ConfigMgr PXE failures are easiest to fix when you identify the stage that stopped: DHCP and relay, PXE/proxyDHCP, TFTP, network boot program (NBP), WinPE, ConfigMgr policy, or task-sequence execution. Start by recording the exact error and checking SMSPXE.log; do not repeatedly disable and re-enable PXE on the distribution point.
PXE failure symptoms and the first place to look
| Symptom | Likely stage | First check | Typical causes |
|---|---|---|---|
PXE-E51: no DHCP or proxyDHCP offers |
DHCP or relay | Client VLAN, IP helpers, DHCP and SMSPXE.log |
Unavailable scope, missing relay/helper, blocked UDP 67/68, switch or ACL problem |
PXE-E52: proxyDHCP but no DHCP offer |
DHCP | DHCP scope and relay path | DHCP unavailable or DHCP traffic blocked |
PXE-E53: no boot filename |
PXE response | PXE responder/WDS status and IP helpers | PXE DP not responding, unsupported DHCP options, firewall or wrong interface |
PXE-E55, PXE-E77 or PXE-E78 |
Firmware/PXE-server exchange | Firmware mode, server response and a packet capture | Architecture or NBP mismatch, relay/ACL issue, or competing responders; confirm the exact firmware message |
PXE-E32, PXE-E35, PXE-E36, PXE-E3B or PXE-T04 |
TFTP | UDP 69, WDS/PXE service and RemoteInstall |
Blocked TFTP, missing files, permissions, corrupt content, packet-size or fragmentation problem |
| WinPE starts with no address | WinPE drivers | ipconfig and SMSTS.log |
Missing or wrong-architecture NIC driver, or an undistributed boot-image change |
| “No boot action” or no task sequence | ConfigMgr policy | Device record, collection and deployment settings | Duplicate/stale identity, no PXE-enabled deployment, unknown-computer setting, wrong site or architecture |
0x80092002 with certificate-store errors |
DP certificate/provisioning | SMSPXE.log |
Malformed or missing ConfigMgr self-signed certificate |
Microsoft’s stage-by-stage guidance and error-code examples are documented in advanced PXE troubleshooting.
As an Amazon Associate I earn from qualifying purchases.
Before changing the distribution point
- Record the model, MAC address, SMBIOS GUID, VLAN/subnet, BIOS or UEFI mode, Secure Boot state, exact PXE code, assigned IP, downloaded NBP (such as
wdsnbp.comorwdsmgfw.efi), and whether WinPE or task-sequence selection appeared. - Reproduce with one test machine. Save the relevant time window from
SMSPXE.logand, if WinPE starts,SMSTS.log. - Test the same machine on the PXE DP’s subnet. Success there but failure across VLANs points to relay, helper, ACL or firewall configuration.
How the ConfigMgr PXE path works
The normal sequence is:
- Client firmware broadcasts DHCP.
- DHCP and router IP helpers deliver DHCP and PXE/proxyDHCP traffic.
- WDS or the ConfigMgr PXE responder identifies the boot server.
- TFTP transfers the NBP and boot files.
- WinPE loads and obtains network access.
- The PXE provider contacts the management point, matches the device and returns task-sequence policy.
- WinPE downloads content and runs the task sequence.
A failure after WinPE has loaded is no longer primarily a DHCP or TFTP problem.
Recommended Free Tools
Verify PXE distribution-point configuration
- In the current-branch console, open Administration → Distribution Points, open the DP properties, and confirm Enable PXE support for clients and Allow this distribution point to respond to incoming PXE requests.
- Confirm whether the DP uses WDS or Enable a PXE responder without Windows Deployment Service. Do not mix their registry, service or DHCP instructions.
- Check selected network interfaces, unknown-computer support, and any response delay when multiple PXE servers exist.
