | On | Generates the task sequence variable (.var) data only once the computer reaches WinPE. | | **Enable ConfigMgr mandatory countdown** (`EnableSCCMMandatoryCountdown`) — Advanced | `30000` | The countdown, in milliseconds, when one or more required task sequences target the computer. `0` boots the required deployment immediately without showing the menu, like the ConfigMgr PXE service point. `-1` does not select the required deployment; the menu then uses the **EnableMenuCountdown** behavior instead. | | **Send ConfigMgr state messages** (`SCCMReportState`) — Advanced | On | Sends state messages for required deployments. Turn this off when using a Rubicon step in the task sequence. | | **Specify a preferred ConfigMgr advertisement ID** (`PreferredAdvertID`) — Advanced | Empty | A deployment ID to select automatically when it targets the computer, regardless of other deployments. Use this to preselect an optional deployment in the menu. Set **Enable ConfigMgr mandatory countdown** above `0` so that the boot does not stop at the menu. | | **Override required deployment with preferred advertisement ID** (`OverrideRequiredDeploymentWithPreferredAdvertID`) — Advanced | Off | Uses the preferred advertisement ID even when a required deployment also targets the computer. | | **Specify a mandatory ConfigMgr advertisement ID** (`SetSMSTSPreferredAdvertID`) — Advanced | On | Passes the selected deployment to WinPE, so the task sequence starts without showing a deployment selection menu in WinPE. | | **ConfigMgr certificate authority thumbprint** (`SCCMCAThumbprint`) — Advanced | Empty | When using a public certificate with Configuration Manager, the thumbprint of the CA certificate that can be validated by a third party. Leave empty otherwise. | | **Hide hidden ConfigMgr PXE deployments** (`HideHiddenPXEDeployments`) — Advanced | On | Hides deployments made available to **Only media and PXE (hidden)** from the boot menu. | | **Stript ConfigMgr task sequence categories** (`StripCategories`) — Advanced | Empty | Task sequence categories to remove from the boot menu. | | **Only show specified ConfigMgr task sequence categories** (`OnlyShowCategories`) — Advanced | Empty | If set, only task sequences in these categories are shown in the boot menu. | | **Order ConfigMgr task sequences by** (`ConfigMgrOrderBy`) — Advanced | Empty | Replaces the SQL `ORDER BY` clause used to sort deployments, so it must be a complete clause, for example `ORDER BY Known Asc, Mandatory Asc, OfferID Asc` (the default when empty). | | **Allow re-execution of mandatory deployments** (`AllowReExecutionOfMandatoryDeployments`) — Advanced | On | Allows required deployments to run again. Replaces the 3.x `MandatoryFlags` setting. | | **External FQDN ConfigMgr override** (`ExternalFQDNCMOverride`) — Advanced | Empty | Overrides the host name used for ConfigMgr content URLs. | | **Report ConfigMgr state via file** (`SCCMReportStateViaFile`) — Advanced | Off | Reports deployment state using a file instead of sending it directly. | | **Bypass keypress for optional deployment** (`BypassKeyPressforOptionalDeployment`) — Advanced | Off | Removes the key press prompt for optional deployments. | | **Lean and mean mode (boot the latest offer available)** (`LeanAndMeanMode`) — Advanced | `1` | When above `0` and the **preferred ConfigMgr advertisement ID** deployment targets the computer, boots that deployment straight away without showing the menu. With `2`, the user must press the boot key first. `0` turns this off. | | **Add variables script** (`PowerShellExtensionVarDataScript`) | `C:\Program Files\2Pint Software\2PXE\PowerShellExtensionAddVariables.ps1` | The PowerShell script that returns custom task sequence variables. Also shown for the **DeployR** integration mode, and also used (with the default path) in **PowerShell** mode. See [Custom task sequence variables](/2pxe-server/4.0/configuration/2pxe-config-file/powershell-request-handler.md#custom-task-sequence-variables). The