first commit

2026-09-19 20:55:32 -04:00
1 parent 831814283e
commit 7aacc0b63f
@@ -0,0 +1,7 @@
+[
+  {"Name":"Tor","Id":"TorProject.TorBrowser","Website":"https://www.torproject.org/download/","Role":"Anonymity-oriented browsing. Keep stock protections; no imported personal profile or additional extensions."},
+  {"Name":"Zen","Id":"Zen-Team.Zen-Browser","Website":"https://zen-browser.app/","Role":"Everyday Firefox-based browsing. Personal-account sessions remain identifying."},
+  {"Name":"Helium","Id":"ImputNet.Helium","Website":"https://helium.computer/","Role":"Everyday Chromium-based browsing. Review setup connections, updates and optional crash reporting."},
+  {"Name":"Mullvad","Id":"MullvadVPN.MullvadVPN","Website":"https://mullvad.net/en/download/vpn/windows","Role":"Optional VPN. Requires a funded account; installation alone does not connect or enable Lockdown mode."},
+  {"Name":"VeraCrypt","Id":"IDRIX.VeraCrypt","Website":"https://veracrypt.io/en/Downloads.html","Role":"Optional encrypted containers. Installation does not encrypt disks or configure unmount-on-lock."}
+]
@@ -0,0 +1,34 @@
+[
+  {"Name":"Microsoft.549981C3F5F10","Label":"Cortana"},
+  {"Name":"Microsoft.BingFinance","Label":"Finance"},
+  {"Name":"Microsoft.BingNews","Label":"News"},
+  {"Name":"Microsoft.BingSports","Label":"Sports"},
+  {"Name":"Microsoft.BingWeather","Label":"Weather"},
+  {"Name":"Microsoft.Copilot","Label":"Copilot app"},
+  {"Name":"Microsoft.GetHelp","Label":"Get Help"},
+  {"Name":"Microsoft.Getstarted","Label":"Tips"},
+  {"Name":"Microsoft.Microsoft3DViewer","Label":"3D Viewer"},
+  {"Name":"Microsoft.MicrosoftOfficeHub","Label":"Microsoft 365 promotional hub"},
+  {"Name":"Microsoft.MicrosoftSolitaireCollection","Label":"Solitaire"},
+  {"Name":"Microsoft.MixedReality.Portal","Label":"Mixed Reality Portal"},
+  {"Name":"Microsoft.People","Label":"People"},
+  {"Name":"Microsoft.SkypeApp","Label":"Skype"},
+  {"Name":"Microsoft.WindowsFeedbackHub","Label":"Feedback Hub"},
+  {"Name":"Microsoft.WindowsMaps","Label":"Maps"},
+  {"Name":"Microsoft.YourPhone","Label":"Phone Link"},
+  {"Name":"Microsoft.ZuneMusic","Label":"Media Player / Groove"},
+  {"Name":"Microsoft.ZuneVideo","Label":"Movies and TV"},
+  {"Name":"Clipchamp.Clipchamp","Label":"Clipchamp"},
+  {"Name":"MicrosoftTeams","Label":"Teams consumer"},
+  {"Name":"Microsoft.OutlookForWindows","Label":"Outlook for Windows"},
+  {"Name":"Microsoft.XboxApp","Label":"Xbox console companion"},
+  {"Name":"Microsoft.GamingApp","Label":"Xbox app"},
+  {"Name":"king.com.CandyCrushSaga","Label":"Candy Crush Saga"},
+  {"Name":"king.com.CandyCrushSodaSaga","Label":"Candy Crush Soda Saga"},
+  {"Name":"king.com.BubbleWitch3Saga","Label":"Bubble Witch"},
+  {"Name":"SpotifyAB.SpotifyMusic","Label":"Spotify"},
+  {"Name":"Disney.37853FC22B2CE","Label":"Disney+"},
+  {"Name":"AmazonVideo.PrimeVideo","Label":"Prime Video"},
+  {"Name":"4DF9E0F8.Netflix","Label":"Netflix"},
+  {"Name":"BytedancePte.Ltd.TikTok","Label":"TikTok"}
+]
@@ -0,0 +1,23 @@
+{
+  "Schema": 1,
+  "Target": { "Build": 26200, "Architecture": "x64" },
+  "CollectedOn": "2026-09-19",
+  "Packages": [
+    {
+      "Id": "reviewed-prerequisite",
+      "File": "replace-with-reviewed-prerequisite.msu",
+      "Sha256": "REPLACE_WITH_ACTUAL_SHA256",
+      "Source": "https://www.catalog.update.microsoft.com/",
+      "Kind": "Windows",
+      "Requires": []
+    },
+    {
+      "Id": "reviewed-target-update",
+      "File": "replace-with-reviewed-target.msu",
+      "Sha256": "REPLACE_WITH_ACTUAL_SHA256",
+      "Source": "https://www.catalog.update.microsoft.com/",
+      "Kind": "Windows",
+      "Requires": ["reviewed-prerequisite"]
+    }
+  ]
+}
@@ -0,0 +1,161 @@
+[
+  {
+    "Id": "diagnostics",
+    "Title": "Minimum supported Windows diagnostic data",
+    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection",
+    "Name": "AllowTelemetry",
+    "Standard": 1,
+    "Strict": 1,
+    "EnterpriseValue": 0,
+    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-system#allowtelemetry",
+    "Impact": "Pro retains required diagnostics. Enterprise/Education use 0. Required service data is separate; this does not silence Microsoft connections.",
+    "Exceptions": []
+  },
+  {
+    "Id": "advertising-id",
+    "Title": "Disable Windows advertising ID",
+    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AdvertisingInfo",
+    "Name": "DisabledByGroupPolicy",
+    "Standard": 1,
+    "Strict": 1,
+    "EnterpriseValue": null,
+    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#disableadvertisingid",
+    "Impact": "Affects the Windows advertising ID only, not GDID, browser fingerprints or account identifiers.",
+    "Exceptions": []
+  },
+  {
+    "Id": "location",
+    "Title": "Turn off Windows location feature",
+    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\LocationAndSensors",
+    "Name": "DisableLocation",
+    "Standard": 1,
+    "Strict": 1,
+    "EnterpriseValue": null,
+    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-admx-sensors#disablelocation_2",
+    "Impact": "Location-dependent features stop working. IP-based and other independent location inference remain possible.",
+    "Exceptions": []
+  },
+  {
+    "Id": "camera",
