# USB Key Deployment

> Create a bootable USB key to provision devices where PXE network boot is not available.

Source: https://docs.capaone.com/capaone/provision-manager/usb-key-deployment/  
Product: CapaOne — a separate CapaSystems product; do not apply this page to any other.

Create a bootable USB key to provision devices when PXE network boot is not available — for
example, remote devices with no managed endpoint on their subnet. The USB key only boots the device
into the CapaOne provisioning environment; the installation itself is still delivered from the
cloud, so the provisioning flow is the same as with PXE.

:::note[Before you start]
- A USB key with at least 1 GB capacity. All existing data on it will be erased.
- [Rufus](https://rufus.ie) — a free, open-source USB writing tool. No installation required.
- The target device must support UEFI boot.
:::

## 1. Download the ISO

1. Navigate to **Windows → Provisioning → Provisioning Points**.
2. Click **New** and select **Deploy Using USB Key**.
3. Download the ISO matching the target device's architecture: **x64** or **ARM64**.

The ISO is rebuilt automatically on every CapaOne release. Always download a fresh copy before
creating a USB key, so the embedded provisioning client and configuration are current.

## 2. Write the ISO to the USB key

1. Open Rufus and insert the USB key.
2. Configure the following settings:

   | Setting | Value |
   |---------|-------|
   | **Device** | Your USB key |
   | **Boot selection** | Click **SELECT** and browse to the downloaded `.iso` file |
   | **Partition scheme** | GPT |
   | **Target system** | UEFI (non CSM) |
   | **File system** | FAT32 |

3. Click **START**.
4. When warned that all data on the USB key will be destroyed, click **OK**.
5. Wait for Rufus to finish. This usually takes 1–3 minutes.

## 3. Boot the device from the USB key

1. Insert the USB key into the target device.
2. Power on and enter the boot menu — typically F12, F11, or ESC.
3. Select the USB key as the boot device. Look for the **UEFI:** prefix, for example
   **UEFI: \<USB name\>**.

The CapaOne provisioning environment starts automatically.

:::tip
If the device boots into Windows instead, check that the device boots in UEFI mode (not
Legacy/CSM), and that Secure Boot is disabled or the USB key is allowed as a boot source.
:::

## What happens after boot

1. The provisioning environment installs any required network and storage drivers and initializes
   the network.
2. It reads its configuration from the `CO\capaoneapi.json` file embedded in the ISO.
3. It connects to the CapaOne API and downloads the deployment client.
4. It displays a QR code. Scan it with a phone, sign in to CapaOne, and select an organization and
   a [provisioning template](/capaone/provision-manager/provisioning-templates/).

Installation then runs unattended, and you can follow it under
**Windows → Provisioning → In Progress**.