Tanium Provision Overview / FAQ

Configuring Provision

What has to be configured before we can use Provision?

The main configuration areas are: the Provision action group (defaults to All Computers, or No Computers if restricted targeting is enabled), Tanium Endpoint Configuration (which delivers Provision tools to endpoints and can require configuration approvals), user roles, PXE settings, global key values, and optional branding.

What user roles does Provision provide?

Predefined roles include Provision Administrator (manage configuration and deployment), Provision Device Retirement Administrator / User / Viewer (manage or view device retirement actions), and Provision Read Only (visibility into settings and configurations).

What network ports does the PXE service need?

On Windows endpoints, Provision can automatically create the local firewall rule. On macOS and Linux, manually open UDP ports 67, 69, 4011 plus the TCP caching port - by default 17519 (HTTP) and 17530 (HTTPS/TLS). Verbose logging can be enabled here for DHCP/PXE troubleshooting.

Which settings apply globally to all OS bundles?

Global Key Values control OS bundle selection behavior (sort order, keyboard/network timeouts, an optional installation confirmation code, automated bundle selection), Azure storage integration for boot images, web service integration, and boot image security (root password, command prompt access during imaging).

Can we brand the imaging experience?

Yes. Under Settings > Branding you can set the installation message users see and upload a company logo (max 5 MB, max 100 px tall).

Offline Domain Join (ODJ)

What is offline domain join and why would we use it?

ODJ lets newly provisioned Windows endpoints join Active Directory without storing clear-text domain-join credentials in unattend.xml. Provision runs TaniumODJService, a small HTTP service built on the Microsoft djoin command, which creates the computer account in the OU specified in the OS bundle.

What does ODJ setup require?

At a high level: a firewall rule allowing inbound connections to the ODJ client port (default 8100), the ODJ feature enabled on at least one Provision endpoint (a Windows satellite that is joined to the target domain and has reliable AD access), and an OS bundle containing the ODJService and DomainName key value pairs.

How should we scope the ODJ service's permissions in Active Directory?

Tanium strongly recommends delegating control so the ODJ service can create computer accounts in a single OU only, and setting the ms-DS-MachineAccountQuota attribute to 0 to prevent unprivileged users from joining computers to the domain.

Can we reuse existing computer names?

Yes. Add names (up to 10 at a time, available 1–7 days) to the Allowed Computer Names table and reference them via the ComputerName key value pair. Choose carefully: anyone with network access to Provision endpoints can access the computer accounts associated with listed names.

Can ODJ deliver certificates or group policy with the join?

Yes. ODJ blobs can optionally include root certificates and group policy templates by adding the Offline Domain Join: IncludeRootCerts, CertTemplate, and PolicyNames key value pairs to the OS bundle.

Preparing OS Bundle Content

What content do we need for a Windows OS bundle?

A Windows image (install.wim from Microsoft media or a custom sysprepped WIM), Windows ADK content generated with the ADKPrep.ps1 script (from Provision's utility.zip), an unattend_<architecture>.xml answer file, the Tanium Client installer bundle, and optionally driver packages, patches, and custom scripts.

How do driver packages have to be named?

Save drivers as .zip or .cab: drivers.zip for common drivers, or model-specific names such as drivers_%Model%.zip (for example, drivers_SurfaceBook.zip), Lenovo model-ID, or SMBIOS Version naming variants.

Can we capture our own reference image?

Yes. Generalize Windows with sysprep /generalize /oobe /shutdown, boot the machine into the Provision boot image (PXE or USB), and use Capture to write a WIM (Windows) or .fsa file (Linux) to an SMB share.

What about Linux deployments?

Linux bundles use cloud-init for customization and require capturing a complete installation. Supported distributions include AlmaLinux, CentOS, Debian, RHEL, Rocky Linux, and Ubuntu (specific versions apply); Amazon Linux, AIX, Solaris, and SUSE are not supported. Default disk layouts and specific volume group names are required, and swap must be disabled before capture.

How are uploaded bundle files managed?

The OS Bundle Files page centralizes uploads, so one file (such as a WIM) can be associated with many bundles at once. Files not assigned to any bundle are automatically deleted after 90 days.

Variables & Advanced Customization

What are key value pairs in an OS bundle?

Key value pairs are settings that control how a bundle is processed - for example ComputerName, AdminPassword, DomainName/ODJService/OU, BitLocker, Timezone, Tags, and WaitFor. They support variable substitution using read-only variables such as %serial%, %model%, and %manufacturer% - for example TAN-%rand:10% generates a name with ten random digits.

Can we prompt a technician for values during deployment?

Yes. Any key value pair can be configured as a Prompt with text, dropdown, or checkbox input (including validation regex and multi-select options). Note that OS refresh deployments do not support prompts - keep separate bundles for refresh scenarios.

Can settings come from an external system?

Yes. Provision can call external web services (GET or POST) before bundle selection, after selection, and after customization prompts to return or override settings - even a static JSON file on a web server works.

Can we run our own scripts - and what if a script needs a reboot?

Custom PowerShell scripts run at defined phases: Customer-PE-Pre.ps1, Customer-PE.ps1, Customer-Pre.ps1, and Customer.ps1. To reboot mid-script, set the RebootAndRerun variable (rather than a restart command) and use ExecutionPass to track which pass is running - see the restart-and-rerun examples.

Does Provision support Microsoft Entra ID or Autopilot?

Yes. Endpoints can join Microsoft Entra ID via a Microsoft provisioning package added to the OS bundle, and Windows Autopilot profiles (JSON) are supported for existing devices - with caveats: with an Autopilot profile, Provision does not install the Tanium Client, does not perform domain join, and skips the later customer scripts.

Troubleshooting Provision

Where do we find the logs?

PXE/ODJ endpoint logs live under the Tanium Client folder (for example, <Tanium Client>\Tools\Provision\logs on Windows). Imaging logs include provision-linux.log, provision-pe.log, provision-os.log, and the DISM_*.log files, and move location by phase - after a completed deployment they land in %PROGRAMDATA%\Tanium\Provision; after a failed Windows deployment, in C:\Windows\temp\logs.

PXE boot isn't reaching the Tanium PXE service - why?

When multiple PXE servers exist on the network, the endpoint accepts whichever responds first. Check with your network team whether other PXE servers are configured in DHCP (scope options 66 and 67).

Why do we see Secure Boot certificate errors (2011 / 2023 cert)?

Errors referencing the Microsoft Windows Production PCA 2011 or Windows UEFI CA 2023 certificates usually mean the ADK content and the endpoint firmware trust different signing certificates. In most cases the fix is regenerating the ADK zip with the latest ADKPrep.ps1 and a current ADK; in some cases you must image with Secure Boot temporarily disabled.

The drive isn't detected during imaging - what's wrong?

"No disk could be located" typically means the endpoint is set to Intel RST (RAID) mode, which is not supported - switch the UEFI/BIOS to AHCI. A missing Provision-pe.ps1 error indicates missing storage drivers, which you add during ADK content preparation.

What routine maintenance does Tanium recommend?

Monthly: check the Health dashboard on the Provision Overview page, confirm the Provision service is running on Provision endpoints, and investigate errors with the Interact question Get Computer Name and Tanium Provision - TaniumPXE Status from all machines.

Quick Reference: Where to Look

Related resources: Configuring Provision  |  Setting up offline domain join  |  Preparing OS bundle content  |  Variables and advanced customization  |  Troubleshooting Provision

Last reviewed by: Managed Services Engineering  |  2026-07-23