JATAGAN SECURITY · AI Box — Field Setup Runbook
INTERNAL · TECHNICIAN INSTRUCTIONS

Set up the AI Box (mini PC)

Follow these steps in order. You'll set up Windows offline, make a backup image, then install Debian Linux so the box can run the AI software. Total time ~60–90 min.

Before you start — what you need:

1 Windows setup — offline, no Microsoft account, no password

Boot the mini PC. When Windows starts its first-time setup (OOBE), the goal is a local account with a blank password.

Do this OFFLINE. Do not connect ethernet or Wi‑Fi yet — being offline forces Windows to let you create a local account.

Windows 11 (including 24H2)

  1. At the first setup screen, press Shift + F10 to open a command window.
  2. Type this and press Enter:
    start ms-cxh:localonly
  3. If that doesn't work on your build, instead run:
    oobe\bypassnro
    The PC reboots; continue setup and choose "I don't have internet""Continue with limited setup".
  4. Create the user (e.g. jatagan). Leave the password blank — click Next without typing one.

Windows 10

  1. When it asks to sign in, click "Offline account" (bottom-left) → "Limited experience".
  2. Create the user (e.g. jatagan), leave the password blank.
When you reach the Windows desktop, now connect the ethernet cable — you'll need internet for the downloads below.

2 Install Macrium Reflect 8 & make a backup image

This makes a full image of the clean Windows install, as a safety backup before we switch the box to Linux.

  1. Download the installer (official free version, from Internet Archive):
    https://archive.org/download/macrium-reflect-v-8.0.7783/Macrium%20Reflect%20v8.0.7783.exe
    ⬇ Download Macrium Reflect 8
  2. Run the installer and install it (Free / Home use).
  3. Create a full image of the system disk to your external drive. (You already know the process — image the whole disk.)
If Macrium asks to register a free license, do it while you're online — it only takes a minute.

3 Create the Debian install USB

Do this from this same Windows PC, before we wipe it.

  1. Download Debian 13 (netinst, 64-bit / amd64):
    https://www.debian.org/CD/netinst/ → click amd64.
    You'll get a file like debian-13.x.x-amd64-netinst.iso (~700 MB).
  2. Download Rufus (USB tool): https://rufus.ie (the portable .exe).
  3. Plug in the USB drive and open Rufus:
    • Device: your USB (double-check the size — it gets erased!).
    • Boot selection: SELECT → the Debian ISO.
    • Partition scheme: GPT  ·  Target system: UEFI (non CSM).
    • Click START. If asked, choose "Write in ISO Image mode".
At this point the Windows backup image is done and the Debian USB is ready. Safe to continue.

4 Install Debian (no desktop / headless)

This erases the whole disk (Windows). That's expected — the Macrium image from Step 2 is our backup.
  1. Leave the USB plugged in and reboot. As it powers on, tap the boot-menu key repeatedly: usually F7, or try Esc / F11 / Del.
  2. In BIOS/Setup: set Secure Boot → Disabled and Fast Boot → Disabled. Save (F10).
  3. From the boot menu pick the entry that says "UEFI: <your USB>", then choose Install.
  4. Follow the installer:
    • Language / Keyboard: your choice.
    • Network: let it use ethernet (DHCP) automatically.
    • Hostname: ai-box-office  ·  Domain: leave blank.
    • Root password: leave blank (press Continue).
    • User: jatagan — and set a password you'll remember (write it down; we need it for remote access).
    • Partition: Guided – use entire disk → the internal disk → "All files in one partition" → FinishYes, write changes.
    • Software selection (IMPORTANT): use the Spacebar to UNCHECK everything except:
      SSH server   and   ✅ standard system utilities.
      Make sure "Debian desktop environment" and "GNOME" are NOT checked.
    • GRUB boot loader: Yes → install to the internal disk.
  5. When it finishes, remove the USB and let it reboot.

5 Confirm remote access & report back

The box has no screen normally — we manage it remotely. Just confirm it's reachable and send us the details.

  1. Log in on the console as jatagan with the password you set.
  2. Find the box's IP address — type:
    ip a
    Look for the line inet 172.16.11.x on the ethernet interface (starts with en…). That's the box IP.
  3. Confirm SSH is running:
    systemctl is-active ssh
    It should print active.
✅ Done. Send Luis these 3 things:
  • Box IP address (e.g. 172.16.11.x)
  • Username: jatagan
  • The password you set
Also make sure the box stays plugged into power and to the camera/office network. We'll take it from here remotely.

Questions during setup? Contact Luis. · Jatagan Security — internal field runbook.