Enable S Mode in Windows 10 ISO Image

As you may already know, Microsoft has cancelled Windows 10 S as a separate edition. Instead, there will be 'S mode', which can be enabled for any edition.  Let's see how to modify your Windows 10 ISO image with Windows 10 Version 1803 or later.

As you may already know, Microsoft has cancelled Windows 10 S as a separate edition. Instead, there will be 'S mode', which can be enabled for any edition. When in S mode, Windows 10 will be restricted to running apps downloaded from the Store only.

Microsoft considers Windows 10 in S Mode suitable for "the majority of customers".

Windows 10 in S Mode is Microsoft's response to Google's Chromebooks. It has a number of restrictions which can make devices with the OS running in this mode less attractive for potential buyers. For example, Windows 10 in S Mode will only run apps from the Windows Store. Microsoft says this change allows it to greatly improve and enhance the security of the OS. Win32 apps converted using Project Centennial (Desktop app converter tool) may run on Windows 10 S though. But it is not possible to download, install or run programs from outside of the Windows Store. The Hyper-V feature is not available in S Mode too.

The next instructions assume that you already have the appropriate ISO image (Windows 10 version 1803 and above).

To enable S Mode in Windows 10 ISO Image, do the following.

1. Download the Windows ADK from this website and install it.
2. Double-click on the ISO file to mount it in File Explorer.
3. Create an answer file (unattend.xml) by using information from a Windows image (.wim) file and a catalog (.clg) file. This should be done with Windows System Image Manager from ADK.
4. Add the amd64_Microsoft_Windows_CodeIntegrity component to Pass 2 offline Servicing.
5. Set amd64_Microsoft_Windows_CodeIntegrity\SkuPolicyRequired to 1. The offline servicing pass in your unattend.xml file should look like this:

       
   <settings pass="offlineServicing">
   <component name="Microsoft-Windows-CodeIntegrity" 
   processorArchitecture="amd64" 
   publicKeyToken="31bf3856ad364e35" 
   language="neutral" 
   versionScope="nonSxS" 
   xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" 
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
   <SkuPolicyRequired>1</SkuPolicyRequired>
   </component>
   </settings>
       
   

6. Save the answer file in the Windows\Panther folder of your mounted image as unattend.xml.
7. Use DISM to apply the unattend file and enable S Mode:

   dism /image:C:\mount\windows /apply-unattend:C:\mount\windows\windows\panther\unattend.xml
   

Note: Only Pass 2 - offline Servicing is processed when an unattend file is applied with DISM.

S mode is now applied to the Windows image. When the PC boots, the same Code Integrity policy that is enforced in Windows 10 S will be enforced on your Windows installation. If you are going to boot the PC into Audit Mode, you'll have to enable manufacturing mode.

Source: Microsoft

Support us

Winaero greatly relies on your support. You can help the site keep bringing you interesting and useful content and software by using these options: