Windows 11 Enterprise vs Pro: What You Get and What You Don’t

Windows 11 Enterprise vs Pro is closer than the names suggest. Enterprise has everything in Pro, plus four features for security and lockdown. The bigger gap is in how Microsoft sells the two. We’d start with the short list of what only Enterprise has.

The edition rows follow Microsoft’s Windows commercial licensing overview.

What only Enterprise has

Microsoft’s overview names the features that need the Enterprise edition on the PC. There are four.

BitLocker protects a disk while the PC is off. Personal Data Encryption adds a layer per person, and we’d turn it on for shared laptops first.

The lockdown settings are for PCs that should do one job. Think of a reception screen or a kiosk in a shop.

Credential Guard in detail

Credential Guard is the reason most teams move to Enterprise. It protects NTLM password hashes, Kerberos tickets and stored domain credentials.

Those secrets move into an environment isolated by virtualization-based security. Malware with administrator rights can’t extract them from there.

It can break old software. Microsoft lists four things that stop working: Kerberos DES encryption, unconstrained delegation, TGT extraction and NTLMv1. I’d test legacy apps before a rollout.

Everyday Kerberos traffic isn’t touched. File shares and Remote Desktop keep working, in Microsoft’s words.

Two places where Microsoft advises against it: domain controllers gain nothing from it, and Exchange Server doesn’t support it.

The source is Microsoft’s Credential Guard overview.

What Pro already includes

Some lists online still file these under Enterprise. They run on Pro.

AppLocker is the one older articles get wrong. Microsoft’s AppLocker page says it’s included with all editions of Windows, except Windows 10 version 1809 or earlier.

Don’t pay for Enterprise for these. Our comparison of Windows 11 Home vs Pro lists what Pro adds over Home.

Edition, subscription and use rights

Most confusion starts here. Microsoft uses the word Enterprise for an edition and for a subscription.

E5 is E3 with Microsoft Defender for Endpoint Plan 2 added.

A product key gives you the first layer. The other two come with Microsoft’s subscriptions only, and we’d rather say so before you order.

A Pro PC under an Enterprise subscription

Microsoft’s overview covers one more case. Someone with an Enterprise E3 subscription works on a PC that still runs Pro. We copied below which features then work.

Four rows say no for Pro. Those four are the real edition gap.

Subscription activation, and PCs that stay on Pro

Subscription activation steps a Pro PC up to Enterprise when a licensed user signs in. Microsoft’s point: no keys to manage and no Enterprise images to deploy.

It works in reverse too. When the subscription ends, the device goes back to its original edition after a grace period.

Microsoft also lists cases where a PC stays on Pro although its user holds a subscription.

The subscription doesn’t block any of these. Five Windows instances per licensed user are part of the use rights, so one person’s laptop and cloud PC are both covered.

How each edition is sold

Microsoft sells Enterprise E3 and E5 per user, through commercial licensing and the Cloud Solution Provider program. Both need Windows Pro underneath as the qualifying system.

That’s why an Enterprise PC nearly always starts life on Pro.

We sell single keys instead. Our Windows 11 Enterprise key activates the Enterprise edition on one 64-bit PC, with no subscription and no expiry. The Windows 11 Pro key does the same for Pro. Both arrive instant to email.

The license types have their own page: retail vs OEM vs volume license.

Hardware limits

The figures are from Microsoft’s memory limits page. No office PC comes near either number.

What a PC needs to run Windows 11 at all is in our Windows 11 requirements guide.

Buying for heavy workstation hardware? Look at the Windows 11 Pro for Workstations key before Enterprise.

That choice has its own page: Windows 11 Pro for Workstations vs Pro.

How to choose: Windows 11 Enterprise vs Pro

Three questions about risk, one about hardware, then the decision.

1. Ask whether you have to answer for stolen domain credentials; if so, Credential Guard points to Enterprise.
2. Look for shared or often-lost laptops where encryption per person would help.
3. List the kiosks, reception PCs and frontline devices that need a locked-down desktop.
4. Check that those PCs support virtualization-based security and Secure Boot.
5. If none of the first three apply, stay on Pro.
6. If one applies, move those PCs to Enterprise and leave the rest on Pro.

A mixed fleet is normal. Nothing forces one edition on every desk.

Switching a Pro PC to Enterprise

No reinstall is needed. Microsoft’s Windows edition upgrade page marks Pro to Enterprise as supported, with no reboot required.

1. Right-click Start and select Run.
2. Enter ms-settings:activation and select OK.
3. Select Change product key.
4. Enter the Enterprise key.
5. Follow the instructions on screen.

The same page gives a command for the job:

changepk.exe /ProductKey XXXXX-XXXXX-XXXXX-XXXXX-XXXXX

Coming from Home? Our guides to upgrading Windows 10 Home to Pro and upgrading to Windows 11 Pro cover the first hop.

Afterwards I’d check the Windows activation status. If it stalls, start at how to activate Windows 11.

Enterprise and Enterprise LTSC

These are two products. Regular Enterprise takes the yearly feature updates, like Pro. LTSC is meant for specialised devices that must change as little as possible.

Microsoft lists Windows 11 Enterprise LTSC under commercial licensing only. From the earlier generation we keep a Windows 10 Enterprise LTSC 2019 key. A regular Windows 10 Enterprise key is there too.

Keys and activation

Each edition has its own keys. A Pro key doesn’t activate Enterprise, and an Enterprise key doesn’t activate Pro.

Companies with volume agreements often activate Enterprise through their own server: see what KMS activation is. A single key from us activates online with Microsoft, once.

More background is in digital license vs product key and finding your Windows product key. Every edition we carry is under Windows 11 keys.

Mistakes we see most

• Buying Enterprise for BitLocker, which Pro already has.
• Expecting Windows Autopatch or Universal Print from a product key.
• Typing an Enterprise key into Home.
• Turning on Credential Guard without testing old line-of-business apps.
• Mixing up Enterprise and Enterprise LTSC.
• Reinstalling Windows to change edition when a key change is enough.

Terms used on this page