Microsoft has blocked hands-free WDS deployment on Windows 11 and Server 2025 to patch CVE-2026-0386, with full enforcement arriving in April 2026.