Use the following steps to prepare and install RIS:

To configure the Remote Installation service, follow these steps:

Inside Out: The RIS server must be authorized as a DHCP server

RISetup should automatically authorize the RIS server in Active Directory as a DHCP server, regardless of whether the server is actually running DHCP. This is necessary because it is how DHCP servers are able to locate RIS servers. You see, DHCP simply forwards the RIS request (which it can't handle) to the RIS server. If for some reason DHCP authorization fails, it can be confirmed by looking in the system log for event ID 1046 from DhcpServer that states the DHCP/BINLSVC service has determined that it is not authorized to start. If this happens, you must authorize the server manually using an account that is a member of the Enterprise Admins group. Log on to a DHCP server, and start its DHCP administration tool or use the DHCP administration tool in Administrative Tools. In the DHCP console, click Action on the menu, then choose Manage Authorized Servers. In the Manage Authorized Servers dialog box, click Authorize, and then type the IP address of the RIS server. Afterward, you must either stop and then restart the Remote Installation service in the Services node in the Computer Management console or reboot the server. A reboot is typically a good idea. Note also that the Group Policy settings control whether and how the related RIS services are started (for details, see the section entitled "Controlling Access to RIS Servers" later in this chapter).

Inside Out: Automating RIS installations

You can associate the operating system image with an answer file (Remboot.sif) to streamline the unattended installation of the operating system to the target computer. You create the answer files used by RIS in Setup Manager as discussed in Chapter 5.

You can also configure the RIS server by double-clicking its computer account in Active Directory Users and Computers and then selecting the Remote Install tab, as shown below.

The following options are displayed:

In addition to the settings in Active Directory that control how the server handles client requests, you can verify the RIS server configuration, gain administrative access to RIS clients using this server, and control management of RIS-installed computers.

To verify that the RIS server is correctly configured, click Verify Server in the Remote Install tab. RIS will analyze the configuration, repair any problems if possible, and report on the status of the server.

Clicking Show Clients loads the Find Remote Installation Clients dialog box, which lets you find and display known remote installation clients within the selected scope (the entire directory or a single domain).

How client computer names are generated and where they are placed in Active Directory are controlled by settings available through the Advanced button (as shown in the following screen).

You can configure the naming format used for generating client computer names in the New Clients tab. Several naming formats are offered, including the following:

You can also specify the client account location—the place in the directory where the client computer accounts are established. You can store the new computer account in the default Active Directory location in the Computers container or the same location as the user creating the account, or you can select a specific location in the directory.

To configure manually how the computer account names are created, select a naming option to use as the template, and then click Customize to open the Computer Account Generation dialog box, as shown in the screen on the following page. The initial custom name format is based on the naming option you used as a template. You can then modify the format and select from several variables to create a wide variety of name templates. A box at the bottom of the dialog box previews the naming formats for you. If you make a mistake in the formatting, it shows an error.

The variables that can be used in computer names include the following:

For example, to have computer names generated from the first 10 characters of the user logon name plus the first 5 characters of the MAC address of the NIC plus an incrementing number, use this syntax:

%10Username%5MAC%#

You needn't get that fancy, though. Maybe you just want to use a standard root name and increment? Well, you can do that, too. Consider the following example:

cpandl%#

Here, all computers names begin with cpandl (which is the abbreviated company name for City Power & Light) and end with a number that is automatically incremented by RIS.

You can view and manage the RIS installation images in the Images tab (as shown in the following screen). Information concerning each installation image is displayed—the image name, operating system it contains, platform it supports, and the language to which it is localized are all listed. You can add and remove images in this dialog box, while additional information and options are available by clicking Properties.

You can modify the name and description of the image presented by the CIW (as shown in the screen on the following page). This wizard also contains additional details about the image, including version, language, date last modified, type of image, and RIS image storage folder. Security for the image is accessed by clicking Permissions. This lets you limit access to each OS image based on security group membership.

You can set security permissions on RIS services and images to control access to remote OS installation. By setting security permissions on the image, you can specify the users and groups that are allowed to install from this OS image. You control the remote installation of the OS images by applying permissions to the default answer file for that image. For a RIPrep image, this file is Riprep.sif. For RISetup, this file is Ristndrd.sif. Right-click the file, and select Properties. In the Properties dialog box, shown in the screen on the following page, select the Security tab, and configure group and user names and the appropriate permissions.

When RIS installs an operating system on a computer, a computer account is created in Active Directory. Therefore, engineers and administrators who will be performing RIS installations must be able to add computers to the domain. If the individuals performing RIS installations don't already belong to a security group that can add computers to the domain, they must be granted the right to do so before they can use RIS.

To do this, set permissions in Active Directory that allow the designated security group to add computers to the domain by following these steps:

Through delegation, you allow users to create computer accounts, but you don't miss out on the opportunity to allow users to help themselves. If Sally messes up her computer by installing things she shouldn't have installed, hand her a remote installation boot floppy disk, tell her to insert the disk, boot the machine and press F12 when prompted, and then follow the prompts, making sure to choose the appropriate image she needs. This way, Sally can help herself, and you can focus on other tasks, such as keeping the network running.

As long as Sally has been authorized to join a computer to the domain, she'll be able to complete the installation process. If she hasn't, though, she'll see an error telling her that she doesn't have permission to create or modify a computer account in the domain. Now you might be wondering why you need to authorize Sally to join a computer to the domain when any ordinary user can create a computer account. Well, if there is an existing computer account, RIS must delete the computer account and create a new one with the same name or change the password for the computer account, depending on the operating system. These procedures cannot be performed by ordinary users, which is why you must authorize the user to join a computer to the domain.

Users with the privilege to join a computer to the domain can create computer accounts and modify the computer accounts they've created. They won't, however, be allowed to modify the computer accounts other users have created. If you want to allow users to modify computer accounts created by other users, you must create a special RIS installers group, grant it this permission, and then add users who should have this permission to the group.

To create a special group for RIS installers, follow these steps:

To add members to the special RISInstallers group, follow these steps:

That's it! Yes, it was a lot of work, but now you can let users help themselves.