KB5129631 Puts the Whole WDS Role, Including PXE, on the Deprecation Track
The notice is broad. In the next release of Windows Server, Microsoft plans to deprecate the inbox WDS server role and associated WDS functionality, including: The Windows Deployment Services server role and its Deployment Server and Transport Server role services · WDS-provided PXE boot and network bootstrap functionality · WDS management tools, command-line interfaces, APIs, and related service activation paths · WDS multicast transport and WDS-dependent multicast deployment workflows · Related Windows Preinstallation Environment components that are used specifically to create or operate WDS clients, including WinPE-WDS-Tools.
Put simply, this covers every piece of WDS. The Deployment Server role service answers PXE boot requests and serves boot images. The Transport Server role service handles the network transport layer that multicast depends on. WDSUTIL, the WDS console and the WDS APIs are all included. On the client side, custom Windows PE (WinPE) images built around the WDS client tools fall under the same notice.
Microsoft also listed the announcement on its Windows release health hub, alongside the September 2026 Windows non-security preview update. When this piece was written, no independent outlet had reported on the notice beyond Microsoft's own pages. That is not a problem for the facts here, because a first-party KB is the authoritative record of what Microsoft plans. The company calls it early notice and says it will revise the article as the release schedule, the deprecation and removal milestones, and more migration guidance become available.
Deprecation Leaves Windows Server 2025 Unchanged but Sets the Direction
Deprecation and removal are two separate stages in Microsoft's lifecycle. Microsoft's Windows Server feature documentation says a deprecated component still ships in Windows Server, is supported for production deployments, and continues to receive security and quality updates per the product lifecycle. Removal comes later, and that is the stage where things stop working. Removal is when a feature or functionality is no longer available for use and has been removed from a product or service.
For the current fleet, the KB is plain: WDS remains available on currently supported Windows Server releases, including Windows Server 2025 and earlier. The announcement makes no immediate functional change to Windows Server 2016, 2019, 2022, version 23H2 or 2025. Microsoft does remind customers that they must keep applying security updates and follow its current WDS security guidance.
The notice leaves the removal date open. Microsoft confirms that WDS will eventually be removed, and says removal can happen in the next Long-Term Servicing Channel (LTSC) release, or it can be several releases away. We will update this page when this timeline is available. Any claim that WDS disappears in a specific year goes beyond what Microsoft has said.
A server you already run gives you a concrete planning window. According to PDQ's lifecycle summary, as of September 2026, Windows Server 2016 extended support ends in January 2027, while Windows Server 2025 remains in extended support through November 2034. The practical effect: a WDS server on Windows Server 2016 hits its support wall in a few months regardless of this notice, while a WDS server on Windows Server 2025 is covered for years.
Five Years of Shrinking Scope Led to the WDS Deprecation
Microsoft has been cutting WDS back in stages for five years, and its own timeline in the KB shows the sequence:
| Milestone | What changed |
|---|---|
| 2021 | Windows Setup workflows that boot boot.wim from installation media in WDS mode were deprecated for Windows 11 and later. Custom-image PXE scenarios remained available. |
| April 14, 2026 | WDS hands-free deployment was disabled by default and became unsupported after Windows updates released on or after this date. |
| September 21, 2026 | Early notice of planned deprecation of the remaining WDS role and WDS-provided PXE. |
| Next Windows Server release | WDS role and associated inbox functionality planned for deprecation; version and schedule not yet published. |
The 2021 change was visible to admins at the time. When Windows Insider build 21364 shipped, admins building WDS discover images from its boot.wim reported that the image showed only a message saying Windows Deployment Services client functionality is being partly deprecated. Since then, the working pattern has been to use WDS only as a PXE delivery mechanism for custom boot images. As one 2026 administration guide summarizes, WDS can still PXE-boot these clients, but only with a custom boot image (e.g., WinPE built with the Windows ADK, or via Configuration Manager).
The April 2026 change was driven by security. Microsoft's hardening guidance for CVE-2026-0386 (KB5074952) says hands-free deployment relied on an Unattend.xml answer file, which can include credentials. Sending that file over an unauthenticated RPC channel could let an attacker on the same network intercept it, leading to credential theft or remote code execution. Microsoft rolled the fix out in two phases. First, the January 13, 2026 updates added a registry value, AllowHandsFreeFunctionality, under HKLM\SYSTEM\CurrentControlSet\Services\WdsServer\Providers\WdsImgSrv\Unattend, along with new event log alerts. Then, updates released on or after April 14, 2026 made the secure behavior the default. Admins can still set the value to 1 to bring hands-free deployment back, but Microsoft says that path carries known security risks and is not recommended. The guidance also says CVE-2026-0386 did not affect Configuration Manager, which used WDS only to serve boot files and network bootstrap programs.
Microsoft's FAQ answer on whether WDS is already deprecated fits this history: Yes, it is partially deprecated. What the September notice adds is the removal of the one job most organizations still used WDS for: answering PXE requests.
Configuration Manager Survives, but Its WDS-Backed PXE and Multicast Must Go
For many enterprises the real exposure runs through Microsoft Configuration Manager. Microsoft is clear that Configuration Manager operating system deployment is not being deprecated. What has to change is any Configuration Manager site whose distribution points still use WDS for PXE or multicast.
