TECPXE guide

This guide covers installing TECPXE, setting up your first client and build, and imaging machines. It is written for help desk technicians: no command line needed. Each section stands on its own, so jump to what you need.

Install

Install TECPXE on one Windows computer or server that is plugged into the imaging bench network. Windows 10, Windows 11, and Windows Server 2016 to 2025 (64-bit) all work.

1. Download TECPXE-Setup.exe from the download page.
2. Double-click it. Click Yes when Windows asks for permission.
3. If Windows shows “Windows protected your PC”, click More info, then Run anyway. Setup is not signed with a paid certificate yet; the file is safe.
4. Click Next. Setup suggests a storage folder on the drive with the most free space. Keep it unless you have a reason to change it.
5. Click Install, then Finish. TECPXE opens in your browser.

Setup does everything else: it installs TECPXE as a Windows service that starts with the computer, adds the watchdog service, opens Windows Firewall, and puts a TECPXE icon on the desktop and in the Start menu.

If Windows Deployment Services is installed

WDS and TECPXE cannot both answer network boot requests on the same server. Setup warns you and turns WDS off if you continue. To remove WDS for good, use Server Manager, Remove Roles and Features.

Updating TECPXE

Download the newest TECPXE-Setup.exe and run it on the server. It stops TECPXE, updates it, and starts it again. Settings, clients, builds, files, and history are all kept.

Uninstalling

Use Settings, Apps in Windows (or Start menu, TECPXE, Uninstall TECPXE). It asks whether to keep your data; choose No to keep it if you might reinstall.

First-run setup

TECPXE opens in your browser when Setup finishes. (Later, use the TECPXE icon on the desktop, or from another computer open http://<server-ip>.) The setup screen asks three things:

1. Your company name. Used on reports and as the default registered organization.
2. Network boot. Pick the server address on the imaging network, and say whether that network already has a DHCP server.
3. Windows. Upload a Windows 10 or 11 ISO and choose Import.

Everything can be changed later under Settings.

The imaging network

Machines find TECPXE by network booting. Give the imaging bench its own VLAN or switch so production computers never boot into TECPXE by accident.

Alongside an existing DHCP server (default)

TECPXE answers only network boot requests (ProxyDHCP). Your DHCP server keeps handing out addresses. Nothing needs to change on the DHCP server.

As the DHCP server

On an isolated bench switch with no DHCP server, set Settings, Network boot to Be the DHCP server and enter an address range. Never use this on a network that already has DHCP.

Secure Boot

TECPXE boots machines with iPXE, which is not signed for Secure Boot. Turn off Secure Boot in the firmware before network booting, and turn it back on afterward if the client needs it.

Only answer some networks

Under Settings, Network boot, list the networks TECPXE should answer, such as 192.168.50.0/24. Machines on other networks are ignored.

Windows images

1. Go to Images and ISOs and drop a Windows ISO on the upload area. For large ISOs you can instead copy the file into the content folder’s isos folder and choose Scan folder.
2. Choose Import as Windows image. TECPXE copies out the Windows files and lists every edition inside (Pro, Enterprise, Education, and so on).
3. Builds pick an image and an edition. The boot default image is used to start Windows PE before a build is chosen.

When Microsoft releases a new Windows ISO, import it and point your builds at it. Delete old images when no build uses them.

The ISO library also boots Linux installers and utility ISOs (Memtest86+, GParted, Clonezilla, vendor diagnostics). Turn on In boot menu for any ISO you want listed.

Applications

Starter catalog

Applications, Starter catalog lists common software with install settings ready: Chrome, Firefox, 7-Zip, Acrobat Reader, .NET and Visual C++ runtimes, Zoom, Notepad++, VLC, and more. Choose Add and TECPXE downloads the current version.

Your own applications

For QuickBooks, TrialWorks, line-of-business software, and agents:

1. Choose Add application, name it, and pick I upload them.
2. Drop the installer on the application page.
3. Set the silent install arguments and anything else under Install.

Install order

Applications install by phase: Runtimes, then Core apps, Client apps, and Agents. Use Install first to make one application wait for another, such as QuickBooks after .NET. TECPXE adds missing dependencies to a build automatically.

