Provision a Windows Build

Prepare the content, check the PXE prerequisites, configure the Provision satellite, then launch the first deployment.

Reference: Provision Quick Start: Install, Configure, and Test

Prepare the Tools

Tanium tools

• In the Tanium Console, open Provision -> Settings.
• Download the ZIP files provided by the module, typically scripts.zip and utility.zip.
• These files are used later to prepare the ADK content and build the OS bundle.

ADK tools

• On the preparation machine, install the Windows ADK and the Windows PE add-on from Microsoft Learn.
• This step is only required once per preparation machine.

Provisioning Content

Create ADK

• Extract utility.zip on the ADK machine.
• Run adkprep.ps1 to generate the ADK package expected by Tanium Provision.
• Keep the generated archive ready to upload into the OS bundle.

Prepare Unattend

• Prepare an unattend.xml adapted to your Windows deployment.
• If you need post-install logic, package it in a script ZIP or a PowerShell script.
• Keep the files simple and test them outside Provision before using them in a production bundle.

Example unattend.xml: GitHub sample

Provision post-install references: Provision advanced options

Tanium Client

• Download the Tanium Client ZIP that matches your environment.

Wim

• Use the Windows install.wim from the Microsoft ISO as the operating system image.

Drivers

• Prepare the driver ZIP that matches the target model or virtual platform.

Driver packaging reference: Preparing content

Custom Post-Install Content

Add custom post-install content when you need actions specific to your environment. This is usually a PowerShell script or a ZIP with scripts and support files.

• Use this content for actions not covered by the base image, drivers, unattend.xml, or the Tanium Client package.
• Keep the logic simple, test it outside Provision first, and do not rely on user input or network access during deployment.
• If the action must restart the machine or use advanced post-install behavior, check the Tanium Provision advanced options documentation.

Reference: Provision advanced options

Create the OS Bundle

• In Provision, click Create OS Bundle.

• Name the bundle, select the operating system and architecture, then add each required component.

• Add the WIM.

• Add the prepared ADK archive.

• Add unattend.xml.

• Add the Tanium client ZIP.

• Add the custom script ZIP or PowerShell file used during provisioning.

Validation checklist: before moving to PXE, confirm that the bundle is saved and all required files appear in the bundle details.

PXE Prerequisites

Before enabling PXE on an endpoint, check the network and firmware prerequisites. These checks prevent many first-run failures.

• Confirm that the target endpoint can reach the Provision satellite for PXE boot. If it is on another subnet, configure the DHCP relay or IP helper.
• Check that the firewall does not block the PXE path. Common PXE flows use DHCP / BOOTP (UDP 67/68), TFTP (UDP 69), and PXE proxy / BINL (UDP 4011), depending on your design.
• Make sure the test endpoint uses the expected firmware mode: UEFI or legacy BIOS, correct boot order, and correct Secure Boot behavior.
• Verify that the OS bundle is fully synchronized to the Provision satellite before the first PXE boot. A saved bundle is not enough if replication is still running.
• For lab testing on Hyper-V, disable Secure Boot if the guest does not boot correctly with your selected PXE flow.

Reference: Provision Quick Start: Install, Configure, and Test

Create the PXE Endpoint

Important: create and save the OS bundle before enabling PXE on an endpoint.

• In Provision, select Create Provision Endpoint then Create Satellite.

• Choose a device name.
• On the target client, run get_endpoint_fingerprint.cmd and collect the MAC address.

• Enter the MAC address under Unique Identifier, enable PXE, and finish the configuration.

• Select the PXE role and the cache that will host your bundle.

• Wait for the PXE service to be installed on the satellite and for the OS bundle synchronization to complete.

• When the PXE service is ready and the bundle is synchronized, the endpoint is ready for testing. The first sync can take several minutes.

Run the Deployment

• For a Hyper-V lab, disable Secure Boot on the VM before testing PXE boot.

• Boot the endpoint on PXE.
• In the PXE workflow, select the keyboard layout and continue.

• Select the Task Sequence or deployment target presented by Provision.

First Troubleshooting Checks

• No PXE response: check DHCP relay / IP helper, VLAN path, and firewall rules first.
• PXE menu appears but no task sequence is available: verify the OS bundle is fully synchronized to the selected cache / satellite.
• Boot starts but deployment fails later: check the OS bundle content again, especially install.wim, drivers, unattend.xml, the Tanium Client ZIP, and custom post-install files.

References

• Provision Quick Start: Install, Configure, and Test
• Preparing content
• Provision advanced options
• GitHub Provision examples