Our organization moved most of its Windows 11 fleet to Enterprise E3 several years ago so we could centrally manage AppLocker through Group Policy. The Microsoft 365 Enterprise license is assigned through a dedicated Entra security group, and an Enterprise product key was also applied to endpoints with slmgr. Users separately receive Microsoft 365 Business Premium through another group.
We'd now like to eliminate the recurring Enterprise subscriptions and return the fleet to Windows Pro without losing AppLocker enforcement. Microsoft has removed the previous edition restriction for AppLocker, so the policy itself should remain usable on Pro.
About 90% of the devices are physical Windows 11 PCs that originally shipped with OEM Pro licenses stored in firmware. The remaining 10% are Windows client VMs running under Hyper-V on a powerful workstation host and do not have embedded OEM keys.
What is the recommended process for the physical devices? Is removing the Enterprise assignment enough for them to return to Pro, or would we need to reapply the firmware key, reimage them, or take another step? For the VMs, should we purchase separate perpetual Pro licenses, or is there a better licensing option? Also, has anyone seen issues with AppLocker, AppIDSvc, or existing GPO rules after moving from Enterprise back to Pro?
4 Answers
For the physical PCs, verify that the original Pro entitlement is still present and that the users are covered by Business Premium. Removing the Enterprise assignment may eventually cause the device to fall back, but the timing and behavior should not be treated as guaranteed. I’d avoid deleting the Enterprise group until the pilot succeeds, and keep a reimage path ready. A clean install should detect the embedded OEM Pro key automatically.
Don’t assume the Hyper-V host’s OEM license covers Windows client guests. VM licensing depends on the host edition, the guest operating system, and the virtualization rights attached to the licenses. Client Windows VMs usually need their own qualifying licenses or another appropriate commercial licensing arrangement. A licensing reseller should validate the exact setup before you buy MAK keys, since the correct answer can differ between Windows Server guests and Windows client guests.
AppLocker policies themselves shouldn’t need to be rewritten for Pro. AppIDSvc and the existing GPO rules generally continue to work once the OS is on a supported build. Still, validate enforcement in audit and enforced mode on a pilot machine after the edition change, because any activation or servicing problem could look like an AppLocker problem.
The AppLocker side should be fine: the edition check was removed, and AppLocker can run on current Windows 11 Pro builds. The risky part is the edition change itself. Enterprise-to-Pro is not generally a supported in-place downgrade, so removing the subscription or entering a Pro key may leave the device on Enterprise rather than cleanly switching it back. Test a few representative machines before planning the whole rollout; you may end up needing to reimage the physical systems and let them activate from their firmware Pro keys.
That’s the concern—these machines started with Pro, but we also applied the Enterprise key with slmgr. We’ll test the licensing-group removal and activation behavior on a small pilot group before assuming the OEM key will be used again.
We already use AppLocker on Windows 11 Pro systems without trouble, so the policy capability should not be the blocker. The licensing transition and whether it requires reimaging are the parts that need careful testing.