Windows 11 S Mode: What It Blocks and How to Switch Out

A client buys a batch of budget laptops, the tech opens the first one, and the RMM agent refuses to install. The Store page that explains why reads like a feature, not a lock. Windows 11 S mode is a Store-only configuration that ships on cheaper hardware, and leaving it is free, quick and permanent.

What S Mode Is

Microsoft's own definition is short: Windows 11 in S mode is "a version of Windows 11 that's streamlined for security and performance." The streamlining is one rule. Only apps from the Microsoft Store can be installed, and Microsoft Edge stays the default browser with Bing as its search engine.

S mode isn't a separate edition you buy. It's a configuration switched on at the factory, which is why you meet it on retail laptops and not on an image you built. Under the hood it runs a built-in application control policy, the same family of controls that App Control for Business exposes to admins, except here the allowlist is "whatever the Store signed" and you can't edit it.

That puts S mode in the same family as Smart App Control, with a different enforcement line. Smart App Control judges each app by signature and reputation. S mode judges by where it came from.

What S Mode Blocks, and What Still Works

The block list is shorter than the Store page suggests, and the gaps decide what to do with a device.

Microsoft's FAQ states the browser rule directly: you can't set Chrome or Firefox as the default in S mode. Anything that arrives as a downloaded .exe or .msi is the practical casualty: remote monitoring agents, VPN clients, line-of-business installers and the command-line tools technicians reach for. An S mode device can't be onboarded the way the rest of the fleet is.

The point of S mode is that nothing outside the Store runs, so the device is hard to infect with the usual downloaded malware. For a laptop that only ever needs Office and a browser, that protection does its job. For a managed device it's the thing that stops management.

Which Editions Ship in S Mode

On Windows 11, S mode exists in one edition. Microsoft's FAQ: "Windows 11 in S mode is only available in the Windows 11 Home edition." There's no Windows 11 Pro in S mode, no Enterprise in S mode, no Education in S mode.

Windows 10 was broader. Home, Pro, Enterprise and Education could all ship in S mode, and that difference still shows up when older devices are upgraded.

Windows 10 support ended on October 14, 2025, so any Windows 10 Pro in S mode device still in service needs the switch before it needs anything else.

Why do OEMs ship it? Microsoft positions S mode as the safe default for entry-level hardware, and manufacturers put it on the laptops that compete on price. The buyer gets a machine that resists drive-by installs. The IT team inheriting it gets a one-time decision.

The Switch Is One-Way

Every Microsoft page on the subject repeats the same sentence, so here it is once: "Switching out of S mode is one-way. If you switch out of S mode, you'll need to keep using the standard version of Windows 11."

There's no toggle to turn it back on. The only way back is a factory reset from the manufacturer's recovery image, and Microsoft's deployment guidance adds a catch: a device switched out through the Store "will remain out of S mode even after the device is reset" when you use the built-in reset. Treat the switch as a change to the device, not a setting.

That's why the decision belongs in onboarding, not in a ticket at 4:50pm. Decide once per device model and apply it the same way across the fleet.

How to Switch Out on One PC

The consumer route takes about a minute and doesn't need a product key or a payment. Microsoft's support page: "There's no charge to switch out of S mode."

1. Open Settings, then System, then Activation.
2. Under "Switch to Windows 11 Home", select "Go to the Store". Don't select the upgrade-to-Pro option on the same page; that one costs money and is a different change.
3. On the Store page titled "Switch out of S mode", select "Get".
4. Wait for the confirmation. From then on, apps from outside the Store will install.

Two things go wrong often enough to plan for. The Store page needs a working Store and an internet connection, and on a new device the Store sometimes fails with "try again, something went wrong." A Microsoft moderator's answer from February 2026 gives the fix: reset the Store app from Settings, Apps, Installed apps, Microsoft Store, Advanced options, Reset, then try again. The second is a device with no Microsoft account signed in; the Store page is the only switch there is, so signing in with any Microsoft account, even a throwaway for setup, is the path.

Skip the registry edits and "S mode remover" tools that forum threads pass around. The official alternative is a clean install from non-S media, which is also one-way and takes longer.

How to Switch a Fleet Out, or Keep It In

For enrolled devices, Intune handles both directions through one profile. Microsoft's Intune documentation, updated June 2026, lists the setting under Devices, Configuration, Create, Templates, "Edition upgrade and mode switch". The "Switch out of S mode" setting has three options:

• No configuration: Intune leaves the device alone, and the user can switch it themselves.
• Keep in S mode: prevents users from switching the device out.
• Switch: switches the device out of S mode the next time it checks in.