Checking that it installed

By default TECPXE trusts the installer’s exit code (0, 3010, and 1641 count as success). Add a detection rule to be certain: an MSI product code, a registry key or value with a minimum version, or a file path such as %ProgramFiles%\Vendor\app.exe.

License keys and site codes

Add them to the client as variables, then use {{NAME}} in silent arguments or scripts. For example, an RMM agent with /qn TOKENID={{NINJA_TOKEN}} installs with each client’s own token.

Microsoft 365 and Office

Set the installer type to Microsoft 365 / Office and upload the Office Deployment Tool’s setup.exe (it is in the starter catalog). Pick the product, update channel, and shared computer activation; TECPXE writes the configuration file and runs setup.exe /configure.

Application updates

Applications can come from three places: versions you upload, the winget catalog (thousands of Windows apps), or a vendor link that always points at the newest installer.

Pilot and Production: mark one build per client (or your own test build) as Pilot. New versions go there first. When they work, choose Use in Production, or set Move Pilot to Production after so TECPXE promotes versions with no failed installs automatically.

Checks run every night at the hour set under Settings, Updates, or right away with Check for updates. Every download is checked against the publisher’s SHA-256 hash. TECPXE keeps the last few versions of each app so you can roll back.

For software TECPXE cannot download, set Remind me to check for a new version after a number of days.

Clients

Each MSP client has its own settings, used by every build for that client.

Copy client duplicates a client and its builds, a quick start for a similar new client.

Builds

A build is the recipe a technician picks: Windows edition, applications, scripts, and settings.

Use inheritance

1. Create an MSP Baseline available to every client: runtimes, browser, 7-Zip, Reader, your remote support tool, and baseline settings.
2. For each client, create a build that inherits from the baseline and adds that client’s agents and software.
3. Add department builds that inherit from the client build, such as Accounting with QuickBooks.

Changes flow down: add an app to the baseline and every client build gets it. A build can Skip an inherited app it does not want.

Scripts

PowerShell scripts run as SYSTEM on the new machine, before or after the applications. Use {{NAME}} for client variables.

Settings

Toggles for common baseline changes: remove consumer apps, turn off consumer features, high performance power plan, turn off Fast Startup, turn on Remote Desktop, turn on .NET Framework 3.5, and turn on BitLocker (the recovery key is saved on the machine record).

When finished

Leave the machine at the sign-in screen, shut it down for shipping, or restart it.

Drivers

TECPXE matches each machine to a driver pack by its model identifiers and adds the drivers before Windows starts. Machines without a pack still deploy with the drivers built into Windows.

1. Choose Refresh catalogs once to load the Dell, HP, and Lenovo catalogs.
2. Choose Add from catalog and search for models, or paste the list of models you buy.
3. Leave Download drivers for new models automatically on (Settings, Updates). When an unknown model boots, TECPXE downloads its pack in the background; the next machine of that model gets it.

For white-box or custom hardware, choose Upload drivers and provide a ZIP of drivers, a CAB, or the vendor’s driver pack. Use model * to cover every model from a manufacturer.

Driver packs follow the same update settings as applications, including Pilot and Production. Models without drivers lists models seen on the bench in the last 30 days that have no pack.

Imaging a machine

1. Plug the machine into the imaging network. Turn off Secure Boot.
2. Power on and choose network boot (F12 on Dell and Lenovo, F9 on HP, or the firmware’s boot menu).
3. The TECPXE menu appears. Start TECPXE is the default.
4. The machine shows up on the Bench as waiting. Choose Assign, pick the client and build, and leave the name blank to use the client’s pattern. At the machine you can also type C to choose there.
5. If the disk already has Windows, TECPXE asks before erasing it: type WIPE at the machine, or confirm on the dashboard.
6. Windows is applied, drivers are added, and the machine restarts into setup. Applications install on their own and report back.

Each step lights up on the bench. Open Wall display on a TV at the bench for a full-screen view.

A machine that finished keeps booting to its own disk even if network boot is first in its boot order, so it does not image itself twice.

