Windows Deployment Services (WDS) is a Windows Server role that installs Windows over the network. Instead of booting from local media, a client can start from a PXE boot image, download setup files, and receive an unattended installation or a scripted build. WDS is often used in enterprise provisioning, device refresh, and recovery workflows where many systems need to be configured in a consistent way.
WDS matters in security because deployment infrastructure is a high-trust path into endpoints. If an attacker can alter boot images, answer files, or the deployment server, they may be able to push a malicious build, weaken security settings, or capture credentials during setup. Defenders therefore treat WDS as part of the attack surface: restrict network access, secure PXE and DHCP-related services, sign or validate images where possible, and inventory every workflow that depends on it. Even when not directly attacked, WDS deprecation can expose fragile dependencies that complicate patching, recovery, and migration.