What’s new in Windows 10 Enterprise LTSC 2021

Windows 10 Enterprise LTSC 2021 builds on Windows 10 Enterprise LTSC 2019, adding premium features such as advanced protection against modern security threats and comprehensive device management, app management, and control capabilities. Windows 10 Enterprise LTSC 2021 enhances security and functionality for businesses, ensuring a robust operating environment.

The Windows 10 Enterprise LTSC 2021 release includes the cumulative enhancements provided in Windows 10 versions 1903, 1909, 2004, 21H1, and 21H2. Details about these enhancements are provided below.

The Windows 10 Enterprise LTSC 2021 version also supports advanced security features that are essential for enterprise environments, making it a preferred choice for organizations looking to enhance their security posture.

Hardware security

System Guard

System Guard has improved a feature in this version of Windows called SMM Firmware Protection. This feature is built on top of System Guard Secure Launch to reduce the firmware attack surface and ensure that the System Management Mode (SMM) firmware on the device is operating in a healthy manner – specifically, SMM code cannot access the OS memory and secrets.

In this release, Windows Defender System Guard enables an even higher level of System Management Mode (SMM) Firmware Protection that goes beyond checking the OS memory and secrets to other resources like registers and IO.

For users of Windows 10 Enterprise LTSC 2021, this improvement leads to a significant reduction in potential vulnerabilities, making it an ideal choice for sensitive operations.

With this improvement, the OS can detect a higher level of SMM compliance, enabling devices to be even more hardened against SMM exploits and vulnerabilities. Based on the platform, the underlying hardware and firmware, there are three versions of SMM Firmware Protection (one, two and three), with each subsequent versions offering stronger protections than the preceding ones.

There are already devices in the market today that offer SMM Firmware Protection versions one and two. SMM Firmware Protection version three This feature is currently forward-looking and requires new hardware that will be made available soon.

Operating system security

The enhancements in Windows 10 Enterprise LTSC 2021 are designed specifically to address the needs of modern businesses, ensuring that they can operate securely and efficiently.

System security

Windows Security app improvements now include Protection history, including detailed and easier to understand information about threats and available actions, Controlled Folder Access blocks are now in the Protection history, Windows Defender Offline Scanning tool actions, and any pending recommendations.

Encryption and data protection

With Windows 10 Enterprise LTSC 2021, organizations can manage their data protection strategies more effectively, ensuring compliance with industry standards.

BitLocker and Mobile Device Management (MDM) with Azure Active Directory work together to protect your devices from accidental password disclosure. Now, a new key-rolling feature securely rotates recovery passwords on MDM-managed devices. The feature is activated whenever Microsoft Intune/MDM tools or a recovery password is used to unlock a BitLocker protected drive. As a result, the recovery password will be better protected when users manually unlock a BitLocker drive.

Network security

Windows Defender Firewall

Windows 10 Enterprise LTSC 2021’s firewall capabilities provide an added layer of security, protecting against external threats while allowing for dynamic traffic regulation.

Windows Defender Firewall now offers the following benefits:

Reduce risk: Windows Defender Firewall reduces the attack surface of a device with rules to restrict or allow traffic by many properties, such as IP addresses, ports, or program paths. Reducing the attack surface of a device increases manageability and decreases the likelihood of a successful attack.

Safeguard data: With integrated Internet Protocol Security (IPsec), Windows Defender Firewall provides a simple way to enforce authenticated, end-to-end network communications. It provides scalable, tiered access to trusted network resources, helping to enforce integrity of the data, and optionally helping to protect the confidentiality of the data.

For enterprises leveraging Windows 10 Enterprise LTSC 2021, the firewall is crucial in maintaining a secure network environment.

Extend value: Windows Defender Firewall is a host-based firewall that is included with the operating system, so there is no additional hardware or software required. Windows Defender Firewall is also designed to complement existing non-Microsoft network security solutions through a documented application programming interface (API).

The Windows Defender Firewall is also now easier to analyze and debug. IPsec behavior has been integrated with Packet Monitor (pktmon), an in-box cross-component network diagnostic tool for Windows.

