Cloud, Store, and Consumer Features¶
Windows 11 ships with features built for home users: the Store, widgets, news on the taskbar, OneDrive, spotlight wallpapers, cloud clipboard. Each one is a channel to a cloud service, a way to install software outside IT's control, or both. Level 1 turns off the ones that leak data; Level 2 turns off the rest.
Check the README before disabling the Store, OneDrive, or the camera.
Where¶
gpedit.msc → Computer Configuration → Administrative Templates unless marked User Configuration.
Level 1¶
| CIS | Setting | Path | Set to | Why |
|---|---|---|---|---|
| 18.10.59.5 | Allow indexing of encrypted files | Windows Components → Search | Disabled | The search index would hold plaintext copies of encrypted file contents |
| 18.10.81.2 | Allow Windows Ink Workspace | Windows Components → Windows Ink Workspace | Enabled: On, but disallow access above lock | Ink can't be opened from the lock screen |
| 19.7.8.1 | Configure Windows spotlight on lock screen | User Configuration → Windows Components → Cloud Content | Disabled | No cloud images and links on the lock screen |
| 19.7.8.2 | Do not suggest third-party content in Windows spotlight | User Configuration → Cloud Content | Enabled | |
| 19.7.8.5 | Turn off Spotlight collection on Desktop | User Configuration → Cloud Content | Enabled | |
| 19.7.26.1 | Prevent users from sharing files within their profile | User Configuration → Windows Components → Network Sharing | Enabled | Users can't share their own folders to the network |
Level 2: installing software¶
| CIS | Setting | Path | Set to | Why |
|---|---|---|---|---|
| 18.9.20.1.1 | Turn off access to the Store | System → Internet Communication Management → Internet Communication settings | Enabled | "Look for an app in the Store" prompts go away |
| 18.10.66.4 | Turn off the Store application | Windows Components → Store | Enabled | The Store won't run |
| 18.10.66.1 | Disable all apps from Microsoft Store | Windows Components → Store | Disabled | Counterintuitive: Enabled also blocks built-in apps from updating. Leave Disabled; use the row above. |
| 18.10.56.1 | Turn off Push To Install service | Windows Components → Push to Install | Enabled | Apps can't be pushed from a Microsoft account on another device |
| 18.10.18.1 | Enable App Installer | Windows Components → Desktop App Installer | Disabled | See Attack Surface Hardening |
| 18.10.18.7 | Enable Windows Package Manager command line interfaces | Desktop App Installer | Disabled | winget off. Run updates first. |
Level 2: cloud sync and data leaving the machine¶
| CIS | Setting | Path | Set to | Why |
|---|---|---|---|---|
| 18.10.50.1 | Prevent the usage of OneDrive for file storage | Windows Components → OneDrive | Enabled | Files don't sync to a Microsoft account. Check the README. |
| 18.9.33.1 | Allow Clipboard synchronization across devices | System → OS Policies | Disabled | Clipboard contents (passwords included) don't go to the cloud |
| 18.9.33.2 | Allow upload of User Activities | System → OS Policies | Disabled | Activity history stays local |
| 18.10.40.1 | Allow Message Service Cloud Sync | Windows Components → Messaging | Disabled | |
| 18.10.29.2 | Turn off account-based insights, recent, favorite, and recommended files in File Explorer | Windows Components → File Explorer | Enabled | |
| 18.10.13.2 | Turn off cloud optimized content | Windows Components → Cloud Content | Enabled | |
| 18.9.51.1 | Turn off the advertising ID | System → User Profiles | Enabled | Apps can't track the user across apps |
| 18.10.63.1 | Turn off KMS Client Online AVS Validation | Windows Components → Software Protection Platform | Enabled | Activation doesn't report online |
| 18.1.3 | Allow Online Tips | Control Panel | Disabled | Settings app doesn't fetch tips |
| 18.9.28.1 | Disallow copying of user input methods to the system account for sign-in | System → Locale Services | Enabled | A user's custom input method can't run on the login screen |
| 18.9.23.1 | Support device authentication using certificate | System → Kerberos | Enabled: Automatic | Machine authenticates with a certificate when one exists |
Level 2: consumer features on the desktop¶
| CIS | Setting | Path | Set to |
|---|---|---|---|
| 18.10.72.1 | Allow widgets | Windows Components → Widgets | Disabled |
| 18.10.49.1 | Enable news and interests on the taskbar | Windows Components → News and interests | Disabled |
| 18.8.1.1 | Turn off notifications network usage | Start Menu and Taskbar → Notifications | Enabled |
| 18.8.2 | Remove Personalized Website Recommendations from the Recommended section in the Start Menu | Start Menu and Taskbar | Enabled |
| 18.10.81.1 | Allow suggested apps in Windows Ink Workspace | Windows Components → Windows Ink Workspace | Disabled |
| 18.10.11.1 | Allow Use of Camera | Windows Components → Camera | Disabled (check the README) |
| 19.7.8.4 | Turn off all Windows spotlight features | User Configuration → Cloud Content | Enabled |
Apply¶
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v AllowIndexingEncryptedStoresOrItems /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\WindowsInkWorkspace" /v AllowWindowsInkWorkspace /t REG_DWORD /d 1 /f
reg add "HKCU\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v ConfigureWindowsSpotlight /t REG_DWORD /d 2 /f
reg add "HKCU\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v DisableThirdPartySuggestions /t REG_DWORD /d 1 /f
reg add "HKCU\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v DisableSpotlightCollectionOnDesktop /t REG_DWORD /d 1 /f
reg add "HKCU\SOFTWARE\Policies\Microsoft\Windows\NetworkSharing" /v NoInplaceSharing /t REG_DWORD /d 1 /f
Level 2:
reg add "HKLM\SOFTWARE\Policies\Microsoft\WindowsStore" /v RemoveWindowsStore /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v AllowCrossDeviceClipboard /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v UploadUserActivities /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo" /v DisabledByGroupPolicy /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Dsh" /v AllowNewsAndInterests /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Feeds" /v EnableFeeds /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\OneDrive" /v DisableFileSyncNGSC /t REG_DWORD /d 1 /f
Verify¶
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v AllowIndexingEncryptedStoresOrItems
reg query "HKLM\SOFTWARE\Policies\Microsoft\WindowsStore" /v RemoveWindowsStore
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\OneDrive" /v DisableFileSyncNGSC