Wrapping Up the Windows 11 Enterprise Experiment

I hadn’t really expected Windows 11 Enterprise to solve the enshittification issues with Windows 11. So it was no surprise when it didn’t.

At a high level, I have always understood that Windows 11 Enterprise wasn’t the answer, that I would never be able to recommend this solution, broadly or not, as a way to overcome the enshittification problems with Windows 11. But I’ve pushed forward out of curiosity: I think we all vaguely understand that Microsoft gives its corporate customers an enshittification out that it doesn’t provide to individuals (at least outside of the EEA). What I wanted to know was what that looked like, and how much this version of the product addresses my concerns with the more familiar Windows 11 Home and Pro.

But in testing Windows 11 Enterprise, it occurred to me that I needed a more formal process to determine whether it could in any way meet my de-enshittification needs. And so this morning, I woke up, reset Windows 11 Enterprise to test some other configurations (see below) and maybe answer some lingering questions. And while I did that, I wrote what turned into A Windows 11 Enshittification Checklist (Premium). Which was originally just going to be a list of problems and then expanded into something more detailed.

So let me start there: To see how Windows 11 Enterprise addresses the list of major issues I and others have with this platform, let’s just step through the list. To be clear, I’ve observed these changes on an installation with no corporate policies while using a Microsoft account (MSA) sign-in (described later).

Forced telemetry. FIXED. Windows 11 Enterprise users can disable telemetry entirely, a capability that is not offered to users of Windows 11 Home or Pro. As an individual, you do so with the Local Group Policy Editor by navigating to Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds, locating the “Allow Diagnostic Data” option, changing it from “Not Configured” to “Enabled,” and enabling the option “Diagnostic data off (not recommended).”

Preinstalled crapware. FIXED. Windows 11 Enterprise does not preinstall any crapware.

Constant, unpredictable feature updates. NOT FIXED. Windows 11 Enterprise doesn’t change the behavior of Windows Update or how the system is updated.

Forced Microsoft account sign-ins. N/A. Windows 11 Enterprise forces you to sign in with a Microsoft work or school account (WSA), though you can later add a Microsoft account (MSA) sign-in, use that instead, and remove the work or school account (and its associated policies). More on this below: There’s a lot going on here.

Forced Microsoft Edge usage (Widgets, Search, Copilot, etc.). NOT FIXED. Windows 11 Enterprise does nothing to address this anticompetitive, anti-user behavior.

‌Bad Edge behaviors when you choose to use it, bad behaviors when you do not. NOT FIXED. Microsoft Edge still exhibits most of its worst behaviors in Windows 11 Enterprise, with minor changes related to Entra ID/Microsoft 365 integration.

Arbitrary hardware requirements. NOT FIXED. But it’s easy to work around these issues.

‌OneDrive harasses you to use folder backup and then silently enables it if you keep saying no. PARTIALLY FIXED/NOT FIXED. Depending on your configuration, OneDrive (consumer) will or will not harass you to enable folder backup and then just enable it regardless. If you are using a Microsoft work or school sign-in account, it will not do this. But if you remove that account (and its associated policies), OneDrive will revert to its original, malware-like behavior. Because the goal here is for an individual to use the system normally, this one is really NOT FIXED.

Related: Microsoft Office apps like Word display warning banners when you don’t save to OneDrive locations by default. NOT FIXED. Windows 11 Enterprise in no way addresses how Microsoft Office apps behave.

Add that all up, and it ain’t pretty: Of the 9 issues I raise, Windows 11 Enterprise only fixes two of them, and I rate both of those as minor issues anyway. Windows 11 Enterprise doesn’t fix 6 of the remaining issues, and one is not applicable. (And requires more work. Again, see below.)

Here’s what I did this morning and into the afternoon.

As noted, I woke up and reset Windows 11 Enterprise so I could step through some remaining configuration tests. The first thing I tried when the Out-of-Box Experience (OOBE) appeared was to use the “oobe\bypassnro” workaround I documented in Overcome Windows Setup Annoyances to see whether this would allow me to configure the PC with just a local account, bypassing the Microsoft work or school account requirement. But it did not. So I would later try creating the Windows 11 Enterprise installation media using Rufus, which, as noted in that same article linked above, lets you configure Windows Setup options that might help us bypass the work or school account requirement. More on that below.