For PXE, the migration is fairly direct. Configuration Manager has a PXE responder without WDS, a built-in PXE listener on the distribution point that answers boot requests without the Windows role underneath. Microsoft's instruction in KB5129631 is to configure and validate that responder in place of WDS-backed PXE.
Multicast is harder. Microsoft states that the non-WDS PXE responder supports unicast, not WDS-dependent multicast. Multicast lets a distribution point stream one copy of an image to many machines at once. Unicast sends a separate stream to each client. Organizations that image a lab or a whole floor at once will therefore see more load on distribution points and the network. Microsoft's guidance is to plan for unicast and evaluate whether additional distribution points, more network capacity or smaller deployment waves are needed. It does not say every environment will need new hardware. It says each organization has to measure.
The KB also calls Configuration Manager a better, more flexible and more feature-rich option for deploying Windows images than WDS. That is Microsoft recommending its own product. It is a reasonable path for organizations that already license it, but the KB does not claim it is the only one.
HTTP(S) Boot and Third-Party PXE Are Conditional Alternatives for Direct WDS Users
Organizations that run WDS directly, without Configuration Manager, get the least specific guidance. For direct WDS or custom PXE workflows, Microsoft recommends evaluating non-Microsoft PXE and deployment solutions. It does not name any products and does not publish a migration procedure for this case. The KB also makes clear that independent PXE implementations and third-party deployment products that do not depend on the inbox WDS role are not affected.
HTTP(S) Boot gets a careful qualification. Microsoft describes it as a separate firmware and deployment capability. It may work as an alternative when the device firmware, the network environment and the chosen deployment solution all support it. Microsoft explicitly says it is not a replacement for Configuration Manager PXE-based operating system deployment. Anyone pitching HTTP(S) Boot as a simple swap for WDS is claiming more than Microsoft does.
Custom WinPE clients are the easiest dependency to overlook. Some organizations built their own imaging front ends on WDS client APIs or added the WinPE-WDS-Tools optional component to boot images. Microsoft tells them to identify those dependencies and redesign the workflow around a deployment solution that does not require inbox WDS components. This is actual engineering work: a script that calls WDS client functions will need a rewrite, not a configuration change.
Mapping Your WDS Dependencies Before Microsoft Sets a Removal Date
Microsoft's recommended first step is discovery, and its checklist in KB5129631 translates into a practical sequence:
- Inventory every server that has the WDS role or its Deployment Server or Transport Server role services installed, and record the Windows Server version and its lifecycle end date.
- For each server, list the workflows that depend on it: new-device provisioning, reimaging, recovery, lab builds and any other network boot scenario.
- Look for indirect dependencies. Microsoft specifically names Configuration Manager distribution points with WDS-backed PXE, custom Windows PE images, scripts and automation, WDS APIs, WDSUTIL usage, multicast workflows, and applications that call WDS components.
- Check boot images for the WinPE-WDS-Tools component and any code that uses WDS client APIs.
- Pilot the replacement using representative device firmware, network conditions, security controls, image sizes and deployment volumes. A test on a single virtual machine will not reveal the problems a production imaging wave will.
- If you are moving from multicast to unicast, model distribution point capacity, network bandwidth, scheduling and wave size before the first large rollout.
While all of this is under way, Microsoft explicitly allows organizations that need more migration time to keep running WDS on a currently supported Windows Server release. That depends on the release's lifecycle and on following current WDS security guidance, which in practice includes leaving the April 2026 hands-free hardening in its secure default.
What this means for you
Your decision depends on how WDS is used in your environment, not on the announcement date. If Configuration Manager already handles PXE through its non-WDS responder and you don't use multicast, you have almost nothing to do. If you use WDS-backed PXE in Configuration Manager, the switch is a known configuration change you can plan and test on your own schedule. If you rely on multicast, run WDS on its own, or maintain custom WinPE tooling built on WDS, start the discovery and design work now. Those are the cases where Microsoft offers the least prescriptive help.
- KB5129631 makes no immediate change to WDS on Windows Server 2016, 2019, 2022, version 23H2 or 2025, and those installations stay supported under their published lifecycles.
- Microsoft has not named the next Windows Server version or a WDS removal date, and says removal could come in the next LTSC release or several releases later.
- Configuration Manager OS deployment is not being deprecated, but distribution points using WDS-backed PXE should move to the Configuration Manager PXE responder without WDS.
- That responder supports unicast only, so multicast deployments need capacity planning for distribution points, bandwidth and wave size.
- HTTP(S) Boot is an option only where firmware, network and deployment tooling support it, and Microsoft rules it out as a replacement for Configuration Manager PXE.
- A WDS server running on Windows Server 2016 faces an earlier deadline from its own lifecycle, since extended support for that release ends in January 2027.
WDS began as the successor to Remote Installation Services, and Microsoft is now retiring it in the same staged way: first the boot.wim setup path, then hands-free deployment for security reasons, and now the role and its PXE listener. The next concrete milestone is Microsoft's update to KB5129631 naming the Windows Server release and removal schedule. Organizations that have finished their dependency inventory by then will be choosing a migration date. Those that haven't will be told one.