notifications

cableEnrollment

Image devices from an imaging station: pick a station, see what is on its PXE network, and enrol one machine with brand-specific guidance or a whole rack at once.

1Imaging station

2Devices on st-1

4 on PXE refresh

checklistBefore PXE boot: one firmware visit per device

Security Chip (TPM2): set to Enabled, then Clear Security Chip once
Secure Boot: set to Enabled AND Reset to Setup Mode (clears the factory keys)
Save & Exit, then boot the device from the network (PXE)

With this state set, everything after Start imaging runs hands-off: signed install, key enrolment, TPM2 sealing, verification - no BIOS visit afterwards.

Tick the devices to image, give each a CMDB name, and enrol them all onto one profile and group in a single audited pass.

Hardware profile Type to search. A model that is not listed has to be described in the overlay first: imaging needs its disk layout, not just its name.

Class

Group

02:7c:89:52:69:d8 HP EliteBook 840 G10 · 512 GB auto_awesomehp-elitebook-840 info Disk layoutLUKS2 on nvme0n1, ext4 root, 1 GiB ESP Imaging steps for this model

Enter the firmware - Esc then F10. Clear the Secure Boot keys to reach setup mode.
PXE-boot the installer - F9, pick the network entry.
Confirm the target disk - nvme0n1 is wiped.
Seal to the TPM - Same ceremony as every other model; the console drives it.

CMDB name

02:8f:6b:de:9d:52 Lenovo ThinkPad T14 Gen 4 · 1024 GB auto_awesomelenovo-t14-g4 info Disk layoutLUKS2 on nvme0n1, ext4 root, 1 GiB ESP Imaging steps for this model

Enter the firmware - F1 during boot. Set Secure Boot to setup mode so the console can enrol its keys.
PXE-boot the installer - F12, pick the network entry the station serves.
Confirm the target disk - nvme0n1 is wiped. There is no second disk in this model.
Seal to the TPM - After the first boot the console seals the LUKS key; the recovery key is escrowed and the device forgets its copy.

CMDB name

02:ab:f7:5d:0d:bf Lenovo ThinkPad T14 Gen 4 · 1024 GB auto_awesomelenovo-t14-g4 info Disk layoutLUKS2 on nvme0n1, ext4 root, 1 GiB ESP Imaging steps for this model

Enter the firmware - F1 during boot. Set Secure Boot to setup mode so the console can enrol its keys.
PXE-boot the installer - F12, pick the network entry the station serves.
Confirm the target disk - nvme0n1 is wiped. There is no second disk in this model.
Seal to the TPM - After the first boot the console seals the LUKS key; the recovery key is escrowed and the device forgets its copy.

CMDB name

02:ca:d2:25:60:68 HP EliteBook 840 G10 · 512 GB auto_awesomehp-elitebook-840 info Disk layoutLUKS2 on nvme0n1, ext4 root, 1 GiB ESP Imaging steps for this model

Enter the firmware - Esc then F10. Clear the Secure Boot keys to reach setup mode.
PXE-boot the installer - F9, pick the network entry.
Confirm the target disk - nvme0n1 is wiped.
Seal to the TPM - Same ceremony as every other model; the console drives it.

CMDB name

Selected devices need a unique name; imaging wipes the disk.