Why is my WDS unattend.xml failing after the April 2026 update?

Is using unattend.xml on network drives still safe for Windows deployment?

Microsoft is fundamentally altering how Windows Deployment Services (WDS) handles automated installations. Starting January 2026, administrators must prepare for the deprecation of unattend.xml file support on network drives. This shift addresses critical security vulnerabilities inherent in unauthenticated network deployments. By April 2026, Microsoft will enforce a “secure by default” posture, requiring immediate administrative action to maintain deployment workflows.

The Vulnerability: CVE-2026-0386 Explained

The urgency stems from CVE-2026-0386, a Remote Code Execution vulnerability identified in early 2026. The legacy WDS workflow presents two specific dangers:

1. Unauthenticated Transmission: The system transmits the unattend.xml file via unauthenticated Remote Procedure Calls (RPC).
2. Credential Exposure: Sensitive login information travels across the network during the PXE boot phase without adequate protection.

These flaws allow potential attackers to intercept credentials via Man-in-the-Middle (MITM) attacks or execute unauthorized code on accessible networks. Consequently, Microsoft is mandating authenticated RPC to harden the deployment process.

Phased Implementation Timeline

Microsoft is rolling out these changes in two distinct phases to allow administrators time to adapt.

Phase 1: Preparation and Logging (January 13, 2026)

With the release of updates like KB5074109 (Windows 11 24H2/25H2), “Hands-Free Deployment” remains functional but now includes diagnostic warnings.

• Status: Active but monitored.
• Change: The system introduces event log warnings when unsecured deployments occur.
• Action: Administrators can now manually select between secure or insecure modes via the registry.

Phase 2: Enforcement (April 14, 2026)

The April security update marks the hard enforcement of these protocols.

• Status: Disabled by default.
• Change: The system blocks unauthenticated access to unattend.xml files.
• Impact: Automated installations relying on network-based answer files will fail unless explicitly re-enabled.

Technical Configuration and Registry Controls

Administrators manage this behavior through a specific registry key. You must modify this value to either enforce security or temporarily restore legacy functionality.

Registry Path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdsServer\Providers\WdsImgSrv\Unattend

Value Name:

AllowHandsFreeFunctionality (32-bit DWORD)

Configuration Values:

• Value 0 (Recommended): Blocks unauthenticated access. This secures the environment but disables hands-free deployment from network drives.
• Value 1 (Legacy): Permits unauthenticated access. This restores functionality but exposes the network to CVE-2026-0386.

Diagnostics and Troubleshooting

To assist in this transition, the January 2026 update adds specific logging capabilities. Administrators should monitor the “Microsoft-Windows-Deployment-Services-Diagnostics/Debug” log. Reviewing these events helps identify which deployment workflows require modification before the Phase 2 enforcement deadline.