WDS Answer files

Created by Adam Greenhow, Modified on Fri, 7 Aug at 8:49 AM by Adam Greenhow

The April 14, 2026 security updates (such as KB5082142 for Windows Server 2022 and corresponding cumulative updates for other supported Windows Server versions) disable "Hands-Free Deployment" and unattend.xml answer file support in Windows Deployment Services (WDS) by default. This change hardens servers against CVE-2026-0386, which exposed sensitive deployment credentials over network channels.

Background and Timeline

January 13, 2026 (Phase 1): Microsoft introduced Event Log alerts and registry options to warn administrators and allow manual disabling of insecure hands-free deployment.
April 14, 2026 (Phase 2): The security update went live, switching the feature to secure-by-default and automatically blocking unauthenticated answer file processing.

How to Re-enable (If Necessary)

You can override the default block by modifying the registry key to re-enable hands-free functionality, though Microsoft strongly advises against it due to the security risks.

Work around

Option 1: Apply via PowerShell (Fastest)

Open an elevated PowerShell window (Run as Administrator) on your WDS server and execute the following command:

powershell

New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Services\WDSServer\Providers\WDSPXE" -Name "AllowHandsFreeFunctionality" -Value 1 -PropertyType DWORD -Force

Restart the WDS Service

For changes to take effect immediately without rebooting the host server, run this in your command line/PowerShell window: [1]

powershell

Restart-Service WDSServer