Windows S mode represents a fundamentally different approach to using Windows, one that favors structure over unmanaged flexibility. It changes how users interact with the system and apps on Windows devices by limiting them to the Microsoft Store and tightly managed configurations.
Windows in S mode provides a strict environment compared to the standard Windows setup. This approach makes more sense in scenarios where consistent security is a priority, such as in schools and frontline operations.
Let’s learn what S mode in Windows actually is, how it works, how to enable it, and whether it is the right choice to make.
What is S mode on Windows?
Windows S mode is a locked-down configuration mode to improve the system’s security, performance, and battery life while still providing the familiar Windows experience. It is designed for a restricted Windows configuration that exclusively supports Microsoft Store apps. So by default, Microsoft Edge will be the supported browser, whereas the default search engine will be Bing; you may also allow other browsers available in the Microsoft Store.
S mode can be applied only to the supported Windows editions, which are:
- Windows 10: Home, Pro, Enterprise, and Education
- Windows 11: Home
One important distinction is that S mode is not a separate version of Windows. It’s a configuration state with the same underlying OS, but with a set of enforced restrictions on what can run and how. This matters because switching out of S mode is a one-way action. Once disabled, S mode cannot be re-enabled on the same device through standard means.
S mode minimizes the attack surface, prevents unauthorized installations, and ensures consistent device behavior. These characteristics make S mode a preferred choice in environments where security, performance consistency, and simplified management are more important than full system flexibility.
How to enable S mode in Windows
Enabling Windows S mode isn’t as simple as switching a setting on a device. It is a feature that cannot be turned on directly on the device, which is already in use. There are only a few ways in which S mode can be enabled.
Here are the realistic ways to turn on S mode on Windows devices:
Method 1: Fresh installation of Windows edition with S mode
Installing a fresh Windows edition is the only official way to enable S mode in Windows, as there’s no built-in way to enable it.
Here’s how to do it:
- Step 1: Go to microsoft.com and download the Windows 10 or Windows 11 ISO.
- Step 2: Use the Media Creation Tool to create a bootable USB drive.
- Step 3: Boot your device from the USB drive and launch the Windows setup.
- Step 4: When prompted to select an edition, choose Windows 10 Home in S mode or Windows 11 Home in S mode (availability depends on the ISO version).
Complete the installation and sign in with a Microsoft account; it is a requirement for S mode to function correctly.
Note: This process wipes the existing OS. Back up all data before proceeding. Also note that once S mode is disabled post-installation, it cannot be re-enabled without repeating this same process.
Method 2: Activation of S mode via Windows settings on OEM devices
Some OEM Windows devices allow you to turn on S mode manually using the following steps:
- Step 1: Open Settings > Update & Security (Windows 10) or System (Windows 11).
- Step 2: Select Activation.
- Step 3: Switch to Windows 10/11 S mode, if available.
- Step 4: Follow the instructions provided on your screen.
Note: Some Windows OEM devices come with S mode enabled straight out of the box. The devices are pre-configured in S mode by the manufacturer before they reach the end user. Here, there’s no need for manual intervention to enable the S mode.
You need to simply check if S mode is active on your Windows device. Follow the steps given below:
- Step 1: Go to Settings > System > About.
- Step 2: Under Windows specifications, check the Edition field.
- Step 3: If it reads Windows 10 Home in S mode or Windows 11 Home in S mode, then S mode is active.
For organizations procuring devices at scale, OEM pre-configured devices are the most practical way to enable S mode without manual setup on each machine.
Method 3: Registry modifications
It is an unofficial method and not supported by Microsoft. It may not fully replicate the behavior of a native S mode installation, and results may vary depending on the Windows build. An incorrect change can cause system instability or boot failures. Create a full registry backup before proceeding.
- Step 1: Press Win + R, type regedit, and hit Enter to open the Registry Editor.
- Step 2: Navigate to: HKEY_LOCAL_MACHINESYSTEMControlSet001ControlCIPolicy
- Step 3: Locate the SkuPolicyRequired entry and set its value to 1.
