MC1217584 High Major change
Windows Deployment Services (WDS): Hands-free deployment hardening (Phase 1)
Summary AI-generated
WDS hands-free deployment will be disabled by default due to CVE-2026-0386; admins must apply January 2026 update and prepare for default block in April 2026 unless overridden via registry.
Suggested actions AI-generated
- Apply January 2026 Windows security update
- Review Event Log and registry key options
- Set AllowHandsFreeFunctionality registry if needed
- Plan for default block in April 2026
Written by Azure OpenAI (gpt-4.1) from the text of the post below. It can be incomplete or wrong; the original post is authoritative.
Similar posts
Search for more like this- MC1250927 Windows Deployment Services (WDS): Hands-free deployment hardening (Phase 2)
- MC1276259 Windows Deployment Services (WDS): Hands-free deployment hardening (Phase 2)
- MC1478819 Windows Deployment Services (WDS) deprecation in the next Windows Server release
- MC1254512 (Updated) Second deployment phase for Kerberos RC4 hardening begins with the April 2026 Windows security update
- MC1279830 Second deployment phase for Kerberos RC4 hardening begins with the April 2026 Windows security update
- MC1456735 60-Day Reminder: AD FS DKM container ACL hardening begins in October 2026
Original post from Microsoft
Prepare for a two-phase hardening change related to CVE-2026-0386. The Unattend.xml file that underlies the hands-free deployment feature of Windows Deployment Services (WDS) poses a vulnerability when it’s transmitted over an unauthenticated RPC channel. Starting with the January 2026 security update, you can explicitly disable it with the help of new Event Log alerts and registry key options. In April 2026, hands-free deployment will be disabled by default. After that date, it will no longer work unless explicitly overridden with registry settings.
When will this happen:
- January 2026 security update: Phase 1 of hardening begins. Hands-free deployment continues to be supported and can be explicitly disabled to enhance security. Use the new Event Log alerts and registry key options.
- April 2026 security update: Phase 2 of hardening follows. Hands-free deployment will be disabled by default but can be re-enabled, if necessary, with an understanding of the associated security risks.
How this will affect your organization:
These hardening measures are meant to enhance security. If no action is taken (no registry key added) between January-April 2026, hands-free deployment will be blocked after the April 2026 security update.
What you need to do to prepare:
Apply the Windows update released on or after January 13, 2026 to enable the mitigation and ensure that devices are secure. When ready to disable hands-free deployment, apply the following registry setting:
- Registry location: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdsServer\Providers\WdsImgSrv\Unattend
- DWORD name: AllowHandsFreeFunctionality
- Value data: 00000000
Additional information:
- Read the full hardening guidance: Windows Deployment Services (WDS) Hands-Free Deployment Hardening Guidance related to CVE-2026-0386.
- Learn more about the related vulnerability: CVE-2026-0386.
- See deployment alternatives: Windows Deployment Services (WDS) boot.wim support.
- Explore cloud-based solutions: Windows Autopilot and Windows Autopilot device preparation documentation.