MC1276259 Medium Major change
Windows Deployment Services (WDS): Hands-free deployment hardening (Phase 2)
Summary AI-generated
Starting April 2026, hands-free deployment in Windows Deployment Services is disabled by default to enforce security for CVE-2026-0386; override requires registry change.
Suggested actions AI-generated
- Override secure default with registry setting to retain hands-free deployment (not recommended)
- Plan migration to alternative deployment solutions
- Review hardening guidance for CVE-2026-0386
Written by Azure OpenAI (gpt-4.1) from the text of the post below. It can be incomplete or wrong; the original post is authoritative.
Similar posts
Search for more like this- MC1250927 Windows Deployment Services (WDS): Hands-free deployment hardening (Phase 2)
- MC1217584 Windows Deployment Services (WDS): Hands-free deployment hardening (Phase 1)
- MC1478819 Windows Deployment Services (WDS) deprecation in the next Windows Server release
- MC1279830 Second deployment phase for Kerberos RC4 hardening begins with the April 2026 Windows security update
- MC1254512 (Updated) Second deployment phase for Kerberos RC4 hardening begins with the April 2026 Windows security update
- MC1388721 30-Day Reminder: Final deployment phase for Kerberos RC4 hardening begins with the July 2026 Windows security update
Original post from Microsoft
As announced in January 2026, the unattend.xml file used in hands‑free deployment poses a vulnerability when transmitted over an unauthenticated RPC channel. Beginning with the April 2026 security update, the second phase of hardening for CVE-2026-0386 is now in effect. These changes make hands‑free deployment disabled by default to enforce secure behavior. After this update, hands‑free deployment no longer works unless explicitly overridden with registry settings.
When will this happen:
Starting with the April 2026 security update, Windows Deployment Services (WDS) enforces secure‑by‑default behavior by automatically disabling hands‑free deployment.
How this will affect your organization:
After installing the April 2026 security update, hands‑free deployment is blocked to prevent unauthenticated access to unattend.xml, enforcing the hardening requirements for CVE-2026-0386. Any workflows that rely on unattend.xml‑based deployment will no longer function unless overridden with registry settings.
What you need to do to prepare:
Organizations that still require hands‑free deployment after installing the April 2026 security update must explicitly override the secure default by setting the AllowHandsFreeFunctionality registry value to 1, which keeps unattend.xml‑based deployments operational but reintroduces the security risks associated with CVE-2026-0386. When this override is used, devices will log diagnostic messages indicating that they are operating in an insecure mode. Because this configuration is not recommended for long‑term use, IT admins should plan to migrate to alternate deployment solutions and return to secure‑by‑default behavior.
Additional information:
- Read the full hardening guidance: Windows Deployment Services (WDS) Hands-Free Deployment Hardening Guidance related to CVE-2026-0386.
- Learn more about the related vulnerability: CVE-2026-0386.
- See deployment alternatives: Windows Deployment Services (WDS) boot.wim support.
- Explore cloud-based solutions: Windows Autopilot and Windows Autopilot device preparation documentation.