script is not created if it does not exist. Use a local path; environment variables are allowed. | | **Enable debug SQL statement log** (`EnableDebugSQLStatementLog`) — Advanced | Off | Logs the SQL statements sent to the ConfigMgr database, for troubleshooting. | | **Eanble debug script log** (`EnableDebugScriptLog`) — Advanced | Off | Logs the scripts generated for clients, for troubleshooting. | | **Set unattended in TsmBootstrap** (`SetUnattendedInTsmBootstrap`) — Advanced | Off | Sets the unattended option in the task sequence bootstrap configuration. | ### PowerShell settings These settings are shown when **Integration mode** is set to **PowerShell**. The scripts are not created if they do not exist. Use local paths; environment variables are allowed. | Setting | Default | Description | | ------------------------------------------------------------ | ------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------ | | **Allow boot script** (`PowerShellExtensionAllowBootScript`) | `C:\Program Files\2Pint Software\2PXE\PowerShellExtensionAllowBoot.ps1` | The script that decides whether a client should boot at all. It only returns true or false, and it can run several times during each boot. | | **Boot images** (`PowerShellExtensionBootImagesScript`) | `C:\Program Files\2Pint Software\2PXE\PowerShellExtensionBootImages.ps1` | The script that returns the boot files and images for a client. Also shown for the **DeployR** integration mode. | ### Infrastructure settings | Setting | Default | Description | | ---------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------- | | **Use Infrastructure** (`JoinInfrastructure`) | On | Registers 2PXE with the StifleR infrastructure service. The other settings in this section are only shown when this is turned on. | | **StifleR web service URL** (`StifleRWebServiceURI`) | Empty | The URL of the StifleR server's web service, for example `https://stifler.contoso.com:9000`. Required when **Use Infrastructure** is on. | | **Heartbeat rate online threshold for infrastructure service in seconds** (`ServiceHeartBeatRateSec`) — Advanced | `30` | The maximum time between heartbeats for the infrastructure service to be considered online. | | **Maximal allowed time difference in infrastructure service calls in seconds** (`MaxTimeDifferenceAllowedInInfrastructureCallsSec`) — Advanced | `60` | The maximum clock difference allowed between the infrastructure service and this server. | | **PlatformR token expiration time in minutes** (`PlatformRTokenExpirationMinutes`) — Advanced | `2` | How long infrastructure tokens are valid, from 1 to 60 minutes. | ### Advanced settings These settings are only shown when **Show advanced** is turned on, and are shown by their setting name. #### Boot behavior | Setting | Default | Description | | --------------------------- | ------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `EncryptionKey` | A built-in 32-character value | Used to encrypt requests so that they survive service restarts, and so that servers in a cluster or load-balanced group can read each other's requests. Must be exactly 32 characters. The editor can generate a random value. Use the same value on every server in a load-balanced group. | | `DebugBeforeBoot` | Off | Pauses in the iPXE debugger before booting. | | `EnableMenuCountdown` | `10000` | The countdown, in milliseconds, when only optional deployments or boot images are available. When the countdown ends, the computer exits to the next boot device. `0` turns off the countdown, so the menu waits until an item is selected. Keep the value above `1000`. | | `DefaultMenuItemId` | `exit` | The menu item selected by default. For DeployR, this is the boot image ID. For PowerShell, this is the key returned by the PowerShell script. | | `EnableiPXEBootLoaders` | On | Uses iPXE boot loaders instead of Windows boot loaders. iPXE downloads boot images over