Pre-staging and batches

Pre-stage one machine

Deployments, Pre-staged: enter the serial number or MAC address, client, and build. When that machine network boots, it deploys with no one at the keyboard and skips the wipe question.

Import a list

Import a CSV with one serial number per line (and an optional computer name). Use the serial numbers from the order or packing slip.

Batches

Deployments, Batches sends one build to a group. Next machines that boot takes the next set number of unassigned machines. Machines from a serial list uses an imported list. The batch view shows every machine’s progress.

Limits

Settings, Deployments can cap how many machines image at once and how much bandwidth each machine uses. Extra machines wait their turn.

Machine records

Every deployment keeps a record: model, serial, MAC, client, build, each step, every application with its version and result, missing drivers, the local admin password, and the BitLocker key. Choose Record for a printable page. Passwords and keys are shown only when you choose to view them, and every view is logged.

Deployments, Export CSV downloads the full history.

Settings, Notifications sends a message to Microsoft Teams, Slack, or any webhook when a machine finishes or fails, and when application updates arrive.

Keeping it running

TECPXE is built to stay up without anyone looking after it.

• Starts with Windows. TECPXE is a Windows service set to start automatically, even before anyone signs in.
• Restarts after a crash. Windows restarts the service within seconds if it stops unexpectedly.
• Watchdog. A second service, TECPXE Watchdog, checks TECPXE every 30 seconds and restarts it if it stops responding. If it keeps failing, the watchdog repairs folders, oversized logs, and damaged data files, and records what it did. TECPXE also keeps the watchdog running.
• Self-check. TECPXE checks its own web server and restarts itself cleanly if it stops answering.
• System checker. Every 5 minutes TECPXE checks its folders, disk space, network services, server address, boot files, images, the watchdog, and backups, and fixes what it can.

When something is wrong

1. Open TECPXE, go to System, and click Run checks and fix. Each problem shows what to do about it.
2. If TECPXE will not open, open the Start menu, find TECPXE, and click Repair TECPXE. Click Yes when Windows asks. It checks everything and fixes what it can.
3. Still stuck? Restart the server. TECPXE starts again on its own.

You can also see the two services in Windows Services (services.msc) as TECPXE and TECPXE Watchdog.

Backups and moving servers

TECPXE backs up its settings, clients, builds, application list, and history every night and keeps the last 14. Change this under Settings, Backups. You can point backups at a network share. ISOs, images, and installers are not in the backup; include the storage folder in your normal server backups.

To download a backup, go to Settings, Backups, and click Download.

To move TECPXE to a new server:

1. Run TECPXE-Setup.exe on the new server.
2. Copy the old storage folder (for example D:\TECPXE) to the new server's storage folder.
3. Copy the newest backup zip to the new server, open Command Prompt as administrator, and run "C:\Program Files\TECPXE\tecpxe.exe" restore C:\path\to\tecpxe-backup-<date>.zip. TECPXE stops, restores, and starts again.

Security

• No sign-in by default. The admin pages only accept connections from private networks. Add other networks under Settings, Access if you need them. You can also set an access password there.
• Secrets stay secret. Domain join passwords, local admin passwords, product keys, and secret variables are encrypted on disk and never returned to the browser. The encryption key is a separate file only the service can read.
• Machine tokens. Each machine gets its own token that only unlocks its own build’s files, and the token is revoked when the deployment finishes. Passwords written for Windows setup are deleted from the machine after first boot.
• Browser protections. TECPXE refuses requests from other websites and from unknown host names, and sends strict security headers.
• Locked-down data folder. C:\ProgramData\TECPXE, which holds the encryption key and history, is limited to SYSTEM and Administrators.
• Verified downloads. Application and driver downloads are checked against the publisher’s SHA-256 hash.
• Audit log. Every change and every password view is recorded on the System page.

Troubleshooting

Command reference (advanced)

Help desk never needs these; Setup, the Start menu shortcuts, and the System page cover everything. For engineers, the program is at C:\Program Files\TECPXE\tecpxe.exe; run it from Command Prompt opened as administrator.