Windows Editions and Features

Windows 10 and Windows 11 are not a single product but a family of editions tailored to different market segments. Microsoft uses a common codebase (the OneCore unified core) for all editions, then enables or disables features based on the edition's product key. This approach reduces development and maintenance costs while allowing customers to pay for only the features they need.

The editions you need to know for the 220-1102 exam are: - Windows 10/11 Home: For home users. Lacks advanced security and management features. - Windows 10/11 Pro: For small businesses and power users. Adds BitLocker, Remote Desktop (host), Hyper-V, Group Policy management, and Windows Sandbox. - Windows 10/11 Pro Workstation: For high-performance workstations (e.g., with Intel Xeon or AMD Opteron processors). Adds ReFS (Resilient File System), persistent memory, and faster file sharing (SMB Direct). - Windows 10/11 Enterprise: For large organizations with volume licensing. Includes all Pro features plus AppLocker, DirectAccess, BranchCache, Windows To Go (Windows 10 only), and UE-V (User Experience Virtualization). - Windows 10/11 Education: Essentially Enterprise with academic licensing. Features are identical to Enterprise, but licensing restricts use to educational institutions. - Windows 10/11 Pro Education: A variant of Pro for academic users, with Cortana disabled by default. - Windows 10/11 Pro for Workstations: Special edition for high-end hardware with support for up to 4 CPUs and 6 TB RAM (vs. 2 CPUs and 2 TB in Pro).

When you install Windows, the setup media contains all edition files. The edition you get is determined by the product key entered during installation. If no key is entered, Windows installs in a trial mode (usually Pro) and later requires activation. The edition is stored in the registry at:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EditionID

This value is checked by the Windows licensing service (slui.exe) and by features that require a specific edition. For example, Hyper-V checks if the edition is Pro or higher before enabling the Hyper-V Platform feature.

Upgrading from one edition to another (e.g., Home to Pro) is possible via an Anytime Upgrade (Windows 10) or by entering a new product key in Settings > Update & Security > Activation (Windows 10/11). The upgrade process downloads a new license file and enables the additional features without reinstalling the OS. Downgrading is not supported; you must perform a clean installation.

#### BitLocker Drive Encryption - Available in: Pro, Pro Workstation, Enterprise, Education (not Home) - BitLocker encrypts the entire Windows volume using AES encryption (128-bit or 256-bit). It requires a Trusted Platform Module (TPM) version 1.2 or higher. Without a TPM, you can enable BitLocker via Group Policy but must use a USB startup key. - Exam trap: Candidates often think BitLocker is available in Home. It is not. Some may confuse BitLocker with Device Encryption, which is available on some Home devices with modern hardware (e.g., Surface tablets). Device Encryption is a lighter version that encrypts the OS drive automatically if the device supports InstantGo (Modern Standby).

#### Remote Desktop (RDP) – Host - Available in: Pro, Pro Workstation, Enterprise, Education (not Home) - Home edition can only connect to remote desktops (client), not host them. This is a common exam question: "Which edition allows you to remote into your PC from another device?" Answer: Pro or higher.

#### Hyper-V - Available in: Pro, Pro Workstation, Enterprise, Education (not Home) - Hyper-V is a Type 1 hypervisor that runs on top of Windows. It requires a 64-bit processor with SLAT (Second Level Address Translation) and at least 4 GB RAM. Home edition cannot install Hyper-V. - Exam trap: Some candidates think Hyper-V is available in Home because the feature list shows it. However, the option to add Hyper-V is grayed out in Home.

#### Windows Sandbox - Available in: Pro, Pro Workstation, Enterprise, Education (not Home) - A lightweight desktop environment to run untrusted applications in isolation. Uses hardware virtualization. Requires AMD or Intel virtualization extensions.

#### Group Policy Management - Available in: Pro, Pro Workstation, Enterprise, Education (not Home) - Home edition cannot edit local or domain Group Policy (gpedit.msc). This is a common exam distinction: "Which tool is missing in Home?" Answer: Local Group Policy Editor.

#### AppLocker - Available in: Enterprise, Education (not Home, Pro, or Pro Workstation) - AppLocker allows administrators to control which applications users can run based on publisher, path, or hash. It is more granular than Windows Defender Application Control (WDAC) which is available in all editions.

#### DirectAccess - Available in: Enterprise, Education (not Home, Pro, or Pro Workstation) - DirectAccess provides seamless, automatic remote access to corporate networks without a VPN. It requires Windows Server 2012 or later on the server side. DirectAccess is being replaced by Always On VPN in newer deployments.

