Windows 2000 PXE Remote Network Boot Explained

Microsoft Windows 2000 manages remote network boot sequences through its integrated Remote Installation Services (RIS), utilizing the industry-standard Preboot Execution Environment (PXE) protocol. By coupling PXE with native Windows network infrastructure—specifically Dynamic Host Configuration Protocol (DHCP), the Boot Information Negotiation Layer (BINL), Active Directory, and Trivial File Transfer Protocol (TFTP)—Windows 2000 automates the initialization, authentication, and operating system deployment processes for bare-metal systems across a local network without requiring physical installation media.

Core Architecture Components

The Windows 2000 network boot architecture relies on four fundamental services operating in unison:

  • DHCP Server: Assigns dynamic IP configurations to PXE-enabled clients and directs them to the remote boot server using custom DHCP options.
  • Boot Information Negotiation Layer (BINL): A Windows 2000 system service running on the RIS server that listens for client requests, verifies client credentials with Active Directory, and determines the appropriate boot images and network drivers.
  • Active Directory (AD): Validates permissions, ensures the RIS server is authorized to answer clients, and pre-stages client computer accounts using their network adapter's Globally Unique Identifier (GUID).
  • TFTP Service: Delivers the initial lightweight boot files, bootstrap loaders, and the OS Chooser interface from the RIS server to the client machine's memory.

Step-by-Step Remote Boot Workflow

When a client computer with a PXE-compliant network interface card (NIC) boots from the network, the sequence executes through the following distinct stages:

  1. DHCP Discovery and PXE Tagging:
    The client machine broadcasts a standard DHCPDISCOVER packet that includes PXE-specific tags identifying the client as a network boot candidate, along with its MAC address and System GUID.

  2. IP Allocation and Server Offer:
    The DHCP server responds with a DHCPOFFER containing an IP address, subnet mask, default gateway, and DNS parameters. Simultaneously, the RIS server's BINL service detects the PXE broadcast and offers its services if the server is authorized in Active Directory.

  3. BINL Verification:
    The client sends a request to the BINL service on port 4011. BINL queries Active Directory to confirm whether the client machine has been pre-staged. If pre-staged, BINL retrieves the client's configuration policies; if not, it prepares generic installation pathways based on the RIS configuration.

  4. TFTP Bootstrap Retrieval:
    The BINL service informs the client of the boot filename to fetch—typically Startrom.com—and the IP address of the TFTP server. The client downloads this initial file into RAM via TFTP.

  5. OS Chooser Initialization:
    Startrom.com prompts the user (usually by pressing F12 for network service boot) to proceed. Upon confirmation, the bootstrap loader downloads and executes OSChooser, a text-mode, low-overhead graphical interface.

  6. Authentication and Image Selection:
    Through OSChooser, the user enters Active Directory domain credentials. The RIS server authenticates the user, evaluates Group Policy, and returns a tailored menu of permitted operating system installation options (such as unattended Windows 2000 Professional installations or Sysprep-based RIPREP images).

  7. Setup Handoff:
    Once the user selects an installation image, OSChooser uses TFTP to download Setupldr.exe, the Windows 2000 kernel components, and network drivers directly into client RAM. Execution control then transitions from the PXE/TFTP runtime to the standard Windows 2000 Text-Mode Setup engine, which mounts the network installation share via SMB to finish the installation.