The sleek new Surface Laptop comes with it, and so do US$300 two-in-one tablet PCs for education. But exactly what is Windows 10 S, and how is it different from other versions of Windows 10?
The “S” in Windows 10 S doesn’t stand for anything, although Microsoft throws around words such as safe, secure, streamlined, superior performance, simple and student to explain it - standardised and super locked down might be closer to the mark.
This is a full version of Windows with some limitations, one that’s designed to start up quickly, have long battery life, and keep working properly month after month after month, without resets or support calls.
“Windows 10 S was inspired by teachers,” Mohammed Samji from the Windows engineering team told Computerworld. “It’s about making sure the operating system is safe and secure, but most importantly whether it’s for school or for consumer or enterprise, when you have a device, you want it to work great the day you open it, and the next day and a thousand days later.”
The education market is the first focus for the Windows 10 S push. To some extent, “Windows 10 in S mode,” as Microsoft frequently refers to it to emphasise that this is the full version of Windows underneath, is a reaction to the danger posed by competition from Chromebooks.
A key point is that devices you’re relying on in a classroom need a battery that lasts all day, because they have to work in the last lesson of the day as well as the first.
Another is that schools are usually short on IT resources, so they’re looking for simpler management options that rely on the cloud.
But education is only the first market for Windows 10 S, and Microsoft wants home users and even enterprises to see its advantages as well.
And simpler management does appeal to a lot of enterprises; last year 83 per cent of the businesses in a CCS Insight enterprise survey said they planned to “converge their PC management and Enterprise Mobility management strategy and teams” and use Mobile Device Management (MDM) to manage PCs as well as phones.
“The entire industry is pushing toward modern management,” Samji said. “Education is a great candidate for that, but it’s very common for enterprises to be asking for the exact same solution.
"With this current version of Windows 10 S our focus is on education, but a lot of the requirements are exactly the same.”
A pristine PC
The point of all the locking down that Windows 10 S does is to keep Windows feeling shiny and new, or pristine, as Microsoft puts it; “We want to make sure that users have a pristine experience with Windows 10 S,” said Samji.
It strives for that pristine state in several ways.
First, Windows 10 S starts with all the features in Windows 10 Pro (there’s even a Windows Insider option), which means it includes new security protections such as code integrity checks.
More significantly, this is a Windows that restricts which applications you can run (they have to come from the Windows Store) and that explicitly removes key enterprise management technologies.
Windows 10 S can’t join a domain or use Active Directory; instead, it connects to Azure Active Directory, which means there are no log-on scripts or startup applications to slow down start time.
That removes Group Policy, a feature that gives IT admins control but also slows systems down and makes Windows fragile. And the registry keys that implement it let power users tweak their setup, which isn’t conducive to pristine devices.
Instead of Group Policy, it’s managed the way smartphones and tablets are, using MDM tools and cloud identities.
To appeal to the schools it hopes will be the first big customers for Windows 10 S, Microsoft has a version of its Intune cloud management service especially for the education market, and it offers tools to set up accounts and language and Wi-Fi settings and to install apps – either online or via a USB stick that teachers or admins plug into Windows 10 S devices.
The registry is still there, but Windows 10 S doesn't have the Registry Editor that applications can use to change system behaviour. That also means users can’t tweak things in lamentable ways, and registry “cleaner” utilities likely to cause problems are blocked.
With normal desktop software, any application can add and change registry keys and file associations. Because Windows 10 S only runs software from the Windows Store, all the apps use a virtualised registry, so one app can’t affect the settings another app uses.
Windows Store restrictions
Windows Store apps can be uninstalled cleanly, so you can try out apps without worrying that they’ll add unwanted services and applications that can reduce performance and battery life — another thing that makes Windows 10 S less fragile than Windows 10.
Not everyone will realise it’s software they’ve installed that slows Windows down, and even if they do it can be tricky to remove cleanly.
The restriction to Windows Store apps also limits the apps that OEMs can preinstall on devices; they can’t add a different antivirus client from the built-in Windows Defender or add utilities that intercept website certificates and allow them to inject advertising.
Limiting Windows 10 S to the Store may not be as much of a limitation as you might think. For example, if you want to use the scanning feature in your multifunction printer (something you can’t do with just the device drivers delivered through Windows Update), most hardware vendors have Store apps for their recent devices with these kinds of features.
There’s no command line in Windows 10 S – neither the Microsoft-DOS-style command console nor PowerShell – and no scripts that could introduce malware or change settings to degrade performance and battery life. That means you can’t sideload your own apps, even if you have the code. And you can’t add a command-line tool.
