Windows deployment isn’t going anywhere, no matter how often Microsoft talks about a cloud-only future. Out in the real world, imaging, task sequences, and controlled builds are still critical for many organizations.
MDT hasn’t been developed since 2019, aside from a BIOS detection patch in 2020, and it has never officially supported Windows 11. It just happened to keep working, which is a big reason so many organizations are still using it today. Over time, that “it still works” status masked the reality that MDT was effectively frozen, with no engineering investment and growing technical debt.
The sudden removal of the download, triggered in part by a security concern in the monitoring service, simply forced that reality into the open. But for many, nothing actually broke overnight; MDT continues to function in existing environments, which is why it remains in use.
Historically, it has been one of the most influential deployment tools, shaping how task sequences and imaging are done even today. Its current situation isn’t about immediate failure, it’s about running a legacy tool that Microsoft has clearly moved on from.
So, what next?
As long as you disable or replace the MDT monitoring service, there is no immediate need to stop using MDT. Though in general, I recommend starting to look for a replacement that is actively developed, supports newer Windows versions, and additional platforms (like ARM).
If you are using ConfigMgr (SCCM) today, it definitely makes sense to also use it for imaging. ConfigMgr OSD is a bit complex, I admit that, but it's a good OSD solution. That being said, buying ConfigMgr for just OSD does add some extra overhead.
A good alternative is the DeployR solution from 2Pint Software, and its development is led by Michael Niehaus, who was also the lead developer for MDT.
MDT Download link
Should you still need MDT, you can still find the download on the Internet Archive (and other Internet sources). Here is a functional link (as of today): https://web.archive.org/web/20220228162840/https://www.microsoft.com/en-us/download/confirmation.aspx?id=54259
The BIOS detection hotfix (KB4564442) is still available for download from Microsoft: https://download.microsoft.com/download/3/0/6/306AC1B2-59BE-43B8-8C65-E141EF287A5E/KB4564442/MDT_KB4564442.exe
WARNING: If downloading MDT from an unknown source, make sure it's not infected with malware or similar. As a starting point, you want to look for the Microsoft signature, and the correct SHA256 hash. You can also uploaded the file to https://www.virustotal.com.
The correct SHA256 hash for the SHA256 signed MicrosoftDeploymentToolkit_x64.msi is DABFD183C525BDB4866D2D9324F064A291CA62F3A16AC429CF3338BE529D1D58
If you find an older SHA1 signed MSI, the SHA256 hash for that file is 4810C0D8DAA1FECE0AFB7103A4AA6E33EF92A2E238E3A704FE4425E21DB98808
Other than disabling the MDT monitoring service.Is there something you can do to plug the security issue yourself?
Not that I know of… If you need a monitoring solution, build something custom that is more secure.