#### BranchCache - Available in: Enterprise, Education (not Home, Pro, or Pro Workstation) - BranchCache optimizes WAN bandwidth by caching files and web content from branch office servers on local clients.

#### Windows To Go (Windows 10 only, removed in Windows 11) - Available in: Enterprise, Education (Windows 10) - Allows booting Windows from a USB drive. Requires a certified USB 3.0 drive of at least 32 GB. This feature was deprecated in Windows 10 version 2004 and is not present in Windows 11.

Understanding upgrade paths is crucial for the exam. You can upgrade from:

You cannot upgrade from Home directly to Enterprise; you must first go to Pro, then to Enterprise. Also, you cannot downgrade editions without a clean install.

For volume licensing, organizations purchase a single Enterprise license and then deploy it using volume activation (KMS or MAK). The client edition must be Enterprise (or Education) to accept volume licensing keys.

Windows 11 raised hardware requirements significantly compared to Windows 10:

These requirements apply to all editions. However, Windows 11 Home requires an internet connection and Microsoft account for initial setup (OOBE). Pro and Enterprise can use local accounts.

For the exam, commit the following to memory: - Home lacks: BitLocker, RDP host, Hyper-V, Windows Sandbox, Group Policy, AppLocker, DirectAccess, BranchCache, Windows To Go (Win10). - Pro adds: BitLocker, RDP host, Hyper-V, Windows Sandbox, Group Policy, Assigned Access (kiosk mode). - Pro Workstation adds: ReFS, persistent memory, SMB Direct, support for up to 4 CPUs and 6 TB RAM. - Enterprise adds: AppLocker, DirectAccess, BranchCache, Windows To Go (Win10), UE-V, MDOP (Microsoft Desktop Optimization Pack). - Education: Same as Enterprise but licensed for academic use.

While the edition feature sets are largely the same between Windows 10 and 11, Windows 11 removed Windows To Go and added stricter hardware requirements. Some features like Cortana are disabled by default in certain editions (e.g., Pro Education). The exam may ask about Windows 11-specific requirements, so remember that TPM 2.0 is mandatory for Windows 11, whereas Windows 10 only required TPM 1.2 (and only for BitLocker).

A global company with 10,000 employees needs to provide secure remote access to the corporate network without traditional VPN client complexity. They choose Windows 10/11 Enterprise to leverage DirectAccess (or Always On VPN in newer deployments). DirectAccess automatically establishes a bi-directional connection to the corporate network whenever the client has internet access. Configuration involves deploying Group Policy settings to enable DirectAccess, specifying the DirectAccess server (Windows Server with Remote Access role), and configuring network security settings. In production, DirectAccess requires careful planning for DNS, IPv6 (or IPv4 with NAT64/DNS64), and certificate infrastructure (IPsec with computer certificates). Misconfigurations often lead to connectivity issues: clients fail to connect if the DirectAccess server's certificate is invalid or if the client cannot resolve the DirectAccess server's hostname. Performance considerations include bandwidth usage for the encrypted tunnel and the overhead of the IPsec negotiation. The company must also ensure that all clients are running Enterprise edition, as DirectAccess is not available in Pro or Home.

A law firm with 50 employees must encrypt all laptops to comply with data protection regulations. They deploy Windows 10/11 Pro on all devices and enable BitLocker Drive Encryption. The IT administrator configures BitLocker via Group Policy to require TPM + PIN for pre-boot authentication. Each laptop's recovery key is backed up to Active Directory Domain Services (AD DS). In production, BitLocker is managed centrally, and the administrator monitors encryption status using the BitLocker Administration and Monitoring (MBAM) tool (part of MDOP). Common issues: TPM initialization failures, BitLocker recovery key backup failures, and performance degradation on older hard drives. The firm chose Pro over Enterprise because they don't need AppLocker or DirectAccess, and Pro is more cost-effective for their size.

A university computer lab has 200 desktops used by students. They need to prevent students from installing unauthorized software and restrict access to certain applications. They deploy Windows 10/11 Education edition, which is functionally identical to Enterprise but available at a reduced academic price. They use AppLocker to create rules that only allow applications from trusted publishers (e.g., Microsoft, Adobe) and block all executables from the Downloads folder. They also use Group Policy to enforce security settings and disable control panel access. In production, AppLocker rules are tested in audit mode before enforcement to avoid blocking legitimate applications. Common misconfigurations: overly restrictive rules that break system processes (e.g., svchost.exe) or failure to include necessary Windows components. The lab also uses Windows Sandbox (available in Education) to allow students to safely test software without affecting the host system.