CONFIGURATION AND FUNCTIONAL TESTING OF PXE BOOT BASED ON WINDOWS SERVER. SECURITY ISSUES

The article examines the configuration and functional testing of PXE boot technology based on Windows Server, with particular attention to the security of network boot infrastructure. The purpose of the study is to analyze risks caused by the use of DHCP and TFTP, the absence of built-in authentication, and the transmission of critical boot parameters over the network, and to verify a protection measure based on network segmentation. The paper systematizes MITM, Rogue DHCP, DHCP Starvation, TFTP Flood, TFTP File Injection, and DHCP option overwrite scenarios, describing the conditions required for their implementation, possible consequences, and tools. The experimental part was carried out on a virtual test bed based on KVM in Proxmox VE. A Windows Server 2019 host provided DHCP and Windows Deployment Services, while a client virtual machine was used to test the complete PXE boot cycle. Functional testing confirmed address assignment, retrieval of the boot file from WDS, and initiation of operating system installation. A Rogue DHCP scenario was also demonstrated, in which the client accepted substituted network parameters from an unauthorized DHCP server. To reduce these risks, the PXE infrastructure was moved to a dedicated VLAN with its own DHCP scope and restricted access. Tests showed that a client outside the PXE VLAN received no PXE responses, whereas assigning the required VLAN enabled successful network boot. The results support network segmentation as a practical method for limiting access to broadcast DHCP/TFTP traffic and reducing the attack surface.