Table of Contents
What are your options when WDS hands-free deployment stops working in April 2026?
Approaching WDS Security Changes
Microsoft is restricting Windows Deployment Services (WDS) to improve network security during operating system installations. Administrators currently using WDS to deploy Windows clients and Windows Server environments have just four weeks to prepare. Microsoft will disable hands-free provisioning by default to prevent vulnerabilities associated with storing configuration files on network drives.
You must act quickly to ensure your deployment workflows continue functioning smoothly. While you can manually reactivate the feature, doing so exposes your network to the exact security risks Microsoft aims to close. Understanding the rollout timeline helps you transition to safer deployment frameworks.
Stage One Transition
The first phase of this security update began in January 2026. Microsoft introduced explicit controls to help administrators transition away from insecure deployment practices.
- The January update added a registry key to toggle between secure and insecure deployment modes.
- System event logs now generate specific warnings when devices use the legacy hands-free deployment method.
- Hands-free deployment remains supported but allows administrators to disable it proactively for testing purposes.
Stage Two Implementation
The final phase takes effect in April 2026, likely aligning with Patch Tuesday on April 14. This update alters how WDS operates out of the box to enforce tighter security protocols.
- Microsoft will disable hands-free provisioning by default across all updated systems.
- Administrators can re-enable the feature manually through specific registry configurations.
- Organizations reactivating hands-free mode must formally accept the documented security risks.
Recommended Administrator Actions
You should review your current deployment infrastructure immediately. Monitor your event logs to identify which systems still rely on the legacy hands-free provisioning process. Once you identify these dependencies, begin testing alternative deployment solutions that comply with modern security standards. Modernizing your deployment workflows protects your environment and aligns your infrastructure with Microsoft’s current security recommendations.