Windows 11 SE: Why it is more secure than Windows 10 S

Microsoft believes it has a solution to managing computers in education.

Image: Shutterstock/sirikorn thamniyom

Microsoft has been thinking about how to make PCs more suitable for education. They want to combine the flexibility and control of the PC ecosystem with what schools need. This is a complicated problem. Is it better to accept the Windows general-purpose computing model and move on to ChromeOS’s browser based world, where everything is easier to manage in the browser?

Windows RT was one way to limit what could be done, limiting it to a managed view on the Windows Store. This same approach is carried over to Windows 10 with S mode. It restricts access to Windows Store only. Microsoft is ending its Education and Business Store versions, which makes this model untenable. It also faced resistance from education departments, who are used to making their own licensing agreements for software and tools and prefer not to purchase from a vendor’s store.

A new Windows is available for education

Microsoft launches a new version of Windows that is education-focused. Windows 11 SELaunched with a simplified user interface The new low-cost version is now available. Surface Laptop SEThis version of Windows is tightly managed and only available to educators. It’s available only with Windows 11 SE hardware from Microsoft and hardware partners such as Lenovo. These products are only sold through education channels.

The SE does not stand for anything. It’s intended to be a brand identifier just like Home or Pro. However, the policies that it carries will make potential purchasers believe it to be a “Student Edition.” There are no restrictions on the sale of Windows 11 SE hardware, but it is branding that will let potential purchasers know this is not a Windows for home or work. This is for the classroom only..

SEE: Cyberattacks on schools could increase during ransomware open season (TechRepublic).

Run anything…

There are no restrictions on the types of applications that can be supported, unlike Windows 10 S. Windows 11 SE can run Win32 Zoom client on Windows 10 S. This is a change that brings the Windows education release into line with.
Microsoft’s new Windows Store policies

. All types of packaged software can be run, including Java apps. The FAQs on the platform even go so far as to mention that Zoom can be installed.

This is where the new flexibility comes into play, loosening restrictions on what code can be run. It will run on Windows 11 SE if it is supported by Windows 11. If it was granted permission, it would. The new lockdown level gives system managers much more control than they used. Windows 10 S had the ability to access the Windows Store and download Appx and MSIX packs, but Windows 11 SE can only use the browser and applications provided by Windows Intune for Education.

…that we say you can run

Approved apps are restricted to a curated listing in one of six categories: content filter, test-taking app, accessibility tools and classroom communications. Management and support, as well as browser, are all allowed. Windows 11 SE also includes Minecraft’s education edition and Office. Schools IT departments can collaborate with their sales channel to add new apps to the list. Microsoft will accept requests for educational software to be evaluated. Windows 11 Pro Education removes many of the restrictions of Windows 11 SE. If a school requires more than the curated list of apps, it will need to upgrade to Windows 11 Pro Education. It may be preferable for higher grades. Windows 11 SE is recommended to K-8.

SEE: Windows 11: Tips for installation, security, and more (free PDF). (TechRepublic)

This means that you won’t have access to the Windows Store or support for standalone installers. To get the full capabilities of a standard Windows installation, you will need to bring your Home or Pro licence and any media. There is no way to go back to Windows 11 SE after you have upgraded.

It makes sense to offer a carefully curated list supported applications. Schools will want to control devices and prevent the use of non-educational programs. Browsers are available to users who want to access software not installed by schools. They can take advantage of Edge, Firefox, or Chrome’s capabilities.

Management and curating

You can still access services such as YouTube and Spotify through your browser. Many popular services and apps offer browser-based options. This should allow users to experience a Chromebook-like experience. Microsoft may be doing this by using Office and curated apps to make Windows 11 SE devices Chromebook+ for schools that use traditional software in conjunction with newer web options. Microsoft describes it to be a cloud first operating system.

Microsoft must balance on a tightrope. While there is a demand for inexpensive devices in education, schools also need devices that can be controlled and managed. It’s clear that Windows 11 SE isn’t for home users. It’s basically useless without an Intune for Education Backend and other modern management tools such as Windows Autopilot.

Use Intune to Education

Microsoft’s Windows 11 SE strategy centers around this. Education: Intune. Teachers and school IT staff are able to configure and manage the devices. Unlike Microsoft 365 Intune, there is no subscription to the Education release. Instead, licenses are provided with Windows 11 SE. Azure Active Directory allows you to manage users and supports multi-factor authentication. Microsoft Accounts is an option, but it’s not recommended because it restricts your use to the built-in software.

Because schools are limited on budgets, it makes sense to use a per-device management approach. Instead of seperating hardware and management, all comes together with a $250 laptop. Schools can purchase hardware and be assured that the license is available for the management platform. They simply need to turn on the laptop, register it with their tenant and then provision users and software.

Finding the balance

Windows 11 SE offers a delicate balance between being open and protected. Microsoft wants to offer the best of both the open and closed worlds. It restricts the list of applications that can be installed, but allows both Win32 applications and UWP apps to work. The cloud-based web apps are clearly the main focus. They offer an alternative to Chromebooks and augment the web experience with a small number of Windows essential applications. It will be interesting for schools to respond to this approach. And whether Intune for Education gives them extra control beyond traditional Windows installation.

Also, please see