A PXE problem in Configuration Manager shows up in one of four places: a code on the device's firmware screen, a line in SMSPXE.log on the distribution point (DP), a Windows Deployment Services (WDS) service that won't start, or a boot image the console can't update. This quick reference lists the documented messages from each stage with their meaning, the usual cause and the first thing to check.
Codes in this quick reference
PXE-E52: proxyDHCP offers were received. No DHCP offers were received.PXE boot screen (firmware)PXE-E77: Bad or missing discovery server listPXE boot screen (firmware)PXE-E35: TFTP read timeoutPXE boot screen (firmware)PXE-E36: Error received from TFTP serverPXE boot screen (firmware)PXE-E3F: TFTP packet size is invalidPXE boot screen (firmware)PXE-E3B: TFTP Error - File not FoundPXE boot screen (firmware)PXE-T04: Access ViolationPXE boot screen (firmware)Failed to create certificate store from encoded certificate (Error: 80092002): the DP certificate can't be decodedSMSPXE.log
+ 12 more codes in the tables below.
How to read these codes#
Start by working out which stage failed. Where the message appears tells you:
| Where you see it | Stage | What writes it |
|---|---|---|
Firmware screen (PXE-E or PXE-T code) | DHCP discovery or the TFTP download, before Windows PE starts | The PXE firmware of the network adapter |
SMSPXE.log on the PXE-enabled DP (on a standalone DP, <drive>:\SMS_DP$\sms\logs) | Certificate checks, the boot decision, boot image handling | The SMS PXE provider that registers with WDS, or the PXE responder service |
| smsdpprov.log (standalone DP) or distmgr.log (DP on the site server) | Installing PXE and writing the DP's settings | The DP provider and Distribution Manager |
| SMSProv.log on the SMS Provider server | Updating, importing or changing boot images | The SMS Provider |
smsts.log in Windows PE (X:\Windows\Temp\SMSTSLog) | Everything after Windows PE starts | The task sequence |
Covered elsewhere on this site, so not repeated here: PXE-E51, PXE-E53, PXE-E55, PXE-E78 and PXE-E32, plus the SMSPXE.log sequence no advertisements found, No boot action. Aborted., Not serviced. (see PXE boot failing in Configuration Manager). Codes logged after Windows PE starts, such as 0x800704C6 when the boot image has no network driver, are in the task sequence error codes reference.
PXE firmware messages (before Windows PE)#
No Configuration Manager log exists at this stage. Microsoft's guidance for every discovery error is the same: IP helpers on the routers that forward the client's broadcast to both the DHCP server and the PXE-enabled DP, no DHCP options 60, 66 or 67 (only option 60 when DHCP and WDS share a server), and UDP 67, 68, 69 and 4011 open between the client, DHCP and the DP. If the device boots when it's plugged into the DP's own subnet, fix the routing.
DHCP and boot server discovery#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
PXE-E52 | proxyDHCP offers were received. No DHCP offers were received. | The PXE-enabled DP answered but no DHCP server did: the router forwards the broadcast to the DP only, or DHCP can't hand out an address | The IP helper list on the client's router (DHCP server and DP), then free leases in the scope |
PXE-E77 | Bad or missing discovery server list | The boot server discovery details the client received are unusable, usually because DHCP or router settings try to steer PXE instead of forwarding the broadcast | Remove PXE-related DHCP options at server and scope level; use IP helpers |
TFTP download#
The device found the boot server but couldn't download the boot files. A simultaneous network trace on the DP and on a mirrored switch port shows whether the client's read requests get answers.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
PXE-E35 | TFTP read timeout | The transfer started but blocks stopped arriving: packet loss, a firewall, or a block or window size the network path can't carry | The trace; then reduce the block size on the DP, as Microsoft's advanced PXE article advises |
PXE-E36 | Error received from TFTP server | The DP's TFTP service refused the request, for example for a missing file or blocked access | The WDS logs on the DP for TFTP errors, then the checks for PXE-E3B and PXE-T04 |
PXE-E3F | TFTP packet size is invalid | A block size that the client firmware or the network path can't handle, typically after it was raised | Undo any customized block size and retest |
PXE-E3B | TFTP Error - File not Found | A boot file the client asked for isn't on the DP: empty SMSBoot folders, or no PXE-enabled boot image for that architecture | RemoteInstall\SMSBoot\x86 and \x64 hold files and boot.sdi is in SMSBoot; the boot image has Deploy this boot image from the PXE-enabled distribution point set |
PXE-T04 | Access Violation | The TFTP server can't read the requested file, usually because of permissions on the REMINST share or the RemoteInstall folder | Share and folder permissions, compared with a working DP |
Tip: If you've added RamDiskTFTPBlockSize or RamDiskTFTPWindowSize under HKLM\SOFTWARE\Microsoft\SMS\DP to speed up boot image downloads, remove or lower them first. Microsoft warns that a large block or window size can make the download fail with a time-out, and that large blocks cause fragmented packets most PXE clients don't support. WDS and the PXE responder both use these values.
