# 2maXBoot 0.9.0 beta 1 2maXBoot is a diskless network-boot server for Windows PCs. The PCs have no local system disk: they boot over the network (PXE) and run Windows from one shared image on the server, served over iSCSI. Every boot starts clean, because a PC's writes go to a per-boot writeback that is thrown away at the next boot. Changes you want to keep are made on one PC in **Super User** mode and saved into the shared image for every PC. This is a beta for LAN-centre and cafe operators. Try it on a test network before trusting it with your customers' PCs, and send us what goes wrong (see "Collecting logs"). ## Requirements - **Server:** Windows 10 or 11 (64-bit), or Windows Server 2019 or later, with an administrator account. 2maXBoot runs elevated because it serves DHCP, TFTP and iSCSI. - **A dedicated boot network.** 2maXBoot is the DHCP server for the PCs it boots. Put the server and the PCs on a network or VLAN of their own, with **no other DHCP server on it** (turn off the router's DHCP for that segment). If the boot network shares a switch with your normal LAN, 2maXBoot will offer addresses to every device on it. A second NIC in the server for the boot network is the simplest setup. - **Wired Gigabit Ethernet** from server to PCs; Wi-Fi does not work. - **Storage:** an NTFS drive for boot images (a Windows 11 image is 30-60 GB and grows with saved revisions) and room for writebacks (a few GB per running PC). Keep both off the server's Windows drive if you can; an SSD is strongly recommended. Windows on a PC crashes if the writeback drive fills up, so leave headroom. - **RAM:** 16 GB works; more lets the server keep more of the image in memory (Settings > Storage > Server memory). - **PCs:** UEFI firmware with network (PXE) boot enabled. Secure Boot can stay ON: PCs get a Microsoft-signed network loader. If a PC shows "Selected boot image did not authenticate" (or a similar security violation), enable the Microsoft third-party certificate once in its BIOS: - HP: F10 > Security > Secure Boot Configuration > **Enable MS UEFI CA key** (needed on newer models such as the EliteDesk 8 Mini G1i). - Lenovo: **Allow Microsoft 3rd Party UEFI CA**. Other brands: a similarly named option. - **Gaming motherboards (ASUS, MSI, Gigabyte, ASRock):** usually trust that certificate already, but check: network boot on ("Network Stack" / "IPv4 PXE Support"), CSM/Legacy off (UEFI only), and Secure Boot in "Windows UEFI" mode (choose "Install default Secure Boot keys" if the board asks). - **New PCs and names:** if you used Computers > Generate clients, each new PC shows a menu on its own screen at its first network boot; pick its name there. ## Install 1. Run `2maXBoot_0.9.0-beta.1_x64-setup.exe`. 2. **SmartScreen:** the beta installer is not code-signed yet, so Windows shows "Windows protected your PC". Click **More info**, then **Run anyway**. Check the SHA-256 we sent with the download first: `Get-FileHash .\2maXBoot_0.9.0-beta.1_x64-setup.exe`. 3. Accept the administrator prompt and finish the installer. It only copies files to `C:\Program Files\2maXBoot`; it does not change your network, DHCP or firewall. 4. Start **2maXBoot** from the Start menu (it asks for administrator rights every time). ## First start: the setup checklist The Overview page shows a setup checklist. Work through it top to bottom; each step says what is missing and most have a button that does the work for you. 1. **Running as administrator** - restart 2maXBoot elevated if this is not ticked. 2. **Boot network** - choose the network card and address range the PCs boot on. Pick the dedicated boot NIC, never the adapter of your normal office or home LAN. 3. **Storage** - choose the folders for boot images and for writebacks. 4. **Firewall** - opens the ports the PCs need (DHCP, TFTP, iSCSI, the coordinator), only on the boot network. 5. **Coordinator** - installs the bundled coordinator (it prepares images and talks to the PCs) into `C:\ProgramData\2maXBoot\Server` and registers it as a scheduled task. 6. **Start with Windows** - starts 2maXBoot when you sign in. Windows does not run it before someone signs in, so set the server to sign in automatically if it must survive a power cut unattended. 7. **WinPE onboarding files** - the small WinPE environment a new PC runs once to report its hardware. The coordinator step installs it into `C:\ProgramData\2maXBoot\Server\payload`; this step ticks when the files are there and intact. 8. **First boot image** - add a Windows image (next section). 9. **First PC** - power on a PC on the boot network and watch it appear under Computers. The DHCP, TFTP and iSCSI services only start once you start them (Services, or the checklist); a fresh install never starts handing out addresses on its own. ## Making your first Windows image 2maXBoot boots one standalone **dynamic `.vhd`** file (VHD, not VHDX; no parent/differencing disk) holding a **UEFI/GPT** Windows installation. The easiest way to make one is a Hyper-V Generation 2 VM: 1. **Create the VM.