How to configure BIOS or UEFI to install an operating system from the network

Installing an operating system from the network is a great option for administrators and advanced users, but it requires carefully adjusting the device's firmware: we're talking about BIOS/UEFI, boot modesPXE and securityIn this practical guide you will find everything you need to do it correctly, from the keys to enter the menu to how to detect which mode WinPE has started in, including small Tricks to avoid surprises.

Before touching anything, it's important to be clear about one principle: ideally, today we should work on UEFI mode with Secure Boot When possible, for the security and speed advantages. However, if your network environment only offers legacy BIOS boot (classic PXE), you will need to enable or maintain the Legacy/CSM mode or use specific options that allow it. We'll look at it step by step and with alternatives for WindowsDebian and servers.

BIOS vs. UEFI: Why it matters for network booting

The BIOS was the original system that initialized the hardware and launched the operating system; UEFI is its modern evolution with a more user-friendly interface, support for mouse, faster start and security featuresAlthough many people use both terms interchangeably, for network installation purposes they make key differences.

In pure UEFI, GPT is used as the partition scheme and the loaders have different location and format to those in BIOS. In contrast, in BIOS (or UEFI in CSM mode) it is used MBRIf you are going to start over the network via PXE, you must confirm if the server will work for you. images for UEFI (IPv4/IPv6 UEFI PXE) or only for legacy BIOS. Server-side compatibility is key.

A helpful tip: if you install Windows in one mode, your computer will continue to boot in that same mode from then on. Changing it later is possible, but requires care. Microsoft offers a tool for this. MBR2GPT to convert MBR to GPT without reinstalling, although it requires meeting certain conditions (e.g., adequate partitions and free space).

Accessing the firmware and boot menu: keys and shortcuts that save your life

To access the firmware menus, you usually press the manufacturer's key during POST. The most common ones are: Esc, Del, F1, F2, F10, F11 or F12On tablets, the buttons are sometimes used for volume up/downIf the screen is moving too fast, consult the manual or the manufacturer's website.

If you already have Windows installed, you can also access UEFI from within the system itself: on the login screen or from the Start menu, press Restart while holding Shift, and then follow this path: Troubleshoot > Advanced options > UEFI firmware settingsIt's a very convenient shortcut when you don't remember the key manufacturer.

To temporarily select the device without changing the default order, invoke the One-Time Boot menu. These are usually F12, F11 or F8You will see entries of the UEFI type: USBUEFI: IPv4, BIOS: LAN or similar. Choose one or the other. the boot mode for that session without rearranging anything in the firmware.

Choose the correct mode: Modern UEFI or Legacy BIOS (CSM)

When possible, select UEFI mode. It offers better defenses like Secure BootIt boots faster and manages large GPT disks without limitations. However, if the network boot provided by your organization only works in BIOS/classic PXE, enable the Legacy/CSM mode or explicitly select “BIOS: Network/LAN” in the temporary menu.

Sometimes you'll see the same device listed twice, once as UEFI and once as BIOS. This is normal: both point to the same medium but require... different firmwareIf you need to boot via UEFI network, look for UEFI IPv4/IPv6 entries; if your network only supports legacy, choose the equivalent BIOS/PXE.

Keep in mind that some computers only support one mode or the other, or require you to disable security features to enable legacy BIOS. If you need to do this, go to Security and look for Secure Boot to disable it. Do not do this if you are going to use UEFI PXE with valid signatures; only when strictly necessary.

How to prepare network boot (PXE) in the firmware

Go into the Boot section of the firmware and enable it. Network Stack/PXE If available. In UEFI, you'll usually see options like "UEFI: IPv4 Network" or "UEFI: IPv6 Network"; in legacy BIOS, you'll see "Network/LAN" or something similar. Set the network as the first option if you're installing directly from PXE.

On many devices, you'll see the device listed twice: “UEFI: Network” and “BIOS: Network/LAN”. Your choice should be to fit with the server which is supplied to you via the network. If your environment has both, UEFI is preferable for security; if only classic PXE is available, then legacy BIOS must be used.

If you don't want to permanently change the boot order, use the fast boot menu for the installation session. This leaves the internal disk as priority for everyday use, and when you need it, you choose the network accordingly.

