1

What’s New in Windows 8.1 for Business (Pro and Enterprise Editions)

This document outlines the key feature comparison of Windows 7, Windows 8 and Windows 8.1 for Business (Pro and Enterprise). The purpose of this document is to

summarize the tremendous value Windows 8.1 brings to your business, and to help you make informed decisions.

Feature name Windows 7 Windows 8 Windows 8.1 Feature Enhancements

User Experience – The new Windows 8.1 user interface can be easily customized for a unique, individual experience. There are more ways to create an experience that’s personal, expressive, and keeps pace with your work and life.

Make Windows all about you – Windows 8.1 makes your work more vibrant and powerful, but also more personal.

Lock screen photo slide show Sets favorite pictures and turns the lock screen display into your cloud powered photo frame. Sources can

include photo folders or files, from local or SkyDrive.

The Start screen and l ive tiles Start screen has all of the information that matters most. Live tiles always keep you up-to-date. You can

customize the Start screen and tiles to put your favorite apps front and center.

Customize tiles + In Windows 8, you can only select and customize one tile at a time. In Windows 8.1, you can select multiple

tiles and then move, uninstall, resize, or turn off live tiles all at once.

Ti le sizes + In Windows 8, there are 2 tile sizes – medium and wide – you can choose. In Windows 8.1, existing tile sizes

remain in addition to new small and large tiles to fit your need.

Set the desktop wallpaper as Start screen

background Sets the background of the background and the Start screen to be the same to create seamless experience.

Get around faster – With Windows 8.1, you can find things fast, switch between apps, and get around efficiently on your device.

Apps launch other apps + In Windows 8, the app doing the launching was automatically removed from the screen. In Windows 8.1, it

allows an app to launch another app in a snap view next to the launching app.

Use multiple apps side by side + Windows 8 was limited to two apps at once, and 1/3 or 2/3 snapping or just one windows per app. In

Windows 8.1, depending on the resolution of the screen, you can open up to four apps side by side with

flexible windows sizing for each app on the screen for multitasking.

Bing Smart Search + In Windows 8, search provides different results, depending on whether you are in an app (in-app results), or

on the Start screen or desktop (whole PC). In Windows 8.1, Bing Smart Search provides results that include

the best of the PC and the web in a simple-to-read, app-like experience.

Automatically backup and sync settings across devices via SkyDrive

Files, start screen layout, apps and their settings, and other personalization (e.g. theme, reading list, browser

favorites, etc.) are stored on SkyDrive and follow you to other devices. It automatically roams or backups

those settings, and makes all of this integrated into PC Settings.

The Start button on Desktop In Windows 8.1, the Start button is located on the lower-left corner of the screen, allowing one-click/tap

access to the Start screen.

Optional boot to the desktop/Apps View/Start screen Allows you to select where to boot your device: direct to Desktop, Apps View, or the Start screen.

Apps – Windows apps and services help you stay productive and connected while mobile, bringing together all you do across all your d evices.

Windows Store The Windows Store is the place to find new apps and old favorites. With over 100,000 apps since the launch

of Windows 8, Windows Store is constantly being refreshed with high-quality submissions from a global

community of creative app builders.

2

Feature name Windows 7 Windows 8 Windows 8.1 Feature Enhancements

Automatic app updates (for both apps from Windows Store and build-in apps)

Installed apps from the Windows Store can be set to automatically get updates. The built-in apps also get

updates automatically, even when the store has been disabled for the user by the IT organization.

Popular Office apps that are preinstalled in Windows RT +

Windows RT 8 has Office Home & Student 2013 RT pre-installed (with Word, Excel, PowerPoint, OneNote.)

Windows RT 8.1 has Office Home & Student 2013 RT that also includes Outlook 2013 RT.

Bui lt-in apps (Mail, Calendar, People, and

more) Details in footnotei

Xbox SmartGlassii with Play To / Play On SmartGlass turns the mobile phone or tablet into a second screen that intelligently interacts with Xbox 360

to elevate the entertainment experience.

Management – Windows 8.1 empowers Bring Your Own Device programs responsibly with enhanced management features. You can work from more places with more secure access to company data and apps - staying productive and confident.

Ass igned access Enables a single Windows Store app experience on dedicated-use devices. It turns on a predefined set of

filters that blocks other actions so the specified app runs and other apps can’t be accessed.

Open Mobile Device Management New OMA-DM capabilities are built in and enable mobile device management using third-party MDM

solutions with no additional agent required. Enhanced policies manage more settings from both Windows

Intune and the third-party MDM solutions.

