Windows 11 Which Version to Install

[mikes]

The one that hit us in 2017 or so used some escalation exploit to give itself SYSTEM permissions so it could read/write at least to the windows directories (symantec a/v did nothing to stop it which likely says more about symantec a/v). Perhaps this has been patched out but all I am saying is you can't be too sure

[Julian]

I am also running Applocker, in allow list mode. It can be a problem for some applications, but as most apps are now signed, it easy to allow a publisher, so signed updates just run.

Like most school we have some wanbe junior hackers, Applocker helps keep them frustrated.

[mavhc]

On 02/07/2025 at 09:52, mikes said:

The one that hit us in 2017 or so used some escalation exploit to give itself SYSTEM permissions so it could read/write at least to the windows directories (symantec a/v did nothing to stop it which likely says more about symantec a/v). Perhaps this has been patched out but all I am saying is you can't be too sure

There's loads of escalation exploits in Windows, they get patched each month though or everyone would be compromised

[5nowman]

On 01/07/2025 at 12:59, mikes said:

Applocker is essential IMO, it's not too hard to set it up as you can run it in log only mode to start with to catch anything that your users need that you didn't know ran. (e.g. SIMS as Pulsar.exe) - it also allows MS binaries by default so it's hard to mess up your system with it, like you could have done with Software Restriction Policies.   Without Applocker I've seen it can be very easy for malware to spread as it can write its binaries anywhere on the system, even if the user doesn't have write permissions there, and will sail right past most antivirus software. 

 

We deployed 24H2, only started deploying Windows 11 this year so we wanted the latest version (which can be a mistake looking at all the Server 2025 problems) but it's worked well for us so far. Had the usual silly Microsoft bugs as they never finish their software properly (mouse cursor disappearing on text fields) but have worked around them so far. Using Professional  (apart from our old Win 10 upgraded machines which keep their Education version from Win 10) - doesn't seem to be many differences between Pro/EDU that I can see?

Pro doesn't have app locker? that is the biggest difference right?

[mavhc]

On 06/07/2025 at 02:39, 5nowman said:

Pro doesn't have app locker? that is the biggest difference right?

Correct, SRP works fine though

 

Don't forget Pro Education, which is worse than Education, because.

[5nowman]

23 minutes ago, mavhc said:

Correct, SRP works fine though

 

Don't forget Pro Education, which is worse than Education, because.

What is SRP?

[mavhc]

34 minutes ago, 5nowman said:

What is SRP?

https://learn.microsoft.com/en-us/windows-server/identity/software-restriction-policies/software-restriction-policies

[5nowman]

10 minutes ago, mavhc said:

https://learn.microsoft.com/en-us/windows-server/identity/software-restriction-policies/software-restriction-policies

Thank you for taking the time out to reply.

 

will read. Have an epic day!

[Disease]

Anyone know why I don't see the latest versions in my VLSC?

[mikes]

I wasn't sure if they integrate the very latest hotfixes/patches into the downloadable ISO do they?  That won't get updated until 25H2 is released?

[LeMarchand]

I thought the circled date indicated that they update the ISO periodically. The download size definitely changes.

 

[OLPTech]

Search for Updated Jun 2025 and they appear