Why pay for Windows Pro’s advanced features when you can get them for free?

Microsoft mainly supplies Windows in two different editions: Home and Professional.

Windows 11 Home is pre-installed on many PCs, while the Pro edition is often installed on business devices. This is because Windows 11 Pro can be integrated into a company’s network infrastructure (Active Directory), whereas the Home edition cannot.

However, this feature is not necessary for private users who are unlikely to operate a Windows server in their home network.

Nevertheless, the Windows Pro edition has some features that are of interest to everyone.

• Saving tip 1: Buy Windows 11 Pro legally for just $79 instead of $199
• Saving tip 2: Buy a Windows 11 Pro upgrade for just $59 instead of $99

If you want to take advantage of this, you can perform a Pro update for a fee. For details, see the box “Upgrade from Windows 11 Home to Pro.”

IDG

But an upgrade from Windows Home can also be completely free: Almost all Pro functions can be replaced by free software.

It is even possible to unlock two Pro functions in the Home Edition, which we describe in more detail in this article.

See also: Windows survival skills: 8 things every PC user should know how to do

The differences between Windows Home and Pro

There are actually only a few points where the two editions differ. Here are the most important and relevant for private users:

• Bitlocker encryption, which can be used to secure the entire drive or USB sticks, is reserved for the Pro edition. Bitlocker is particularly useful for laptops so that nobody can access your data if the device is lost. However, Microsoft has added a similar function to the Home edition of Windows 11 24H2 with device encryption (point 3). This requires you to log in with a Microsoft account. Users who do not want a Microsoft account or use Windows 10 can use alternative methods (points 4 and 5).
• Hyper-V is software that can be used to virtualize operating systems. For example, you can install Linux or Windows in Hyper-V while Windows is running and use it as a virtual second system. We describe how Hyper-V can be activated in the Home edition and what the alternative Virtualbox offers in points 6 and 7.
• The remote desktop enables remote access to the desktop of another Windows computer via the network. The Home edition only offers remote support, where a user must first invite a helper before they can access the other PC. Both methods are only suitable to a limited extent for spontaneous help via the internet. Remote access only works if the necessary ports are open in the router firewall. This is not necessary for other remote assistance programs (see point 8).
• Group policies offer centralized management of user rights. They are mainly used in larger company networks in which functions can be restricted or specified on all PCs via the central server. Local group policies are a variant for computers that do not belong to a Windows domain. The editor for this can be activated in the Home edition, or an alternative tool can be used (see box “Configuring Windows with group policies”).

Encryption with Windows on-board resources

With the Home edition of Windows 10 and 11, you cannot encrypt drives with Bitlocker. However, it is possible to integrate encrypted external hard drives or USB sticks into the file system. Encryption must be carried out on another PC on which the Pro or Enterprise edition is installed.

If no other computer is available, use a virtual PC (point 6 or 7).

Microsoft

Go to “Settings” (Win-I), search for Bitlocker and click on “Manage Bitlocker.” Click on the desired drive and then on “Activate Bitlocker.”

Tick the box “Use password to unlock the drive” and enter a sufficiently secure password. After clicking on “Next,” save the recovery key in a file, for example. Follow the further instructions of the wizard.

A drive encrypted in this way can also be used with the Home edition. If you open it in the file manager by double-clicking on it, Windows will ask you for the password.

Device encryption of Windows 11 24H2

Microsoft has equipped Windows 11 24H2 Home with a new function that can be used to encrypt the system drive. Bitlocker provides the basis, albeit with fewer options than the Pro edition. Windows login with a Microsoft account is also required.

Chris Hoffman / IDG

If you are using version 24H2, you should check the option in the “Settings” under “Privacy and security > Device encryption.”

If “Device encryption” is not displayed, the system requirements for Windows 11 are probably not met. Then check in the firmware settings of the PC whether TPM and Secure Boot are activated.

If you activate device encryption, you should save the associated recovery key. You can determine the key via account.microsoft.com/devices/recoverykey after logging in with your Microsoft account.

The recovery key is required so that you can access your data via a rescue or secondary system in the event of Windows or hardware problems.

See also: How to make Microsoft Windows services work for you

Encrypt drives with Veracrypt

If you don’t want to or can’t use Bitlocker or device encryption, Veracrypt is an almost equivalent alternative. The tool also has the advantage that it is available for Linux and Mac OS. You can also use it to integrate encrypted Windows drives under these systems.

In terms of security, it is difficult to compare Bitlocker and Veracrypt. With the open source tool Veracrypt, you can examine the source code and check the code quality and implementation of the algorithms. This is not possible with Bitlocker.

Neither method can promise 100 percent security — ultimately, the use of any software is a question of trust.

A study conducted by the Fraunhofer Institute for Secure Information Technology (SIT) in 2020 is entitled “VeraCrypt with minor flaws.” No serious vulnerabilities were found.

Veracrypt is not as well integrated into the system as Bitlocker. It is somewhat cumbersome to use and you have to enter the password for decryption every time you restart Windows. For security reasons, the password should be more than 20 characters long and sufficiently complex.

If this is too much effort for you, you should consider whether you really need to encrypt the entire hard drive. Perhaps the solution presented in point 5 will suffice. Please also note that Veracrypt only requests the password on a restart. When reactivating after “Sleep,” only the Windows password is requested by default.

If you want to encrypt the system partition, proceed as follows:

Step 1: The use of Veracrypt is considered secure. Nevertheless, it is advisable to create a complete backup of the Windows partition or at least the personal files.

If, for example, the power fails during encryption, the files on the hard drive will no longer be readable. Also have a USB stick ready that is formatted with the FAT32 file system.

About 5MB of free space is sufficient and you can also use the stick for other purposes.

Veracrypt

Step 2: In Veracrypt, go to “System > Encrypt system partition/system drive.” Follow the easy-to-understand instructions of the wizard. You can accept the defaults almost everywhere.

When entering the password, please note that the Veracrypt bootloader works with the U.S. keyboard layout. The program takes this into account and switches the keyboard layout when entering the password. Tick the “Show password” box to see the actual password.

Step 3: The wizard prompts you to create a rescue data carrier. By default, Veracrypt saves the required file under the name “VeraCrypt Rescue Disk.zip” in your “Documents” folder.

Unzip the file and copy the “EFI” folder it contains to your FAT32-formatted USB stick. After clicking on “Next,” the wizard will check whether the folder is present.

Step 4: In the “System encryption pre-test” step, click on “Test.” Read the description, which is best printed out. Click on “Yes” when you are prompted to restart the PC. Type in the password and confirm with the Enter key.

If Veracrypt does not accept the password, for example if it is entered incorrectly, press the Esc key. Windows will then start as usual from the previously unencrypted hard drive and you will have to configure the encryption again.

Otherwise, Windows will start after you enter the password. After Windows logon, the “Pre-test completed” window appears automatically, in which you click on “Encrypt.” Veracrypt then starts the encryption process, which may take some time. A window will inform you of the progress.

Step 5: Try booting from the rescue drive. You may need to change the boot sequence in the firmware setup. The rescue system offers a simple menu that can be used to repair the Veracrypt boot loader, load an alternative boot loader, or decrypt the system partition.