The policy applies on check-in, no reboot, no product key. The same page is blunt about reversal: "Switching out of S mode is one way." Removing the profile later doesn't put the device back.

Underneath Intune sits the WindowsLicensing configuration service provider, which any MDM can call. Three nodes do the work, per Microsoft Learn (March 2025): SwitchFromSMode switches the device out, SwitchingPolicy set to 1 blocks the user from switching while still letting the admin do it, and Status reports the result, where 0 is switched, 1 is in progress, 3 is already out and 4 is failed.

Autopilot fits the same model. Microsoft's deployment guidance describes three options for devices that arrive in S mode: keep them in S mode, switch them out during the first-run experience with Autopilot, or switch later through MDM.

One practical consequence: you can't script an inventory of S mode devices from the devices themselves, because the scripting tools aren't allowed to run there. Read the Status node or the edition field in your MDM instead. Once a device is out, the usual tooling applies; OpenFrame, for example, can run a script across a client's devices and collect each one's output, so confirming the edition on every laptop is one job rather than fourteen.

If Intune isn't in the picture and the devices are few, the Store route on each machine during onboarding beats anything clever. Pair it with the debloat pass you're already doing on retail laptops.

Keep It or Leave It

Walk each device model through three gates.

Does anything on the required app list arrive as a download rather than from the Store? That includes your RMM agent, your EDR agent, the VPN client and any line-of-business installer. One yes means the device leaves S mode, because nothing else in the plan works until it does.

Does the user need a browser other than Edge as their default, or a search engine other than Bing? Policy and preference both count. A yes is another exit.

Will the device be managed at all? An unmanaged laptop for a single purpose, where Store apps cover the work and nobody needs admin tools, is the case S mode was built for. A school loaner, a kiosk-style front desk PC or a family machine can stay in S mode and be better for it.

For an MSP the answer is nearly always the first gate. Managed devices run agents, agents aren't Store apps, so the switch happens during onboarding and the device joins the fleet like any other. What you give up is the Store-only guarantee. Replace it with the controls you'd apply anyway: standard user accounts, Intune or your RMM for app deployment, and an allowlist policy if the client's risk warrants one.

Two forum threads on the consumer side show how the question usually arrives. In this r/Windows11 thread the poster likes the idea of the extra security but can't install what they need, and worries about never being able to go back:

The replies split the way the decision does: switch if you need software outside the Store, keep it if the Store covers you. One admin adds that S mode tends to ship on low-end hardware, and that "Choose where to get apps" in Settings gives similar control on a normal install.

An earlier thread asks the other common question, whether leaving S mode changes the interface:

It doesn't. The desktop, Start menu and settings stay the same. The only change is which apps will install.

For a walkthrough of the switch on a real machine, Ask Leo covers what S mode is and how to leave it:

The Short Version

S mode is Windows 11 Home with a Store-only lock, shipped on budget hardware. It blocks downloaded installers and non-Edge default browsers, which means it blocks the agents a managed fleet depends on. Leaving is free through Settings, Activation and the Store, or through an Intune edition upgrade and mode switch profile, and it can't be undone. Decide per device model during onboarding, and if the device will be managed, switch it out before you try to install anything.

If the device also came with the usual retail extras, start with the debloat guide. If you're replacing the Store-only guarantee with a proper allowlist, App Control for Business is the next read. And if the Store route fails and the machine has to start over, the factory reset guide covers both ways in.

FAQ

Is switching out of S mode free?

Yes. Microsoft's support page says there's no charge to switch out of S mode. The switch happens through the Microsoft Store and doesn't need a product key. Don't confuse it with the "Upgrade your edition of Windows" option on the same Activation page, which moves Home to Pro and is a paid change.

Can I turn S mode back on after switching out?

No. Microsoft describes the switch as one-way, and there's no setting to re-enable it. The only ways back are a factory recovery from the manufacturer's image or a clean install of an S mode build, and Microsoft's deployment guidance notes that a device switched out through the Store stays out even after the built-in reset.

Does Windows 11 Pro come in S mode?

No. On Windows 11, S mode is only available on the Home edition. Windows 10 offered S mode on Home, Pro, Enterprise and Education, and Windows 10 Pro, Enterprise or Education devices in S mode have to switch out before they can upgrade to Windows 11.

Can I install Chrome in Windows 11 S mode?

Not as a downloaded installer, and even a Store-listed browser can't be set as the default. In S mode, Edge is always the default browser and Bing is the default search engine. If Chrome or Firefox as the default is a requirement, the device needs to switch out of S mode.