{"id":319,"date":"2026-05-13T12:56:46","date_gmt":"2026-05-13T20:56:46","guid":{"rendered":"https:\/\/rainier-it.com\/blog\/?p=319"},"modified":"2026-05-13T12:59:27","modified_gmt":"2026-05-13T20:59:27","slug":"windows-11-pro-vs-home-for-smbs","status":"publish","type":"post","link":"https:\/\/rainier-it.com\/blog\/windows-11-pro-vs-home-for-smbs\/","title":{"rendered":"Why Your SMB Needs Windows 11 Pro, Not Home: The $99 Upgrade That Saves $4,000 in Incidents"},"content":{"rendered":"\n<p>I see the same thing in small offices three or four times a year. The owner walks into Costco, picks up a nice-looking laptop on sale, hands it to the new front-desk hire, and asks me a week later why we can&#8217;t join it to Entra, why BitLocker is greyed out, why nobody can RDP into it from home, and why every Group Policy I push gets silently ignored.<\/p>\n\n\n\n<p>The answer is always the same: <strong>it shipped with Windows 11 Home<\/strong>.<\/p>\n\n\n\n<p>Windows 11 Home is a fine operating system for one human being using one device at one kitchen table. It is the wrong product to run a business on, and the gap between Home and Pro is the single most-overlooked source of preventable IT incidents I see in SMB land. The good news is the upgrade is $99, takes ten minutes, doesn&#8217;t require a reinstall, and unlocks every feature this post covers.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\ud83d\udcbc Why Your SMB Needs Windows 11 Pro, Not Home<\/h1>\n\n\n\n<p>This post is for anyone buying laptops for a small business \u2014 owners, office managers, the person who got drafted into &#8220;IT&#8221; because they&#8217;re the youngest in the room. By the end you&#8217;ll know exactly what Pro buys you, how to check what you&#8217;ve got, and how to upgrade in place if you guessed wrong.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udd0d What edition am I running?<\/h2>\n\n\n\n<p>Easiest check is <code>winver<\/code> from the Start menu \u2014 pops up a dialog with the edition. From PowerShell:<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#2e3440ff\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#d8dee9ff;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>Get-ComputerInfo | Select-Object `\n    WindowsProductName, WindowsEditionId, WindowsVersion, OsBuildNumber<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki nord\" style=\"background-color: #2e3440ff\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #88C0D0\">Get-ComputerInfo<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">|<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #88C0D0\">Select-Object<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">`<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">    WindowsProductName<\/span><span style=\"color: #81A1C1\">,<\/span><span style=\"color: #D8DEE9FF\"> WindowsEditionId<\/span><span style=\"color: #81A1C1\">,<\/span><span style=\"color: #D8DEE9FF\"> WindowsVersion<\/span><span style=\"color: #81A1C1\">,<\/span><span style=\"color: #D8DEE9FF\"> OsBuildNumber<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>You&#8217;re looking for <code>WindowsProductName<\/code> to say <code>Windows 11 Pro<\/code> and <code>WindowsEditionId<\/code> to say <code>Professional<\/code>. If it says <code>Core<\/code> or <code>Windows 11 Home<\/code>, keep reading.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">1. \ud83d\udd12 Real BitLocker, not &#8220;Device Encryption&#8221;<\/h2>\n\n\n\n<p>This is the headline. Windows 11 Home does have <em>something<\/em> called Device Encryption \u2014 but it&#8217;s a stripped-down variant with serious limits:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Requires a Microsoft account.<\/strong> You cannot use Device Encryption with a local account; the recovery key has to escrow to your personal Microsoft account. For an SMB endpoint that&#8217;s a non-starter.<\/li>\n\n\n\n<li><strong>No PowerShell management.<\/strong> <code>Enable-BitLocker<\/code>, <code>Get-BitLockerVolume<\/code>, <code>manage-bde<\/code> \u2014 all missing or crippled.<\/li>\n\n\n\n<li><strong>No XTS-AES 256.<\/strong> Device Encryption uses AES-128-CBC. Fine for casual theft, weaker than what Pro defaults to.<\/li>\n\n\n\n<li><strong>No per-drive control.<\/strong> You can&#8217;t separately encrypt a second internal drive or an external one.<\/li>\n\n\n\n<li><strong>No recovery-key escrow to Entra ID or AD.<\/strong> Which means when (not if) the TPM clears during a firmware update, you&#8217;re looking at the user&#8217;s personal Microsoft account password to recover the laptop&#8217;s drive. Good luck if they forgot it and quit two weeks ago.