0x000/ms-private
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

Prepare ms-private 0.0.1 release candidate

Browse Source
This commit is contained in:
0x000 committed 2026-09-22 21:21:41 -04:00
1 parent 7aacc0b63f
commit a515538438
75 files changed
+3957 -3484
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

README.md
+161 -50
View File
@@ -1,79 +1,190 @@
# Wind privacy toolkit
# ms-private
A local Windows privacy configuration tool and an evidence-based implementation plan. Browser choices: **Tor Browser, Zen, Helium**. Research checked 2026-09-18.
**Make Windows yours.** A local Windows privacy toolkit for documented settings, app removal, browser choice, network controls, exact sensor selection, Recall, cleanup and session-lock actions. The release is one self-contained x64 executable with an elevation manifest and a graphical wizard. Its reviewable PowerShell engine is embedded in the executable; it never downloads and executes changing scripts from the web.
**Status: development prototype.** Audit and planning run without elevation. Policy apply/restore is implemented, with transaction tests; Windows behavior and network effects still require VM testing. It does not certify anonymity or zero Microsoft traffic.
## Start here
```powershell
./Wind.ps1
./Wind.ps1 -Mode Plan -Profile Strict
./Wind.ps1 -Mode Guide
./Install-Apps.ps1 -App Tor,Zen,Helium,Mullvad -WhatIf
```text
m s - p r i v a t e
Make Windows yours.
----------------------------------------------------
> Review plan
Privacy profile Strict
Browsers Zen
Apps & debloat
Microsoft app accounts Purge
Windows updates Keep
Apply selected changes
Restore policies
Default browser settings
Privacy guide
Quit
----------------------------------------------------
Arrows move Enter select Esc back
```
The default mode is a read-only policy audit. Guide prints Windows Settings links and browser setup guidance, including the Home edition path. Nothing downloads or executes remote scripts.
## Run
On supported Windows 11 Pro/Enterprise/Education editions, from a 64-bit elevated PowerShell:
Download `ms-private-0.0.1.exe`, verify the adjacent SHA-256 file, then double-click the executable. Windows shows a UAC elevation prompt because the executable contains a `requireAdministrator` application manifest. Run it from the Windows account whose current-user apps and settings you intend to change; entering credentials for another administrator can target that account instead.
The executable contains the reviewed runtime and does not fetch code. It validates the embedded manifest and every SHA-256 before extracting to `%ProgramFiles%\ms-private\runtime\<version>-<payload hash>`, validates the installed copy on every launch, repairs modified or extra runtime files, removes older runtime versions, then opens the graphical wizard with Windows PowerShell 5.1. The executable is currently unsigned, so Windows may show an unknown-publisher warning.
Source and development runs remain available with 64-bit Windows PowerShell 5.1 or PowerShell 7:
```powershell
./Wind.ps1 -Mode Apply -Profile Standard -WhatIf
./Wind.ps1 -Mode Apply -Profile Standard
# Optional: notify before downloading updates, preserving the update engine
./Wind.ps1 -Mode Apply -Profile Standard -Updates Notify
# Restore using the journal path printed by Apply
./Wind.ps1 -Mode Restore -Journal 'C:\path\to\journal.json' -WhatIf
./Wind.ps1 -Mode Restore -Journal 'C:\path\to\journal.json'
.\ms-private.ps1
# or the tabbed graphical wizard
.\ms-private-GUI.ps1
```
Apply is explicit. Standard keeps existing update settings. Updates can be Keep, Automatic, Notify or Manual. Manual disables automatic updates; it does not promise no update network traffic or control browser/Store updates. Re-run Audit after reboot, then follow the behavioral checks in the validation plan.
Move with **Up/Down**, select with **Enter**, toggle checkboxes with **Space**, return with **Esc**. **Page Up/Down** scroll long lists. Type to filter applications; Backspace erases the filter. The highlighted item's explanation appears below the list. Choices stay in memory until you apply them.
Windows Home and unreviewed builds are **audit/guide only** for machine policy changes. A registry value being present is not evidence that Windows honors it. The currently reviewed build families are 26100 and 26200; this is a scope gate, not a claim of end-to-end testing.
Launching the menu changes nothing. Review the plan, then select **Apply selected changes**. The final confirmation defaults to going back.
## Implemented
## Automatic presets
- Source-linked policy catalog: minimum supported Windows diagnostic level, advertising ID, location, camera, app microphone default, cloud speech, clipboard synchronization, Find My Device, cloud search and Delivery Optimization.
- Strict adds clipboard history suppression and DO mode 99 (no peering or DO cloud service; updates still contact their own services).
