Windows 10 S is the new edition of the client OS that is restricted to run only applications from the Windows Store. The advantage is that it is more stable and secure than an OS where the user can install software from anywhere. Microsoft has positioned the OS for the education market. But perhaps it has possibilities for the enterprise too.
Windows 10 S was released in May 2017. It is only available as an OEM installation, for example in this Microsoft Surface Laptop.
Vendors with Windows 10 S laptops currently include Dell, HP and others. Prices are in a similar range to other laptops and notebooks.
The marketing from Microsoft is aimed at the education market, but what interests me is the scope for using Windows 10 S in the enterprise. Mobility is costly, and this OS might bring the cost down.
The main problem for enterprise mobility is making it secure. One approach to this is the managed laptop:
- a custom Windows 10 Enterprise image
- joined to the domain
- authenticated by a certificate
- no admin rights for the user, OR admin rights with more active detection and blocking
- SSL VPN client
- web proxy client.
This has more complexity and higher support costs than a standard desktop. An alternative approach is to do away with the idea of validating the device at all, and provide access to enterprise data and applications only through a virtual desktop. In this case mobility is provided by any device running the remote access software: like Citrix Receiver or the VMware Horizon client. It can be a Mac, a Chromebook or a mobile thin client. The problem here is that, if you want to work offline, you need to store data and you need local applications. If you do that, you again need a managed device, and you add further costs.
Windows 10 S may provide a new option. Use a regular desktop in the office, and a Windows 10 S laptop for mobility. As the Windows 10 S laptop cannot run applications except from the Windows Store, the level of protection and additional support required is much lower. You can still run Office applications like Outlook. You can still edit a PowerPoint presentation or work on an Excel spreadsheet offline. But the scope for malware is much reduced. If you need to use an enterprise application like SAP when working from home, say, then you can use remote access to connect to a virtual desktop or a published application. But in this case the virtual desktop needs to be provided only to the mobile users and not to all users.
Windows 10 S supports these enterprise features:
- Trusted Platform Module (depending on the OEM hardware)
- Certificate Store for enterprise certificates
- BitLocker disk encryption
- Azure domain join and Windows Hello authentication
- mobile device management with Intune, AirWatch or similar
- desktop applications from Microsoft, Adobe, etc. as long as they are available from the Windows Store.
The typical company laptop is an expensive compromise. It needs to be powerful enough to run enterprise applications, light enough to carry around easily, secure enough to hold enterprise data, flexible enough to allow the user to work offline. I think on balance I would prefer to use a regular desktop in the office, and a Windows 10 S laptop for mobility.