<\/li>\n<\/ul>\n\n\n\n<p>Windows 11 Pro ships <strong>real BitLocker<\/strong> \u2014 the same drive-encryption stack we built the <a href=\"\/blog\/lock-down-windows-11-in-15-minutes\/\">Lock Down Windows 11 in 15 Minutes checklist<\/a> around. XTS-AES 256, PowerShell-scriptable, key-escrow to Entra ID or Active Directory or a third-party vault, separately encrypt every drive in the machine. Try this on Pro vs Home and watch the second one error out:<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#2e3440ff\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#d8dee9ff;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly># Real BitLocker \u2014 works on Pro, fails on Home\nEnable-BitLocker -MountPoint \"C:\" `\n    -EncryptionMethod XtsAes256 `\n    -UsedSpaceOnly `\n    -TpmProtector\n\nAdd-BitLockerKeyProtector -MountPoint \"C:\" -RecoveryPasswordProtector<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki nord\" style=\"background-color: #2e3440ff\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #616E88\"># Real BitLocker \u2014 works on Pro, fails on Home<\/span><\/span>\n<span class=\"line\"><span style=\"color: #88C0D0\">Enable-BitLocker<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">MountPoint <\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #A3BE8C\">C:<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">`<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">    <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">EncryptionMethod XtsAes256 <\/span><span style=\"color: #81A1C1\">`<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">    <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">UsedSpaceOnly <\/span><span style=\"color: #81A1C1\">`<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">    <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">TpmProtector<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #88C0D0\">Add-BitLockerKeyProtector<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">MountPoint <\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #A3BE8C\">C:<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">RecoveryPasswordProtector<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>On Home: <code>Enable-BitLocker : The term 'Enable-BitLocker' is not recognized as a name of a cmdlet\u2026<\/code> or \u2014 if the cmdlet exists \u2014 a hard error about edition support.<\/p>\n\n\n\n<p><strong>Why this matters:<\/strong> the difference between a stolen laptop being &#8220;a hardware loss&#8221; and &#8220;a notifiable data-breach incident&#8221; is whether the drive was properly encrypted with a recovery story. Pro gives you that. Home gives you a sketchy approximation.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">2. \ud83d\udee0\ufe0f Group Policy Editor (<code>gpedit.msc<\/code>)<\/h2>\n\n\n\n<p>Open Start \u2192 type <code>gpedit.msc<\/code> on a Home machine. You get <strong>&#8220;Windows cannot find &#8216;gpedit.msc&#8217;.&#8221;<\/strong> On Pro it opens the Local Group Policy Editor and the entire Windows policy surface \u2014 hundreds of toggles for everything from &#8220;Block password reuse&#8221; to &#8220;Disable USB removable drives&#8221; to &#8220;Force Defender Tamper Protection.&#8221;<\/p>\n\n\n\n<p>The two big consequences:<\/p>\n\n\n\n<p>1. <strong>Most security-hardening guides \u2014 including ours \u2014 assume you can edit local Group Policy.<\/strong> Without <code>gpedit.msc<\/code>, you&#8217;re stuck doing the registry-key version of every setting, which is more error-prone and gets undone by Windows updates more often. 2. <strong>GPOs from a domain controller silently fail to apply.<\/strong> Home machines on a domain (which is itself a Pro-only feature, see below) won&#8217;t pull policy from your AD or Entra environment. They just ignore it.<\/p>\n\n\n\n<p>If you ever want to push a settings baseline to a fleet of laptops without paying for Intune, Pro is the minimum.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">3. \ud83c\udfe2 Join the Company (Entra ID + Active Directory)<\/h2>\n\n\n\n<p>This is the one that bites people first. Windows 11 Home <strong>cannot join an Entra ID tenant, an Active Directory domain, or be managed by Intune.<\/strong> Full stop. The &#8220;Access work or school&#8221; pane in Settings has the option greyed out with a tooltip telling you to upgrade.<\/p>\n\n\n\n<p>What that means in practice:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>No central identity.<\/strong> Every user signs in with a personal Microsoft account or a local account. Onboarding and offboarding is per-machine. When someone leaves, you&#8217;re back to that &#8220;did anyone change the Wi-Fi password&#8221; feeling.<\/li>\n\n\n\n<li><strong>No conditional access.<\/strong> You can&#8217;t enforce &#8220;only company-managed laptops can open Outlook.&#8221; Anyone with the user&#8217;s password gets in from anywhere.