- Edition/build checks, read errors, app microphone exception detection, and managed-device detection before mutation.
- Exact DWORD value/absence capture, a journal saved before writes, readback, failure rollback, and conflict-aware restoration. No full registry exports, personal identifiers or browsing contents are collected.
- Optional package installation with exact WinGet IDs, normal installer/hash checks, no silent license acceptance, no forced restarts, and `-WhatIf`.
- Tor, Zen and Helium are all available; installing does not select a default or configure the browsers.
Both interfaces use the validated catalog in [presets.json](config/presets.json). At startup, ms-private recommends Fresh Install only when both Windows and the current user profile are no more than seven days old. Older, inconsistent or unreadable timestamps select Established PC. Choosing any preset fills every related control; **Review plan** enumerates the exact policy, application and device targets before one final Apply approval.
## Not implemented yet
| Preset | Automatic behavior |
| --- | --- |
| Established PC | Conservative default for an older installation. Applies Standard privacy policy only. Keeps every app, browser, account, service, device, Recall item and file; networking and update settings remain unchanged. |
| Fresh Install | Complete initial setup: Strict policies/services, account purge, Recall removal, reviewed endpoint blocking, cleanup/schedule/lock handling, Mullvad/VeraCrypt, Zen/Tor, detected sensors and every unambiguously removable app including Store, Edge and OneDrive. |
| Gentle | Standard policy and curated promotional-app removal. Keeps personal apps, Store, Edge, OneDrive, accounts, sensors and networking. |
| Medium | Strict policies and services, Microsoft app-account purge, Recall deletion/feature removal, optional-endpoint blocking, cleanup/schedule/lock handling, Mullvad and VeraCrypt installation, and every unambiguously removable Microsoft or third-party app including Store, Edge and OneDrive. |
| Strong | Medium plus Tor Browser and automatic camera, microphone and sensor selection. This can disable Windows Hello and conferencing hardware. |
| Maximum | Strong plus Zen, Helium and Tor and timed default-outbound isolation. Keeping isolation blocks ordinary connectivity, including online updates, until suitable allow rules are created or isolation is restored. |
Network enforcement, packet-capture validation, a graphical wizard, AME packaging, Home GUI automation, debloating, sensor hardware disablement, Recall removal, automatic cleanup, and lock-event handling are specified in [the implementation plan](docs/PLAN.md). Their status is explicit because an incomplete privacy control must not appear enabled.
Fresh Install, Medium and stronger presets use exact installed identities. They do not issue wildcard package deletion commands. WebView2, drivers, firmware, runtimes, servicing components, Defender/security products, authentication components, chosen browsers, Mullvad, VeraCrypt and recovery infrastructure stay protected. Store removal is current-user scope and can require an official recovery or Windows repair path to reinstall.
Read [the research and threat model](docs/RESEARCH.md), [Home setup guide](docs/HOME-GUIDE.md), and [validation protocol](docs/VALIDATION.md).
### Source ZIP / repeated security prompts
The [privacy register](outputs/01a0b6c2-22ad-7b62-9a5a-4a09014a9b42/Windows-privacy-register.xlsx) records 85 controls and decisions, 19 tool/research entries, sources, application status and 24 remaining tasks. The [blog draft](outputs/01a0b6c2-22ad-7b62-9a5a-4a09014a9b42/Windows-privacy-blog-draft.md) explains the motivation and evidence. The [supplied GDID script review](docs/GDID-SCRIPT-REVIEW.md) records 12 findings and the two pinned research revisions. None of these artifacts represents a deployed identifier block.
## Offline update preparation
Direct downloads require outbound requests. For no direct Microsoft contact from the protected PC, use a separate collector and an isolated Windows environment; see [the offline update design](docs/OFFLINE-UPDATES.md). Cloud protection is unavailable while isolated.
Review the download first. In the ZIP's Properties, select **Unblock** before extracting. If already extracted, run the following **from this reviewed project folder**:
```powershell
# Local version/edition/architecture only; no identifying hardware/account fields.
./Offline-Updates.ps1 -Json
# Check an explicitly prepared local bundle. Does not download or install.
./Offline-Updates.ps1 -Mode Verify -Manifest 'D:\Updates\bundle.json' -Json
Get-ChildItem -LiteralPath . -Recurse -File | Where-Object { $_.Extension -in '.ps1', '.psm1' } | Unblock-File; Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned -Force; .\ms-private-GUI.ps1
```
Populate `config/offline-bundle.example.json` with reviewed packages and actual hashes first. The verifier checks integrity against an unsigned manifest, target build/architecture and declared prerequisite order. It does not establish publisher authenticity, complete prerequisites, applicability, coverage or isolation. Run `./tests/Run-OfflineUpdateTests.ps1` for its synthetic tests.
