Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Hyper-V virtual machines have the ability to PXE boot. Obviously, PXE boot raises some security concerns. The problem is, unlike a typical physical machine's firmware, there isn't an obvious way to disable PXE boot altogether.

Hyper-V manager shows each of the VM's network adapters in Settings=>Firmware=>Boot Order:

enter image description here

You can move a network adapter to the bottom of the boot order, but you can't remove it altogether from that screen. So if, for some reason, Hyper-V can't boot from any of the other drives, the VM still tries to PXE boot and shows this screen:

enter image description here

I've scoured Settings=>Network Adapter for a way to disable PXE boot to no avail.

So my questions are:

  1. How do you disable PXE boot in a Hyper-V VM?
  2. If you can't disable PXE boot, is there a good reason why?

I'm using Windows Server 2012 R2

share|improve this question

migrated from superuser.com Aug 12 at 7:28

This question came from our site for computer enthusiasts and power users.

2 Answers 2

up vote 1 down vote accepted

Use Powershell to Remove Network Boot Devices from the Boot Order

You can use PowerShell to strip the Network BootTypes from the VMs boot order.

Extract the Current Boot Order

Using Powershell you can use this command to extract the current boot order:

$old_boot_order = Get-VMFirmware -VMName testvm -ComputerName MyHyperVHost `
                  | Select-Object -ExpandProperty BootOrder

If you inspect $old_boot_order You should see the list of boot devices for testvm. Something like this:

enter image description here

Strip the Network Boot Devices

You can strip the boot devices from the boot list with the Network BootType using this command:

$new_boot_order = $old_boot_order | Where-Object { $_.BootType -ne "Network" }

Inspecting $new_boot_order should look something like this with no more Network boot devices:

enter image description here

Set the New Boot Order

To set the new boot order for the VM use this command:

Set-VMFirmware -VMName testvm -ComputerName MyHyperVHost -BootOrder $new_boot_order

Confirm the New Boot Order

To confirm what you did use that first Get-VMFirmware command again:

Get-VMFirmware -VMName testvm -ComputerName MyHyperVHost `
| Select-Object -ExpandProperty BootOrder

Beware: If you use both PowerShell and Hyper-V manager to make changes to the boot order, PowerShell may report erroneous (out-of-date) boot order. See also this technet thread.

share|improve this answer

Regarding your concerns about PXE

The implementation of PXE in a corporate environment may raise concerns about security. This document shows why these concerns are mostly unfounded.

http://www-01.ibm.com/support/docview.wss?uid=swg21247020

share|improve this answer
    
The link you provided does not work. 410 Gone –  alx9r Aug 12 at 22:07
    
Sorry; check the link again please –  Pat Aug 13 at 8:02
1  
The article basically says to configure your network so that you are sure that you are only communicating with a legitimate PXE server. I don't need PXE boot at all. So relying on network configuration to protect against PXE boot exploits violates both the "defense in depth" and the "reduced attack surface" principles. PXE boot should simply be disabled on VMs that don't need that ability. –  alx9r Aug 14 at 18:53
    
the article shows you how if you do your homework you shouldn't see your PXE "attack surface" bigger that it really is. –  Pat Aug 14 at 19:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.