Microsoft Discourages Automated Installation of Windows 11 and Server 2025 Due to Serious RCE Vulnerability

Microsoft has unveiled a two-step initiative to deactivate the hands-free installation feature in Windows Deployment Services (WDS) after identifying a significant remote code execution (RCE) vulnerability identified as CVE-2026-0386.

The issue, stemming from faulty access management, permits an unauthorized assailant on a neighboring network to intercept confidential configuration documents and execute arbitrary code during network-based operating system installations.

Windows Deployment Services is a server feature that allows IT managers to install Windows operating systems remotely via a network, generally utilizing PXE (Preboot Execution Environment) boot.

A fundamental aspect of this service, hands-free deployment, depends on an Unattend.xml answer file to automate installation interfaces, including credential input, without necessitating manual operator engagement. This capability is extensively applied in corporate settings to efficiently provision extensive arrays of machines.

Windows Deployment Services Vulnerability

CVE-2026-0386, released on January 13, 2026, outlines an improper access control issue (CWE-284) in WDS that arises from the Unattend.xml file being sent over an unauthenticated RPC channel.

Since the answer file is exposed through the RemoteInstall shared folder without authentication, an assailant on the same network segment can capture the file, compromise embedded credentials, or introduce harmful code that executes during the installation process.

Security analysts have noted that a successful exploitation could provide SYSTEM-level privileges, facilitate lateral movement across a domain, and even permit attackers to corrupt OS deployment images, rendering it a supply chain-level threat in enterprise data centers.

Microsoft confirmed that the vulnerability holds a CVSS v3.1 vector of AV:A/AC:H/PR:N/UI:N with High impact ratings across Confidentiality, Integrity, and Availability.

The flaw impacts Windows Server versions from Server 2008 to Server 2025, including Windows Server 2016, 2019, 2022, and version 23H2.

Two-Phase Hardening Timeline

Microsoft is implementing mitigations in two phases:

• Phase 1 — January 13, 2026: Hands-free deployment remains operational but can be manually disabled. New Event Log notifications and registry key controls are introduced, enabling administrators to enforce secure behavior by setting AllowHandsFreeFunctionality = 0 under HKLMSYSTEMCurrentControlSetServicesWdsServerProvidersWdsImgSrvUnattend.
• Phase 2 — April 2026: Hands-free deployment will be entirely disabled by default. Administrators who have not implemented any registry configurations from January to April 2026 will find the feature automatically deactivated following the April security update.

Administrators who absolutely need the feature can temporarily reactivate it by setting AllowHandsFreeFunctionality = 1, but Microsoft explicitly cautions that this is not a secure setup and should be regarded as a short-term measure only.

• Evaluate all WDS configurations for Unattend.xml usage immediately.
• Implement the January 13, 2026, or subsequent Windows security update.
• Set AllowHandsFreeFunctionality = 0 to reinforce secure behavior before April 2026.
• Keep watch in Event Viewer for alerts about insecure unattend.xml access.
• Transition to alternative deployment solutions such as Microsoft Intune, Windows Autopilot, or Microsoft Configuration Manager, which is not impacted by this vulnerability.

Microsoft’s KB article 5074952 offers comprehensive guidance and registry specifics for affected organizations. Administrators are strongly encouraged to act before April 2026 to prevent disruption in their deployment processes.