Nerdpedes,
have a look at
https://security.stackexchange.com/questions/64915/what-are-the-biggest-security-concerns-on-pxe
Best of:
I can capture a full machine image. Do your systems automatically connect to the domain controller after setting up the machine? If so, this image probably has domain controller credentials on it, that I can capture and use elsewhere.
Computer makes a DHCP request --> DHCP server responds with address and PXE parameters --> Computer downloads boot image using TFTP over UDP
If the good guys got the traffic on that low level, unencrypted. Then they would have it all.
PXE can be used to silently and automatically install a modified, or entirely different operating system, including one which runs as an ISO (CD/DVD) image, without actually modifying the hard drive, leaving no trace of it, when machine is rebooted.
Are you talking about the winPE environment, I've never seen the ability to download and run an iso in ram without touching the HDD like a live cd. Can you please provide info or instruction on this?
WinPE can run from RAM, you could boot to a virtual disk over the network, most linux flavors can run as a Live CD...
You can get a lot of stuff running in a WinPE environment, especially if you're the one writing the software.
Yes, this is all true but you need to exit the winPE environment to run the OS. You say you can boot to a virtual disk over the network. Wouldn't this be a thin client / terminal services rather than PXE?