HTTP (directly from the distribution point when using ConfigMgr) instead of over TFTP from the RemoteInstall folder. | | `iPXEF12PromptTimeout` | `10000` | How long, in milliseconds, the iPXE boot loader waits for F12 for optional ConfigMgr deployments. | | `AcceptBootKeyEFI` | `0x000a` (Enter) | The key the user presses to boot from the network on UEFI devices. For key codes, see the [iPXE prompt command](https://ipxe.org/cmd/prompt). | | `AcceptBootKeyBIOS` | `0x000a` (Enter) | The key the user presses to boot from the network on BIOS devices. | | `AcceptBootTextEFI` | `Press Enter to boot to network` | The prompt shown to the user on UEFI devices. | | `AcceptBootTextBIOS` | `Press Enter to boot to network` | The prompt shown to the user on BIOS devices. | | `UseEmbeddedBootSDI` | On | Uses the boot.sdi file embedded in the boot image at `\sms\boot\boot.sdi`. ConfigMgr boot images always contain this file, so it is always used for them. Other WinPE images do not contain it unless you add it; turn this off if you cannot add it. | | `wimbootParams` | `gui quiet` | The command line passed to wimboot, for example `gui`, `pause`, `pause=quiet`, `rawbcd` or `index=x`. See the [wimboot documentation](https://ipxe.org/appnote/wimboot_architecture). | | `KernelParams` | `nomodeset rhgb quiet rd.noverifyssl` | The Linux kernel parameters used when booting the DeployR Fedora boot image. Shown for the **DeployR** integration mode. | | `EnableDeployRDebugLogging` | Off | Turns on debug logging in the DeployR client. | | `iPXEErrorHandlingText` | A built-in iPXE script | The iPXE script that runs when an error occurs. It displays the error, reports it, and offers the iPXE shell (Ctrl-B) or retries the boot. | | `DefaultExitString` | `exit 0` | The iPXE command used to exit back to the firmware. Some UEFI firmware treats exit codes differently; for example, Hyper-V stops on `exit 0` but boots the next device on `exit 1`. | | `NtpServer` | `time.windows.com` | The NTP server that clients use when their clock differs from the server's. | | `DisablePeerDist` | Off | Turns off PeerDist (BranchCache) for iPXE downloads. When off (the default), peering for files served by 2PXE requires the Windows BranchCache feature on the 2PXE server; see [BranchCache Setup](/2pxe-server/4.0/configuration/branchcache-setup.md). In **MEMCM** mode, users can also press **P** at the start of the boot menu to turn off BranchCache for that boot. | #### Boot menu and appearance | Setting | Default | Description | | --------------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `ColorOptions` | A built-in set of iPXE `colour` and `cpair` commands | The color scheme of the iPXE user interface. | | `SplashBackground` | `2PintLogo.png` | The image shown during the boot process. | | `StartBackground` | `Start.png` | The image shown at the start of the boot process. | | `LoginBackGround` | `Login.png` | The image shown when the client must sign in before booting. | | `FailureBackground` | `Error.png` | The image shown when an error occurs. | | `DownloadBackground` | `Downloading.png` | The image shown while a boot image downloads. | | `ProcessBackground` | `Wait.png` | The image shown while a request is being processed. | | `MenuWelcomeLine` | `Welcome to 2PXE!` | The heading shown at the top of the boot menu in **MEMCM** mode. It is only used with a purchased 2PXE license; otherwise the menu shows `Welcome to 2PXE!