Install Window 11 in S mode (or Windows 10)

NavyLCDR said:

Are you sure? I was never able to make that happen, even with 2 EFIs and even when installing from a completely stock ISO file onto a brand new blank VHDX. See here:

How does MS lock a computer to S Mode? - Windows 10 Help Forums

This thread started on Elevenforum but I want to start it here for the Windows 10 gurus not on Elevenforum. Install Window 11 in S mode (or Windows 10) | Windows 11 Forum Here is the status of the experiment so far. Starting with @cereberus finding that o

www.tenforums.com

Click to expand...

The way I did it was a bit different.

I created a W11 S mode iso.

I installed it in a Hyper-V VM - definitely Windows 11 Home S Mode

I then created some unallocated space on my second drive (gpt, nvme)

I then cloned the vhdx file to the unallocated space using Macrium Reflect.

I now booted pc to my original drive OS (selecting from bios) - Pro 11, and no S mode

I booted to drive 2 (selecting from bios) - Home 11 S Mode.

I repeated a couple of times to make sure.

I then added a boot entry of the Home S mode to my original drive EFI.

Now this is where it gets weird.

If I boot from the original drive EFI and select Window 11 Home from gui, it fires up as normal mode.

If I select the second drive efi from bios, it boots as S Mode.

So the difference must be something to do with the EFIs but no idea what!

So restoring an ESP from a normal mode backup results in booting in normal mode from that ESP? But any new ESPs created on that computer will be in S Mode?

Also, here is an interesting find:

I have not tried audit mode in Windows S Mode.

NavyLCDR said:

Ahh... Tenforums has the apparent answer, it is in UEFI firmware!

Windows S mode manufacturing environment

Windows 10 S WinPE, CI policy, OOBE, and DISM information.

learn.microsoft.com

Click to expand...

That says it is in two places

1. Windows 11 in S mode, enforced at boot.
2. EFI firmware policy, enforced during firmware load and OS boot.

Thinking about it, you do not have access to uefi in a vm (there is not even any menus in settings) but S mode still works.

However, I cheated by cloning S Windows to my pc with no S mode. So maybe it still thinks I am using a virtual machine when booting from efi on second drive?

In fact, once Hyper-V is enabled, even the host OS is running in a virtual machine.

Weird eh?

NavyLCDR said:

So restoring an ESP from a normal mode backup results in booting in normal mode from that ESP? But any new ESPs created on that computer will be in S Mode?

Also, here is an interesting find:

Windows S mode manufacturing mode

Enable and disable manufacturing mode in Windows 10 in S mode

learn.microsoft.com

I have not tried audit mode in Windows S Mode.

Click to expand...

Don't know but it is certainly more perplexing than I would have thought.

Is it possible to run audit mode from S mode?

I would have thought sysprep etc will get blocked. You certainly get blocked from cmd.

cereberus said:

Don't know but it is certainly more perplexing than I would have thought.

Is it possible to run audit mode from S mode?

I would have thought sysprep etc will get blocked. You certainly get blocked from cmd.

Click to expand...

I'll tell you in a couple minutes.

NavyLCDR said:

So restoring an ESP from a normal mode backup results in booting in normal mode from that ESP? But any new ESPs created on that computer will be in S Mode?

Also, here is an interesting find:

Windows S mode manufacturing mode

Enable and disable manufacturing mode in Windows 10 in S mode

learn.microsoft.com

I have not tried audit mode in Windows S Mode.

Click to expand...

Sorry read this again.

Once PC is is S mode, restoring ESP from a normal mode backup did not override the S mode.

All new ESPs are S mode as far as I can tell until you run the S Mode removal app.

I think once a computer is running Windows 11 Home S it is saved on Microsoft servers, do even if you initially install the standard version, it is automatically converted to S. You can either run it always in S mode or standard mode. You cannot combine both at the same hardware. So the solution is to run standard mode and use Parental Control to restrict access to the children accounts. Why not go that route? A restricted account, let alone a child account, cannot install any software without requesting Administrator access. So there is no fear to get any malware.

spapakons said:

I think once a computer is running Windows 11 Home S it is saved on Microsoft servers

Click to expand...

That was already disproven in the experiments.

Windows S Mode cannot be installed on legacy BIOS machines. When I did a clean install from the ISO file modified for S Mode in a generation 1 VM (legacy BIOS), I got normal mode Windows 10. When I used the same ISO file modified for S Mode on a gen 2 VM, I got S mode.

So, I was able to get a computer to boot 1 VHDX in S Mode, and boot a second VHDX in normal mode. I did a clean install of Windows 10 S Mode to a VHDX file in a gen 2 VM. It booted in S Mode. I then recycled the VHDX file that had Windows 10 Home installed in legacy BIOS mode and converted it to boot in UEFI mode by adding a FAT32 EFI partition to it. It booted in UEFI mode with normal Windows 10. Then I rebooted the VHDX with Windows 10 S Mode, and it booted in S Mode. Now to set up dual booting and see what happens .

