TFTP: 192.168.1.60: request for EFI\Microsoft\Boot\Policies\UnlockToken.pol.

Question

To whom it may concern,

I have been having a problem getting my PXE boot to fully complete. The test VM successfully initiates the network boot, but it stalls and times out with error 0x8007274C right during the "Loading files..." stage while downloading the boot image over TFTP. Note, I'm new to this type of setup, and my main goal is to learn how to do this type of configuration.

Some of the steps that I attempted are:

1. In the registry, I created a RamDiskTFTPBlockSize and changed it from 1456 to 1024, to attempt to prevent packets from dropping. I also created a RamDiskTFTPWindowSize, and I set it to 1.
2. I restarted the relevant PXE Responder service after making registry changes.
3. Performed an update on the Distribution Point on the boot image package.
4. Verified and associated the DP with the correct boundary groups.
5. There was a scratch size option that I changed for 32mb to 512 mb.
6. I also created a firewall rule to allow the SCCM PXE boot process traffic to pass, and I have ports 67, 68, 69, 4011 added to the rule.
7. I also changed the network adapter to vmxnet3 on my SCCM server (Windows Server 2019) and in the test VM's (Windows 10) vmx file.

I'm sure that I may be forgetting a few things, but hopefully what I wrote helps. This is being done in VMware Workstation.

Regards,

Answer 1

For a PXE boot that reaches "Loading files..." and then times out during TFTP, the most relevant checks are the TFTP transfer path and the boot files on the PXE-enabled distribution point.

Based on the symptoms and the steps already tried, use this sequence:

1. Capture the TFTP exchange with Wireshark or Netmon For TFTP timeout errors, the recommended troubleshooting method is to monitor the network traffic. A common pattern is that the client sends TFTP read requests but does not receive the expected response or acknowledgment.
2. Verify the required ports are open end-to-end PXE requires these ports open between the client, DHCP server, and PXE-enabled DP:
   • DHCP: 67, 68
   • TFTP: 69
   • BINL: 4011
   Since firewall rules were already added, confirm traffic is actually passing between the VM and the PXE-enabled DP, not just allowed locally.
3. Check whether DHCP options 60/66/67 are configured If DHCP options 60, 66, and 67 are set on the DHCP server, PXE clients can fail with errors such as no boot filename received or proxy DHCP not replying on port 4011. Microsoft does not support using these options on a DHCP server to redirect PXE clients when the PXE server is on another computer. The supported approach is to remove those DHCP options and use the router IP helper configuration so PXE requests reach the PXE server correctly.
4. Re-check the TFTP block size setting Large TFTP block or window sizes can cause the boot image download to fail with a timeout. Configuration Manager supports customizing the RamDisk TFTP block and window sizes specifically because these values can affect PXE reliability. Since the block size was already reduced to 1024 and window size to 1, keep focus on validating whether the change actually improved the transfer in the packet trace. The documentation specifically recommends testing customized settings in the environment to determine the most efficient configuration.
5. Verify the PXE boot files exist on the DP For TFTP transfer failures, verify these locations and files on the PXE-enabled DP:
   • RemoteInstall\SMSBoot\x86
   • RemoteInstall\SMSBoot\x64
   • SMSBoot\Fonts
   • RemoteInstall\SMSBoot\boot.sdi
   During PXE boot, the NBP and boot files downloaded by TFTP include items such as:
   • smsboot\x64\pxeboot.com
   • smsboot\x64\bootmgr.exe
   • \SMSBoot\Fonts\wgl4_boot.ttf
   • \SMSBoot\boot.sdi
   • the boot WIM under \SMSImages\<PackageID>
   If any of these are missing or inaccessible, the client can stall during file loading.
6. Verify the boot image is enabled for PXE deployment Make sure Deploy this boot image from the PXE-enabled distribution point is enabled in the boot image properties.
7. Confirm the WIM is present on the DP Verify that the boot image exists on the distribution point under:
   • C:\RemoteInstall\SMSImages\<PackageID>
8. Check WinPE network driver status from the client If the boot image starts but networking fails in WinPE, driver issues are common. Press F8 in WinPE and run:

      ipconfig
   

   The expected result is that the NIC is recognized and has a valid IP address. In SMSTS.log, a healthy case shows a detected network adapter with a valid IP address.
9. Verify the WDS service state if WDS is being used For TFTP transfer issues, verify that the WDS service is started on the DP. Also check WDS logs for additional TFTP errors.
10. If using Configuration Manager PXE responder without WDS, check for option 82 requirements Configuration Manager supports option 82 only with the PXE responder without WDS. It is not supported with WDS.

The most likely causes from the described symptom are:

• TFTP traffic not completing even though PXE starts
• unsupported DHCP option configuration
• missing or inaccessible boot files on RemoteInstall
• WinPE NIC driver issue after initial boot file download begins
• oversized or unsuitable TFTP transfer settings for the VMware network path

---

• Use PXE to deploy Windows over the network with Configuration Manager
• Understand PXE boot in Configuration Manager
• Advanced troubleshooting for PXE boot issues in Configuration Manager
• PXE clients computers do not start when you configure the Dynamic Host Configuration Protocol server to use options 60, 66, 67