`. | | `MenuSelectLine` | `-- ---- Available Task Sequences ----` | The line shown above the list of task sequences. | | `SelectLine` | `-- ---- Available Task Sequences ----` | An alternative separator line for the task sequence list. | | `MenuDisplayFormat` | `{4,-60} #{5} ({2})` | The format of each task sequence in the menu. The placeholders are: `{0}` deployment ID, `{1}` boot image ID, `{2}` required or available, `{3}` boot image architecture, `{4}` task sequence name, `{5}` and `{6}` task sequence ID, `{7}` boot image path, `{8}` boot image version. | | `MenuDisplayFormatDeployed` | `{4,-60} #{5} ({2} [Already Deployed])` | The format used for task sequences that have already run on the computer. | The image files are in the `Boot` folder under the RemoteInstall folder. #### Folders, ports and services | Setting | Default | Description | | -------------------------------------- | ------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `CertificatesFolder` | `%PROGRAMDATA%\2Pint Software\2PXE\Certificates` | Where 2PXE stores the certificates it creates. Replaces the 3.x `CertificatesPath` setting. | | `RemoteInstallFolder` | `%PROGRAMDATA%\2Pint Software\2PXE\Remoteinstall` | The folder that contains boot files and images. It is created if it does not exist, along with the `Boot`, `Tmp` and `Sources` subfolders. Use a local path that the service account can access; environment variables are allowed. Replaces the 3.x `RemoteInstallPath` setting. | | `RunHttpServer` | On | Runs the built-in web service used by iPXE. It only serves files from the RemoteInstall folder. | | `RunOnHttpPort` | `8050` | The HTTPS port of the built-in web service. | | `RunOnNonHttpsPort` | `8049` | The HTTP port, used for HTTP boot on devices that do not support HTTPS, and to provide the current time to clients whose clock is wrong. `0` turns it off. | | `RunOnDhcpPort` | On | Answers PXE requests on the DHCP port (67). Turn this off if the server is also a DHCP server. | | `RunOnPxePort` | On | Answers PXE requests on the proxy DHCP port (4011). | | `UseHighPerformanceRestartableThreads` | On | Uses improved thread handling, for servers that handle many PXE requests. | | `FWTFTP` | On | Creates a Windows Firewall rule for TFTP (port 69) when the service starts. | | `FWDHCP` | On | Creates a Windows Firewall rule for DHCP (port 67) when the service starts. | | `FWPROXYDHCP` | On | Creates a Windows Firewall rule for proxy DHCP (port 4011) when the service starts. | | `FWHTTP` | On | Creates a Windows Firewall rule for the web service when the service starts. | | `ForceDPLowerCaseHostName` | Off | Uses a lowercase host name for the distribution point in content URLs. | | `UrlReplaceRaw` | Empty | Replaces parts of content URLs. Specify pairs as `find;replace`, separated by commas, for example `https://server1/path;http://server1/path, oldvalue;newvalue`. | #### TFTP | Setting | Default | Description | | --------------------------- | ----------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `RunTftpServer` | On | Runs the built-in TFTP server. Turn this off if you use your own TFTP server. | | `ListenToTftpIp` | `0.0.0.0` (all addresses) | The IP address the TFTP server uses. On servers with multiple network adapters, set this (usually to the same address as **Bind to IP**) if TFTP replies are sent from the wrong adapter. | | `TftpFilter` | `boot\*`, `\tmp\*`, `\boot\*`, `tmp\*`, `\Sources\*`, `Sources\*` | The folders under the RemoteInstall folder that the TFTP server serves files from, as relative wildcard paths. | | `TftpBlockSize` | `768` | The TFTP block size: 512, 768, 1024, 1456, 2048, 4096, 8192 or 16384. Larger values can reduce download times, but PXE firmware, routers and other network equipment may limit them. | | `OptionBlockSizeAllowed` | Off | Allows clients to negotiate the TFTP block size. | | `TftpWindowSize` | `4` | The number of TFTP packets sent before waiting for an acknowledgement, up to 32. Only used with Windows boot loaders, which take this from the BCD. | | `TftpResponseTimeout` | `2000` | How long, in milliseconds, the TFTP server waits for a response. | | `TftpUseSinglePort` | Off | Sends and receives all TFTP data on a single port. This can help with firewalls and network equipment that do not handle dynamic ports well. | | `CacheTFTPFilesInMemory` | On | Keeps TFTP files in memory instead of reading them from disk for each request. This uses more memory but is much faster on busy