<\/li>\n\n\n\n<li><strong>No automatic BitLocker key escrow.<\/strong> Pro + Entra = your IT admin can recover the drive from the portal. Home + Microsoft account = pray the user remembers their personal MS account password.<\/li>\n\n\n\n<li><strong>No Intune \/ Defender for Endpoint.<\/strong> Both refuse to enroll Home editions. Those are the only two ways to push a consistent security baseline to remote laptops at scale.<\/li>\n<\/ul>\n\n\n\n<p>If your business has more than one or two computers, <strong>central identity is not a luxury, it&#8217;s a survival mechanism<\/strong>. Pro is the price of admission.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">4. \ud83d\udda5\ufe0f Accept Incoming Remote Desktop<\/h2>\n\n\n\n<p>Windows 11 Home <strong>can be an RDP client<\/strong> \u2014 it can connect <em>out<\/em> to other machines. It <strong>cannot be an RDP host<\/strong> \u2014 nobody can RDP <em>into<\/em> it. The receiving end has to be Pro or better.<\/p>\n\n\n\n<p>For SMB owners, this comes up the first time someone says &#8220;I forgot a file on my office desktop, can I grab it from home?&#8221; On Pro: enable RDP, set up port-forwarding (or better, a VPN, or much better, a Zero Trust mesh like Tailscale or Cloudflare Access), done. On Home: install third-party remote-access software (TeamViewer, AnyDesk, Splashtop) and now you&#8217;re paying a per-seat subscription forever to do what&#8217;s built into the OS.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#2e3440ff\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#d8dee9ff;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly># Enable RDP on Windows 11 Pro (run as admin)\nSet-ItemProperty `\n    -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server' `\n    -Name 'fDenyTSConnections' -Value 0\nEnable-NetFirewallRule -DisplayGroup 'Remote Desktop'\n\n# Restrict to a specific user (don't leave it wide open)\nAdd-LocalGroupMember -Group 'Remote Desktop Users' -Member 'christopher'<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki nord\" style=\"background-color: #2e3440ff\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #616E88\"># Enable RDP on Windows 11 Pro (run as admin)<\/span><\/span>\n<span class=\"line\"><span style=\"color: #88C0D0\">Set-ItemProperty<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">`<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">    <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Path <\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #A3BE8C\">HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">`<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">    <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Name <\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #A3BE8C\">fDenyTSConnections<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Value <\/span><span style=\"color: #B48EAD\">0<\/span><\/span>\n<span class=\"line\"><span style=\"color: #88C0D0\">Enable-NetFirewallRule<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">DisplayGroup <\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #A3BE8C\">Remote Desktop<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #616E88\"># Restrict to a specific user (don&#39;t leave it wide open)<\/span><\/span>\n<span class=\"line\"><span style=\"color: #88C0D0\">Add-LocalGroupMember<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Group <\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #A3BE8C\">Remote Desktop Users<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Member <\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #A3BE8C\">christopher<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>This won&#8217;t even run on Home \u2014 the registry key exists but the service that backs it refuses to accept connections.<\/p>\n\n\n\n<p><strong>Important caveat:<\/strong> turning RDP on does not mean opening port 3389 to the internet. Don&#8217;t do that. Put it behind a VPN, a Tailscale tailnet, or a Cloudflare Access policy. RDP on the public internet has been brute-forced into oblivion since 2017.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">5. \ud83e\uddea Hyper-V and Windows Sandbox<\/h2>\n\n\n\n<p>Both are Pro+ features. Both are wildly useful for an SMB:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Hyper-V<\/strong> lets you spin up a free Linux VM to test something, run a legacy XP app for one stubborn line-of-business tool, or stand up a domain controller in a lab on your laptop. Built into Windows, no VirtualBox \/ VMware required.<\/li>\n\n\n\n<li><strong>Windows Sandbox<\/strong> is a 30-second disposable Windows VM. You launch it, drag in a sketchy installer, run it, see what it does, close the window \u2014 <em>poof<\/em>, the entire VM is gone. Zero state persists. This is the single best tool for safely opening that &#8220;is this attachment legit?