Additionally, the Windows Defender Firewall event logs have been enhanced to ensure an audit can identify the specific filter that was responsible for any given event. This enables analysis of firewall behavior and rich packet capture without relying on other tools.

The enhanced monitoring features in Windows 10 Enterprise LTSC 2021 provide administrators with real-time insights, crucial for maintaining security across enterprise networks.

Windows Defender Firewall also now supports Windows Subsystem for Linux (WSL); You can add rules for WSL process, just like for Windows processes. For more information, see Windows Defender Firewall now supports Windows Subsystem for Linux (WSL).

Virus and threat protection

Attack surface area reduction – IT admins can configure devices with advanced web protection that enables them to define allow and deny lists for specific URL’s and IP addresses. Next generation protection – Controls have been extended to protection from ransomware, credential misuse, and attacks that are transmitted through removable storage.

Windows 10 Enterprise LTSC 2021 delivers comprehensive threat protection, ensuring that enterprises remain resilient against evolving cyber threats.

• Integrity enforcement capabilities – Enable remote runtime attestation of Windows 10 platform.
• Tamper-proofing capabilities – Uses virtualization-based security to isolate critical Microsoft Defender for Endpoint security capabilities away from the OS and attackers. Platform support – In addition to Windows 10, Microsoft Defender for Endpoint’s functionality has been extended to support Windows 7 and Windows 8.1 clients, as well as macOS, Linux, and Windows Server with both its Endpoint Detection (EDR) and Endpoint Protection Platform (EPP) capabilities.

Advanced machine learning: Improved with advanced machine learning and AI models that enable it to protect against apex attackers using innovative vulnerability exploit techniques, tools and malware.

The advanced machine learning capabilities of Windows 10 Enterprise LTSC 2021 provide predictive threat detection, allowing businesses to proactively address vulnerabilities.

Emergency outbreak protection: Provides emergency outbreak protection which will automatically update devices with new intelligence when a new outbreak has been detected.

Certified ISO 27001 compliance: Ensures that the cloud service has analyzed for threats, vulnerabilities and impacts, and that risk management and security controls are in place.

Geolocation support: Support geolocation and sovereignty of sample data as well as configurable retention policies.

With built-in compliance features, Windows 10 Enterprise LTSC 2021 helps organizations adhere to regulations while securing critical data.

Improved support for non-ASCII file paths for Microsoft Defender Advanced Threat Protection (ATP) Auto Incident Response (IR).

Application security

App isolation

The app isolation features in Windows 10 Enterprise LTSC 2021 enhance security by ensuring that untrusted applications do not compromise system integrity.

Windows Sandbox: Isolated desktop environment where you can run untrusted software without the fear of lasting impact to your device.

Microsoft Defender Application Guard

Microsoft Defender Application Guard enhancements include:

Windows 10 Enterprise LTSC 2021’s Application Guard helps protect enterprise users from malicious threats while browsing the internet.

• Standalone users can install and configure their Windows Defender Application Guard settings without needing to change registry key settings. Enterprise users can check their settings to see what their administrators have configured for their machines to better understand the behavior.
• Application Guard is now an extension in Google Chrome and Mozilla Firefox. Many users are in a hybrid browser environment, and would like to extend Application Guard’s browser isolation technology beyond Microsoft Edge. In the latest release, users can install the Application Guard extension in their Chrome or Firefox browsers. This extension will redirect untrusted navigation to the Application Guard Edge browser. There is also a companion app to enable this feature in the Microsoft Store. Users can quickly launch Application Guard from their desktop using this app. This feature is also available in Windows 10, version 1803 or later with the latest updates.To try this extension:
  1. 1. Configure Application Guard policies on your device.
     2. Go to the Chrome Web Store or Firefox Add-ons and search for Application Guard. Install the extension.

  For organizations, implementing Windows 10 Enterprise LTSC 2021 means gaining access to enhanced security features that are vital for today’s digital landscape.

  1. 1. Follow any additional configuration steps on the extension setup page.
     2. Reboot the device.
     3. Navigate to an untrusted site in Chrome and Firefox.

