Our organization upgraded most of its Windows 11 fleet to Enterprise E3 several years ago so we could centrally manage AppLocker through Group Policy. Users receive Microsoft 365 Business Premium through one licensing group, while Windows Enterprise E3 is assigned through a separate group. Enterprise product keys were also activated on endpoints with slmgr.
We now want to eliminate the recurring E3 subscriptions because AppLocker no longer requires an Enterprise edition after Microsoft removed the edition check. About 90% of the fleet consists of physical Windows 11 PCs that originally shipped with Pro licenses embedded in firmware. The remaining 10% are Windows client VMs running under Hyper-V, so they do not have OEM keys available in the guest.
What is the recommended process for moving the physical devices back to Pro? Is removing users from the Enterprise licensing group enough, or should we explicitly restore the embedded Pro keys? Would this require reimaging the machines, and does the result differ when the Enterprise key was manually installed with slmgr?
For the Hyper-V VMs, should we license each guest with a separate Windows Pro volume or other commercial license, or is there a better licensing option?
Finally, has anyone seen AppLocker or AppIDSvc problems after moving from Enterprise to Pro?
4 Answers
There are reports of devices returning to Pro after the Enterprise entitlement is removed and the licensing grace period expires, but I would not rely on that behavior for an entire fleet. Remove the Enterprise assignment, confirm every user still has Business Premium, and monitor a small pilot group for activation and edition changes. If the devices remain on Enterprise or show licensing errors, plan on reimaging rather than trying slmgr cleanup commands across production machines.
Be careful assuming that removing the E3 assignment performs a supported Enterprise-to-Pro downgrade. Some devices may eventually fall back to Pro when they no longer have an eligible Enterprise user, but changing licensing groups and entering a Pro key is not a guaranteed downgrade path. Microsoft support guidance commonly points to reinstalling or reimaging when a supported edition change cannot be performed in place.
Because the physical machines have Pro OEM licenses in firmware, reimaging them should allow Windows to reactivate Pro automatically. Test a few representative systems first, including one that received the Enterprise key through slmgr, before estimating the savings.
That is the main concern here: an embedded Pro key gives you a valid license, but it does not necessarily provide a supported way to convert an already-installed Enterprise edition without reinstalling.
The AppLocker part should be fine: current Windows 11 Pro builds can enforce AppLocker, and the edition check was removed. Existing GPO rules generally do not need to be redesigned just because the device is running Pro. Still, test AppIDSvc and enforcement on a pilot machine before changing the whole fleet.
The Hyper-V guests need to be evaluated separately. An OEM Pro license in the physical host’s firmware does not automatically license Windows client VMs. Server virtualization rights also do not generally solve the licensing requirements for Windows client guests. The correct option depends on whether these are Windows client or server VMs, how many run on each host, and what Microsoft licensing agreement you have, so confirm the design with your licensing reseller before buying MAK keys or relying on host licensing.
A practical test would be to remove both the group assignment and any manually installed Enterprise activation from one device, reboot it, and check the edition and activation status with Windows Settings and slmgr. That should tell you whether your specific setup behaves as expected.