Kyro

Install Windows 11 over the network.

Kyro is an open-source PXE server in early development. The goal: you point it at a Windows 11 ISO, and a PC that boots from the network gets Windows Setup from it. No USB stick, no unpacking the ISO by hand.

Source on GitHubRead the roadmap

In progress. Kyro cannot boot a machine yet. This page describes the plan, and each part says how far it is.

From power-on to Windows Setup
StepDHCPTFTPHTTPSMB
1The PC asks where to boot from, plannedDHCP
2Its firmware loads iPXE, plannedTFTP
3iPXE shows the menu of images, plannedHTTP
4wimboot starts Windows PE, plannedHTTP
5Windows PE opens the install share, plannedSMB
6Windows Setup runs, plannedHTTPSMB
  • Planned
  • In progress
  • Working
  • Tested

Compared with the roadmap on 12 November 2026. If the two differ, the roadmap is right.

One program instead of a stack you assemble by hand.

Installing Windows over the network usually means putting DHCP, TFTP, HTTP, iPXE and wimboot together yourself, or using a tool that is convenient but not fully open source.

Kyro aims to be the convenient option with every part open: one program that you point at your Windows 11 ISOs, under a license that lets anyone read, audit and change it.

What is planned

License
GPL, version 3
Form
One static binary, written in Go
Runs on
Linux first, then Docker and Windows
Boots
x86-64 PCs with UEFI or BIOS firmware
Installs
Windows 11 from an unmodified ISO
Builds on
iPXE and wimboot, used unmodified

One ISO, any number of setups.

The usual way to keep several Windows configurations is one ISO per configuration, each several gigabytes large and almost identical to the others.

Kyro keeps the two apart. An image is a Windows ISO. A profile is an answer file with a name, and it is small. The boot menu is meant to offer each image with the profiles that fit it, and always once without a profile.

In progress.The design is proposed. Nothing of it is built.

Read the profile design

Example: one image, three entries in the boot menu

ImageWindows 11 ISOSeveral gigabytes. Stored once, not modified.

  • ProfileOffice PCAnswer file. Setup runs without questions.
  • ProfileWorkshop benchAnother answer file for the same image.
  • No profileInteractiveSetup asks its questions as usual.

Answer files, written in your browser.

Windows Setup asks for a language, a disk, an account and more. An answer file (autounattend.xml) answers in advance, so nobody has to sit in front of the installer.

This site is going to have a form that writes such files. It runs in the browser only: what you type, passwords included, stays on your computer. The page already forbids its scripts every network connection.

Planned.The options are written down as a proposal. The form is not built.

Read the proposed options
Example: part of an autounattend.xml
<settings pass="specialize">
  <component name="Microsoft-Windows-Shell-Setup"
      processorArchitecture="amd64"
      publicKeyToken="31bf3856ad364e35"
      language="neutral"
      versionScope="nonSxS">
    <ComputerName>PC-{{serial:12}}</ComputerName>
    <TimeZone>W. Europe Standard Time</TimeZone>
  </component>
</settings>

{{serial:12}} is a Kyro token. Kyro is meant to replace it with the serial number of the PC that asks for the file, cut to 12 characters.

Made for a boot network you control.

PXE has no authentication, and Kyro cannot change that. The security model says so before anything else.

Read the security model

  • Anyone on the network can answer.

    A booting PC acts on the DHCP answers it gets. Any machine in the same broadcast domain can point it at a different boot file.

  • Give it its own VLAN.

    Kyro belongs on an isolated boot VLAN that contains only Kyro and the machines being installed.

  • Answer files are readable there.

    They can hold passwords, and Kyro is going to hand them to every client that boots. Keep long-lived secrets out of them.