Microsoft's own documentation adds two details that matter for planning: the timeline, and a multicast limitation that could catch Configuration Manager shops off guard.
What Microsoft actually announced
Two separate changes are underway, and they often get mixed up.
The future role deprecation. Microsoft published support article KB5129631 on September 21, 2026. It says Microsoft plans to deprecate the Windows Deployment Services (WDS) server role beginning with the next release of Windows Server. This includes the inbox WDS role, WDS services, management tools, and interfaces, and WDS-provided Preboot Execution Environment (PXE) boot functionality. EndpointWeekly's breakdown of the KB says the scope also covers WDS multicast transport, WDS's management tools/CLIs/APIs, and the WinPE-WDS-Tools optional component.
Nothing stops working yet. According to Microsoft's message center summary, WDS remains available on currently supported Windows Server releases according to their published servicing lifecycles. However, deprecation period is designed to begin migration to newer and better alternatives before eventual removal. One migration guide notes that a later removal date has not been announced.
Restrictions already in effect. Microsoft's WDS boot.wim support page says that starting with Windows 11, workflows that use the boot.wim from installation media, or that run Windows Setup in WDS mode, are no longer supported. The page puts it plainly: an end-to-end Windows 11 deployment using only WDS can't be done. Windows Server 2022 workflows that use installation-media boot.wim show a deprecation notice you can dismiss, but they aren't blocked yet. Windows 10, Windows Server 2019 and earlier versions aren't affected. Custom boot images, including the ones Configuration Manager uses, are a separate case and still work.
There's also a security change. WDS hands-free deployment scenarios were disabled by default and became unsupported after installation of Windows updates released on or after April 14, 2026. Microsoft links that change to hardening guidance for CVE-2026-0386.
In short: if you image Windows 11 using only WDS and installation-media boot.wim, that path is already closed. Everyone else has some time, though less than it might seem.
PXE isn't going away, but WDS's version of it is
Posey says WDS and PXE are different things. PXE is a long-standing network boot standard, and other tools will keep using it. That's correct, but there's a nuance: Microsoft is deprecating the PXE service that WDS itself provides. Network booting will still be possible. You'll just need a different PXE server to answer the requests.
Microsoft's Configuration Manager documentation describes enabling a PXE responder on a distribution point without WDS, and says it can even run on the same server as DHCP. That setup takes three changes:
- Set
DoNotListenOnDhcpPort(DWORD) to1underHKLM\Software\Microsoft\SMS\DP - Set DHCP option 60 to
PXEClient - Restart the SCCMPXE and DHCP services
Microsoft also says DHCP options aren't supported when one PXE-enabled distribution point serves multiple subnets. In that case, configure IP helpers on your routers. The documentation also warns that PXE isn't a secure protocol and that PXE servers and clients belong on a physically secure network.
Option 1: Microsoft Configuration Manager
Posey calls Configuration Manager one of the strongest choices for organizations that still do traditional operating system deployment (OSD). It offers task sequences, driver injection, application installs and a PXE responder that doesn't need WDS. Microsoft agrees. The deprecation notice recommends it by name, and the KB states that Microsoft Configuration Manager operating system deployment is not being affected. However, begin migrating Configuration Manager environments that still use WDS-backed PXE or WDS-dependent multicast away from those WDS dependencies.
The multicast catch. Microsoft's notice states that the Configuration Manager PXE responder without WDS supports unicast, not WDS-dependent multicast. If your imaging days involve sending one stream to a lab of 40 machines, switching to the WDS-free responder means each machine pulls its own unicast copy. Plan for the extra network load, or find another way to multicast.
There's at least one feature you gain. Configuration Manager supports DHCP option 82 during the PXE handshake only with the PXE responder that runs without WDS.
Other practical points from Microsoft's PXE documentation:
- PXE and multicast scenarios need an on-premises distribution point.
- Since version 2006, PXE-based task sequences can download content from a content-enabled cloud management gateway. The PXE distribution point still needs the boot image, and the device still needs an intranet connection to the management point.
- If a device has the network adapter first in its boot order and a required deployment targets it, the device can start a task sequence without anyone touching it. Microsoft says this raises the risk of an accidental reimage.
- The Windows PE add-on for the ADK for Windows 11, version 22H2 and later no longer includes 32-bit Windows PE.
Bottom line: Configuration Manager is the obvious next step for shops that image heavily. It does require infrastructure to maintain, and multicast workflows will need redesigning.
Option 2: Windows Autopilot and Microsoft Intune
Posey is clear that Autopilot isn't an imaging tool. It configures the Windows installation that's already on the device. Microsoft's Autopilot overview says it uses the OEM-optimized version of Windows preinstalled on the device, so you don't have to maintain custom images and drivers for every model. Instead of reimaging, Autopilot can apply settings and policies, install apps and change the Windows edition, for example from Pro to Enterprise.