- Step 4: Close the Registry Editor and restart the device.
This method is worth knowing, but it’s not recommended for production environments or managed device fleets. For any serious deployment, Method 1 or 2 is a more appropriate approach.
Why use S mode?
S mode is purpose-built for environments where security, consistency, and low maintenance overhead matter more than user flexibility. Here’s where it makes practical sense:
1. Security by restriction
Since only Microsoft Store apps can be installed, the online attack surface is significantly reduced. There’s no risk of users downloading unvetted executables or inadvertently installing malware through third-party sources. This provides baseline management for shared devices or endpoints with minimal IT oversight.
2. Predictable hardware performance
S mode limits what apps can run on a device, which directly translates to better performance on budget hardware. With fewer background processes, no resource-heavy third-party apps are required. Devices stay responsive, which is a practical advantage for organizations deploying low-cost endpoints at scale.
3. Reduced management overhead
Devices in S mode behave consistently. There’s less variation in what’s installed, fewer support tickets around unauthorized software, and a more uniform device state across the fleet. For IT teams managing large numbers of endpoints, such consistency increases the success of operations.
4. Extended battery life
Fewer processes running means lower CPU utilization, which contributes to longer battery life. This is an advantage for field workers or students who spend extended time away from a power source.
S mode works well when the use case is defined and narrow, such as kiosk terminals, student devices, frontline worker machines, or any endpoint where the required apps are available through the Microsoft Store.
Best practices for using S mode in Windows
If you’ve decided S mode is the right fit for your environment, how you configure and manage it matters. Here are some key practices to follow:
1. Verify app availability before deployment
Before rolling out S mode devices, confirm that every app required is available in the Microsoft Store. If the critical apps you need are not available in the Microsoft Store, you must decide whether to permanently switch out of S mode because you can’t turn it back on.
2. Pair S mode with an MDM solution
S mode handles app restriction, but it doesn’t replace a strong device management layer, which is a must for a larger device fleet. Pairing S mode devices with an MDM solution such as Microsoft Intune or Scalefusion gives you visibility into all endpoints, the ability to enforce custom policies, and remote management capabilities on top of the baseline restrictions that S mode provides.
3. Use Microsoft accounts consistently
S mode requires a Microsoft account for setup, and functions best within the Microsoft ecosystem. Standardize Microsoft accounts across your deployment to avoid sign-in inconsistencies. This ensures seamless access to OneDrive, Microsoft 365, and other integrated services.
4. Keep Windows Update enabled
S mode doesn’t exempt devices from needing patches. Keep Windows Update and Windows Defender active to ensure devices are updated regularly. Regular updates help maintain security, improve system stability, and protect against emerging threats.
Challenges of Windows devices in S mode
S mode has its cons that cause inconvenience for IT teams, enterprises, and users.
1. No Win32 apps outside Store
S mode only allows apps available on the Microsoft Store, which restricts users from installing other native apps and software such as Chrome, Adobe, and VLC. This creates a disruption for users who rely on these native apps and don’t need to learn other apps.
On the other hand, most enterprises use legacy internal tools, industry-specific apps, and even some common apps that are now inaccessible. The only way around this is to permanently disable S mode, which is an irreversible decision.
2. Browser lock-in
Only the Microsoft Edge browser is allowed, limiting users from accessing other traditional browsers such as Chrome, Firefox, and Opera. This forces users to shift from their preferred browser to another one. Various organizations rely on Chrome-based internal tools and browser extensions, and such restrictions cause operational inconvenience.
3. Limited enterprise flexibility
S mode works on a fixed set of rules that can’t be adjusted at the device level. There’s no way to grant exceptions for specific users, allow a single trusted app outside the Store, or adapt restrictions to different roles within the same fleet.
Every device operates under the same constraints, regardless of what the use case actually demands. For IT teams managing diverse endpoint profiles, such rigidity creates a management gap that S mode itself has no answer for.
