In order for Windows 3.1 to use networking, a DOS NIC driver, protocol and client software must be installed. As networking became feature rich, the size of the software resident in the real-mode (640k) portion of the RAM grew to the point that many applications refused to run due to inefficient amounts of the 640k left.
Windows 3.11 for Workgroups solves this by adding a Windows protected-mode networking driver, which loads the software as .386 files (VxDs) instead of loading it in the real-mode segment.

The downside is that when you exit to DOS, all networking support disappears.

The Windows 3.11 FW splash screen.

Of course, you can have multiple user accounts on the system, and this is the login screen.

As you can see, unlike my Windows 3.1 screenshots, I installed Windows 3.11 FW with 256 color support turned on.

Oops, wrong password...

And of course, the Windows 3.11 FW Program Manager, which is really no different than the Windows 3.1 Progman, aside from the addition of a few networking things.