SMSPXE.log on the distribution point#
The DP hands its certificate to PXE clients and uses it when it asks the management point (MP) what to do with a device, so a certificate problem breaks every PXE boot from that DP. Restart WDS (or the PXE responder service) and read the lines logged at startup.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
Failed to create certificate store from encoded certificate. Verify the provided Certificate was provisioned correctly. (Error: 80092002) | 0x80092002 CRYPT_E_BAD_ENCODE: An error occurred during encode or decode operation. | The DP has no usable certificate; Microsoft documents it for a self-signed certificate that was never created | Change the expiration date of the self-signed certificate in the DP's properties, wait for the new one, restart WDS (not applicable to HTTPS DPs) |
PXE::MP_LookupDevice failed; 0x80092002 (also PXE::MP_GetList and PXE::MP_ReportStatus) | The DP couldn't query the MP; often logged with PXE Provider failed to process message | The certificate problem in the row above | Fix the certificate; the device's MAC address then appears with a boot action |
Certificate [<thumbprint>] issued to '<DP>' has expired. | Logged with Certificate not valid (Error: 800B0101), Failed to send status message (80004005) and PXE::MP_ReportStatus failed; 0x80070490 | The DP still uses its old certificate. Microsoft documents this when a PXE password is set and the site server was moved or restored from backup | distmgr.log for the next row |
Failed to get the encrypted PXE password (distmgr.log) | Distribution Manager can't decrypt the PXE password | The site's machine keys changed, so the password and the new certificate can't be written to the DP | Clear Require a password when computers use PXE on the DP's PXE tab, wait for DP registry settings have been successfully updated, restart WDS, then set the password again |
Cannot read the registry value of MACIgnoreListFile (00000000) | Informational, followed by MAC Ignore List Filename in registry is empty | No PXE exclusion list is configured, which is normal | Nothing; if you do use an exclusion list, check that the MACIgnoreListFile value points to your file |
WDS and PXE setup on the distribution point#
WDS won't start#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
Windows could not start the Windows Deployment Services Server on Local Computer. with service-specific error code -1056505588 | WDS won't start because the SMS PXE provider (smspxe.dll) can't load | Microsoft documents a missing Visual C++ runtime on a remote DP that has no Configuration Manager client (article written for the 2012 version) | The Application log for the next row |
Activation context generation failed for "C:\SMS_DP$\sms\bin\smspxe.dll". (SideBySide, event ID 33) | A runtime assembly that smspxe.dll depends on isn't installed (Microsoft.VC90.CRT in the documented case) | No Configuration Manager client, and no matching Visual C++ redistributable, on the DP | Install the client on the DP, or run vcredist_x64.exe from the Client\x64 folder of the site's installation directory |
Lines that look like errors but are normal#
Microsoft's walkthrough of a successful PXE install on a remote DP (recorded on an older version) shows these lines in smsdpprov.log. Each is followed by the step that fixes it, so they matter only if the install stops right after them.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
RegQueryValueExW failed for Software\Microsoft\SMS\DP, PxeInstalled / RegReadDWord failed; 0x80070002 | The PxeInstalled value doesn't exist yet | First PXE install on this DP | PxeInstalled and IsPXE are 1 under HKLM\SOFTWARE\Microsoft\SMS\DP afterward |
Failed to open WDS service. / WDS is NOT INSTALLED | WDS isn't installed yet | Setup adds the WDS role next (not needed with the PXE responder) | Successfully installed WDS. a few lines later |