Taken together, these constraints make S mode a challenge for most enterprise environments unless the use case is tightly scoped and the required tool set lives entirely within the Microsoft ecosystem.
Move beyond S mode limitations with Scalefusion
Enabling S mode is a powerful first step in securing your hardware, but maintaining that security across a growing fleet of devices requires more than just initial setup. S Mode is a “one-way street,” and while users can switch out of it in a few steps, relying on manual management can lead to security gaps and inconsistent configurations.
This is where Scalefusion MDM becomes an essential partner for IT teams using Windows devices in S mode. With Scalefusion UEM, you can:
- Enforce S mode policies: Remotely disable the “Switch out of S Mode” option to ensure devices stay locked down and secure.
- Automated app deployment: Silently push approved Microsoft Store apps to your entire inventory without user intervention.
- App management (Win32 exceptions): Since standard S mode blocks all non-Store apps, apply S mode supplemental policies to allow specific, trusted Win32 (desktop) apps to run. However, these apps have to be digitally signed and authorized by the organization.
- Zero-touch enrollment: Use Windows Autopilot integration to automatically boot your devices into a managed S Mode environment and ship them directly to users.
- Kiosk lockdown: Further restrict S Mode devices to a single-app or multi-app kiosk mode for frontline or educational use.
By moving beyond manual configuration and adopting Scalefusion, you gain the visibility and command needed to manage Windows S Mode at scale. This ensures your Windows endpoints remain fast, secure, and compliant.
S mode is a commitment, not just a configuration
Windows S mode, whether Windows 10 or Windows 11 S mode, is built for specific environments, and it delivers on that promise when deployed with intent. But unlike most configuration changes, switching out of S mode is permanent. There’s no rollback, no trial and error, and no partial implementation. Once the decision is made, it defines how that device operates for its entire lifecycle.
That means you need to do these checks before deploying Windows S mode: auditing app requirements, validating that the use case genuinely fits within S mode’s constraints, and ensuring the right management layer is in place from day one.
S mode Windows environments without proper management are fragile in practice. Users can exit S mode, policies drift, and visibility disappears. Scalefusion ensures that the commitment you make at deployment holds. Keep your entire device fleet in the state you intended with persistent policy enforcement, centralized app management, and visibility across every managed endpoint through a single pane of glass.
To Know More, Contact Our Experts and Book a Demo.
Deploy S mode in Windows with confidence. Manage it with Scalefusion.
FAQs
1. How to enable S mode on an existing Windows device?
You cannot enable S mode on an existing Windows device through standard settings. The only official way to get S mode is through a fresh installation of a compatible Windows edition or by purchasing an OEM device that ships with S mode pre-enabled.
2. How to switch out of S mode?
To get out of S mode, go to Settings > Update & Security > Activation (Windows 10) or Settings > System > Activation (Windows 11). Under the Switch to Windows Home or Switch to Windows 11 Pro section, click Go to the Store. Select the Get button on the Switch out of S mode or a similar page that appears in the Microsoft Store.
3. How to check if your Windows device supports S mode?
Go to Settings > System > About and check the Edition field under Windows specifications. If it reads Windows 10 Home/Pro/Education/Enterprise or Windows 11 Home, the device is potentially eligible for S mode via a fresh installation. Windows 11 in S mode is not available on its Pro, Enterprise, and Education editions.
4. When should I use Windows S mode?
S mode is best suited for smaller, well-defined use cases such as student devices, frontline worker terminals, shared kiosks, or any endpoint where the required apps are available through the Microsoft Store, and flexibility is not a priority. If your environment relies on Win32 apps or non-Edge browsers, S mode may not be helpful.
5. How to check if you have Windows S mode enabled?
Go to Settings > System > About. Under Windows specifications, check the Edition field. If it reads Windows 10 Home/Pro/Education/Enterprise in S mode or Windows 11 Home in S mode, then S mode is currently active on your device.