WinPE and Windows installation program: Check firmware mode

When working with Windows PE or the Windows network installer, you might wonder in which mode the environment was started. To find out, check the Registry. From the line of commands, run this command to read PEFirmwareType:

reg query HKLM\System\CurrentControlSet\Control /v PEFirmwareType

The returned value indicates the active firmware mode in WinPE or the installer. Here is a reference table for quickly reading the data. PEFirmwareType:

Returned code	Firmware mode
0 x 1	BIOS
0 x 2	UEFI

If you need to automate it in a script In batches, you can parse the Registry output and Use tools to analyze Windows startup. Pay attention to the delimiters: between delims= and the first token must be preceded by a tab followed by a space. An example of usage could look like this (adapting paths and syntax to your environment):

wpeutil UpdateBootInfo
for /f "tokens=2* delims= 	 " %%A in ('reg query HKLM\System\CurrentControlSet\Control /v PEFirmwareType') do set Firmware=%%B
if %Firmware%==0x1 echo El equipo ha arrancado en modo BIOS.
if %Firmware%==0x2 echo El equipo ha arrancado en modo UEFI.

The idea is that your network installation process can react differently depending on the active mode (UEFI/BIOS)For example, by selecting the appropriate boot manager or specific scripts.

Ensure that it always starts in the desired mode

There are two simple techniques to minimize human error. First, use disks that are already formatted with the appropriate scheme: GPT for UEFI and MBR for BIOSIf you try to install in the wrong mode, Windows may block the installation and you will have to restart in the correct mode.

Second, if you want to force a specific mode in WinPE/Setup media, delete the boot files for the mode you don't want. To boot only in UEFI, delete the file Bootmgr in the root of the installation media; to boot only in BIOS, delete the folder efi from the same source. This prevents unintentional starts in the wrong mode.

This pair of tricks is especially useful in environments with multiple technicians or where there is a mix of old and modern equipmentIt reduces errors and speeds up deployments, especially when the installation comes via network and physical control of the equipment is limited.

Practical boot configuration: order, device, and useful keys

If you enter the Setup (BIOS/UEFI), look for the Boot or Exit tab to adjust the priority. In modern UEFI systems, you'll see a list like "Boot Option #1/2/3…". Set the method you're going to use as the first option. change boot order for Network (PXE), USB, or DVD. When you're finished, save changes (F10 is usually the shortcut) and restart.

Another equally valid method is to enter the “Boot Menu” directly (F12, F11…), where internal drives, connected USB devices, and network options are displayed. This route is practical if you are performing a one-off installation from the network without leaving the fixed network as a first priority.

If your USB keyboard isn't responding in the boot menu on very old computers, look in the firmware for options like "Legacy USB Support" or "Legacy Keyboard Emulation." Enabling these usually restores functionality. keyboard control in those menus prior to the operating system.

Server installation: UEFI and virtual media (typical example at Dell)

On servers with remote administrators, it's common to use "Virtual Media" to mount an ISO image and boot it as if it were a physical DVD, even remotely. On many machines (for example, Dell PowerEdge servers), the flow is: enter with F2 in System Setup, go to System BIOS > Boot Settings and select UEFI as Boot Mode.

Next, in UEFI Boot Settings, adjust the UEFI Boot Sequence so that the virtual optical drive is at the top. Connect the virtual media, map the operating system ISO, and reboot. Upon restarting, the server will prompt you to press a key to begin the installation; if you don't, it may return to the previous screen. F1 / F2 awaiting instructions.

This method is great when the hardware doesn't have an accessible DVD/USB drive or the data center is far away. Remember to install it when you're finished. patches and updates of the newly deployed operating system before putting it into production.

Debian and other distributions: firmware menus, CSM and Secure Boot

The Debian installer detects whether the system has booted in BIOS or UEFI and manages the boot loader accordingly. On systems with CSM, be careful when booting from a USB drive in one mode and then from the internal hard drive in another, as this could cause the installation of the... wrong managerCheck the mode from the boot menu: sometimes you'll see two entries per device (CSM vs. native UEFI).

If the BIOS/UEFI does not display a boot menu, it will be necessary to change the fixed boot order in the Setup so that the device from which it boots is specified. debian-installer put it first. And if the USB doesn't boot despite being properly connected, try changing its type in the firmware to "USB ZIP" or "USB CDROM", or enable "USB legacy support". Some older BIOS versions They fail with USB hard drive type.but they work in CD mode.

Regarding Secure Boot, many UEFI systems only load signed binaries. Debian integrates a "shim" signed by Microsoft, so in principle you can install with Secure Boot EnabledIf something is stuck, temporarily disable Secure Boot to complete the installation, and then re-enable it afterward if necessary.