Share (REMINST) does not exist. (NetNameNotFound) (0x00000906) | The REMINST share hasn't been created yet | Setup creates it on the NTFS drive with the most free space | A line confirming the REMINST share, and a new RemoteInstall folder |
Boot image errors#
Updating a boot image on distribution points, importing one, creating one with the MDT wizard and adding drivers all mount the WIM on the server that hosts the SMS Provider. That may not be the site server: check Administration › Site Configuration › Sites, open the site's Properties and read SMS Provider location on the General tab. Then read SMSProv.log on that server.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
ERROR> failed to mount wim file, err=-1052638943 | The SMS Provider couldn't mount the boot image | The WIMMount service on the SMS Provider server is corrupted, misconfigured or missing | WIMMount's ImagePath points to wimmount.sys in the Windows ADK folder; reinstall it (below) |
Failed to inject OSD binaries into mounted WIM file (often happens if unsigned drivers are inserted into x64 boot image) | The Configuration Manager files couldn't be added to the boot image | The mount failed (row above), or an unsigned driver was added to an x64 boot image | The lines above it; remove the driver you added last (see OSD driver management) |
"Error executing command" - CWimManager::InternalExecuteCmd (hr:0x8007007b) | dism.log when you mount the WIM by hand; 0x8007007B is ERROR_INVALID_NAME | The same WIMMount problem; Process Monitor won't reveal a missing file | Reinstall WIMMount instead of chasing paths |
Check and reinstall WIMMount on every server that hosts the SMS Provider (the path is the default Windows ADK location):
reg query HKLM\SYSTEM\CurrentControlSet\Services\WIMMount /v ImagePath
fltmc filters
cd /d "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\amd64\DISM"
WimMountAdkSetupAmd64.exe /InstallSymptoms without an error code#
- WDS crashes at random during PXE boots, and restarting WDS alone doesn't help. Microsoft links this to redundant routers that both forward the PXE request, so WDS receives duplicates. Remove the IP helpers from the backup router, or make the provider single-threaded with a
NumberOfThreadsDWORD set to 1 underHKLM\Software\Microsoft\SMS\DP(documented for the 2012 versions). - Windows PE starts, then restarts or never shows the wizard. Enable Enable command support (testing only) on the boot image's Customization tab, press F8 and run
ipconfig. If smsts.log has noFound network adapterline with an IP address, the boot image needs a network driver; add only network and storage drivers.
How to verify a fix#
- Certificates: after restarting WDS, SMSPXE.log shows
Begin validation of CertificateandCompleted validation of Certificatewith the new thumbprint, and nohas expiredor80092002lines. - Boot files:
RemoteInstall\SMSImageshas a folder for each boot image package ID, andSMSBoot\x86andSMSBoot\x64hold files. - Boot images: Update Distribution Points completes and SMSProv.log has no
failed to mount wim fileline. - End to end: a test device PXE boots, its MAC address appears in SMSPXE.log, Windows PE starts and smsts.log shows the network adapter with an IP address.
# On the PXE-enabled DP: adjust the drive letters to your DP
Select-String -Path 'D:\SMS_DP$\sms\logs\SMSPXE.log' -Pattern 'Certificate|failed' |
Select-Object -Last 15
Get-ChildItem 'D:\RemoteInstall\SMSImages', 'D:\RemoteInstall\SMSBoot\x64' | Select-Object FullNameReferences#
- Advanced troubleshooting for PXE boot issues in Configuration Manager and Understand PXE boot in Configuration Manager (Microsoft Learn): the PXE-E and TFTP codes and the normal install logs
- PXE boot doesn't work because a self-signed certificate isn't created and Certificate isn't updated on a PXE-enabled distribution point (Microsoft Learn)
- WDS doesn't start on a PXE enabled remote distribution point and PXE boot causes WDS to crash (Microsoft Learn)
- Error when managing boot images in Configuration Manager and Prepare site system roles for OS deployments (Microsoft Learn): WIMMount and the RamDisk TFTP sizes
