Jump to content

way to detect mac-address WinPE network booted on?


pankajtakawale
 Share

Recommended Posts

Is there any command, wmi script or api which returns the NIC info (mac addr) from which WinPE has been network booted on?

example:

If I have multiple NICs and each NIC is attached to different subnet.

I have configured NIC1 at the 1st position of boot loader in BIOS and NIC2 at 2nd position.

Say, DHCP server is not present on NIC1 network, and its present on NIC2 n/w.

so obviously my WinPE will be network booted from NIC2.

Is there any api, command, WMI query to information about n/w adapter from which WInPE has been booted on (in this case NIC2)?

Pankaj.

Link to comment
Share on other sites


I read this somewhere:

@ECHO OFF

ipconfig/all | FIND /I "IP Address">> IP.txt
for /f " tokens=14* delims=, " %%i in (IP.txt) DO SET IPAddress=%%j
NBTSTAT -a %IPAddress% | FIND /I "MAC Address">> net.txt
for /f " tokens=3* delims=, " %%i in (net.txt) DO SET MACAddress=%%j
echo %MACAddress%>> mac.txt
del net.txt;ip.txt
echo %MACAddress%

pause

(Not tried it)

Link to comment
Share on other sites

Im confused how would it (nbtstat) help?

Just another case:

machine has 2 NICs NIC1 & NIC2

NIC1 is on n/w 1 and NIC2 is on n/w 2.

Both n/ws have DHCP server running.

NIC1 has priority over NIC2 in BIOS boot loading.

I have configured WinPE network booting on n/w 2 (to which NIC2 is connected)

Once machine boots up, NIC1 gets ipaddress from DHCP server of n/w 1.

NIC2 gets ipaddress from DHCP server of n/w 2 and also it receives boot-server & boot-filename details. It starts booting WinPE.

Now in above case, WinPE has been booted on NIC2.

How can i detect it thru any command, api from WinPE?

Link to comment
Share on other sites

The DHCP/PXE reply that WinPE is booted from is stored in the registry

HKLM\SYSTEM\CurrentControlSet\Control\PXE, in this block of bytes you can find the IP address used to boot WinPE

Once you have that scan thru Win32_NetworkAdapters in WMI and find the NIC with the IP address you found in ther previous step

Get the MAC address property of the win32_NetworkAdapter and you're done.

All theses steps can be done using vbscript.

Link to comment
Share on other sites

Thnx for valuable info.

I checked the above mentioned PXE registry key.

It has 2 binary values: "BootServerReply" and "DHCPServerACK"

binary values contain hell lot of info, probably whole DHCPOFFER and DHCPACK packets. Any idea how to extract info from these binary values?

Link to comment
Share on other sites

  • 4 weeks later...

VBScript to get MAC Address using WMI:

strComputer = "."

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

Set colItems = objWMIService.ExecQuery ("Select * from Win32_NetworkAdapter")

For Each objItem in colItems

GetMACAddress = objItem.MACAddress

Next

Works under Win PE 2.0.

Link to comment
Share on other sites

One way is to look at hklm\system\currentcontrolset\control\systembootdevice or Remotebootmachinedirectory.

That will give you the name of the RIS server.

That in turn would tell you from wich network your machine booted and if nic2 always is net2 when we have a souloution.

IF we can't be sure on this I would check the ip addresses of the box and see wich one that matches the network of the server

Link to comment
Share on other sites

  • 2 weeks later...
One way is to look at hklm\system\currentcontrolset\control\systembootdevice or Remotebootmachinedirectory.

That will give you the name of the RIS server.

That in turn would tell you from wich network your machine booted and if nic2 always is net2 when we have a souloution.

IF we can't be sure on this I would check the ip addresses of the box and see wich one that matches the network of the server

Hi Mats!

I assume u r talking about WinPE 2.0, is that correct? When checking out my own WinPE 2.0 image which is booted from a WDS box, the above mentioned reg entries cannot be found!! Then again, u r writing RIS server so I dont know if this applied to WDS/PE 2.0 as well.....

Link to comment
Share on other sites

Sorry Br4tt3

Only applies to 1.x booted frpm ris. It doesn't work on any type of /inram booted pe and 2.0 uses inram as default.

On a 2.0 i suspect we would have to check the ip against a list of subnets

Link to comment
Share on other sites

  • 1 year later...

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.


×
×
  • Create New...