With WDS you can configure the server to automatically respond to known clients. You can additionally affect the behaviour for unknown clients. In my environment I have it configured to answer the clients PXE boot request however they are not automatically served for two reasons: I may want to assign them to a different image […]
With WDS you can configure the server to automatically respond to known clients. You can additionally affect the behaviour for unknown clients.
In my environment I have it configured to answer the clients PXE boot request however they are not automatically served for two reasons:
- I may want to assign them to a different image or elect to manually install it without the unattended settings
- I may want the client to not automatically join the domain
- I want to name the something better than MININT-000000ABCDEF
When an unknown client connects to the WDS server the user is presented with a message to say that their request is pending administrative approval on the server.
Using the WDS console, you select the Pending Devices tree and select the option to Name and Approve a client, however doing so presents you with an Access Denied error.
Searching the WDS documentation will tell you that you need to grant permissions in the Active Directory OU to the WDS server computer account to allow it to modify and create computer accounts in the domain.
The instructions are as follows:
- In Active Directory Users and Computers (dsa.msc) navigate to the OU you assigned as the OU for new clients in the WDS configuration.
- Right click on the OU and select Delegate Control
- In the Delegation of Control Wizard, select Next
- Add the WDS computer account as the selected User or Group and select Next
- Select Create a Custom Task and then select Next
- Select Only the following objects and tick Computer Objects
- Tick the Create Selected Objects tick box and then select Next
- Select the Write All Properties option and then select Next and complete the wizard.
Fairly simple to do, however it you have multiple WDS servers this OU’s ACL is going to get messy quickly, so I decided to create a Global Security Group in the domain and add the computer account for WDS to the group. I then applied the Delegated control to the group.
To my surprise I continued to receive the error on the WDS server even after a restart of the services. I tested it by directly adding the WDS computer account to the ACL and it worked as designed.
The problem here appears to be that the ACL isn’t correctly looking at the group membership and giving the WDS server permission to create the computer account in the domain.