  The improvements in Windows 10 Enterprise LTSC 2021 ensure that users can operate securely, even when accessing potentially unsafe websites.

Dynamic navigation: Application Guard now allows users to navigate back to their default host browser from the Application Guard Microsoft Edge. Previously, users browsing in Application Guard Edge would see an error page when they try to go to a trusted site within the container browser. With this new feature, users will automatically be redirected to their host default browser when they enter or click on a trusted site in Application Guard Edge. This feature is also available in Windows 10, version 1803 or later with the latest updates.

Application Guard performance is improved with optimized document opening times:

• • An issue is fixed that could cause a one minute or more delay when you open a Microsoft Defender Application Guard (Application Guard) Office document. This can occur when you try to open a file using a Universal Naming Convention (UNC) path or Server Message Block (SMB) share link.

For enterprises, the enhanced performance in Windows 10 Enterprise LTSC 2021 translates to a more efficient workforce capable of handling complex tasks securely.

• A memory issue is fixed that could cause an Application Guard container to use almost 1 GB of working set memory when the container is idle.
• The performance of Robocopy is improved when copying files over 400 MB in size.

Edge support for Microsoft Defender Application Guard has been available for Chromium-based Edge since early 2020.

With Windows 10 Enterprise LTSC 2021, organizations can integrate security with usability, providing a seamless experience for their users.

Application Guard now supports Office: With Microsoft Defender Application Guard for Office, you can launch untrusted Office documents (from outside the Enterprise) in an isolated container to prevent potentially malicious content from compromising your device.

Application Control

Application Control for Windows: In Windows 10, version 1903 WDAC added a number of new features that light up key scenarios and provide feature parity with AppLocker.

Application Control in Windows 10 Enterprise LTSC 2021 protects critical systems from unauthorized applications, ensuring enterprise integrity.

• • Multiple Policies: WDAC now supports multiple simultaneous code integrity policies for one device in order to enable the following scenarios: 1) enforce and audit side by side, 2) simpler targeting for policies with different scope/intent, 3) expanding a policy using a new ‘supplemental’ policy.
  • Path-Based Rules: The path condition identifies an app by its location in the file system of the computer or on the network instead of a signer or hash identifier. Additionally, WDAC has an option that allows admins to enforce at runtime that only code from paths that are not user-writeable is executed. When code tries to execute at runtime, the directory is scanned and files will be checked for write permissions for non-known admins. If a file is found to be user writeable, the executable is blocked from running unless it is authorized by something other than a path rule like a signer or hash rule.
    This brings WDAC to functionality parity with AppLocker in terms of support for file path rules. WDAC improves upon the security of policies based on file path rules with the availability of the user-writability permission checks at runtime time, which is a capability that is not available with AppLocker.
  • Allow COM Object Registration: Previously, WDAC enforced a built-in allow list for COM object registration. While this mechanism works for most common application usage scenarios, customers have provided feedback that there are cases where additional COM objects need to be allowed. The 1903 update to Windows 10 introduces the ability to specify allowed COM objects via their GUID in the WDAC policy.

The enhancements in Windows 10 Enterprise LTSC 2021 allow for a more secure application environment, vital for enterprise operations.

Identity and privacy

Secured identity

Windows Hello enhancements include:

Windows Hello features in Windows 10 Enterprise LTSC 2021 further secure user identities, essential for enterprise environments.

• • Windows Hello is now supported as Fast Identity Online 2 (FIDO2) authenticator across all major browsers including Chrome and Firefox.
  • You can now enable passwordless sign-in for Microsoft accounts on your Windows 10 device by going to Settings > Accounts > Sign-in options, and selecting On under Make your device passwordless. Enabling passwordless sign in will switch all Microsoft accounts on your Windows 10 device to modern authentication with Windows Hello Face, Fingerprint, or PIN.
  • Windows Hello PIN sign-in support is added to Safe mode.

This capability in Windows 10 Enterprise LTSC 2021 ensures that enterprises can effectively manage user authentication in a secure manner.