That line unblocks PowerShell files inside the current reviewed directory, changes policy only for the current PowerShell process, and starts the GUI. It does not fetch code. You do not need `Unrestricted`, a permanent execution-policy change or a download-and-execute command. Organization policies may override process policy; ms-private does not bypass those policies. Releases are currently unsigned. See Microsoft's [Unblock-File](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/unblock-file) and [execution policy](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies) documentation.
## Recovery and boundaries
## Defaults
Journals go into `%LOCALAPPDATA%\WindPrivacy\journals` by default and contain only the selected policy values, build/edition and a local random installation marker. Keep them private and restore on the originating Windows installation. No journal is uploaded. Apply/restore use a shared mutex to prevent overlapping Wind transactions. Domain/MDM detection is best effort; do not use on an organization-managed device.
| Choice | Default / behavior |
| --- | --- |
| Preset | Automatically Fresh Install only when Windows and the current profile are at most seven days old; otherwise Established PC. Manual selection remains available. |
| Privacy | Standard in Established PC and Gentle; Strict in Fresh Install, Medium, Strong and Maximum. |
| Microsoft app accounts | Kept in Established PC and Gentle; purged in Fresh Install, Medium and stronger. |
| Updates | Keep existing settings. Automatic, Notify and Manual are selectable. No update services are removed. |
| Browsers | Zen selected; choose Zen, Helium, Tor Browser or any combination. All selected browsers are checked before removals begin. |
| Bundled apps | Curated promotional/consumer packages selected for removal; review [the exact catalog](config/debloat.json). |
| Personal apps | Kept in Established PC and Gentle; every unambiguously removable app is selected in Fresh Install, Medium and stronger. |
| OneDrive | Kept in Established PC and Gentle and selected in Fresh Install, Medium and stronger. Cloud-only files remain online; ms-private does not delete sync folders. |
| Edge | Kept in Established PC and Gentle and selected in Fresh Install, Medium and stronger after replacement-browser verification. Windows may refuse removal. WebView2 is preserved. |
Restore changes only catalogued values whose current value still matches what Wind wrote. It reports conflicts instead of overwriting subsequent changes. Repeated restore is safe. Empty registry keys created by Apply may remain. Restoring policy settings cannot recover data already deleted by Windows or third-party programs.
App identity cannot reliably distinguish a preinstalled Spotify/Outlook package from the same app installed manually. Uncheck any catalogued apps you want to retain. Unknown OEM apps are opt-in. ms-private protects OS-marked components and known drivers, runtimes, security tools and dependencies; the name-based list cannot identify every third-party dependency.
The core does not change Defender, firewall, encryption, Secure Boot, UAC, update services, licensing, device identifiers, logs, browser data or user files. No hosts blocklist, RAM cleaner, registry cleaner, `irm | iex`, or security exclusions are used.
Appx removal affects the current user. Provisioned packages and other users' Appx registrations are left alone. Desktop uninstallers follow their displayed user/machine registration scope. Uninstallers can remove app settings and data: policy recovery journals are **not app backups**.
## Tests
Windows restrictions on Edge are respected. There is no forced system-file removal or region-policy editing. If removal is refused, the run stops with an incomplete report; keep Edge in the next plan to continue. Set the replacement default in Windows Settings.
