Feature lockout in Windows

On multiple occasions, Microsoft has used various mechanisms to hide early prototypes of new features in pre-release builds of Microsoft Windows before their formal introduction.
== Windows 7 ==
The development of Windows 7 marks the first time a deliberate centralized effort was introduced to conceal new features. Two separate mechanisms were introduced around build 6608:
* Redpill, a series of registry checks usually present within the executable that implements a hidden feature. Used to enable Superbar, desktop slideshow, Start menu pinning, jump lists, Internet Explorer 8 enhancements, Aero Peek and Aero Shake.
* Bluepill, which is implemented in the Application Compatibility Engine. It still results in a registry check, albeit indirect. Used to enable the new versions of Calculator, Paint, Sticky Notes and WordPad.
Build 7022 is the last known build to include both Redpill and Bluepill.
== Windows 8 ==
A more elaborate feature lockout system, called Redpill or SuperPill, was introduced during the development of Windows 8, which now takes advantage of the licensing subsystem as well as components that are not included with the base system. Noteworthy features hidden behind Redpill include the Start Screen, redesigned logon UI, new OOBE, Ribbon in Explorer, new Aero resources, and the pattern login (which later became the picture password login). However, while the majority of hidden features were locked using Redpill, simple registry checks remained the method of choice in some areas.
Product policies, a set of values usually used to determine what a particular edition can or cannot do, are now also used to control shell features. This made it considerably harder to overcome the protection, as the majority of licensing data is signed and handled largely at kernel level. The intended method of delivering the Redpill policies into an existing install (clean installs do not ship with them) was activating against the internal win8act server with the parameter configextension=rpp. Unlocking the functionality manually implies the need to sacrifice parts of licensing functionality. Besides product policy sourced values, a sizable chunk of behavior hidden by Redpill also depends on an external library called shsxs.dll, which is not included with the base Windows install and is only copied upon the activation of Redpill. This library is home to a large set of image and DirectUI markup assets, as well as a handful of functions used to initialize various parts of Metro such as Charms bar, Start screen search and the PC settings application.
Nearly all builds from Milestone 1 to shortly after the Developer Preview (currently 7779 to 8123) have Redpill implemented. Exemptions are builds from the fbl_eeap(except for 8039) and winmain_win8m3_eeap branches, and notably the x86/x64 winmain compile of build 8020, which do not have any form of Redpill implemented as all traces of Metro user interface components were removed from the operating system at compile time. These builds were released to Microsoft partners via the Ecosystem Engineering Access Program (EEAP). The only available build with Redpill unlocked out of the box is build 8102, the original Developer Preview. Licenses extracted from this build indicate that 5 editions of Redpill were available, ranging from RP01 to RP05, with RP01 having the most features unlocked via its specified product policies. There is also the RP01-PDC edition of Redpill, which is mostly identical to RP01 except it is configured to automatically activate when its associated Windows editions (Prerelease and Server Datacenter) are activated. The Redpill product key configuration indicates that each edition has an associated product key range, suggesting that different tiers of Redpill features could have been given to different groups or individuals.
Due to the complexity of the mechanism, a formerly widespread method of unlocking Redpill on other builds was to use a modified set of components from build 8102, although the reliability of this method decreased with earlier builds. It wasn't until the introduction of Redlock with a custom version of shsxs.dll reimplemented from scratch that Redpill could be unlocked for builds before build 7927.
=== Unlockers ===
3 tools have been developed to enable features hidden by Redpill:
* RedPill Enabler (also known as the MDL Redpill Enabler, named after the forum where it was first published on) was the one of the first public applications meant to enable features restricted by Redpill. It was developed by Vizion, a member of the My Digital Life forum, and was first released on 17 June 2011.
*BluePoison was a Redpill tool made in 2011 by blog WindowsBlogItalia. It was more reliable than the previous Redpill tool. Not much is known about it.
* Metro Unlocker was developed by MetroFetro, a YouTuber and developer. It was the first public application that allowed for all restricted features to be enabled, including the Start screen, and remained the only application capable of performing such a task from its initial release in 2016 until the release of Redlock in 2020.
* Redlock was developed by lucasm and gus33000, two BetaWiki members and software developers. The initial version was released on 29 January 2020. The tool is designed to replicate Microsoft's original Redpill implementation as closely as possible.
== Windows 10 and later ==
Windows versions since the Windows 10 Anniversary Update utilize a simplified feature locking mechanism which make use of numeric strings internally referred to as Velocity staging keys or Feature IDs. These values are controlled by dynamic link libraries ntdll.dll or fcon.dll (Feature Configuration), found within the Windows\System32 directory, responsible for managing feature enablements in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FeatureManagement key (and related subkeys, such as Overrides and EnterpriseTempControls). Features can also be restored from their previous state through the use of a Last Known Good store (found in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FeatureManagement\LastKnownGood) if the library detects problems with the existing overrides. Built-in feature overrides were introduced from as early as Windows 11 build 22606.
The availability of certain features may depend on the current state of an associated staging key. In most cases, feature states can be modified if the priority data returns 8 (User). In certain cases, a feature may be either forcibly enabled or disabled in code if its priority returns ImageDefault. This type of feature lockout also introduces a data type called "variants", which ship multiple treatments for the same staging key. Treatments may vary between devices and installations.
Currently, most features introduced in newer Windows releases employ this method for concealing and/or testing features that are not ready for widespread release to a scoped set of users. The first known feature to use this new feature lockout mechanism is an early version of the Themes Settings section, which was first introduced in Windows 10 build 14984 with the feature ID 5403577. Traditional feature enablement checks via the Windows registry remain as a perennial choice for certain aspects of the operating system.
=== Tools ===
There are four available tools that offer the ability to manage the states of Velocity staging keys:
* ViVeTool - Developed by Albacore, recommended for enabling features in later builds of Windows 10 and 11.
* mach2 - Developed by Rafael Rivera, used to enable features from older Windows 10 builds including build 17618's Sets and 18946's new start menu. Discontinued since December 2020.
* "Experimental features" drop-down menu in Settings (Windows Update > Windows Insider Program); Velocity staging key 40062046 - Included as part of internal Windows builds (e.g.: build 25267 (rs_wdatp_edr)). It is one of two official methods used internally by Microsoft employees to enable various staging keys, such as security fixes from the Microsoft Security Response Center (MSRC), non-public shell features and bugfixes or improvements for internal Windows functionalities (such as the DirectX graphics stack). It may not list features that are currently unfinished.
* Staging Tool (StagingTool.exe): This is another official internal tool used by Microsoft employees to manage and configure the states of Velocity staging keys through the use of a command line-based user interface. A version of the tool was unintentionally distributed in two internal Feedback Hub quests that were made public on 2 August 2023. The link was later taken down, although archived versions of it exist online.
== Gallery ==
Windows11-10.0.25267.1001-Settings-ExperimentalFeatures.png|Windows Insider Program page with Experimental Features dropdown enabled, in Windows 11 build 25267 (rs_wdatp_edr)
== See also ==
*Leak prevention in Microsoft Windows
== Notes ==
Category:Introduced in Windows 7
Category:Introduced in Windows 8
Category:Introduced in Windows 10
Category:Windows components