- Confirm the required boot image is distributed and PXE-enabled. In Software Library → Operating Systems → Boot Images, open Properties → Data Source, select Deploy this boot image from the PXE-enabled distribution point when appropriate, then update or redistribute it. See Manage boot images.
DP settings and the WDS/PXE-responder distinction are covered in Microsoft’s distribution-point guidance.
#1 Best Overall
- USB-C 2-in-1 storage OTG: The Lexar JumpDrive Dual Drive D40E features USB Type-A and Type-C connectors in a slim, portable form factor for easy device compatibility
- Transfer speeds up to 100MB/s: Based on internal testing, performance may vary depending upon the host device, interface, and usage conditions. 1MB=1,000,000 bytes
- Plug and Play: Widely compatible with USB Type-C smartphones, tablets, laptops, Macs, and traditional Type-A devices, no software installation required. The 360° swivel design allows for easy switching between connectors without the hassle of losing a cap
- Durable & Compact: The Lexar D40E USB memory stick features a metal enclosure, withstands temperatures from 0° to 50° C (32°F to 122°F), and is lightweight at 26g with dimensions of 70.4 x 16.9 x 11.7mm
- Security & Warranty: Securely protects files using an advanced security software solution with 256-bit AES encryption. Backed by a Lexar 3-year limited warranty
Fix routed-network and firewall problems
For a client on another subnet, configure router or Layer-3-switch IP helpers to both the DHCP server and PXE-enabled DP. Microsoft’s ConfigMgr guidance recommends IP helpers rather than DHCP options 60, 66 or 67 for normal multi-subnet designs. Generic WDS advice about options 66/67 should not be applied automatically.
- Allow DHCP UDP 67 and 68.
- Allow TFTP UDP 69.
- Allow the documented traditional PXE BINL/proxyDHCP path, UDP 4011, where applicable to the selected implementation.
- Check Windows Firewall on the DP, router ACLs, switch relay behavior and duplicate DHCP/PXE responders.
Use Microsoft’s PXE deployment guidance for helper and deployment-setting details.
Rank #2
- High-speed USB 3.0 performance of up to 150MB/s(1) [(1) Write to drive up to 15x faster than standard USB 2.0 drives (4MB/s); varies by drive capacity. Up to 150MB/s read speed. USB 3.0 port required. Based on internal testing; performance may be lower depending on host device, usage conditions, and other factors; 1MB=1,000,000 bytes]
- Transfer a full-length movie in less than 30 seconds(2) [(2) Based on 1.2GB MPEG-4 video transfer with USB 3.0 host device. Results may vary based on host device, file attributes and other factors]
- Transfer to drive up to 15 times faster than standard USB 2.0 drives(1)
- Sleek, durable metal casing
- Easy-to-use password protection for your private files(3) [(3)Password protection uses 128-bit AES encryption and is supported by Windows 7, Windows 8, Windows 10, and Mac OS X v10.9 plus; Software download required for Mac, visit the SanDisk SecureAccess support page]
Read the right logs
On the PXE-enabled DP
SMSPXE.logshows whether the request arrived, the device identity match, boot action, task sequence, boot image and management-point interaction.DistMgr.loghelps diagnose boot-image processing and distribution.- Use WDS logs when WDS is the selected implementation and the failure is in its service or TFTP operation.
In WinPE
SMSTS.log covers NIC and storage initialization, management-point communication, content download and task-sequence execution. ConfigMgr includes CMTrace in boot images; from a command prompt run:
cmtraceLog purposes are listed in Microsoft’s log-files reference.
Rank #3
- What You Get - 2 pack 64GB genuine USB 2.0 flash drives, 12-month warranty and lifetime friendly customer service
- Great for All Ages and Purposes – the thumb drives are suitable for storing digital data for school, business or daily usage. Apply to data storage of music, photos, movies and other files
- Easy to Use - Plug and play USB memory stick, no need to install any software. Support Windows 7 / 8 / 10 / Vista / XP / Unix / 2000 / ME / NT Linux and Mac OS, compatible with USB 2.0 and 1.1 ports
- Convenient Design - 360°metal swivel cap with matt surface and ring designed zip drive can protect USB connector, avoid to leave your fingerprint and easily attach to your key chain to avoid from losing and for easy carrying
- Brand Yourself - Brand the flash drive with your company's name and provide company's overview, policies, etc. to the newly joined employees or your customers
When TFTP or the NBP fails
- Confirm the PXE service is running and UDP 69 is permitted.
