Zenworks Configuration Management, PXE, and Firewalls

I recently added a new site to my ZCM setup and I couldn't get the clients to PXE boot.  This problem was particularly frustrating because it seemed so familiar and I knew that I had encountered it and fixed it once before.

I did remember to start the Proxy DHCP (pdhcp in some places) service and set it to automatically start.  That's a simple as going to the Services console, picking the "Novell Proxy DHCP Service" and setting the Startup type to Automatic and then clicking on Start.

But PXE still doesn't work.  What did I miss?

The firewall configuration.

Out of the box, the Zenworks installer sets a lot of firewall allow rules, but it doesn't set the ones needed for PXE booting.  You have to set those manually.  Here's how to do that.

Go to the Control Panel > System and Security > Windows Firewall.  Click on the "Allow a program or feature through Windows Firewall".  (You could just turn off the Windows Firewall if you wanted to, that would also fix this problem).


Then click on the "Allow another program..." button.

Then the "Browse..." button

Now you want to browse to your Zenworks folder.  By default that's C:\Program Files (x86)\Novell\Zenworks.  From there we're going to drill down further into the bin\preboot folder.  You should have wound up at C:\Program Files (x86)\Novell\Zenworks\bin\preboot

You'll notice a couple of applications: novell-pbserv, novell-proxydhcp, novell-tftp, novell-zisdservice, and novell-zmgprebootpolicy.  We're going to select and allow each of these in the firewall.  Just start with the first one, novell-pbserv, select it, then click the Open button.  Now you're back to the "Add a Program" screen, just click the Add button.

It should automatically check the box for the Domain network location which should be all you need.

At this point it's just rinse and repeat.  You'll click on the "Allow another program button" and go through and selecting all the "novell-xxxx" applications one by one adding them to the list.  Once you get them all done, it'll look like this.

How to change CTRL+ALT in vSphere Web Client

I've been working on setting up a new SYSPREP Win7.  I started the build on a virtual machine running on top of VMware vSphere.  I tweaked it and got it like I wanted it.  Then I went take the image in Zenworks and realized I couldn't get into the imaging mode.  To load the imaging menu you press CTRL + ALT during the PXE boot portion, but CTRL + ALT is also the same key combination to release control of the virtual machine window.  I could have just booted it from a Zenworks boot CD, but I wanted to use the PXE boot.  I looked through the options in vCenter and couldn't find anything related to the changing those settings.  Then I turned to Google and I found a bunch of posts talking about how you couldn't change it.  The outlook was starting to look a little bleak, but then I stumbled into a workaround.  Apparently, the standalone program VMPlayer and the vSphere console use the same configuration file.  You can find that file here:

C:\Users\yourusername\AppData\Roaming\VMware\preferences.ini

There are lot of guides on how to tweak the settings in that file.  But here's the settings that were relevant to what I wanted to do.

pref.hotkey.control = "true"
pref.hotkey.gui = "true"
pref.hotkey.shift = "false"
pref.hotkey.alt = "false"

These settings change the CTRL+ALT combination to CTRL + Win (that's "gui" above).  Keep in mind that the "Hint" across the top of the window still says press CTRL+ALT to release the cursor.   You also have to close and reopen the window for it to pickup the change.  I panicked at first because I changed the settings, couldn't get them to work and then forgot that I had changed them.  Later when I went back into a VM I couldn't get out of it.  I'll admit, it did take me minute to realize what I had done.