The overview also says Intune is only one of the management options after deployment. Others include Windows Update client policies, Configuration Manager and third-party tools. Automatic MDM enrollment into services such as Intune requires a Microsoft Entra ID P1 or P2 subscription to configure.
Autopilot works best for remote and hybrid workers, since IT never has to handle the hardware. It's a poor fit if you need a custom golden image, have specialized OS requirements or run complex workflows. Posey makes that point too.
Bottom line: Autopilot replaces the reason many organizations imaged machines in the first place, not the imaging itself.
Option 3: Third-party imaging (SmartDeploy, Clonezilla, FOG Project)
Posey groups three products together: SmartDeploy, a commercial imaging tool; Clonezilla, an open-source disk cloning tool; and FOG Project, an open-source network imaging and management system. They work in different ways, and he advises checking licensing cost, support availability and hardware compatibility before choosing one.
FOG matters here because it multicasts. Its documentation describes a Linux-based system that boots clients over TFTP and PXE, supports multicast imaging, can join machines to a domain and deploys software through "snapins." The project recommends a dedicated server and a gigabit network card. FOG is GPL-licensed and comes with no warranty, and support runs through its community forum. FOG's introduction page lists Windows imaging support only up to Windows 10. Test it against your actual Windows 11 hardware before you commit.
Microsoft's own position supports this option. Neowin reports that for direct WDS or custom PXE deployments, Microsoft suggests evaluating non-Microsoft PXE and deployment solutions.
Bottom line: these tools aren't interchangeable. Shortlist one, then test it on your hardware, drivers and Secure Boot settings.
Option 4: USB deployment media
For small offices, branch sites or a few machines a week, USB media avoids server infrastructure entirely. Microsoft's manufacturing guidance covers building installation media by hand:
- Use a flash drive with at least 5 GB free. It will be formatted.
- In Disk Management, format the drive as FAT32 so it boots on both BIOS and UEFI PCs, then mark the partition active. If that menu option is missing, use
diskpart. - Copy the full contents of the Windows ISO or DVD to the drive. You can add an unattend file to automate setup.
- Boot the target device from the drive using its boot menu key (often Esc, F10 or F12) and follow Windows Setup.
Common problem: FAT32 can't hold files larger than 4 GB. If install.wim is too big, Microsoft's fix is to copy everything else with robocopy D: E: /s /max:3800000000, then split the image with Dism /Split-Image /ImageFile:D:\sources\install.wim /SWMFile:E:\sources\install.swm /FileSize:3800. Setup picks up install.swm automatically.
Posey also describes a more customized approach: boot WinPE from USB and apply a Sysprep-prepared image. That works, but it isn't the only USB method. Whichever you choose, expect to install some apps and drivers after Windows is up.
Option 5: Windows provisioning packages
Microsoft describes a provisioning package (.ppkg) as a container of configuration settings that configures a device without installing a new image. It says the approach suits businesses deploying anywhere from tens to a few hundred computers. You build packages in Windows Configuration Designer, which is available from the Microsoft Store. Packages can include Wi-Fi profiles, certificates, apps, Active Directory or Entra join and more. You can deliver them on removable media, by email, from a network share, or through NFC tags and barcodes.
Watch out for this: Microsoft's documentation says a provisioning package can't auto-enroll devices into Intune. It points admins to the Configuration Manager console for that. Packages can enroll devices in third-party MDM services and do bulk Entra enrollment.
Bottom line: provisioning packages configure Windows. They don't deploy it.
Don't move to MDT
Posey correctly lists the Microsoft Deployment Toolkit as retired. Microsoft's retirement notice, updated January 6, 2026, says MDT no longer gets updates, fixes, support or compatibility updates for new Windows releases, though existing installations may keep working. Microsoft also recommends removing MDT steps and integration from Configuration Manager task sequences to avoid corruption and editing failures. Replacing one deprecated tool with another retired one only adds to the work later.
Migration checklist
Before you choose a tool, list what you actually use today:
- Boot images: installation-media boot.wim (already blocked for Windows 11) or custom WinPE?
- PXE: standalone WDS, or Configuration Manager's WDS-backed PXE? Move the latter to the WDS-free responder.
- Multicast: if you rely on it, decide whether you can accept unicast or need a third-party tool that multicasts.
- Hands-free deployment: if it broke after April 2026 updates, that's by design.
- Volume and location: remote users point toward Autopilot. Labs and reimaging point toward Configuration Manager or third-party tools. A handful of PCs points toward USB plus a provisioning package.
- MDT dependencies: find them and remove them.
There's no immediate deadline. Your WDS servers will keep working on Windows Server 2025 and earlier for the rest of those releases' lifecycles. Use that time to move deliberately, and test your replacement in a lab before taking anything offline.