- Inspect
C:RemoteInstallSMSBootx86,C:RemoteInstallSMSBootx64,C:RemoteInstallSMSBootFontsandC:RemoteInstallSMSBootboot.sdi. - Check the
REMINSTshare and folder permissions and, when applicable, WDS logs. - Verify expected package content under
C:RemoteInstallSMSImages<PackageID>. - If timeouts suggest packet fragmentation or firmware incompatibility, test a smaller TFTP block size.
Do not choose an NBP without considering firmware. BIOS, x64 UEFI and Arm64 UEFI require compatible boot files and images. A 64-bit UEFI client needs a compatible x64 image; Arm64 UEFI needs Arm64. Windows 11 ADK 22H2 and later no longer include 32-bit WinPE; the last supported 32-bit WinPE is associated with the Windows 10 version 2004 add-on.
Repair WinPE networking and storage
At the WinPE prompt run:
ipconfigIf no adapter or valid address appears, add the hardware-specific NIC driver matching the boot-image architecture. If the disk is invisible, add the required mass-storage driver. After changing a boot image, update it on the affected DP. Inject only necessary NIC and storage drivers rather than large unrelated driver collections. Microsoft’s driver and redistribution procedure is in Manage boot images.
Rank #4
- GOOD VALUE PACKAGE - 1 Pack 32GB Memory Stick USB 2.0 Flash Drives with great cost performance and high quality.
- BIG CAPACITY - The available capacity: 29.10GB-29.8GB, You can save the data of movies, music, photos, designs, programs, manuals, handouts in a high speed.Good performance in digital data storing, transferring and sharing with families, friends, workmates, clients and machines.
- EASY TO USE & PLUG AND WORK - Support windows 7 / 8 / 10 / Vista / XP / 2000 / ME / NT Linux and Mac OS, Compatible with USB2.0 and below.
- TWISTTURN DESIGN & EASY CARRY - The metal clip rotates 360° round the ABS plastic body which with rubber oil skin feeling finish. The capless design can avoid lossing of cap, and providing efficient protection to the USB port.
- WARRANTY & SUPPORT - SIMMAX logo is laser printed on the USB connector surface, our products are of good quality and we promise that any problem about the product within one year since you buy.
Resolve “no task sequence” and “no boot action”
- Check the device’s MAC and SMBIOS identity for duplicates, stale records, changed motherboards or adapters.
- Verify collection membership and that a task sequence is deployed to that collection.
- Confirm the deployment is available to PXE using Configuration Manager clients, media, and PXE, Only media and PXE, or Only media and PXE (hidden).
- Enable unknown-computer support only when that is the intended workflow; an existing database record is not an unknown computer.
- Verify site assignment, management-point selection, boot-image architecture and boundary-group content location.
- For a required deployment already attempted, use Clear Required PXE Deployments when appropriate.
A device match followed by “no advertisements found” and “No boot action. Aborted” indicates policy or deployment, not DHCP or TFTP. See Microsoft’s advanced troubleshooting article.
Special case: DHCP and WDS or PXE responder on one server
WDS-based PXE
For the documented WDS/DHCP co-hosting design, Microsoft uses:
Best Value
- 【16GB Flash Drive】USB flash drives with 16GB capacity, meet your needs of daily use on work, school, home and travelling for photos, music, videos, files storage and transfer. IMEASON thumb drives can be used to store different files, easy to data backup.
