Windows as a Service isn't just for giving consumers new features; it's for enterprises, too.

For consumers, next spring's Windows 10 Creators Update is going to bring integrated virtual reality and 3D creativity. Today, Microsoft described what it will have to offer to enterprise customers.

The Anniversary Update added Windows Defender Advanced Threat Protection (ATP) that extended the Defender anti-malware to include cloud-based intelligence to detect anomalous behavior. Microsoft gave us a real-world example of this: a previously unknown (and hence, able to bypass antivirus software) cryptolocker variant was noticed to be deleting System Restore points prior to encrypting user data. This is an unusual thing for a piece of software to do, so much so that it was flagged, enabling the infected system to be isolated and the malware dealt with.

This ATP has also been integrated with Office 365 so that, for example, a malicious file can be correlated with the e-mail it was sent in.

In the Creators Update, this ability to detect unusual behavior is being extended. Currently, it examines files and network traffic; the update is adding the ability to detect in-memory payloads (for example, browser-based attacks that leave no on-disk evidence) and kernel exploits. Unknown malware that does things such as modify the memory of other processes or play clever games to inject drivers into the kernel, will be highlighted, enabling further investigation.

The dashboard used to manage these threats is being made more extensible so that administrators can add events and alerts based on their own intrusion detection systems. Honeypot servers, for example, can be plumbed into the Threat Intelligence system to make the dashboard more comprehensive.

ATP will also offer stronger remediation capabilities: suspicious machines can be isolated from the rest of the network, forensically dumped, and have files and processes quarantined. That quarantining can be expanded into an organization-wide block.

Microsoft is also working to improve Windows 10's management. Windows Upgrade Analytics, released in September, uses the Windows telemetry data to give administrators a better insight into their systems; it gives a view of which applications are being used, which hardware and drivers are deployed, and, moreover, it provides a view of any problems that might occur when upgrading to Windows 10, such as users with software or hardware known to be incompatible. In the Creators Update, this is being extended to cover Windows 10 systems to help track application errors, driver crashes, and other potential problems. In this way, Microsoft is encouraging enterprises to enable the collection of (sometimes contentious, from a privacy standpoint) Windows telemetry data.

The Creators Update will also include a feature to help organizations that are replacing Windows 7 system images that use the legacy PC BIOS and MBR disk partition scheme with Windows 10 images that use UEFI firmware and the GPT disk partition scheme. This generally requires manual intervention to both repartition the disk and change the system firmware to use UEFI-style booting instead of BIOS-style booting. With the update, a conversion tool will be available to automate this process and manage it from System Center Configuration Manager.

There will also be enhancements to bring-your-own-device scenarios with features to protect corporate data on personally owned devices, even when those devices are not enrolled in any mobile device management system. Protection policies will be applied to individual applications without requiring users to cede control of their own hardware, nor requiring IT groups to be responsible for managing that hardware.

Delivering new features on a regular basis is part of the promise Microsoft is making with "Windows as a Service," and enterprises are the target for this just as much as consumers. It says that enterprise deployments of Windows 10 have tripled over the last six months, and the company tells us that most deployments are using the Current Branch or Current Branch for Business—the latter of which was updated to include summer's Anniversary Update last week—so that even corporate users can keep pace with new features and capabilities.