How Can I Secure Access to Boot Images?

A common question is “How can I secure access to boot images?” Unfortunately there is not a way to do that. There is no logon during the PXE bootup. The PXE client simply downloads a list of available boot images and presents them to end users. It is possible for an end user to download a boot image and use it to do something unexpected or unauthorized to their Windows installation, bypassing the security mechanisms.

You could decide not to put and enabled boot images on the WDS server. Instead, you could create DVD or USB boot media from the boot images suing WAIK. This means that you would require some media for building or rebuilding computers. Of course, there is nothing to stop determined users from bringing in their own boot media. Any Windows 7 or Windows Vista DVD comes with a copy of Windows PE, and the tools you use to create a customized boot images are free to download and use.

Another solution would be to encrypt the hard disks on your computers by BitLocker. This could be done on the Ultimate and Enterprise editions of Windows 7. A user might be able to boot up their computer with some boot media but they will not be able to access the contents of the hard disk to bypass the administrative restrictions of the Windows installation.