Sideloading LOB apps

For Windows 8/8.1, desktop apps can continue to be deployed as they always have been. For new touch-

optimized Windows 8/8.1 apps, the Windows Store is a great way to install these apps to business

customers. Medium- or enterprise-size customers who typically deploy apps at broader scale might want to

also distribute new Windows 8/8.1 apps directly to devices within their organization. For example, this direct

deployment option makes sense for custom developed line-of-business apps or enterprise software

purchased directly from an ISV.

Customers can enable their devices running Windows 8/8.1 Enterprise, Windows 8/8.1 Pro, or Windows RT

8/8.1 for direct deployment of custom-developed, line-of-business Windows 8/8.1 apps outside of the

Windows Store through Enterprise Sideloading. iii

Start screen control

IT departments can control the layout of the Start screen on company-issued devices to ensure key apps are

easily accessible. It also prevents users from customizing their Start screen to ensure consistency across

individual workgroups or the entire company.

*Only available in Windows 8.1 Enterprise.

Work folders Work Folders allows you to automatically sync your work files and folders located on a corporate file server

in the data center to your personal device without needing to join a domain or connect with a VPN from

your user folder located in the corporation’s data center.

Workplace join Your personal device can be registered with the company Active Directory, thereby enabling your personal

device to access corporate resources that have been published with conditional access policies once your

identity and the device you are using has been verified.

Domain Join and Group Policy A domain is a group of network PCs that share a common database and security policy. Group Policy

provides the centralized management and configuration of operating systems, applications, and users'

settings in an Active Directory environment.

Virtualization – Microsoft virtualization technologies help personalize the user experience, simplify application deployment, and enhance work style whenever you go.

App-V + In Windows 8, App-V 5.0 enables your desktop applications to be delivered virtually anywhere, regardless of

your device. In Windows 8.1, App-V 5.0 SP2 builds on existing solutions through the following new features:

1) Shell extension support, enabling the virtual application to behave more like if it was installed locally on

3

your device. 2) Sequencing enhancements, simplifying the virtual application creation process and

improving the overall experience of deploying a set of applications to you.

*This is a feature in the Microsoft Desktop Optimization Pack (MDOP) suite. It is available to Software

Assurance for Windows customers as an add-on subscription license.

Feature name Windows 7 Windows 8 Windows 8.1 Feature Enhancements

User Experience Virtualization (UE-V) +

UE-V is an on premise solution that captures and centralizes application and Windows settings for the user.

This enables users to change devices without reconfiguring their applications or settings. UE-V in Windows 8

focuses on providing a personal and flexible experience for the end user, being simple and versatile for the

IT Pro to enable what applications should have their settings roam, and be easily integrated and can scale

through your existing tools and infrastructure. In Windows 8.1, UE-V 2.0 continues to deliver on these focus

area by: 1) Supporting Windows 8 apps enabling you to personalize these apps across your devices. 2)

Providing tools giving you flexibility to control how your own applications and personal settings roam with

the new Company Settings Center. 3) Delivering enhancements to the underlying sync engine to optimize

the integration and scalability of UE-V with your existing infrastructure.

*This is a feature in the Microsoft Desktop Optimization Pack (MDOP) suite. It is available to Software

Assurance for Windows customers as an add-on subscription license.

Virtual desktop infrastructure (VDI)

enhancements +iv

In Windows 8, enhancements in Microsoft RemoteFX and Windows Server 2012 provide users with a rich

desktop experience with the ability to play 3D graphics, use USB peripherals and use touch-enabled devices

across any type of network (LAN or WAN) for VDI scenarios.

In Windows 8.1, enhanced VDI in Windows Server 2012 R2 with improvements in Management, Value, and

User Experience: Session Shadowing allows Admins to view and remotely control active user sessions in an

RDSH server. Disk dedupe and storage tiering allow for lower cost storage options. User experience for

RemoteApps, network connectivity and multiple displays has been improved.

*This is a feature in Windows 8/8.1 Enterprise.

Security and Compliance –Windows delivers the security, performance, updates, and compatibil ity to help manage today’s devices and infrastructure – and it works

with the infrastructure and tools you already have.

AppLocker + + In Windows 8 and 8.1, AppLocker has the ability to set rules for Windows Store apps.

*Only available in Windows 7/8/8.1 Enterprise.