And setting up dual booting worked! The computer boots from the same EFI on the same VHDX every time. It will boot into normal Windows 10 Home on one VHDX drive, and into Windows 10 S Mode on the other VHDX drive, but again it is from the same EFI partition with a dual boot menu. Hmmm.... I wonder what will happen if I upgrade these to Windows 11? I have to do college homework now, so will have to try it later.

NavyLCDR said:

So, I was able to get a computer to boot 1 VHDX in S Mode, and boot a second VHDX in normal mode. I did a clean install of Windows 10 S Mode to a VHDX file in a gen 2 VM. It booted in S Mode. I then recycled the VHDX file that had Windows 10 Home installed in legacy BIOS mode and converted it to boot in UEFI mode by adding a FAT32 EFI partition to it. It booted in UEFI mode with normal Windows 10. Then I rebooted the VHDX with Windows 10 S Mode, and it booted in S Mode. Now to set up dual booting and see what happens .

Click to expand...

I tried all this - the moment you dual boot it all goes down the pan.

First - EFI on drive 1 contain bcd for normal Windows Pro - add bcd entry for Windows Home S mode on drive 2 to get dual boot graphics screen
Select S mode entry on graphics screen and it boots in to Windows Home in normal mode!

Second - EFI on drive 2 contains bcd for S Mode Windows. You cannot change this bcd.
Select this efi from bios - boots into Windows Home in S mode!

So depending on which is controlling EFI, the Home S version boots into S mode or normal mode.

Go figure!

OK...One more find. I did all of the above with Secure Boot and TPM boot disabled. However, once I turned on Secure Boot and TPM on the VM, the Windows 10 Home normal mode switched to S Mode! If I turn Secure Boot off, it goes back to dual booting Windows 10 Home normal and S mode. Secure Boot is the key!

Secure boot on: Both Windows 10 Home boots into S Mode.
Secure boot off: One Windows 10 Home boots into normal mode, and the other boots into S Mode.

I knew that I would crack it! Damn you MS!

(TPM on or off makes no difference, it is the Secure Boot setting).

NavyLCDR said:

And setting up dual booting worked! The computer boots from the same EFI on the same VHDX every time. It will boot into normal Windows 10 Home on one VHDX drive, and into Windows 10 S Mode on the other VHDX drive, but again it is from the same EFI partition with a dual boot menu. Hmmm.... I wonder what will happen if I upgrade these to Windows 11? I have to do college homework now, so will have to try it later.


View attachment 52121View attachment 52122View attachment 52123

Click to expand...

Well done, but I am not sure you will get same behaviour dual booting on Host PC as I think the UEFI setting overrides things (but not consistently)

Hyper-V does not have a UEFI as such - it is sort of emulated via gen 2 setup.

I think Hyper-V just looks at the Windows setting and just uses that.

NavyLCDR said:

OK...One more find. I did all of the above with Secure Boot and TPM boot disabled. However, once I turned on Secure Boot and TPM on the VM, the Windows 10 Home normal mode switched to S Mode! If I turn Secure Boot off, it goes back to dual booting Windows 10 Home normal and S mode. Secure Boot is the key!

Secure boot on: Both Windows 10 Home boots into S Mode.
Secure boot off: One Windows 10 Home boots into normal mode, and the other boots into S Mode.

I knew that I would crack it! Damn you MS!

(TPM on or off makes no difference, it is the Secure Boot setting).

Click to expand...

Ok - that could be the way. Now will it work on host rather than in VM?

I will test later.

No surprise, It says so on the link I posted here:

Hi folks

Try this (method relies on deleting all the entries in the internal hardware efi file(s) on the relevant PC's firmware and then re-creating efi partition and bootloader).

1) boot stand alone linux live system.
efibootmgr or efibootmgr -v to list entries
efibootmgr -b XXXX -B to delete.

(Or in Windows itself if you can boot into command line via UEFI mode).

bcdedit /enum firmware to list entries#
bcdedit /delete {GUID} to delete an entry by its "identifier".

2) Recreate the EFI partition

3) then re-install the bootloader (bcdboot.exe) -- use standard one from a windows iso -- uupdump has probably your relevant release if you haven't got an install iso.

Cheers
jimbo

Try this

Click to expand...

Why ?

Why go all this trouble to dual boot with S mode? Just create a limited child account and control it with Parental Control. It is easier to configure than you think.

I installed SE on a External 250 GB SSD drive using WinToUSB Pro.
1st I installed the Win11 Pro version then followed the steps below..
Plug-it-in (w/ USB) when I want to test (play) w/ it, restart PC & boot to other OSs on rig when done testing SE.

Here is the steps I used
"For creating WIM-based images, install the Pro edition (at the very least; Enterprise is also acceptable), reboot into audit mode and invoke the following command, which installs the generic product key for CloudEditionEdition (aka Win11 SE):"