Because I had to use a work or school account (WSA), I did so. And then I created a local account sign-in and configured it as an administrator to see whether I could just switch to that account and then remove the WSA. But when I signed out of the WSA, the local account didn’t appear as an option. All I could do was sign in to the WSA or provide the email address and password of another account.

I’m sure there’s a workaround to that, but I wanted to get moving, so I signed back in, deleted the local account, and added my MSA as a sign-in account with administrator privileges. Then, I signed out and signed in to my MSA. When I got to the Desktop, I removed the WSA sign-in (in Settings > Accounts > Other Users) and, as critically, the associated organizational policies (in Settings > Accounts > Access work or school). Windows did not like that.

I entered my MSA credentials and was a bit surprised that it worked. But I rebooted as prompted and when it returned, Windows 11 was configured normally, and I could do things like change my PIN to a normal, 4-character PIN, something that had been unavailable when the corporate policies were applied. Windows 11 Enterprise remained activated and worked normally.

I think took a second to verify that I could, using my MSA sign-in account, disable all telemetry tracking as noted above. And was not surprised to discover that I could. Good.

But this test was incomplete: I have a Microsoft 365 commercial account that I can use to sign in to Windows 11 Enterprise. But most individuals do not. So the next step was to figure out whether I could make some version of the Windows 11 Enterprise installation media that bypasses that requirement.

To find out, I downloaded the Windows 11 Enterprise evaluation ISO and used Rufus to create a new version of the installation media. I used the following settings.

Once that was done, I rebooted the test PC with that media and hoped for the best. I should have known better, I guess, but it was mostly OK. Rufus had the desired effect on Windows Setup: It created a local account named paul and, because I chose a “limited” (offline) setup, I was quickly punted into the Desktop. From there, I got online, installed updates, and had a quick peek around.

It was mostly as expected, but choosing the evaluation version was a mistake: There was evaluation watermark text on the desktop, and when I tried to change the product key to the one I had gotten earlier, it wouldn’t work. Choosing that version was dumb, so I created installation media a second time, again with Rufus (and the same settings), but this time using the Windows 11 Enterprise ISO that the service that sold me the key provided.

That went better.

This time I signed in to my Wi-Fi network first. After that, the OOBE disappeared, and I was dumped into the Desktop. There were no major changes to report: The Desktop was devoid of that evaluation watermark text, as expected, and it seemed to be correctly activated. I had the product key ready if not. As I was getting it up-to-date with Windows Update, I configured my MSA as a sign-in and administrator. And on the next reboot, I signed in with that account instead of the local account. (Which I then removed.)

A few quick notes about that: I had to configure a PIN on first sign-in, of course, but it accepted a 4-digit PIN because there are no Microsoft 365 organizational policies applied to the PC. And while I will need some time to be sure, I have little doubt that the OneDrive associated with my MSA will eventually quietly enable folder backup without my consent.

I’ll leave this configuration as is for a while to see exactly what changes. But it does appear that I’ve answered the open questions I had at the end of that previous article: Yes, you can remove a WSA (and its associated policies) from Windows 11 Enterprise after the initial installation. And, yes, you can use Rufus to modify Windows Setup such that you can install Windows 11 Enterprise and not need to configure a WSA at all. So I’ll just try and make sure that it keeps working like that.

I’m sure there are other questions. But my aim here was to determine whether Windows 11 Enterprise could somehow be used as a solution to the enshittification issues we see in Windows 11 Home and Pro. And based on my rundown of the Windows 11 enshittification checklist above, it appears not: Adjusting my prior scoring to account for Rufus “solving” the MSA/WSA sign-in requirement, Windows 11 Enterprise (when installed with Rufus) addresses only 3 of the 9 enshittification issues, it but doesn’t help with the other 6, 2 or 3 of which are the worst of the lot.

And with that, my thoughts turn once again to Europe and the Digital Markets Act (DMA) compliance changes that Microsoft made to Windows 11 there. There must be some way to get that working here in the United States and elsewhere.

Right?