Cloud, Store, and Consumer Features¶
Windows 11 ships with features built for home users: the Store, widgets, news on the taskbar, OneDrive, spotlight wallpapers, cloud clipboard. Each one is a channel to a cloud service, a way to install software outside IT's control, or both. Level 1 turns off the ones that leak data; Level 2 turns off the rest.
Check the README before disabling the Store, OneDrive, or the camera.
Where¶
gpedit.msc → Computer Configuration → Administrative Templates unless marked User Configuration.
Level 1¶
| CIS | Setting | Path | Set to | Why |
|---|---|---|---|---|
| 18.10.59.5 | Allow indexing of encrypted files | Windows Components → Search | Disabled | The search index would hold plaintext copies of encrypted file contents |
| 18.10.81.2 | Allow Windows Ink Workspace | Windows Components → Windows Ink Workspace | Enabled: On, but disallow access above lock | Ink can't be opened from the lock screen |
| 19.7.8.1 | Configure Windows spotlight on lock screen | User Configuration → Windows Components → Cloud Content | Disabled | No cloud images and links on the lock screen |
| 19.7.8.2 | Do not suggest third-party content in Windows spotlight | User Configuration → Cloud Content | Enabled | |
| 19.7.8.5 | Turn off Spotlight collection on Desktop | User Configuration → Cloud Content | Enabled | |
| 19.7.26.1 | Prevent users from sharing files within their profile | User Configuration → Windows Components → Network Sharing | Enabled | Users can't share their own folders to the network |
Level 2: installing software¶
| CIS | Setting | Path | Set to | Why |
|---|---|---|---|---|
| 18.9.20.1.1 | Turn off access to the Store | System → Internet Communication Management → Internet Communication settings | Enabled | "Look for an app in the Store" prompts go away |
| 18.10.66.4 | Turn off the Store application | Windows Components → Store | Enabled | The Store won't run |
| 18.10.66.1 | Disable all apps from Microsoft Store | Windows Components → Store | Disabled | Counterintuitive: Enabled also blocks built-in apps from updating. Leave Disabled; use the row above. |
| 18.10.56.1 | Turn off Push To Install service | Windows Components → Push to Install | Enabled | Apps can't be pushed from a Microsoft account on another device |
| 18.10.18.1 | Enable App Installer | Windows Components → Desktop App Installer | Disabled | See Attack Surface Hardening |
| 18.10.18.7 | Enable Windows Package Manager command line interfaces | Desktop App Installer | Disabled | winget off. Run updates first. |
Level 2: cloud sync and data leaving the machine¶
| CIS | Setting | Path | Set to | Why |
|---|---|---|---|---|
| 18.10.50.1 | Prevent the usage of OneDrive for file storage | Windows Components → OneDrive | Enabled | Files don't sync to a Microsoft account. Check the README. |
| 18.9.33.1 | Allow Clipboard synchronization across devices | System → OS Policies | Disabled | Clipboard contents (passwords included) don't go to the cloud |
| 18.9.33.2 | Allow upload of User Activities | System → OS Policies | Disabled | Activity history stays local |
| 18.10.40.1 | Allow Message Service Cloud Sync | Windows Components → Messaging | Disabled | |
| 18.10.29.2 | Turn off account-based insights, recent, favorite, and recommended files in File Explorer | Windows Components → File Explorer | Enabled | |
| 18.10.13.2 | Turn off cloud optimized content | Windows Components → Cloud Content | Enabled | |
| 18.9.51.1 | Turn off the advertising ID | System → User Profiles | Enabled | Apps can't track the user across apps |
| 18.10.63.1 | Turn off KMS Client Online AVS Validation | Windows Components → Software Protection Platform | Enabled | Activation doesn't report online |
