Symptom
When you try to install or deploy an image on a Surface device that has Windows 10 in S mode preinstalled, you may encounter one or more of the following issues:
Issue 1
After the deployment of an image by using Microsoft Deployment Toolkit (MDT), System Center Configuration Manager, or another deployment tool, the device is configured in S mode even though the image is not configured for S mode.
Issue 2
If you are deploying Windows in an automated manner by using Microsoft Deployment Toolkit (MDT), you may see the following error messages during Lite Touch:
Windows could not parse or process the unattended answer file for pass [specialize]. The settings specified in the answer file cannot be applied. The error was detected while processing settings for component [Microsoft-Windows-Deployment]
Logs may show error message that resemble the following:
0x800711C7 - This program was blocked by Device Guard because it violates the code integrity policy installed on this system.
Issue 3
You receive a pop-up message that states "Your organization used Device Guard to block this app."
Resolution
To fix the issue, use one of the following solutions:
-
Purchase a commercial version of the device that has Windows 10 Professional installed. See Where to buy Surface.
-
Switch the device out of S mode manually by using the Microsoft Store, and then deploy the image.
More information
For information about how to change editions by using Intune, see Use a configuration profile to upgrade Windows 10, or switch from S mode in Intune.
Before you deploy new operating system, check the product terms to determine your reimaging licensing options for qualifying operating systems.
On a Surface that had preinstalled Windows 10 in S mode that was then taken out of S mode, if you use a Surface recovery image to reimage the device, the Surface will switch back to S mode.
If you order a warranty replacement device for a Surface that had preinstalled Windows 10 in S mode that was then taken out of S mode, the Surface device replacement will be in S mode. This is because your replacement device will be the same "consumer stock keeping unit" (SKU) as the original.
