Topic: WDS - Winload.exe Signature Failure  (Read 5647 times)

WDS - Winload.exe Signature Failure
« on: March 12, 2014, 08:27:33 PM »

HumanCaviar

  • Apprentice
  • *
  • Date Registered: Mar 2014
  • Posts: 4
I don't know if anyone else has come across this, but I'm having an issue trying to boot my Win8.1SE_PE .wim file from a Windows Deployment Server.  After selecting the boot image, I am confronted with a Windows Boot Manager error. (winload.exe digital signature could not be verified - URL below for screen)
i60.tinypic.com/2nhqm88.jpg

-WDS Server OS:  Windows Server 2012 R2
-WDS Version:  6.3.9600.16384

Build Attempt 1:
Win8.1SE Source:  Windows 8.1 Ultimate Evaluation Installation ISO (extracted to directory)
Win8.1SE Version:  Win81SE82_Builder
-Attempted build on Windows 8.1 Professional

Build Attempt 2:
Win8.1SE Source:  Windows Server 2012 R2 Installation ISO (extracted to directory)
Win8.1SE Version:  Win81SE82_Builder
-Attempted build on Windows 7SP2 Professional

Any ideas?  I tried messing around with the WDS bcd files on the server to disable driver signing but it didn't help.  Anything I'm missing?

Re: WDS - Winload.exe Signature Failure
« Reply #1 on: March 13, 2014, 09:02:44 AM »

was_JFX

  • Code Baker
  • Grand Chef
  • *****
  • Date Registered: Dec 2010
  • Posts: 1074
The digital signature of winload.exe is no longer valid in the latest build.
This was necessary to disable Driver Signature Enforcement.

http://theoven.org/index.php?topic=866.msg11055#msg11055

Adding NoIntegrityChecks to your BCD store should solve the problem.

Re: WDS - Winload.exe Signature Failure
« Reply #2 on: March 13, 2014, 03:48:14 PM »

HumanCaviar

  • Apprentice
  • *
  • Date Registered: Mar 2014
  • Posts: 4
Hi JFX, thanks for the reply!  I attempted your BCD change, but it didn't have an effect.  I may have put it in the wrong place, as Windows Deployment boot chain isn't as familiar to me as an attached storage device (see below for current boot-chain/bcd output).  I'd love to get the latest and greatest running on WDS, but if it just isnt going to work right now I'll cope.  If it wont, what is the latest build that keeps the signature of winload.exe intact?

###Boot-Chain/BCD Output###
Misc Info:
-WIM File: WDSDIR$\Boot\x64\Images\Srvr2k12PE.wim
-Test Client:  PXE Bootable x86/x64 Core i5 Laptop

=_=_=_=_=_=_=_=[1: $WDSDIR$\Boot\x64\default.bcd]=_=_=_=_=_=_=_=
bcdedit /store default.bcd /enum all

Windows Boot Manager
--------------------
identifier              {bootmgr}
fontpath                \boot\fonts
inherit                 {dbgsettings}
timeout                 30

Debugger Settings
-----------------
identifier              {dbgsettings}
debugtype               Serial
debugport               1
baudrate                115200

Device options
--------------
identifier              {68d9e51c-a129-4ee1-9725-2ab00a957daf}
ramdisksdidevice        boot
ramdisksdipath          \Boot\Boot.SDI
ramdisktftpblocksize    1456
ramdisktftpwindowsize   4
custom:3600000b         Yes

=_=_=_=_=[2: $WDSDIR$\Boot\x64\Images\Srvr2k12PE.wim.bcd]=_=_=_=_=
bcdedit /store Srvr2k12PE.wim.bcd /enum all

Windows Boot Loader
-------------------
identifier              {af4e2d37-f3dd-47fa-b9c2-542622d9f132}
device                  ramdisk=[boot]\Boot\x64\Images\Srvr2k12PE.wim,{eccaea5d-
4110-427d-8676-e3b6e07a8165}
description             Srvr2k12_PE
nointegritychecks       Yes
osdevice                ramdisk=[boot]\Boot\x64\Images\Srvr2k12PE.wim,{68d9e51c-
a129-4ee1-9725-2ab00a957daf}
systemroot              \WINDOWS
detecthal               Yes
winpe                   Yes

Device options
--------------
identifier              {eccaea5d-4110-427d-8676-e3b6e07a8165}
inherit                 {68d9e51c-a129-4ee1-9725-2ab00a957daf}
ramdiskmcenabled        No
ramdiskmctftpfallback   Yes


Re: WDS - Winload.exe Signature Failure
« Reply #3 on: March 13, 2014, 05:42:11 PM »

HumanCaviar

  • Apprentice
  • *
  • Date Registered: Mar 2014
  • Posts: 4
Figured it out with the help of this article: social.technet.microsoft.com/Forums/windows/en-US/903c2088-4fe1-440e-8a98-5fe34d0980e4/howto-create-a-boot-configuration-that-has-no-driver-signature-checks-disable-driver-integrity?forum=w8itprogeneral

New BCD File - Bypasses winload.exe signature check on Windows Deployment Services boot of Windows 8.1/Server 2012 R2 PE.
 
=_=_=_=_=[2: $WDSDIR$\Boot\x64\Images\Srvr2k12PE.wim.bcd]=_=_=_=_=


Windows Boot Loader
-------------------
identifier              {af4e2d37-f3dd-47fa-b9c2-542622d9f132}
device                  ramdisk=[boot]\Boot\x64\Images\Srvr2k12PE.wim,{eccaea5d-4110-427d-8676-e3b6e07a8165}
description             Srvr2k12_PE
loadoptions             DISABLE_INTEGRITY_CHECKS
nointegritychecks       Yes
testsigning             Yes
osdevice                ramdisk=[boot]\Boot\x64\Images\Srvr2k12PE.wim,{68d9e51c-
a129-4ee1-9725-2ab00a957daf}
systemroot              \WINDOWS
detecthal               Yes
winpe                   Yes

Device options
--------------
identifier              {eccaea5d-4110-427d-8676-e3b6e07a8165}
inherit                 {68d9e51c-a129-4ee1-9725-2ab00a957daf}
ramdiskmcenabled        No
ramdiskmctftpfallback   Yes

Re: WDS - Winload.exe Signature Failure
« Reply #4 on: March 13, 2014, 05:59:48 PM »

HumanCaviar

  • Apprentice
  • *
  • Date Registered: Mar 2014
  • Posts: 4
I hadn't initially clicked on the link JFX had provided, if I had I would have saved myself a bunch of time.  As you stated in the linked post, the BCD needs both:
-NoIntegrityChecks 1
and
-loadoptions DISABLE_INTEGRITY_CHECKS

Thanks!

 

Powered by EzPortal