| 18.1.3 | Allow Online Tips | Control Panel | Disabled | Settings app doesn't fetch tips |
| 18.9.28.1 | Disallow copying of user input methods to the system account for sign-in | System → Locale Services | Enabled | A user's custom input method can't run on the login screen |
| 18.9.23.1 | Support device authentication using certificate | System → Kerberos | Enabled: Automatic | Machine authenticates with a certificate when one exists |
Level 2: consumer features on the desktop¶
| CIS | Setting | Path | Set to |
|---|---|---|---|
| 18.10.72.1 | Allow widgets | Windows Components → Widgets | Disabled |
| 18.10.49.1 | Enable news and interests on the taskbar | Windows Components → News and interests | Disabled |
| 18.8.1.1 | Turn off notifications network usage | Start Menu and Taskbar → Notifications | Enabled |
| 18.8.2 | Remove Personalized Website Recommendations from the Recommended section in the Start Menu | Start Menu and Taskbar | Enabled |
| 18.10.81.1 | Allow suggested apps in Windows Ink Workspace | Windows Components → Windows Ink Workspace | Disabled |
| 18.10.11.1 | Allow Use of Camera | Windows Components → Camera | Disabled (check the README) |
| 19.7.8.4 | Turn off all Windows spotlight features | User Configuration → Cloud Content | Enabled |
Apply¶
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v AllowIndexingEncryptedStoresOrItems /t REG_DWORD /d 0 /f
One worked example; the rest are in the table. Type each reg add yourself (the syntax is on The Command Line) and read it back with reg query "<key>" /v <name> before moving on:
| Key | Value | Type | Data |
|---|---|---|---|
HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search |
AllowIndexingEncryptedStoresOrItems |
REG_DWORD | 0 |
HKLM\SOFTWARE\Policies\Microsoft\WindowsInkWorkspace |
AllowWindowsInkWorkspace |
REG_DWORD | 1 |
HKCU\SOFTWARE\Policies\Microsoft\Windows\CloudContent |
ConfigureWindowsSpotlight |
REG_DWORD | 2 |
HKCU\SOFTWARE\Policies\Microsoft\Windows\CloudContent |
DisableThirdPartySuggestions |
REG_DWORD | 1 |
HKCU\SOFTWARE\Policies\Microsoft\Windows\CloudContent |
DisableSpotlightCollectionOnDesktop |
REG_DWORD | 1 |
HKCU\SOFTWARE\Policies\Microsoft\Windows\NetworkSharing |
NoInplaceSharing |
REG_DWORD | 1 |
Level 2:
reg add "HKLM\SOFTWARE\Policies\Microsoft\WindowsStore" /v RemoveWindowsStore /t REG_DWORD /d 1 /f
One worked example; the rest are in the table. Type each reg add yourself (the syntax is on The Command Line) and read it back with reg query "<key>" /v <name> before moving on:
| Key | Value | Type | Data |
|---|---|---|---|
HKLM\SOFTWARE\Policies\Microsoft\WindowsStore |
RemoveWindowsStore |
REG_DWORD | 1 |
HKLM\SOFTWARE\Policies\Microsoft\Windows\System |
AllowCrossDeviceClipboard |
REG_DWORD | 0 |
HKLM\SOFTWARE\Policies\Microsoft\Windows\System |
UploadUserActivities |
REG_DWORD | 0 |
HKLM\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo |
DisabledByGroupPolicy |
REG_DWORD | 1 |
HKLM\SOFTWARE\Policies\Microsoft\Dsh |
AllowNewsAndInterests |
REG_DWORD | 0 |
HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Feeds |
EnableFeeds |
REG_DWORD | 0 |
HKLM\SOFTWARE\Policies\Microsoft\Windows\OneDrive |
DisableFileSyncNGSC |
REG_DWORD | 1 |
Verify¶
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v AllowIndexingEncryptedStoresOrItems
reg query "HKLM\SOFTWARE\Policies\Microsoft\WindowsStore" /v RemoveWindowsStore
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\OneDrive" /v DisableFileSyncNGSC
Try it¶
- Set the consumer experiences and OneDrive values, then log in as a new user and look at the Start menu.
- Find the cloud content policies in
gpedit.msc.
Build it¶
Add these rows to privacy.bat.