Create a boot USB

Download one ISO, write it with Rufus, and boot a technician into ImageForge.

Recommended path

Standard Windows PC

For Intel and AMD PCs, use the x64 ISO. Both release ISOs are signed and boot with Secure Boot enabled.

Setting	Use
Boot selection	Standard ImageForge x64 ISO
Partition scheme	GPT
Target system	UEFI (non-CSM)
Write mode	ISO image mode

Before handing the USB to a technician

Downloaded from an official qualified ImageForge release ISO architecture matches the target CPU Standard or Advanced media choice is recorded Server address is written on the bench sheet for networks without discovery TLS fingerprint is recorded from the Forge console Site-specific media package is available if special WinPE drivers are required USB boot is enabled in target firmware Technician has an active access code

Choose the right ISO

Match the ISO to the PC's processor — that's the only choice to make.

Target PC	ISO
Intel or AMD processor	x64 boot ISO
Snapdragon or other ARM processor	ARM64 boot ISO

An x64 image cannot boot an ARM64 PC and vice versa; if you're unsure, check Settings → System → About on the target for an "ARM-based processor".

Download and write the USB

Open the Downloads page and download the boot ISO that matches the target PC.
Open the ISO's SHA-256 link beside the download. In PowerShell, run Get-FileHash .\imageforge-boot-x64-1.2.0.iso -Algorithm SHA256 and confirm the value matches before writing the USB.
Write it to a USB stick with Rufus: ISO image mode, GPT partition scheme, target UEFI (non-CSM). Any 2 GB+ stick works; the stick also carries session logs back from the field, so bigger doesn't hurt.
Boot the machine from the stick (one-time boot menu: Dell F12, HP F9, Lenovo F12). The client brings up networking, finds your Forge, and asks for a technician access code.

Production media has two signed WinPE driver tiers: a bootstrap NIC/storage set inside boot.wim, and an exact-hardware-ID runtime depot at \ImageForge\BootDrivers\<arch>. If neither tier binds, the client can try a matching signed package from an existing Windows DriverStore, then guide the technician through DHCP renewal or static IPv4 setup. Keep a qualified USB Ethernet adapter with the bench kit: blank or locked disks cannot provide fallback drivers, and ordinary Wi-Fi is not a WinPE recovery path.

Secure Boot profiles and release identity

The public release ISOs are built for the Windows Production PCA 2011 trust chain, which today's shipping firmware trusts. For fleets already moved to the Windows UEFI CA 2023 chain, a site-specific PCA2023 build is available — contact us. Every production USB/ISO contains ImageForge\build-manifest.json with its architecture, profile, ADK version and servicing-KB assertion, client and WIM hashes, and signed-driver inventory; attach it to the hardware test report instead of identifying media by filename alone.

Machines and Forge on different networks

The client discovers the Forge by LAN broadcast. Across VLANs or strict firewalls, technicians simply type the Forge's address when prompted. For repeat deployments across VLANs, keep the Forge address and TLS fingerprint on the bench sheet or request pinned site media from ImageForge support.

Site-specific media packages

The release images can discover the Forge automatically or accept its address at the prompt. A site-specific build is only for settings and driver coverage that are unique to a customer's environment.

Setting	Effect
Forge address	Skips LAN discovery and connects to the named Forge
TLS fingerprint	Pins the media to one Forge identity for air-gapped or strict networks
WinPE drivers	Adds required NIC/storage drivers for hardware the standard ISO does not cover
Fleet qualification	Adds hardware-specific coverage beyond the official release matrix

A production build fails closed unless the current ADK servicing KB is explicitly asserted, the client architecture and exact approved signer match, every driver package passes kernel-policy catalog verification, the bootstrap contains positively identified wired Ethernet and custom or fleet-qualified inbox storage coverage, and at least one certified USB recovery adapter's VID/PID is actually advertised by a bootstrap INF.

Contact support with the Forge address, TLS fingerprint, and any required driver packs. They will provide a media package or updated ISO for your site.

Known firmware traps

Vendor recovery hijack: if a machine boots into Dell SupportAssist / HP Sure Recover instead of the USB, the firmware never booted the stick. Use the one-time boot menu and pick the UEFI entry for the stick.
Secure Boot trust mismatch: current firmware may trust PCA 2011, PCA 2023, or both during the certificate transition. Try the qualified matching ImageForge profile and apply vendor firmware/Windows Secure Boot updates. Disabling Secure Boot is a documented emergency exception, not the normal fix.
Legacy Option ROMs should stay disabled — legacy PXE ROMs can leave NICs in a state PE drivers cannot take over.