&#8221; file your insurance broker just emailed.<\/li>\n<\/ul>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#2e3440ff\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#d8dee9ff;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly># One-line enable on Pro (reboot required)\nEnable-WindowsOptionalFeature -Online -FeatureName Containers-DisposableClientVM -All\nEnable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki nord\" style=\"background-color: #2e3440ff\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #616E88\"># One-line enable on Pro (reboot required)<\/span><\/span>\n<span class=\"line\"><span style=\"color: #88C0D0\">Enable-WindowsOptionalFeature<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Online <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">FeatureName Containers<\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">DisposableClientVM <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">All<\/span><\/span>\n<span class=\"line\"><span style=\"color: #88C0D0\">Enable-WindowsOptionalFeature<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Online <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">FeatureName Microsoft<\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Hyper<\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">V <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">All<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>Home doesn&#8217;t expose either feature.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">6. \ud83d\udcf1 Mobile Device Management (MDM)<\/h2>\n\n\n\n<p>If you ever want to enroll a Windows laptop in Intune, Microsoft 365 Business Premium device management, or any third-party MDM (Kandji, Jamf, NinjaOne, etc.) \u2014 it has to be <strong>Pro or higher<\/strong>. Home cannot be MDM-managed. Period.<\/p>\n\n\n\n<p>This is the single biggest reason SMBs end up doing nightmare reinstalls. They buy ten laptops from Costco, deploy them, then six months later sign up for Microsoft 365 Business Premium because they want central email and security policies. They go to enroll the laptops in Intune. Half of them are Home. Now you&#8217;re either upgrading them one at a time (next section) or doing a clean wipe-and-Pro-reinstall on every one.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">7. \ud83d\udd04 Update for Business (defer + ring deployment)<\/h2>\n\n\n\n<p>Pro gives you fine-grained control over Windows Update:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Defer feature updates<\/strong> by 14, 30, 60, 90+ days (Home: applied immediately, can crash you on day one).<\/li>\n\n\n\n<li><strong>Defer quality updates<\/strong> by 0\u20137 days (Home: applied as soon as they download).<\/li>\n\n\n\n<li><strong>Pause updates<\/strong> for up to 35 days (Home: 7 days max).<\/li>\n\n\n\n<li><strong>Deployment rings<\/strong> via WUfB \u2014 test updates on one pilot machine for a week before they roll to the rest.<\/li>\n<\/ul>\n\n\n\n<p>These are accessible via GPO, registry, or any MDM. On Home you get &#8220;updates happen when Microsoft decides.&#8221; For an SMB whose accountant needs QuickBooks to launch on the morning of payroll, deferral is the difference between &#8220;we patch on Tuesday after we test on the lab machine on Monday&#8221; and &#8220;QuickBooks is broken and no one knows why.&#8221;<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#2e3440ff\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#d8dee9ff;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly># Defer feature updates by 30 days, quality updates by 4 days\n$wu = 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate'\nNew-Item -Path $wu -Force | Out-Null\nSet-ItemProperty -Path $wu -Name 'DeferFeatureUpdates' -Value 1\nSet-ItemProperty -Path $wu -Name 'DeferFeatureUpdatesPeriodInDays' -Value 30\nSet-ItemProperty -Path $wu -Name 'DeferQualityUpdates' -Value 1\nSet-ItemProperty -Path $wu -Name 'DeferQualityUpdatesPeriodInDays' -Value 4\ngpupdate \/force<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki nord\" style=\"background-color: #2e3440ff\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #616E88\"># Defer feature updates by 30 days, quality updates by 4 days<\/span><\/span>\n<span class=\"line\"><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">wu<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">=<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #A3BE8C\">HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #88C0D0\">New-Item<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Path <\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">wu<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Force <\/span><span style=\"color: #81A1C1\">|<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #88C0D0\">Out-Null<\/span><\/span>\n<span class=\"line\"><span style=\"color: #88C0D0\">Set-ItemProperty<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Path <\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">wu<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Name <\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #A3BE8C\">DeferFeatureUpdates<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Value <\/span><span style=\"color: #B48EAD\">1<\/span><\/span>\n<span class=\"line\"><span style=\"color: #88C0D0\">Set-ItemProperty<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Path <\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">wu<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Name <\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #A3BE8C\">DeferFeatureUpdatesPeriodInDays<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Value <\/span><span style=\"color: #B48EAD\">30<\/span><\/span>\n<span class=\"line\"><span style=\"color: #88C0D0\">Set-ItemProperty<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Path <\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">wu<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Name <\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #A3BE8C\">DeferQualityUpdates<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Value <\/span><span style=\"color: #B48EAD\">1<\/span><\/span>\n<span class=\"line\"><span style=\"color: #88C0D0\">Set-ItemProperty<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Path <\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">wu<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Name <\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #A3BE8C\">DeferQualityUpdatesPeriodInDays<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Value <\/span><span style=\"color: #B48EAD\">4<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">gpupdate <\/span><span style=\"color: #81A1C1\">\/<\/span><span style=\"color: #D8DEE9FF\">force<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>Above is a no-op on Home \u2014 the policy registry keys exist but Windows ignores them.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udcb0 The actual math<\/h2>\n\n\n\n<p>Retail price difference, fresh laptop: ~$70\u2013$100. Microsoft&#8217;s in-place upgrade SKU (Settings \u2192 Activation \u2192 Upgrade your edition of Windows) is <strong>$99 once per machine<\/strong>, no reinstall, no data loss.<\/p>\n\n\n\n<p>Now compare against what one preventable incident on a Home machine actually costs:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Incident<\/th><th>Realistic SMB cost<\/th><\/tr><\/thead><tbody><tr><td>Laptop stolen, drive not encrypted<\/td><td>$2,000 \u2013 $25,000 (data-breach notification, legal review, lost client trust)<\/td><\/tr><tr><td>Cryptolocker on unmanaged laptop spreads to NAS<\/td><td>$4,000 \u2013 $40,000 (ransom, downtime, recovery labor)<\/td><\/tr><tr><td>Departing employee, no central identity<\/td><td>$500 \u2013 $3,000 (per-app password resets, file-share permission re-papering, productivity drag)<\/td><\/tr><tr><td>New laptop can&#8217;t enroll in Intune, full rebuild<\/td><td>$400 \u2013 $1,200 (labor + the day the user is on a loaner)<\/td><\/tr><tr><td>RDP-into-office workaround via TeamViewer<\/td><td>$25 \u2013 $80 per user per month, forever<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p><strong>The Pro upgrade pays for itself the first time any one of those gets avoided.<\/strong> Most SMBs hit two or three of them in the first three years.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udd27 How to upgrade in place<\/h2>\n\n\n\n<p>You don&#8217;t have to reinstall. Microsoft sells an upgrade SKU that flips the edition on a running machine in about ten minutes.<\/p>\n\n\n\n<p><strong>The supported path:<\/strong><\/p>\n\n\n\n<p>1. <em>Settings \u2192 System \u2192 Activation \u2192 Upgrade your edition of Windows<\/em> 2. Click <em>Open Store<\/em> under &#8220;Upgrade to Windows 11 Pro.&#8221; 3. Buy the upgrade ($99 USD as of writing). Wait ~10 minutes. Reboot. 4. Edition now reads <code>Professional<\/code>. All your files, apps, and accounts are intact.<\/p>\n\n\n\n<p><strong>If you already have a Pro product key<\/strong> (a lot of Microsoft 365 Business and Volume Licensing customers do):<\/p>\n\n\n\n<p>1. <em>Settings \u2192 System \u2192 Activation \u2192 Change product key.<\/em> 2. Enter the 25-character Pro key. 3. Windows verifies, switches edition, reboots.