** Hyper-V Manager > New > Virtual Machine: **Generation 2**, 4 GB+ memory, a new **dynamically expanding** VHDX of 80-128 GB (the size PCs will see as C:). Attach the Windows 11 ISO. Leave Secure Boot on (template "Microsoft Windows"). No virtual TPM is needed for the install; if setup insists on one, enable it in the VM's Security settings. 2. **Install Windows 11** normally and finish setup with a **local account** (the account your customers' PCs will sign in with, or an admin account you set up auto-logon for later). 3. **No BitLocker.** Windows 11 can turn on device encryption by itself. Check with `manage-bde -status C:`; if protection is on, run `manage-bde -off C:` and wait until it reports "Fully Decrypted". An encrypted image cannot be shared. 4. **Turn off hibernation and Fast Startup** in an elevated prompt: `powercfg /h off`. A hibernated image would resume the VM's state on every PC. 5. Install Windows updates, then **shut down** the VM (Start > Shut down). Do not run Sysprep: 2maXBoot prepares each PC's hardware itself on its first boot. 6. **Convert to a dynamic VHD** on the Hyper-V host, in an elevated PowerShell: ```powershell Convert-VHD -Path 'D:\VMs\Win11.vhdx' -DestinationPath 'E:\2maXBoot\Images\Win11.vhd' -VHDType Dynamic ``` Put the `.vhd` on the drive you chose for boot images, not on the server's Windows drive. 7. **Add it:** Boot images > **Add boot image**, pick the `.vhd`, give it a name. New PCs are put on the newest boot image. Do not open, mount or edit the `.vhd` after adding it: the server tracks the file's size and timestamp, and changes go through Super User on a PC instead. Keep a copy of the original `.vhd` somewhere safe as your known-good starting point. Installing software for everyone: on Computers, enable **Super User** on one PC, boot it, install or change what you need, shut it down, then **Save**. Every PC gets the change on its next boot. ## Known limitations of this beta - The installer is large (about 700 MB) because it carries the WinPE onboarding environment. - The installer is not code-signed (see SmartScreen above). - The bundled network-driver library covers common Intel and Realtek NICs and the usual virtual NICs. A PC with a NIC outside it shows "network driver needed" under Computers. - Remote desktop ("View Desktop") uses TightVNC without a password, and the coordinator has no authentication: keep the boot network closed to anyone you do not trust. - One boot image is the tested setup. Several images work but have had less testing. ## Collecting logs When something goes wrong, zip and send us: - `C:\ProgramData\2maXBoot\Server\logs\` - the server's daily logs (`native-YYYY-MM-DD.log`). - `C:\ProgramData\2maXBoot\Server\state\service\` - the coordinator's logs (`coordinator-*.log`). - The time it happened, and which PC (name or MAC address from Computers). The logs contain PC names, MAC and IP addresses of your boot network, and no passwords. ## Uninstall Shut down every PC that boots from the server first; the uninstaller refuses while PCs are connected. Then Settings > Apps > 2maXBoot > Uninstall. It stops 2maXBoot and the coordinator, and removes their scheduled tasks and firewall rules. It **keeps your data**; delete these yourself if you no longer need them: - Settings and database: `%APPDATA%\com.2maxboot.server` of the Windows account that ran 2maXBoot. - Coordinator, client state and logs: `C:\ProgramData\2maXBoot\Server`. - Boot images, writebacks and game disks: the folders and drives you chose in Settings > Storage. Upgrading to a newer beta also refuses while PCs are connected; install over the top and your data stays. ## Third-party software - **Python 3.11** (CPython) runs the coordinator, under the Python Software Foundation License; the licence text is `C:\ProgramData\2maXBoot\Server\python\LICENSE.txt` after setup. - **TightVNC 2.8.88** (server only) provides "View Desktop" and is licensed under the GNU GPL v2; the licence text is `C:\ProgramData\2maXBoot\Server\client-payload\tightvnc\LICENSE.txt`. We ship TightVNC's unmodified binaries. Its complete corresponding source code is available from https://www.tightvnc.com/download.php, and on request from us for three years from this release: email us and we will send it. - **wimboot** (iPXE project) loads the WinPE onboarding environment and is licensed under the GNU GPL v2; its source is at https://github.com/ipxe/wimboot. The WinPE files themselves (`boot.wim`, `boot.sdi`, `BCD`) are Microsoft Windows PE components. - **python-registry** 1.3.1 (Apache 2.0) and **unicodecsv** 0.14.1 (BSD) and **enum-compat** 0.0.3 (MIT) are bundled for the coordinator.