• • Windows Hello for Business now has Hybrid Azure Active Directory support and phone number sign-in (MSA). FIDO2 security key support is expanded to Azure Active Directory hybrid environments, enabling enterprises with hybrid environments to take advantage of passwordless authentication. For more information, see Expanding Azure Active Directory support for FIDO2 preview to hybrid environments.
  • With specialized hardware and software components available on devices shipping with Windows 10, version 20H2 configured out of factory, Windows Hello now offers added support for virtualization-based security with supporting fingerprint and face sensors. This feature isolates and secures a user’s biometric authentication data.
  • Windows Hello multi-camera support is added, allowing users to choose an external camera priority when both external and internal Windows Hello-capable cameras are present.

The streamlined Windows Hello experience in Windows 10 Enterprise LTSC 2021 enhances security while providing users with seamless access.

• • Windows Hello FIDO2 certification: Windows Hello is now a FIDO2 Certified authenticator and enables password-less login for websites supporting FIDO2 authentication, such as Microsoft account and Azure AD.
  • Streamlined Windows Hello PIN reset experience: Microsoft account users have a revamped Windows Hello PIN reset experience with the same look and feel as signing in on the web.
  • Remote Desktop with Biometrics: Azure Active Directory and Active Directory users using Windows Hello for Business can use biometrics to authenticate to a remote desktop session.

For enterprises, the improvements in Windows 10 Enterprise LTSC 2021 allow for better user experience while maintaining security standards.

Credential protection

Windows Defender Credential Guard

Windows Defender Credential Guard is now available for ARM64 devices, for additional protection against credential theft for enterprises deploying ARM64 devices in their organizations, such as Surface Pro X.

Windows Defender Credential Guard in Windows 10 Enterprise LTSC 2021 provides an additional layer of security against credential theft, crucial for enterprise integrity.

Privacy controls

Microphone privacy settings: A microphone icon appears in the notification area letting you see which apps are using your microphone.

Cloud Services

The cloud services integrated within Windows 10 Enterprise LTSC 2021 further secure enterprise applications and data.

Microsoft Endpoint Manager

Configuration Manager, Intune, Desktop Analytics, Co-Management, and Device Management Admin Console are now Microsoft Endpoint Manager. See the Nov. 4 2019 announcement. Also see Modern management and security principles driving our Microsoft Endpoint Manager vision.

Configuration Manager

Windows 10 Enterprise LTSC 2021 offers robust management tools that enhance the organization’s security posture.

An in-place upgrade wizard is available in Configuration Manager. For more information, see Simplifying Windows 10 deployment with Configuration Manager.

Microsoft Intune

Microsoft Intune supports Windows 10 Enterprise LTSC 2021, except for Windows Update Rings in device profiles.

Microsoft Intune’s support for Windows 10 Enterprise LTSC 2021 allows for streamlined device management and security compliance.

A new Intune remote action: Collect diagnostics, lets you collect the logs from corporate devices without interrupting or waiting for the end user. For more information, see Collect diagnostics remote action.

Intune has also added capabilities to Role-based access control (RBAC) that can be used to further define profile settings for the Enrollment Status Page (ESP). For more information see Create Enrollment Status Page profile and assign to a group.

Mobile Device Management

With Windows 10 Enterprise LTSC 2021, Mobile Device Management becomes more effective with tailored security policies for enterprise needs.

Mobile Device Management (MDM) policy is extended with new Local Users and Groups settings that match the options available for devices managed through Group Policy.

For more information about what’s new in MDM, see What’s new in mobile device enrollment and management

Windows Management Instrumentation (WMI) Group Policy Service (GPSVC) has a performance improvement to support remote work scenarios:

The improvements in Windows 10 Enterprise LTSC 2021 ensure remote work scenarios are supported with enhanced performance and security.

• An issue is fixed that caused changes by an Active Directory (AD) administrator to user or computer group memberships to propagate slowly. Although the access token eventually updates, these changes might not appear when the administrator uses gpresult /r or gpresult /h to create a report.

Key-rolling and Key-rotation

This release also includes two new features called Key-rolling and Key-rotation enables secure rolling of Recovery passwords on MDM-managed AAD devices on demand from Microsoft Intune/MDM tools or when a recovery password is used to unlock the BitLocker protected drive. This feature will help prevent accidental recovery password disclosure as part of manual BitLocker drive unlock by users.