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#2e3440ff\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#d8dee9ff;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly># Same thing from PowerShell (useful for scripting across a fleet)\nchangepk.exe \/productkey XXXXX-XXXXX-XXXXX-XXXXX-XXXXX<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki nord\" style=\"background-color: #2e3440ff\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #616E88\"># Same thing from PowerShell (useful for scripting across a fleet)<\/span><\/span>\n<span class=\"line\"><span style=\"color: #88C0D0\">changepk.exe<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">\/<\/span><span style=\"color: #D8DEE9FF\">productkey XXXXX<\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">XXXXX<\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">XXXXX<\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">XXXXX<\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">XXXXX<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>If you&#8217;re scripting this across multiple machines, <code>slmgr.vbs \/ipk<\/code> and <code>slmgr.vbs \/ato<\/code> are the licensing-service equivalents.<\/p>\n\n\n\n<p><strong>Don&#8217;t fall for $5 keys on shady marketplaces.<\/strong> They&#8217;re usually grey-market volume keys that Microsoft will deactivate within months, leaving you in worse shape than where you started. $99 from the Microsoft Store; $30\u2013$50 from reputable resellers if you really want to penny-pinch.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u2705 The buying rule<\/h2>\n\n\n\n<p>If you&#8217;re buying a Windows laptop for a small business, the rule is short:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>[ ] <strong>Windows 11 Pro<\/strong> \u2014 non-negotiable for any work-related device.<\/li>\n\n\n\n<li>[ ] <strong>TPM 2.0<\/strong> and <strong>Secure Boot<\/strong> enabled \u2014 required for Win11 anyway, but verify in firmware.<\/li>\n\n\n\n<li>[ ] <strong>At least 16 GB RAM, 256 GB NVMe SSD<\/strong> \u2014 Pro features (Hyper-V, Sandbox, BitLocker on-the-fly) all want headroom.<\/li>\n\n\n\n<li>[ ] <strong>A business-line model<\/strong> (ThinkPad T\/X series, Dell Latitude, HP EliteBook). Consumer-line laptops (IdeaPad, Inspiron, Pavilion) often ship Home by default and have flakier driver support for management tooling.<\/li>\n<\/ul>\n\n\n\n<p>If you&#8217;ve got a closet full of Home laptops bought before you read this \u2014 upgrade in place; you don&#8217;t need to throw them out. If you&#8217;re about to buy: look for the &#8220;Windows 11 Pro&#8221; line on the spec sheet, every time, no exceptions.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">What&#8217;s next<\/h2>\n\n\n\n<p>The Pro upgrade is the <em>prerequisite<\/em> for actually doing security right on a Windows endpoint. The follow-up is what to do with it once you have it \u2014 that&#8217;s the <a href=\"\/blog\/lock-down-windows-11-in-15-minutes\/\">Lock Down Windows 11 in 15 Minutes checklist<\/a> we put up last week. After that comes the fleet-management post: doing all of this <em>across every endpoint<\/em> with TacticalRMM, Microsoft Defender, and a managed SOC (Huntress) backing you up.<\/p>\n\n\n\n<p>If your shop is staring at a closet full of Home laptops and not sure whether to upgrade in place or replace \u2014 that&#8217;s exactly the kind of audit we do for free. Drop me a line at <a href=\"mailto:christopher@rainier-it.com\">christopher@rainier-it.com<\/a> or <a href=\"https:\/\/rainier-it.com\/contact\">book a 15-minute call<\/a>. I&#8217;ll tell you honestly whether it&#8217;s a $99-times-six problem or a &#8220;next refresh, buy better&#8221; problem.<\/p>\n\n\n\n<p>Thanks, and buy Pro!<\/p>\n\n","protected":false},"excerpt":{"rendered":"<p>Windows 11 Home is the wrong product to run a business on. Real BitLocker, Group Policy, Entra\/AD join, RDP host, Hyper-V, MDM, and Update for Business are all Pro-only \u2014 and the upgrade is $99 with no reinstall.<\/p>\n","protected":false},"author":1,"featured_media":329,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[15,19,7],"tags":[],"class_list":["post-319","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-microsoft-windows","category-guides","category-it-management"],"_links":{"self":[{"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/posts\/319","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/comments?post=319"}],"version-history":[{"count":2,"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/posts\/319\/revisions"}],"predecessor-version":[{"id":332,"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/posts\/319\/revisions\/332"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/media\/329"}],"wp:attachment":[{"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/media?parent=319"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/categories?post=319"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/tags?post=319"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}