Vulnerability exploit protection (ASLR, DEP) + +

In Windows 7, Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) were

available however these technologies were only used to protect some aspects of Windows. In Windows 8

and Windows 8.1, significant improvements have been made to ASLR, DEP, the heap architecture, and

memory-management algorithms which dramatically reduce the likelihood that vulnerabilities that are

discovered in Windows and or applications can successfully be exploited.

Windows Defender + ++

In Windows 8, Windows Defender was upgraded from antispyware to a full-featured antimalware solution

that is capable of detecting and stopping the full range of range of malicious applications, including viruses,

trojans, etc. Windows Defender takes advantage of the Windows 8.1 ELAM feature which protects it from

tampering and enables the device’s antimalware solution to start before any 3rd

party code.

BitLocker and BitLocker To Go + ++ Detail in footnotes. v

Device Encryption

Prior to Windows 8.1, device encryption was only available in Windows RT and Windows Phone 8. In

Windows 8.1, device encryption is available in all editions of Windows and will automatically be enabled on

the system volume of InstantGo certified devices after a user with administrative privileges logs onto the

device with a Microsoft Account.

4

Feature name Windows 7 Windows 8 Windows 8.1 Feature Enhancements

Picture password Enables users to sign-in to Windows and authenticate using a series of touch gestures instead of a

traditional password.

Virtual Smartcard +

Virtual Smartcards enables organizations to move away from passwords and to a more secure multifactor

authentication option while addressing some of the cost and support issues related to other multifactor

solutions (e.g.: physical smartcards). Virtual Smartcards use a device’s Trusted Platform Module (TPM) to

secure a user’s identity which is then virtualized as a physical smartcard. In Windows 8.1, Virtual Smartcards

have been improved so that they can easily be provisioned to unmanaged devices.

PIN authentication Enables user to use a 4 digit PIN to sign in to their devices rather than a password.

Remote business data removal (RBDR) vi

Gives organizations more control over corporate content on devices which can be identified as corporate vs.

user. RBDR ensures that corporate data for supporting applications (e.g.: Mail, WorkFolders) is encrypted

and can be wiped from a device when the relationship between the organization and a user has ended or

when a device has been lost/stolen.

Advanced biometric framework and support for touch based fingerprint sensors +

Provides advanced biometric capabilities for authenticating user identities, acquiring user consent for

purchases, and confirming user presence when accessing sensitive apps and app data. Includes a common

identity enrollment experience that works with new and existing fingerprint sensors as well as support for

next-generation touch based fingerprint sensors.

System boot integrity (e.g. UEFI Secure

Boot / Trusted Boot)

Windows 8 certified devices include UEFI and its Secure Boot hardware which verifies that the Windows boot

loader is more secure when the device is powered on. If the bootloader has been tampered with or replaced,

Secure Boot will prevent it from starting. Windows 8 and Windows 8.1 also include Trusted Boot, which

verifies the integrity of the remainder of the Windows boot process, components, and antimalware solution.

When combined, UEFI’s Secure Boot and Windows Trusted Boot features prevent low level malware

infections from persisting on the device and protect the antimalware solution from tampering.

Windows and Internet Explorer

SmartScreen

Windows SmartScreen provides application reputation capabilities that enable Windows to block execution

of malicious applications coming from the internet. It is able to block execution of known bad applications

and will warn the user if they encounter new applications that lack a reputation. Internet Explorer includes a

SmartScreen technology to help protect users from phishing sites that may attempt to steal a user personal

information or identity. Like Windows SmartScreen, the Internet Explorers SmartScreen URL reputation

feature will block known bad websites and will warn users when they encounter suspicious content while

they are on the web.

Mobility and Networking – Anywhere, anytime is the new normal. People work from multiple locations and from multiple devices - enabling them to remain productive is the goal. With Windows 8.1, you won’t miss a moment – at your desk, around the office, and outside the office.

Windows To Go +vii

In Windows 8, IT organizations can create a fully manageable corporate desktop on a bootable external USB

drive. With Windows To Go in Windows 8.1, the Windows Store is enabled by default. Windows To Go users

may roam to any number of machines and access the Windows Store and use Windows Store apps.

*Windows To Go is a feature in Windows 8/8.1 Enterprise available to customers with Software Assurance.

BranchCache + viii

+ Details in footnote

*Only available in Windows 7/8/8.1 Enterprise.

5

Feature name Windows 7 Windows 8 Windows 8.1 Feature Enhancements

Bui lt-in VPN cl ients + In Windows 8, only the Microsoft VPN client was included in Windows RT. In Windows 8.1 and Windows RT

8.1, users can also use built-in 3rd

party VPN clients. This feature will be available with Microsoft and third-

party inbox VPN clients.