+    "Title": "Disallow camera devices by policy",
+    "Path": "SOFTWARE\\Policies\\Microsoft\\Camera",
+    "Name": "AllowCamera",
+    "Standard": 0,
+    "Strict": 0,
+    "EnterpriseValue": null,
+    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-camera#allowcamera",
+    "Impact": "Can break camera-dependent workflows. Not a physical disconnection; test Windows Hello and desktop applications after reboot.",
+    "Exceptions": []
+  },
+  {
+    "Id": "microphone-apps",
+    "Title": "Deny Windows app microphone access by default",
+    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
+    "Name": "LetAppsAccessMicrophone",
+    "Standard": 2,
+    "Strict": 2,
+    "EnterpriseValue": null,
+    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessmicrophone",
+    "Impact": "Does not guarantee blocking all desktop applications. Existing per-app exceptions cause a conflict; use the device-wide Settings toggle or hardware disconnect for stronger restriction.",
+    "Exceptions": [
+      "LetAppsAccessMicrophone_ForceAllowTheseApps",
+      "LetAppsAccessMicrophone_UserInControlOfTheseApps"
+    ]
+  },
+  {
+    "Id": "cloud-speech",
+    "Title": "Disallow online speech recognition",
+    "Path": "SOFTWARE\\Policies\\Microsoft\\InputPersonalization",
+    "Name": "AllowInputPersonalization",
+    "Standard": 0,
+    "Strict": 0,
+    "EnterpriseValue": null,
+    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#allowinputpersonalization",
+    "Impact": "Cloud speech functionality is unavailable. Does not govern every application's speech service.",
+    "Exceptions": []
+  },
+  {
+    "Id": "clipboard-sync",
+    "Title": "Disallow cross-device clipboard synchronization",
+    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\System",
+    "Name": "AllowCrossDeviceClipboard",
+    "Standard": 0,
+    "Strict": 0,
+    "EnterpriseValue": null,
+    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#allowcrossdeviceclipboard",
+    "Impact": "Stops Windows clipboard synchronization. Does not delete clipboard contents or copies already sent elsewhere.",
+    "Exceptions": []
+  },
+  {
+    "Id": "clipboard-history",
+    "Title": "Disallow Windows clipboard history",
+    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\System",
+    "Name": "AllowClipboardHistory",
+    "Standard": 1,
+    "Strict": 0,
+    "EnterpriseValue": null,
+    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#allowclipboardhistory",
+    "Impact": "Standard permits clipboard history; Strict disables it. Switching profiles does not recover previously cleared contents.",
+    "Exceptions": []
+  },
+  {
+    "Id": "find-my-device",
+    "Title": "Disable Find My Device",
+    "Path": "SOFTWARE\\Policies\\Microsoft\\FindMyDevice",
+    "Name": "AllowFindMyDevice",
+    "Standard": 0,
+    "Strict": 0,
+    "EnterpriseValue": null,
+    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#allowfindmydevice",
+    "Impact": "Loses Microsoft's device-location recovery feature. Does not erase cloud records already collected.",
+    "Exceptions": []
+  },
+  {
+    "Id": "cloud-search",
+    "Title": "Disable cloud sources in Windows Search",
+    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search",
+    "Name": "AllowCloudSearch",
+    "Standard": 0,
+    "Strict": 0,
+    "EnterpriseValue": null,
+    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-search#allowcloudsearch",
+    "Impact": "Stops searching cloud sources such as OneDrive and SharePoint. Does not establish that all Start web queries are disabled.",
+    "Exceptions": []
+  },
+  {
+    "Id": "delivery-optimization",
+    "Title": "Restrict Delivery Optimization",
+    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\DeliveryOptimization",
+    "Name": "DODownloadMode",
+    "Standard": 0,
+    "Strict": 99,
+    "EnterpriseValue": null,
+    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-deliveryoptimization#dodownloadmode",
+    "Impact": "Standard: HTTP without peering. Strict: HTTP without peering or DO cloud service. Neither blocks all update traffic or guarantees suppression of GDID reporting.",
+    "Exceptions": []
+  },
+  {
+    "Id": "updates-auto",
+    "Title": "Automatic Windows Update choice",
+    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU",
+    "Name": "NoAutoUpdate",
+    "Standard": null,
+    "Strict": null,
+    "EnterpriseValue": null,
+    "Source": "https://learn.microsoft.com/en-us/windows/deployment/update/waas-wu-settings",
+    "Impact": "Manual requires the user to install security updates. Preserves update components; other update policies and products remain separate.",
+    "Exceptions": []
+  },
+  {
+    "Id": "updates-options",
+    "Title": "Windows Update download/install behavior",
+    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU",
+    "Name": "AUOptions",
+    "Standard": null,
+    "Strict": null,
+    "EnterpriseValue": null,
+    "Source": "https://learn.microsoft.com/en-us/windows/deployment/update/waas-wu-settings",
+    "Impact": "Notify requests download/install notification; Automatic requests scheduled automatic installation. Effective behavior needs Windows validation.",
+    "Exceptions": []
+  }
+]