IT Weekly Review: Deployment, Identity and Backup Boundaries

This week brought three changes with a common operational lesson: support depends on the whole deployment chain, not the product name on a dashboard. Microsoft published a new retirement signal for Windows Deployment Services, released an Entra Connect Sync hotfix just before a hard minimum-version deadline, and Veeam added a plug-in build required for a newer on-premises hypervisor. None warrants a blind estate-wide rollout. Each warrants an inventory tied to a specific dependency and an acceptance test that exercises the service users rely on.

On September 21, Microsoft announced that the inbox Windows Deployment Services (WDS) role, its PXE boot functions, management interfaces and multicast transport are planned for deprecation in the next Windows Server release. This is a planning notice, not a removal date: WDS remains available and supported on currently supported Windows Server 2016, 2019, 2022, version 23H2 and 2025 releases. The distinction matters for imaging and disaster-recovery teams. A working Windows Server 2025 deployment server does not need to be switched off this week, but a new build based on WDS now carries a known migration obligation.

Inventory the installed WDS roles and the less visible consumers: Configuration Manager distribution points using WDS-backed PXE, custom Windows PE images, WDSUTIL scripts, APIs, multicast jobs and recovery boot paths. Microsoft says Configuration Manager operating-system deployment itself is unaffected; its PXE responder without WDS is the relevant migration path for WDS-backed sites. That responder uses unicast, so teams losing multicast must measure distribution-point load, network bandwidth and deployment-wave size. Test representative UEFI firmware, network segments, security controls and image sizes before committing to a replacement. Record which current server can keep WDS during the transition and who owns the exit plan.

For hybrid identity, Microsoft released Entra Connect Sync 2.6.92.0 on September 23 as a hotfix with security fixes. It corrects a regression in 2.6.91.0 that could prevent the Connect wizard from registering the locally installed Pass-through Authentication agent when enabling that sign-in method. The affected component is the on-premises synchronization server and its authentication setup, not every Active Directory domain controller. Microsoft separately warns that sync services below 2.5.79.0 stop working on September 30. The older minimum is an immediate deadline; 2.6.92.0 is the current corrective target for teams planning an upgrade or encountering the wizard failure.

Check the running build on both active and staging Connect servers, export configuration and document the sign-in method before changing anything. Confirm prerequisites, including .NET Framework 4.7.2 and TLS 1.2, and obtain the installer through the Entra admin center. In a controlled window, verify service startup, scheduler state, connector health, export backlog and a test identity's end-to-end synchronization. Where Pass-through Authentication is used, test agent registration and an actual sign-in; where it is not used, do not imply that this particular regression affects authentication. If either node remains below the September 30 floor, give that remediation priority and retain evidence of the new build and successful sync.

Veeam released Plug-In for Scale Computing HyperCore 4.1, worker build 13.4.1.328, on September 24. Its updated support matrix says HyperCore 9.7.x is supported only with that plug-in build or later; plug-in 4.1 is listed with Veeam Backup & Replication 13.1.0.411 and 13.1.1.18. This is a narrow but material compatibility boundary for sites running Scale clusters. An upgrade of the hypervisor alone can leave the backup design outside the documented support combination even if jobs still appear in the console. Conversely, estates without HyperCore have no action from this release.

Before moving a Scale cluster to 9.7.x, record the cluster version, Veeam server build, plug-in and worker builds, guest-processing requirements, repositories and recent restore evidence. Stage the independent plug-in release in a representative ring and check Veeam's platform matrix for the exact server combination. Then run a new backup, inspect application-aware processing where configured, restore a guest file and rehearse a VM recovery appropriate to the service. Keep the previous supported combination until those checks pass. This makes hypervisor maintenance a protection change with a recovery checkpoint, rather than assuming the backup integration follows automatically.

The practical priority is clear: map WDS dependencies for the next server generation, bring Entra Connect above the September 30 minimum with a verified hotfix path, and align Scale and Veeam versions before upgrading a protected cluster. The work is different in scope and urgency, but the completion test is the same: demonstrate that deployment, identity synchronization or recovery still works after the version boundary is crossed.