Auto-triggered VPN

When selecting an app or resource that needs access through the built-in VPN client – like a company’s

intranet site – Windows 8.1 will automatically prompt the user to sign in with one click. This feature will be

available with Microsoft and third-party inbox VPN clients. *only applicable to workgroup (non-domain-

joined) machines.

DirectAccess + +ix

Allows remote users to seamlessly access resources inside a corporate network without having to launch a

separate VPN and helps IT administrators keep remote users ’ PCs in compliance by applying the latest

policies, and software updates.

*Only available in Windows 7/8/8.1 Enterprise.

A New Class of Devices – Choose from a wide range of innovative tablets and PCs that are not only sleek and powerful but as unique and innovative as your business .

Work the way you need to with on a tablet with touch or at a desktop with mouse and keyboard. The result is a powerful, produ ctive, and rewarding experience that is truly one of kind that best represents your business.

InstantGox Your device goes from standby to “on” instantly. And InstantGo keeps data, apps, and tiles updated with

current information even on standby, by maintaining a network connection and syncing automatically.

Increased battery l ife + ++ One of the key design tenets of Windows 8 was to optimize for long battery life. With Windows 8.1, we are

seeing a new class of ultrathin PCs and tablets that turn on instantly, have great battery life on a single

charge, and stay connected.

Miracast wireless display support

Miracast is a wireless technology Windows 8.1 uses to project user’s screen to a TV, projector, or other

streaming media player that also supports Miracast. Users can use this to share what they doing on their PC,

show a slideshow presentation, or even play favorite game on a larger screen. Supports duplicate as well as

extend display.

NFC tap to pa ir with enterprise printers Tap Windows 8.1 device against an enterprise NFC-enabled printer and the users are all set to print. No

more hunting on network for the correct printer and no need to buy a special printer to take advantage of

this functionality. Simply attach an NFC tag to existing printers to enable this functionality.

Wi-Fi Direct wireless printing support Use Wi-Fi Direct printers without adding additional drivers or software on your Windows 8.1 device and

print directly without connecting to the network.

Broadband tethering Windows 8.1 provides the ability to use your mobile broadband PC or tablet as a personal hotspot, allowing

other devices to connect to the internet, just like connecting to a Wi-Fi hotspot.

Touchscreen keyboard improvements The updated touchscreen keyboard learns as the user types, making suggestions based on what the user

has written before.

3D printing support Apps can easily support multiple 3D paradigms including: comprehensive design, review, and printing;

special-purpose functionality with printing; or review and print only.

i In Windows 8.1, this includes: Alarms, Calculator, Calendar, Camera, Finance, Food & Drink, Games, Health & Fitness, Mail, Maps, Music, News, People, Photos, Reading List, Sound Recorder, Sports, Travel, Video, and Weather ii Xbox SmartGlass available as download in the Windows Store

6

iii Windows 8.1 Enterprise edition has features built in that enable Enterprise Sideloading, allowing customers running this edit ion on domain-joined PCs to easily manage the deployment of trusted Windows 8.1 apps through a policy setting (refer to this TechNet article to learn more about policy settings for Enterprise Sideloading). Customers will also be able to enable Enterprise Sideloading of trusted Windows 8.1 apps on Windows RT 8.1, Windows 8.1 Pro, or Windows 8.1 Enterprise devices that are not domain-joined by using a Volume Licensing Multiple Activation Key (MAK) in addition to the policy setting referenced above. iv Microsoft licenses Windows for virtual desktops by access device: • Virtual desktop access rights are a benefit of Windows Client Software Assurance (SA). Customers who intend to use PCs covered under SA have access to their Virtual Desktop Infrastructure (VDI) desktops at no additional charge. • Customers who want to use devices that do not qualify for Windows Client SA, such as thin clients, will need to license those devices with Windows Virtual Desktop Access (VDA) in order to access a Windows VDI desktop. Windows VDA is also applicable to 3rd party devices, such as contractor or employee-owned PCs. v BitLocker New functionality in Windows 8 and Windows Server 2012:

BitLocker provisioning - BitLocker can be used to deploy drives to an encrypted state during installation prior to calling setup.

Used Disk Space Only encryption - BitLocker now offers two encryption methods, Used Disk Space Only and Full volume encryption. Used Disk Space Only allows for a much quicker encryption experience by only encrypting used blocks on the targeted volume.

