Problems when deploying Windows to Surface devices with preinstalled Windows 10 in S mode

When you try to install or deploy an image on a Surface device that has Windows 10 in S mode preinstalled, you may encounter one or more of the following issues:

Issue 1

After the deployment of an image by using Microsoft Deployment Toolkit (MDT), System Center Configuration Manager, or another deployment tool, the device is configured in S mode even though the image is not configured for S mode.

Issue 2

If you are deploying Windows in an automated manner by using Microsoft Deployment Toolkit (MDT), you may see the following error messages during Lite Touch:

Logs may show error message that resemble the following:

Issue 3

You receive a pop-up message that states "Your organization used Device Guard to block this app."

To fix the issue, use one of the following solutions:

• Purchase a commercial version of the device that has Windows 10 Professional installed.  See Where to buy Surface.
• Switch the device out of S mode manually by using the Microsoft Store, and then deploy the image.

For information about how to change editions by using Intune, see Use a configuration profile to upgrade Windows 10, or switch from S mode in Intune.

Before you deploy new operating system, check the product terms to determine your reimaging licensing options for qualifying operating systems.

On a Surface that had preinstalled Windows 10 in S mode that was then taken out of S mode, if you use a Surface recovery image to reimage the device, the Surface will switch back to S mode.

If you order a warranty replacement device for a Surface that had preinstalled Windows 10 in S mode that was then taken out of S mode, the Surface device replacement will be in S mode. This is because your replacement device will be the same "consumer stock keeping unit" (SKU) as the original.