## Command line
```powershell
./tests/Run-Tests.ps1
# Policy-only audit, preview, apply and recovery
.\ms-private.ps1 -Mode Audit -Profile Strict -Json
.\ms-private.ps1 -Mode Plan -Profile Strict -Updates Notify
.\ms-private.ps1 -Mode Apply -Profile Strict -WhatIf
.\ms-private.ps1 -Mode Apply -Profile Strict
.\ms-private.ps1 -Mode Restore -Journal 'C:\path\to\saved.journal.json'
# Strict service controls: Connected Devices/CDP, cloud sync/backup, diagnostics, location and WER
.\Services.ps1 -Mode Plan -Profile Strict
.\Services.ps1 -Mode Apply -Profile Strict
.\Services.ps1 -Mode Restore -Journal 'C:\path\to\service-journal.json'
# Current-user Microsoft app-account audit and irreversible sign-out
.\Accounts.ps1 -Mode Plan -Scope AllAppAccounts
.\Accounts.ps1 -Mode Apply -Scope AllAppAccounts -AcknowledgeAccountDataDeletion -WhatIf
.\Accounts.ps1 -Mode Apply -Scope AllAppAccounts -AcknowledgeAccountDataDeletion
# App plan, available IDs, and an explicit apply
.\Manage-Apps.ps1 -Mode Plan -Browser Zen,Helium,Tor
.\Manage-Apps.ps1 -Mode List -Json
.\Manage-Apps.ps1 -Mode Apply -Browser Zen,Helium -WhatIf
.\Manage-Apps.ps1 -Mode Apply -Browser Zen,Helium
# Keep groups or individual apps; use exact IDs returned by List
.\Manage-Apps.ps1 -SkipBundled -KeepOneDrive -KeepEdge
.\Manage-Apps.ps1 -ExtraId 'exact-listed-id' -ExcludeId 'another-listed-id'
# Aggressive exact-inventory preview used by Fresh Install, Medium and stronger presets
.\Manage-Apps.ps1 -Mode Plan -RemovePersonal -RemoveStore -Browser Zen
# Plan or apply one complete preset from the command line
.\Preset.ps1 -Mode Plan -Preset Auto
.\Preset.ps1 -Mode Plan -Preset FreshInstall
.\Preset.ps1 -Mode Apply -Preset FreshInstall -AcknowledgeDestructivePreset
# Optional VPN / encryption software; installation does not configure it
.\Install-Apps.ps1 -App Mullvad,VeraCrypt -WhatIf
# Narrow network preview, timed isolation and local capture
.\Network.ps1 -Mode Plan -Profile BlockOptionalTelemetry
.\Network.ps1 -Mode Apply -Profile Isolate -RollbackMinutes 10
.\Network.ps1 -Mode Validate -Json
.\Network.ps1 -Mode Confirm -Journal 'C:\path\to\network.json'
.\Network.ps1 -Mode CaptureStart
# Exact hardware, Recall, safe cleanup and session-lock handling
.\Hardware.ps1 -Mode List
.\Hardware.ps1 -Mode Plan -InstanceId 'exact PnP instance id'
.\Recall.ps1 -Mode Plan -RemoveFeature
.\Cleanup.ps1 -Mode Plan -AgeDays 7 -Category Temp
.\Cleanup.ps1 -Mode Plan -AgeDays 0 -Category CrashReports,RecentItems,ThumbnailCache,BrowserCache,PowerShellHistory
.\Security.ps1 -Json
.\Lock.ps1 -Mode Install -VeraCryptVolume X:
```
The tests run the transaction engine against an isolated memory store. They do not change Windows policies. The read-only audit can separately be run on the host. Passing these tests is not a substitute for VM and network validation.
WinGet must be installed and its `winget` source usable. ms-private retains normal installer prompts, signature/hash checks and license requirements. It does not silently accept source agreements. If WinGet requires source initialization, open `winget list --source winget` yourself, review its prompts and retry. WinGet and installers make network requests and may keep their own logs.
## Support and recovery
- Policy apply/restore: Windows 11 Pro/Enterprise/Education families, builds 26100/26200. Home and unreviewed builds use the manual guide; the menu explicitly reports skipped policies.
- App operations: build gate 19045/22631/26100/26200. Windows 10 requires an appropriately supported servicing arrangement. Build gating is not proof of successful live testing.
- Domain/MDM-managed devices and non-elevated changes are refused. Use an administrator-managed deployment for those devices.
- Policy changes save original values before writing and roll back failures. Restoration preserves later conflicting edits. Restore newer journals before older ones.
- App operations save intent and per-app outcomes. They stop on ambiguous state, errors, reboot-required results or unsuccessful readback. Earlier successful removals remain removed.
- Account purge is irreversible. It records only catalog IDs and outcomes, never account names, emails, credential targets or secrets. It does not remove the current Windows logon identity or an existing organizational registration.
- Complete presets execute each selected mutation area as a recorded group. A failed group is reported and does not prevent unrelated groups from running; only groups with a failed prerequisite are skipped. Each run writes a summary below `%LOCALAPPDATA%\MsPrivate\runs`, while component recovery journals remain authoritative for restoration.
- Reports and journals stay under `%LOCALAPPDATA%\MsPrivate`. ms-private has no analytics or automatic report uploads. Do not publish local reports: installed-app information can be personal.
Switching Strict to Standard permits clipboard history again and changes DO mode back to 0. It does not restore deleted history. `Updates Keep` retains the current setting, including changes made by an earlier run.
## Advanced controls
`Network.ps1` has three distinct modes. **Observe** changes nothing. **BlockOptionalTelemetry** creates dynamic-FQDN outbound block rules only for the reviewed catalog in [network.json](config/network.json). **Isolate** sets the default outbound action to Block for all firewall profiles and schedules a local SYSTEM rollback before changing them. Confirm an isolation journal only after local recovery and required connectivity checks succeed. Existing explicit allow rules can still pass traffic, and a firewall configuration is not proof of zero telemetry.