Windows: Fast Boot, UEFI, and coexistence with other systems

Windows includes a feature to speed up startup (called quick start) which can leave file systems in an intermediate state. In environments of dual bootThis feature can cause inconsistencies if another operating system writes to those partitions. The recommended approach is disable fast startup when two systems coexist.

Additionally, some Windows updates re-enable this option. Check it periodically just in case. On certain computers, you even need to disable Fast Boot to access UEFI Setup from Windows because of the firmware. USB or keyboard not initialized during accelerated start.

Keep in mind that all systems sharing a disk should use the same type of partition table and preferably the same operating system (UEFI or BIOS). Mixing GPT with MBR, or UEFI with BIOS on the same disk, complicates the boot process and increases the chances of error.

Bootable USB drive to support network deployment

Even if the goal is to install from the network, a bootable USB drive with WinPE or the installer can save you from trouble. If you access the UEFI/BIOS, place the USB as the first option Temporarily, launch WinPE and from there, connect over the network to your installation resources, or use automated scripts that call the unattended installation.

In many modern firmwares, the Boot option directly displays connected devices. If you don't see the USB drive in the list, try the Exit tab, which sometimes offers a "Boot Override" shortcut. Remember that if your USB drive boots in UEFI mode but your PXE environment is BIOS onlyYou will need to force the correct mode using the boot menu or by adjusting the Setup.

If WinPE is your starting point, preparing a compatible drive is trivial with Microsoft tools. Once inside, confirm the mode with the Registry (PEFirmwareType) and launch the network installation or map to your drive. deployment server.

Firmware security: passwords and locks

UEFI/BIOS allows you to set multiple passwords: administrator (to enter Setup), user/power-on (to start the computer), and hard drive. The administrator password prevents unauthorized changes In the settings; the power-on setting adds a layer before loading the system; the disk setting protects your data, but with a risk: if you forget it, there's no going back.

This is no joke: on computers from certain manufacturers, if you lose your administrator or disk password, not even technical support can recover it. The solution usually involves replace the board or unit Proving ownership, with the associated costs. Define secure but manageable passwords and properly document their safekeeping.

If you need to remove passwords, do so from the Setup using an account with administrator privileges. Keep in mind that, in some firmwares, removing the administrator password will also automatically delete the password. of user, and the team again allows startup without prior credentials.

Practical tips for trouble-free network installations

Check which PXE modes your infrastructure supports (UEFI IPv4/IPv6 or legacy). Configure the appropriate mode in the firmware and, to avoid mistakes, pre-format the disks with GPT for UEFI and MBR for BIOS. This reduces errors during the partitioning phase when the installer arrives from the network.

If you're going to automate deployments, add PEFirmwareType detection to the WinPE startup script. Depending on the mode, call the boot loader or the corresponding task chain. To prevent accidental booting in the mode you don't want, delete bootmgr (force UEFI) or the efi folder (force BIOS) from the installation media.

On mixed systems (new and old), consider keeping UEFI enabled with Secure Boot when compatible with your PXE environment. If not, clearly document when to disable it and where the setting is located (usually in Security > Secure Boot) and who can modify it, ideally with an administrator password in the Setup.

Quick tip: When the boot menu doesn't recognize your USB installation media, change its type in the firmware to "USB CDROM" or "USB ZIP". Many older BIOS versions will boot this way without issue, while they will fail if they detect the USB as a USB drive. HDD removable.

For departments with large-scale deployments, using servers with virtual media and well-defined UEFI sequences greatly speeds things up. Ensure the virtual optical drive is first in the UEFI sequence, map your ISO, and confirm the key request on the first restart so that the installer starts immediately.

In dual-boot Windows setups, disable Fast Boot to prevent file system inconsistencies. And check periodically after updates, because sometimes reactivates without you noticing, complicating incident support.

Nobody wants a computer inaccessible due to a forgotten password, so define a corporate password recovery process. Document who can manage passwords. UEFI/BIOS and disksand where they are stored, avoids wasting time and money if hardware needs to be replaced.

With all of the above, you now have a solid foundation for choosing the correct mode, adjusting the firmware, detecting what you booted into, and deploying your operating system over the network without any surprises. If something still doesn't boot, carefully examine the boot mode. Effective boot (UEFI/BIOS), the support of the PXE server and, as a plan B, rely on WinPE or virtual media to complete the installation.