Standard User PIN and password change - Allows a standard user to change the BitLocker PIN or password on operating system volumes and the BitLocker password on data volumes, reducing

internal help desk call volume. Network Unlock - Enables a BitLocker system on a wired network to automatically unlock the system volume during boot (on capable Windows Server 2012 networks), reducing internal help desk call

volumes for lost PINs. Support for Encrypted Hard Drives for Windows - BitLocker support for Encrypted Hard Drives provides a familiar method for managing drive encryption along with the benefit o f using hardware-

based encryption. FIPS Support – The Windows 8.1 version of BitLocker is been updated to provide improved support for the federal regulations such as the Federal information Processing Standard (FIPS). The

Recovery Key Password now supports FIPS mode making BitLocker easy to deploy and manage in environments where FIPS compliance is required. BitLocker New functionality in Windows 8.1 and Windows Server 2012 R2:

Support for device encryption - BitLocker is providing support for device encryption on x86 and x64-based computers with a TPM that supports connected stand-by. Previously this form of encryption was only available on Windows RT devices.

vi This capability requires implementation in the client application and in the server application (Mail + Exchange Server). The client application determines if the wipe simply makes the data inaccessible or actually deletes it. vii Windows Store access is enabled by default, allowing workers to download and install apps on the Windows To Go drive from the network. viii BranchCache in Windows Server 2012 and Windows 8 provides substantial performance, manageability, scalability, and availability improvements:

Office sizes and the number of branch offices are not limited. BranchCache supports any number of offices of any size when the organization deploys hosted cache mode with multiple hosted cache

servers. There is no requirement for a Group Policy Object (GPO) for each office location, streamlining deployment. A single GPO that contains a small group of settings is all that is required to deploy

BranchCache in any size organization, from a large enterprise to a small business. Client computer configuration is automatic. Clients can be configured through Group Policy as distributed cache mode clients by default, however they will search for a hosted cache server – and if

one is discovered, clients automatically self-configure as hosted cache mode clients. BranchCache is deeply integrated with the Windows file server. BranchCache uses Windows file server’s state-of-the-art technology to divide files into small pieces and eliminate duplicates. This

greatly increases the chance of finding duplicate pieces in independent files, resulting in greater bandwidth savings. BranchCache is also more tolerant of small changes in large files. In addit ion, file division calculations are performed only one time. When a client computer that is running Windows 8 downloads content fro m a file server or web server that is running Windows Server 2012 and is using new Data Deduplication technology, there is no need for BranchCache to spend CPU cycles calculating how to divide the c ontent – because the file server and web server have already made these calculations. Duplicate content is stored once and downloaded once. When identical content exists in a file – or across many files on the content server or hosted cache server – BranchCache stores only one instance of the content, which provides disk storage savings. In addition, client computers at office locations download only one instance of duplicate content, saving additional WAN bandwidth.

Small changes to large files produce bandwidth savings. BranchCache now divides files and web pages into smaller pieces. BranchCache uses a highly optimized file server chunking system to choose

intelligent split points inside of files, providing the ability for client computers to download only the part of the file that is changed. Offline creation of content information. When deploying a BranchCache enabled file server or Web server as a content server, content information is calculated offline, well before a BranchCache

client requests a file. This provides faster performance and more bandwidth savings, because content information is ready for the first client that requests the content and calculations have already been performed.

7

Cache Encryption. Cached data is now stored encrypted by default. This allows the organization to ensure data security without using drive encryption technologies. Cache preloading. New tools are available that allow the user to load cacheable content onto hosted cache servers before the content is requested by client computers. The user can preload content

from media, such as DVDs or hard disks, or can transfer the content over the network to the hosted cache server. BranchCache is now manageable with Windows PowerShell and Windows Management Instrumentation (WMI). This enables scripting and remote management of BranchCache content servers,

hosted cache servers, and client computers. ix DirectAccess in Windows 8 and Windows Server 2012 offers many significant new and improved features. In Windows Server 2012, DirectAccess makes it simpler to deploy multisite configurations that connect to the nearest server, improves scalability with high availability, and improves performance in virtual environments. Beyond that, DirectAccess in Windows Server 2012 is easier to deploy than earlier versions, especially for small businesses. Windows Server 2012 combines DirectAccess and Routing and Remote Access Server (RRAS) into a unified server role, which IT admini strators can easily configure by using the Getting Started Wizard. They can deploy DirectAccess without a public key infrastructure (PKI) and provide access to IPv4 resources without using additional transition technologies. x Enabled on all editions that meet InstantGo certification requirements, at OEM discretion (named “connected standby” in the W indows 8 editions)