Search, Cortana, Recall, and Location¶
Features that watch what the user does and where the machine is. Cortana listens, Recall screenshots the desktop every few seconds, cloud search sends queries to Microsoft, and location services tell apps where the machine is. On a work machine each is a data leak waiting for an attacker to find the store.
Where¶
gpedit.msc → Computer Configuration → Administrative Templates → Windows Components.
Level 1¶
| CIS | Setting | Path | Set to | Why |
|---|---|---|---|---|
| 18.10.59.3 | Allow Cortana | Search | Disabled | No voice assistant collecting queries |
| 18.10.59.4 | Allow Cortana above lock screen | Search | Disabled | Nothing answers questions on the lock screen |
| 18.10.59.6 | Allow search and Cortana to use location | Search | Disabled | |
| 18.10.59.5 | Allow indexing of encrypted files | Search | Disabled | Covered on the previous page |
| STIG WN11-00-000125 | Turn off Windows Copilot | User Configuration → Windows Components → Windows Copilot | Enabled | Copilot sends prompts and screen context to Microsoft |
| 18.10.73.1 | Allow Recall to be enabled | Windows AI | Disabled | Recall stores screenshots of everything on screen, searchable, on disk. A local database of every password field, document, and chat the user ever saw. |
Level 2¶
| CIS | Setting | Path | Set to | Why |
|---|---|---|---|---|
| 18.10.59.2 | Allow Cloud Search | Search | Enabled: Disable Cloud Search | Windows Search doesn't query cloud accounts |
| 18.10.59.7 | Allow search highlights | Search | Disabled | The search box stops showing web content |
| 18.10.36.1 | Turn off location | Location and Sensors | Enabled | No app gets the machine's location |
| 5.6 | Geolocation Service (lfsvc) |
services.msc |
Disabled | Same, at the service level |
Apply¶
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v AllowCortana /t REG_DWORD /d 0 /f
One worked example; the rest are in the table. Type each reg add yourself (the syntax is on The Command Line) and read it back with reg query "<key>" /v <name> before moving on:
| Key | Value | Type | Data |
|---|---|---|---|
HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search |
AllowCortana |
REG_DWORD | 0 |
HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search |
AllowCortanaAboveLock |
REG_DWORD | 0 |
HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search |
AllowSearchToUseLocation |
REG_DWORD | 0 |
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsAI |
AllowRecallEnablement |
REG_DWORD | 0 |
HKCU\SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot |
TurnOffWindowsCopilot |
REG_DWORD | 1 |
HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search |
AllowCloudSearch |
REG_DWORD | 0 |
HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search |
EnableDynamicContentInWSB |
REG_DWORD | 0 |
HKLM\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors |
DisableLocation |
REG_DWORD | 1 |
Verify¶
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search"
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsAI" /v AllowRecallEnablement
Example¶
Settings → Privacy & security → Recall & snapshots shows Recall enabled with 40 GB of snapshots. Every screen the user has looked at for weeks is on disk in a database an attacker with the user's access can read. Set the policy to Disabled, then remove the snapshots from that Settings page.
Try it¶
- Turn off location and Cortana and confirm in Settings.
- Set the Copilot value and check the taskbar.
Build it¶
Finish privacy.bat with these rows and a reg query section.
Next¶
Linux, for the other half of the competition.