- 【Metal Swivel Cap Design】USB thumb drive is metal swivel cover provides extra protection for the usb thumbdrive connector, no usb drive cap to lose; keychain design makes it easier to carry without worrying lose it.
- 【Wide Compatibility】USB drive supports Windows 7/8/10/11 / Vista / XP / Unix / 2000 / ME / NT Linux and Mac OS, also Supports USB 2.0 and 1.1 ports. USB Stick support TV, desktop, notebook computer, car, audio and other device. The USB Memory Stick is your great data storage and transfer companion with traveling and working.
- 【Easy to use】usb memory stick is plug and play without any software installation. Just simply plug the Flashdrive into the port of your USB-compatible devices such as computer, laptop to start data storage or transmission.
- 【What You Get】16 GB USB Flash Drive Thumb Drive, The default format of the usb storage flash drive is FAT32.
WDSUTIL /Set-Server /UseDHCPPorts:No /DHCPOption60:YesEquivalent WDS setting: HKLMSYSTEMCurrentControlSetServicesWDSServerProvidersWDSPXEUseDHCPPorts = 0. Option 60 can be defined with:
netsh dhcp server \<DHCP_server_machine_name> add optiondef 60 PXEClient String 0 comment=PXE support
netsh dhcp server \<DHCP_server_machine_name> set optionvalue 60 STRING PXEClientPXE responder without WDS
This uses a different documented arrangement, including HKLMSoftwareMicrosoftSMSDPDoNotListenOnDhcpPort = 1, DHCP Option 60 and service restarts. Do not substitute WDS commands for this design. Refer to Microsoft’s co-hosting procedure and the PXE responder guidance before changing production DHCP.
Recognize the certificate-specific failure
When SMSPXE.log contains:
SMSPXE Failed to create certificate store from encoded certificate.
An error occurred during encode or decode operation. (Error: 80092002; Source: Windows)
SMSPXE PXE::MP_GetList failed; 0x80092002
SMSPXE PXE::MP_LookupDevice failed; 0x80092002treat it as a DP certificate-provisioning problem. Follow Microsoft’s current KB procedure for certificate provisioning, DP/site permissions and repair: PXE boot doesn’t work because of a certificate issue. Do not infer certificate failure from an unrelated PXE initialization message.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use a packet capture when logs cannot locate the boundary
- Mirror the client switch port and capture on the client-side network.
- Capture simultaneously on the PXE DP interface.
- Reproduce one boot attempt.
- Compare DHCPDISCOVER, DHCPOFFER, DHCPREQUEST, DHCPACK, BINL/proxyDHCP and TFTP packets.
- Identify the first expected response missing from either capture; that boundary identifies the responsible network, service or host.
Recovery order
- Correct DHCP, helper, ACL, firewall or unsupported-option configuration.
- Validate and redistribute boot-image content.
- Add only required WinPE NIC or storage drivers.
- Correct device identity, collection and PXE deployment policy.
- Repair a confirmed certificate-provisioning fault.
- Reconfigure or reinitialize WDS/PXE only when logs show provider, service or file corruption.
- Rebuild the DP only as a last resort, after preserving logs and configuration evidence.
Prevent repeat incidents
- Restrict PXE-enabled interfaces and trusted network segments; consider a PXE password.
- Keep PXE images minimal and protect them from rogue responders and TFTP interception. Microsoft’s security guidance is at Security and privacy for operating-system deployment.
- Maintain separate, tested WinPE driver packages for each hardware family.
- Test one known and one unknown computer on every served VLAN after network or ConfigMgr changes.
- Document ownership of DHCP, routing, DP, ConfigMgr policy and endpoint hardware checks.
The Bottom Line
Find the first stage that fails, prove it in the corresponding log or packet capture, and apply the smallest fix. IP helpers and correct DP policy solve many routed and “no boot action” cases; boot-image drivers solve WinPE hardware failures; PXE reinstallation belongs near the end, not the beginning.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
