Antivirus position - Windows 11 S Mode

You've asked nearly every question about S Mode I've ever answered in these forums, but unfortunately, I can't find the previous extensive answers via search to direct you to, so I'll try to make short responses here.

S Mode is a badly understood version of Windows 10 or 11 built from the Windows Core internal version a few years back that removed many of the most vulnerable components including access to shells like Command Prompt or PowerShell, scripting languages, RegEdit and the Win32 API set including all traditional executable file types like EXE, COM, BAT, etc. This is also why S Mode only runs apps from the Microsoft store, since they aren't typical executables and thus can't be installed manually from the Internet the way those older file formats could.

What Is Windows 10 or Windows 11 in S Mode?

That article URL I referenced is the fairest description of S Mode I've seen, since it tries to describe what I just did in more detail. These are why S Mode is truly so secure and nothing you can do after reverting to the outdated legacy mode of Windows everyone else is running will ever be able to make it anywhere near as secure again, so don't even consider switching modes if it's at all possible for you to keep S Mode. I guarantee you that with over 40 years' experience with computers and Microsoft products, including half my career as a security professional, I never will.

I've seen someone else mention a McAfee preinstalled product that I confirmed required switching out of S Mode to complete the installation, since though PC manufacturers can pre-install whatever app launchers they wish in S Mode, they can't actually install the executable version of those apps, nor can you unless you exit S Mode first. Can't recall if it was LiveSafe, but I personally know of no other true AV solution that can operate on S Mode, since they're all based on the executable format, while Windows Defender is embedded within the operating system itself.

You'll notice I've answered your questions in reverse, since they're really asked backwards, as understanding how secure S Mode is in the first place is key to understanding why 3rd-party and even manual scanning or other tools are really unnecessary, since there's simply so little traditional malware that can successfully attack an S Mode device, that most antimalware features re obsolete, as real-time and automatic scanning are sufficient to provide the minimal protection required.

To reinforce this, statement, the only "malware" I'm aware of that's been discussed in these forums with an S Mode device, were a few malicious browser extensions gotten from the Google Store which did things like redirect to advertising websites or cause other similar browsing issues. Of course, any other malicious advertising launched using standard browser methods would likely work as well, but of course the attempt to download malicious app executables or other traditional malware attacks via the browser would fail due to the inability for these to operate in S Mode I mentioned above.

If any of this isn't clear or you've got additional questions, feel free to ask. Though my own Microsoft Surface Go tablet is a first-generation device with Windows 10, these are so similar to Win11 S Mode that it's typically nearly the same other than the better touch interface and other new features that were improved.

Also note, the only other problem we commonly see here is when an S Mode device pops up a yellow triangle alert in the notification bar stating that a quick scan is needed. The reason this happens is actually due to a Microsoft Update, typically the monthly cumulative Windows update, that hasn't yet properly installed. This warning occurs because the Defender components are now out of sync with those relating to Windows itself and/or the currently available engine and definitions downloads, resulting in the automatic quick scan failing and thus prompting for a manually launched scan, which though at least in Windows 10 this can be done by clicking the alert icon, will still continue to fail until the appropriate Windows Update is successfully completed. So, the solution is to go into Windows Update in Settings and do that first.

Rob

< EDIT > Please note that thinking that you need some outdated 3rd-party app that's not available from the Windows Store typically means you just haven't spent the time to look for a modern alterative that is found in the Store.

The common type of person who does stupid things like exiting S Mode because of some ancient 3rd-party app often label themselves 'Power Users', since they're too lazy to actually learn anything new and must instead make everything on their new device look and feel exactly like the Windows XP system they had 20 years ago.

< EDIT 2 > Also please note, there are mostly 3rd-party apps available in the Windows Store, just not every old Win32 app has an exact equivalent there, since some developers are too lazy to provide a modern version of their app, even though Microsoft has made various tools available to make it easier for them to do so. Why would anyone want to use apps from a developer who won't keep their software up to date?

Hi mich w1

I am Dave, I will help you with this.

In Windows 11 in S Mode, Defender runs in the background and protects your PC, there is no method to perform manual scans, I think they do that because in S Mode, you can only install verified apps from the Microsoft Store, and therefore your PC is more secure, because 3rd party software cannot be installed in S Mode.

You can if you feel it is necessary, purchase that McAfee app on the Microsoft Store

To be honest, most people do find they need to switch out of S Mode to Windows 11 Home, because they need to install 3rd party software, if you switch, that is free to do, and is not reversable, you will have the option in Defender to perform different scans.