Packet captures use the built-in Pktmon tool, remain under `%LOCALAPPDATA%\MsPrivate\network`, and are converted to PCAPNG only when stopped explicitly. Captures may contain private addresses and DNS names. ms-private does not install a TLS interception certificate.
Recall apply requires `-AcknowledgeSnapshotDeletion`. The supported policy deletes existing snapshots; restoring the prior setting cannot recover them. Hardware controls act only on exact selected PnP instance IDs and select nothing by default.
Cleanup uses named, allowlisted categories. It can remove old Temp files, WER queues and crash dumps, Recent Items and Jump Lists, unlocked thumbnail caches, Zen/Tor/Helium cache subdirectories, PowerShell interactive history, selected expired ms-private reports, and the current clipboard. Browser-cache cleanup retains cookies, passwords, bookmarks, sessions and settings. It skips reparse points, changed files and locked files. It excludes Documents, Downloads, non-cache browser profile data, credential stores, ms-private recovery journals, Windows event logs, Defender logs, update logs and authentication logs. Deletion reduces local retention but does not erase provider records or guarantee physical erasure on SSDs.
The lock handler clears the current clipboard and can gracefully unmount selected VeraCrypt drive letters; it does not claim to wipe RAM. `Security.ps1` audits BitLocker/device-encryption status, Defender and cloud-protection posture, firewall profiles, Secure Boot, TPM, VBS/Credential Guard, LSA protection, UAC, SMB/SMB1, remote access and protected update/security services without reading recovery keys, account names, Defender exclusions or secrets.
Windows Home uses `Home.ps1` and the wizard's Home tab to open supported Settings pages. ms-private does not automate localized clicks or claim a visible toggle changed without user verification.
## Privacy boundaries
ms-private now applies 56 reviewed privacy policies, optionally disables eight privacy-related service templates, can purge current-user Microsoft application sign-ins, cleans the named privacy-bearing artifacts above and audits encryption and security status. Strict is the default in both wizards. The expanded policy catalog covers user-scoped personalization and input collection, Widgets, search highlights/location, device metadata, downloadable fonts, MSRT reporting, LLMNR and additional app access to foreground text, screen capture, presence, gaze, motion, notifications, phones, radios, location and background execution. It blocks future consumer Microsoft authentication in apps and new workplace registration while preserving the Windows logon identity. It protects Windows Security, Defender, firewall, authentication and update event channels because those records are evidence used to detect and investigate compromise; deleting them does not prevent collection or transmission. ms-private does not promise anonymity or zero Microsoft traffic, and it does not implement RAM/registry cleaners, undocumented identifier rotation, hosts-file blocklists, TLS interception or blanket Microsoft/Azure IP blocking. Network collection is reduced through supported policy, a reviewed 19-endpoint firewall catalog, service shutdown and capture-based validation with recovery paths. Catalog validation rejects update, trust, Defender, SmartScreen, Store-revocation and WNS endpoint families.
Read the [complete tool breakdown](docs/TOOL-BREAKDOWN.md), [current roadmap](docs/ROADMAP.md), [native API audit](docs/NATIVE-API.md), [privacy notes](docs/PRIVACY.md), [anonymity operating guide](docs/ANONYMITY.md), [blog draft](docs/BLOG.md), [privacy register](docs/Windows-privacy-register.xlsx), [manual guide](docs/HOME-GUIDE.md) and [offline update design](docs/OFFLINE-UPDATES.md). `Offline-Updates.ps1` inventories the OS or verifies a prepared bundle's integrity; it does not download, authenticate or install updates.
## Development and release status
```powershell
.\tests\Run-All.ps1
.\Build-Executable.ps1
.\Build-Release.ps1
```
Tests use synthetic registry/app/network/service/account backends, read-only security inventory and temporary workspace files. CI runs 114 PowerShell checks on Windows PowerShell 5.1 and PowerShell 7, plus ten native launcher checks, PE inspection and the one-file publish. The source is ready for review as a **release candidate**; full live uninstall/sign-out/reboot/update/network/device validation on the supported OS matrix remains required before advertising a production-validated release. See [validation](docs/VALIDATION.md) and [contributing](CONTRIBUTING.md).
`Build-Executable.ps1` creates the self-contained x64 executable and checksum. `Build-Release.ps1` writes a source ZIP and checksum, and `Build-AmePlaybook.ps1` creates the separate AME wrapper when 7-Zip is installed. Builders exclude local reports, refuse to overwrite an existing artifact and do not sign or publish it.