Key-rolling and key-rotation features in Windows 10 Enterprise LTSC 2021 prevent accidental recovery password disclosure, essential for enterprise data integrity.

Deployment

SetupDiag

SetupDiag is a command-line tool that can help diagnose why a Windows 10 update failed. SetupDiag works by searching Windows Setup log files. When searching log files, SetupDiag uses a set of rules to match known issues. In the current version of SetupDiag there are 53 rules contained in the rules.xml file, which is extracted when SetupDiag is run. The rules.xml file will be updated as new versions of SetupDiag are made available.

The SetupDiag tool in Windows 10 Enterprise LTSC 2021 helps enterprises diagnose update issues efficiently, ensuring minimal downtime.

Reserved storage

Reserved storage: Reserved storage sets aside disk space to be used by updates, apps, temporary files, and system caches. It improves the day-to-day function of your PC by ensuring critical OS functions always have access to disk space. Reserved storage will be enabled automatically on new PCs with Windows 10, version 1903 pre-installed, and for clean installs. It will not be enabled when updating from a previous version of Windows 10.

Windows Assessment and Deployment Toolkit (ADK)

The new Windows ADK supports both Windows 10 Enterprise LTSC 2021 and Windows 11, providing flexibility for enterprise deployment strategies.

A new Windows ADK is available for Windows 11 that also supports Windows 10, version 21H2.

Microsoft Deployment Toolkit (MDT)

For the latest information about MDT, see the MDT release notes.

For enterprises, the Microsoft Deployment Toolkit (MDT) enhances deployment capabilities across Windows 10 Enterprise LTSC 2021 environments.

Windows Setup

Windows Setup answer files (unattend.xml) have improved language handling.

Improvements in Windows Setup with this release also include:

Windows Setup improvements in Windows 10 Enterprise LTSC 2021 streamline deployment processes, critical for enterprise IT efficiency.

• • Reduced offline time during feature updates
  • Improved controls for reserved storage
  • Improved controls and diagnostics

Enhanced recovery options in Windows 10 Enterprise LTSC 2021 ensure that enterprises can quickly recover from issues, minimizing impact.

• New recovery options

For more information, see Windows Setup enhancements in the Windows IT Pro Blog.

Microsoft Edge

The in-box support for Microsoft Edge in Windows 10 Enterprise LTSC 2021 provides enterprises with a secure browsing experience.

Microsoft Edge Browser support is now included in-box.

Microsoft Edge kiosk mode

Microsoft Edge kiosk mode is available for LTSC releases starting in Windows 10 Enterprise 2021 LTSC and Windows 10 IoT Enterprise 2021 LTSC.

Microsoft Edge kiosk mode in Windows 10 Enterprise LTSC 2021 creates controlled browsing environments for enterprise settings.

Microsoft Edge kiosk mode offers two lockdown experiences of the browser so organizations can create, manage, and provide the best experience for their customers. The following lockdown experiences are available:

• • Digital/Interactive Signage experience – Displays a specific site in full-screen mode.
  • Public-Browsing experience – Runs a limited multi-tab version of Microsoft Edge.

With Windows 10 Enterprise LTSC 2021, organizations can easily manage browsing experiences tailored to customer interactions.

• Both experiences are running a Microsoft Edge InPrivate session, which protects user data.

Windows Subsystem for Linux

Windows Subsystem for Linux (WSL) is available in-box.

Windows Subsystem for Linux in Windows 10 Enterprise LTSC 2021 offers enterprises a versatile development environment.

Networking

WPA3 H2E standards are supported for enhanced Wi-Fi security.

 

WPA3 support in Windows 10 Enterprise LTSC 2021 enhances networking security for enterprise environments.

Product tags: windows 10 end of life, windows 10 enterprise download iso, windows 10 support end date, product key for windows 10, windows 10 ltsc, win10 ltsc, windows ltsc, ltsc windows, win10 enterprise ltsc, windows 10 iot ltsc, windows 10 download, end of life windows 10, end of support windows 10, windows 10 license key, download windows 10,