Skip to content
Trending
Simplify Windows Devices to Run Only the Required Applications using Intune Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys Updated Windows Device Sync Experience Enhances Per-Device Troubleshooting Configure Windows Sandbox vGPU Policy using Intune for Better Graphics Performance or Reduced Attack Surface Simplify Windows Devices to Run Only the Required Applications using Intune Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys Updated Windows Device Sync Experience Enhances Per-Device Troubleshooting Configure Windows Sandbox vGPU Policy using Intune for Better Graphics Performance or Reduced Attack Surface
Understanding Windows Deployment Services Hardening Phase 2 and Its Impact on Hands-Free Deployment

Understanding Windows Deployment Services Hardening Phase 2 and Its Impact on Hands-Free Deployment

Written By Anoop C Nair
Last Updated April 14, 2026
Posted In Windows
SHARE

Key Takeaways

  • Unattend.xml files in WDS can expose sensitive data if sent over insecure channels.
  • Microsoft is removing insecure hands-free deployment by default to improve security.
  • Security changes will be introduced in two phases starting January 2026.
  • Administrators may need to use registry settings to enable or control deployment behavior.

Hey, let’s discuss about Understanding Windows Deployment Services Hardening Phase 2 and Its Impact on Hands-Free Deployments. Windows Deployment Services (WDS) supports network-based deployment of Windows operating systems, and a commonly used feature, hands-free deployment, relies on an Unattend.xml file to automate installation screens, including credentials.

Table of Contents

Understanding Windows Deployment Services Hardening Phase 2 and Its Impact on Hands-Free Deployments

The unattend.xml file can create a security weakness if it is sent through an unauthenticated RPC channel, as this may reveal sensitive information and increase the risk of credential theft or remote code execution. An attacker within the same network might intercept the file and use it to compromise credentials or run malicious code. To reduce this risk and improve security, Microsoft plans to remove default support for hands-free deployment over insecure channel

Understanding Windows Deployment Services Hardening Phase 2 and Its Impact on Hands-Free Deployment - Fig.1
Understanding Windows Deployment Services Hardening Phase 2 and Its Impact on Hands-Free Deployment – Fig.1

Phase 1

In Phase 1(January 13, 2026), hands-free deployment remains supported and can be manually disabled to improve security, with event log alerts added and registry key options provided to select either secure or insecure mode. To activate the mitigation and keep your device protected, install the Windows update released on or after January 13, 2026, and if your WDS setup uses unattend.xml for automated deployments, configure the appropriate registry setting to enforce secure behaviour.

Registry LocationDWORD nameValue data
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdsServer\
​​​Providers\WdsImgSrv\Unattend		AllowHandsFreeFunctionality00000000

Understanding Windows Deployment Services Hardening Phase 2 and Its Impact on Hands-Free Deployment – Table.1

Phase 2

In Phase 2 (April 2026), hands-free deployment will be disabled by default but can be re-enabled if necessary, provided the associated security risks are understood, with the system shifting to a secure-by-default behavior and hands-free deployment no longer functioning unless explicitly enabled through registry settings. During this phase, if hands-free deployment is required, the registry key value must be set to 1.

Patch My PC
Registry LocationDWORD nameValue data
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdsServer\
​​​​​​Providers\WdsImgSrv\Unattend		AllowHandsFreeFunctionality00000001
Windows Deployment Services Security Hardening and Unattend.xml Risk Mitigation – Table.2

Event Logging

New events are introduced to help administrators monitor deployment activity in the Microsoft-Windows-Deployment-Services-Diagnostics/Debug log.

  • Secure mode: A warning is logged when an Unattend file request is made over an insecure connection, and Windows Deployment Services blocks the request to maintain security. This warning appears when unattend.xml is requested without a secure channel.
  • Insecure mode: An error is logged indicating that the system is using insecure Windows Deployment Services settings, which may expose sensitive configuration files to interception, and it recommends applying Microsoft’s security settings to protect deployment.

Need Further Assistance or Have Technical Questions?

Join the LinkedIn Page and Telegram group to get the latest step-by-step guides and news updates. Join our Meetup Page to participate in User group meetings. Also, Join the WhatsApp Community and WhatsApp Channel to get the latest news on Microsoft Technologies. We are there on Reddit as well.

Author

Anoop C Nair has been Microsoft MVP from 2015 onwards for 10 consecutive years! He is a Workplace Solution Architect with more than 22+ years of experience in Workplace technologies. He is also a Blogger, Speaker, and Local User Group Community leader. His primary focus is on Device Management technologies like SCCM and Intune. He writes about technologies like Intune, SCCM,   Windows, Cloud PC, Windows, Entra, Microsoft Security, Career, etc

Written by

Anoop C Nair is Workplace Technology solution architect with 25+ years of experience in global enterprise organizations such as JP Morgan, Capgemini, etc. Microsoft Certified Trainer. Microsoft MVP from 2015 onwards for consecutive 11+ years! He also conducts Intune and modern workplace tech training for enterprise organizations. He is Blogger, Speaker, and Founder of HTMD Community and HTMD Conference. His main focus is on Device Management technologies like Intune, Windows, Cloud PC. He writes about technologies like Intune, SCCM, Windows, Cloud PC, Windows, Entra, Microsoft Security.

Discussion

Join the discussion

Your email address will not be published. Required fields are marked *

Related guides

Intune

Windows 11 KB5101650 KB5099414 July 2026 Patch and 3 Zero Day Vulnerabilities and 570 Flaws

Key Takeaways Windows 11 KB5101650 KB5099414 July 2026 Patch and 3 Zero Day Vulnerabilities and 570 Flaws! In the July 2026 Patch, Microsoft introduced new features designed to improve the overall Windows experience. The update adds enhancements to Windows Update for more flexible update management and introduces Point-in-Time Restore, providing an additional recovery option for […]

AC Anoop C Nair 9 min read
Intune

BitLocker Prompt Issue After June Patch KB5094126 Secure Boot UEFI 2023 Certificate Update

Key Takeaways BitLocker Prompt Issue After June Patch KB5094126 Secure Boot UEFI 2023 Certificate Update! After deploying the June 2026 Windows update (KB5094126), some HP EliteDesk 800 G6 devices began prompting for the BitLocker recovery key after every reboot. Based on our investigation, the Secure Boot UEFI 2023 certificate update does not appear to be […]

AC Anoop C Nair 5 min read
Microsoft Defender for Endpoint

Microsoft Defender for Endpoint EDR Updates are now Separate from Monthly Windows Security Updates for Faster Protection

Key Takeaways In this post, we are discussing how Microsoft Defender for Endpoint EDR Updates Will Be Delivered Through Microsoft Update. Microsoft has introduced a new update model for Microsoft Defender for Endpoint Detection and Response (EDR) security updates. Previously, these updates were included with the monthly Windows security updates. This change enables Microsoft to […]

AC Anoop C Nair 5 min read