servers. | | `VerboseTftpRequestLogging` | Off | Logs every TFTP request. Only turn this on to check whether requests are reaching the server. | #### WinPE and content access | Setting | Default | Description | | --------------------------- | ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `WinPEShlConfiguration_x64` | Starts TsProgressUI, iPXEWinPEClient and TsBootShell | The WinPEShl.ini content for x64 WinPE. Use it to run extra commands after WinPE starts but before the ConfigMgr task sequence starts, for example a custom front end. Replaces the 3.x `x64WinPEShlConfiguration` setting. See [Custom entries in WinPEShl.ini](/2pxe-server/4.0/troubleshooting/custom-entries-in-winpeshl.ini.md). | | `WinPEShlConfiguration_x86` | Starts TsProgressUI, iPXEWinPEClient and TsBootShell | The same as above, for x86 WinPE. Replaces the 3.x `x86WinPEShlConfiguration` setting. | | `Username` | Empty | The account used to access content on ConfigMgr distribution points, in the form `DOMAIN\Username`. | | `Password` | Empty | The password for that account. It is encrypted with the machine key when saved, and the editor never shows the saved value. Replaces the 3.x Password.config file. | ## Settings that changed from 3.x Most settings keep the same name they had in the 3.x `.config` file. The following settings were renamed, combined or removed: | 3.x setting | 4.0 setting | | -------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | `EnablePowerShellExtension`, `EnableSCCMExtension`, `iPXEWSOnly` | **Integration mode** | | `EnableSCCMSQLConnection`, `ConfigMgrSQLConnectionString` | **SQL Server configuration method**, **SQL Server instance**, **SQL Server database** and **SQL Server connection string** | | `EnableiPXEAnywhereWebService` | **Integrate with iPXE Anywhere Web Service** and **Enabled iPXE Anywhere Web Service features** | | `UseiPXENativeDrivers`, `EnableiPXEUSBSupport` | **iPXE Bootloader binary to use** | | `HttpHostNameBindings`, `port` | **Use HTTPS**, `RunOnHttpPort` and `RunOnNonHttpsPort` | | `HostCertificateThumbprint` | **Certificate location mechanism** and **Use certificate with specified thumbprint** | | `MandatoryFlags` | **Allow re-execution of mandatory deployments** | | `CertificatesPath` | `CertificatesFolder` | | `RemoteInstallPath` | `RemoteInstallFolder` | | `UrlReplace` | `UrlReplaceRaw` | | `x64WinPEShlConfiguration`, `x86WinPEShlConfiguration` | `WinPEShlConfiguration_x64`, `WinPEShlConfiguration_x86` | | Password.config file | `Password` | | `EnableDebugLog`, `DebugLogPath`, `EnableSCCMDebugShell`, `EnableSCCMMenuCountdown`, `CustomMenuItems`, `CustomExitParams` | Removed | ## Valid configuration combinations The following table shows supported and unsupported combinations of the main settings. The combinations marked **Recommended** are the fully supported scenarios. | Integration mode | SQL Server configuration method | EnableiPXEBootLoaders | RunHttpServer | Valid configuration | | ---------------- | ------------------------------- | :-------------------: | :-----------: | ------------------------- | | PowerShell | (not used) | ✓ | ✓ | Yes (**Recommended**) | | PowerShell | (not used) | ✓ | | Yes | | PowerShell | (not used) | | | Yes | | PowerShell | (not used) | | ✓ | Yes, but HTTP is not used | | MEMCM | ServerInstanceAndDB or Advanced | ✓ | ✓ | Yes (**Recommended**) | | MEMCM | ServerInstanceAndDB or Advanced | ✓ | | No | | MEMCM | ServerInstanceAndDB or Advanced | | ✓ | Yes | | MEMCM | DoNotUseSQL | ✓ | ✓ | Yes | | MEMCM | DoNotUseSQL | ✓ | | No | | MEMCM | DoNotUseSQL | | ✓ | Yes, but HTTP is not used | | DeployR | (not used) | ✓ | ✓ | Yes (**Recommended**) | | DeployR | (not used) | Any other combination | | No | If you are unsure about your scenario, contact . --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://documentation.2pintsoftware.com/2pxe-server/4.0/configuration/2pxe-config-file.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.