Windows 10 S isn’t just for education; Microsoft hopes the new Windows edition will find its way into homes and enterprises, too. But beneath the familiar user interface are some significant differences.
The sleek new Surface Laptop comes with it, and so do $300 two-in-one tablet PCs for education and business. But exactly what is Windows 10 S, and how is it different from other versions of Windows 10?
The education market is the first focus for the Windows 10 S push. To some extent, “Windows 10 in S mode,” as Microsoft frequently refers to it to emphasize that this is the full version of Windows underneath, is a reaction to the danger posed by competition from Chromebooks. A key point is that devices you’re relying on in a classroom need a battery that lasts all day, because they have to work in the last lesson of the day as well as the first. Another is that schools are usually short on IT resources, so they’re looking for simpler management options that rely on the cloud.
But education is only the first market for Windows 10 S, and Microsoft wants home users and even enterprises to see its advantages as well. And simpler management does appeal to a lot of enterprises; last year 83% of the businesses in a CCS Insight enterprise survey said they planned to “converge their PC management and Enterprise Mobility management strategy and teams” and use Mobile Device Management (MDM) to manage PCs as well as phones.
“The entire industry is pushing toward modern management,” Samji said. “Education is a great candidate for that, but it’s very common for enterprises to be asking for the exact same solution. With this current version of Windows 10 S our focus is on education, but a lot of the requirements are exactly the same.”
It strives for that pristine state in several ways.
First, Windows 10 S starts with all the features in Windows 10 Pro (there’s even a Windows Insider option), which means it includes new security protections such as code integrity checks.
More significantly, this is a Windows that restricts which applications you can run (they have to come from the Windows Store) and that explicitly removes key enterprise management technologies.
Windows 10 S can’t join a domain or use Active Directory; instead, it connects to Azure Active Directory, which means there are no log-on scripts or startup applications to slow down start time. That removes Group Policy, a feature that gives IT admins control but also slows systems down and makes Windows fragile. And the registry keys that implement it let power users tweak their setup, which isn’t conducive to pristine devices.
Instead of Group Policy, it’s managed the way smartphones and tablets are, using MDM tools and cloud identities. To appeal to the schools it hopes will be the first big customers for Windows 10 S, Microsoft has a version of its Intune cloud management service especially for the education market, and it offers tools to set up accounts and language and Wi-Fi settings and to install apps – either online or via a USB stick that teachers or admins plug into Windows 10 S devices.
The registry is still there, but Windows 10 S doesn’t have the Registry Editor that applications can use to change system behavior. That also means users can’t tweak things in lamentable ways, and registry “cleaner” utilities likely to cause problems are blocked. With normal desktop software, any application can add and change registry keys and file associations. Because Windows 10 S only runs software from the Windows Store, all the apps use a virtualized registry, so one app can’t affect the settings another app uses.
Windows Store apps can be uninstalled cleanly, so you can try out apps without worrying that they’ll add unwanted services and applications that can reduce performance and battery life — another thing that makes Windows 10 S less fragile than Windows 10. Not everyone will realize it’s software they’ve installed that slows Windows down, and even if they do it can be tricky to remove cleanly.
The restriction to Windows Store apps also limits the apps that OEMs can preinstall on devices; they can’t add a different antivirus client from the built-in Windows Defender or add utilities that intercept website certificates and allow them to inject advertising.
Limiting Windows 10 S to the Store may not be as much of a limitation as you might think. For example, if you want to use the scanning feature in your multifunction printer (something you can’t do with just the device drivers delivered through Windows Update), most hardware vendors have Store apps for their recent devices with these kinds of features.
There’s no command line in Windows 10 S – neither the Microsoft-DOS-style command console nor PowerShell – and no scripts that could introduce malware or change settings to degrade performance and battery life. That means you can’t sideload your own apps, even if you have the code. And you can’t add a command-line tool.
Not all apps available from the Windows Store will run on Windows 10 S. For example, because Windows 10 S lacks the Windows Subsystem for Linux and the command line, the Linux distros in the Windows Store won’t work. But Linux binaries are exactly the kind of arbitrary code that Windows S is designed to keep off your system. Even if Microsoft packaged up Visual Studio Code for the Store, it would produce code that you couldn’t test or run on a Windows 10 S device.
You can install desktop applications on Windows 10 S, but only if they’ve been sandboxed by Microsoft’s Desktop Bridge tool and come through the Windows Store. That’s how you can get Office 2016; you download Office Home and Student from the Store and get desktop versions of Word, Excel, PowerPoint and Outlook.
Other Office suite productivity apps, such as Sway and Teams, are already available as Store apps. But compromises are necessary; you’re limited to Skype instead of Skype for Business, and the Store version of OneNote doesn’t have all of the features of desktop OneNote. But Microsoft offers Publisher, another desktop application, as part of the Office download from the Store, and Microsoft’s Samji hints that “you’ll see us continue to have more things available from the suite.”
Other software publishers using the Desktop Bridge tool to deliver software include Evernote, Slack, Spotify, Turbo Tax and — when the Fall Creators Update is available — iTunes.
Slightly more surprising, Windows 10 S doesn’t let you run desktop browsers other than Edge and Internet Explorer (for backwards compatibility). That’s because Windows Store policies only allow browsers that use the Edge and Chakra HTML and JavaScript engines included in Windows; Chrome and Firefox would need to install their own HTML engines and make the kinds of changes to the Windows system that Windows 10 S doesn’t allow.
If you download an application that is blocked on Windows 10 S, it won’t install. But if there’s a version of the same software – or what Microsoft considers to be a comparable app – in the Windows Store, the error message will include a link to download that instead, and it will give you the option of upgrading to Windows 10 Pro so you can go back and install the software you want.
Businesses that need a different browser or a desktop tool that isn’t in the Windows Store can turn to remote desktop apps; for example, Citrix Receiver is in the Store.
Windows 10 S devices aren’t just for schools; some devices are only sold to educational institutions. But Microsoft has just announced new Windows 10 S PCs aimed at business users, at similar prices.
