Prepare ms-private 0.0.1 release candidate
This commit is contained in:
0x000 committed
1 parent
7aacc0b63f
commit
a515538438
75 files changed
+3957
-3484
No files matched your search
@@ -0,0 +1,21 @@
|
||||
{
|
||||
"Schema": 1,
|
||||
"Packages": [
|
||||
{"Id":"store","Name":"Microsoft.WindowsStore","Label":"Microsoft Store","Scope":"Consumer","Impact":"Deletes current-user Store app data and sign-in details while leaving the Store installed for app updates and revocation."},
|
||||
{"Id":"xbox-identity","Name":"Microsoft.XboxIdentityProvider","Label":"Xbox Identity Provider","Scope":"Consumer","Impact":"Deletes current-user Xbox identity-provider data and sign-in details."},
|
||||
{"Id":"xbox-app","Name":"Microsoft.XboxApp","Label":"Xbox app","Scope":"Consumer","Impact":"Deletes current-user Xbox app data and sign-in details if the package remains installed."},
|
||||
{"Id":"gaming-app","Name":"Microsoft.GamingApp","Label":"Xbox Gaming app","Scope":"Consumer","Impact":"Deletes current-user Gaming app data and sign-in details if the package remains installed."},
|
||||
{"Id":"gaming-overlay","Name":"Microsoft.XboxGamingOverlay","Label":"Xbox Game Bar","Scope":"Consumer","Impact":"Deletes current-user Game Bar data and sign-in details if the package remains installed."},
|
||||
{"Id":"office-hub","Name":"Microsoft.MicrosoftOfficeHub","Label":"Microsoft 365 hub","Scope":"Consumer","Impact":"Deletes current-user Microsoft 365 hub data and sign-in details; desktop Office activation is separate."},
|
||||
{"Id":"teams-personal","Name":"MSTeams","Label":"Microsoft Teams","Scope":"Consumer","Impact":"Deletes current-user packaged Teams data and sign-in details if installed."},
|
||||
{"Id":"web-account-broker","Name":"Microsoft.AAD.BrokerPlugin","Label":"Windows Web Account Manager broker","Scope":"AllAppAccounts","Impact":"Deletes shared current-user web-account broker data and signs applications out. Windows and apps can request authentication again unless policy blocks it."},
|
||||
{"Id":"accounts-control","Name":"Microsoft.AccountsControl","Label":"Windows account controls","Scope":"AllAppAccounts","Impact":"Resets current-user Windows account-control app data. Device logon and organizational registration remain separate."}
|
||||
],
|
||||
"CredentialTargetPatterns": [
|
||||
"(?i)^MicrosoftAccount:",
|
||||
"(?i)^XboxLive:",
|
||||
"(?i)^Xbl",
|
||||
"(?i)^SSO_POP_",
|
||||
"(?i)(OneDrive|MicrosoftOffice|msteams|login\\.live\\.com|virtualapp/didlogical)"
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,120 @@
|
||||
{
|
||||
"Schema": 1,
|
||||
"RuleGroup": "ms-private",
|
||||
"OptionalTelemetry": [
|
||||
{
|
||||
"Id": "telemetry-vortex",
|
||||
"Fqdn": "vortex-win.data.microsoft.com",
|
||||
"Purpose": "Windows diagnostic data endpoint",
|
||||
"Source": "https://learn.microsoft.com/windows/privacy/manage-windows-11-endpoints"
|
||||
},
|
||||
{
|
||||
"Id": "telemetry-settings",
|
||||
"Fqdn": "settings-win.data.microsoft.com",
|
||||
"Purpose": "Windows settings and diagnostic configuration endpoint",
|
||||
"Source": "https://learn.microsoft.com/windows/privacy/manage-windows-11-endpoints"
|
||||
},
|
||||
{
|
||||
"Id": "telemetry-watson",
|
||||
"Fqdn": "watson.telemetry.microsoft.com",
|
||||
"Purpose": "Windows error reporting endpoint",
|
||||
"Source": "https://learn.microsoft.com/windows/privacy/manage-windows-11-endpoints"
|
||||
},
|
||||
{
|
||||
"Id": "telemetry-functional-events",
|
||||
"Fqdn": "functional.events.data.microsoft.com",
|
||||
"Purpose": "Windows diagnostic data endpoint",
|
||||
"Source": "https://learn.microsoft.com/windows/privacy/manage-windows-11-endpoints"
|
||||
},
|
||||
{
|
||||
"Id": "telemetry-self-events",
|
||||
"Fqdn": "self.events.data.microsoft.com",
|
||||
"Purpose": "Connected User Experiences and Telemetry endpoint",
|
||||
"Source": "https://learn.microsoft.com/windows/privacy/manage-windows-11-endpoints"
|
||||
},
|
||||
{
|
||||
"Id": "telemetry-v10-events",
|
||||
"Fqdn": "v10.events.data.microsoft.com",
|
||||
"Purpose": "Connected User Experiences and Telemetry endpoint",
|
||||
"Source": "https://learn.microsoft.com/windows/privacy/manage-windows-11-endpoints"
|
||||
},
|
||||
{
|
||||
"Id": "telemetry-browser-events",
|
||||
"Fqdn": "browser.events.data.msn.com",
|
||||
"Purpose": "Windows diagnostic data endpoint",
|
||||
"Source": "https://learn.microsoft.com/windows/privacy/manage-windows-11-endpoints"
|
||||
},
|
||||
{
|
||||
"Id": "telemetry-command",
|
||||
"Fqdn": "telecommand.telemetry.microsoft.com",
|
||||
"Purpose": "Windows Error Reporting endpoint",
|
||||
"Source": "https://learn.microsoft.com/windows/privacy/manage-windows-11-endpoints"
|
||||
},
|
||||
{
|
||||
"Id": "telemetry-command-service",
|
||||
"Fqdn": "www.telecommandsvc.microsoft.com",
|
||||
"Purpose": "Windows Error Reporting endpoint",
|
||||
"Source": "https://learn.microsoft.com/windows/privacy/manage-windows-11-endpoints"
|
||||
},
|
||||
{
|
||||
"Id": "telemetry-settings-data",
|
||||
"Fqdn": "settings.data.microsoft.com",
|
||||
"Purpose": "Windows dynamic settings endpoint",
|
||||
"Source": "https://learn.microsoft.com/windows/privacy/manage-windows-11-endpoints"
|
||||
},
|
||||
{
|
||||
"Id": "location-inference",
|
||||
"Fqdn": "inference.location.live.net",
|
||||
"Purpose": "Windows location inference endpoint; paired with the location policies",
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/privacy/manage-windows-11-endpoints"
|
||||
},
|
||||
{
|
||||
"Id": "device-metadata-service",
|
||||
"Fqdn": "dmd.metaservices.microsoft.com",
|
||||
"Purpose": "Device metadata download endpoint; blocked only in the optional telemetry profile",
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/privacy/manage-windows-11-endpoints"
|
||||
},
|
||||
{
|
||||
"Id": "font-streaming-service",
|
||||
"Fqdn": "fs.microsoft.com",
|
||||
"Purpose": "Downloadable font service endpoint",
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/privacy/manage-windows-11-endpoints"
|
||||
},
|
||||
{
|
||||
"Id": "widgets-cdn",
|
||||
"Fqdn": "widgetcdn.azureedge.net",
|
||||
"Purpose": "Windows Widgets content delivery endpoint",
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/privacy/manage-windows-11-endpoints"
|
||||
},
|
||||
{
|
||||
"Id": "widgets-service",
|
||||
"Fqdn": "widgetservice.azurefd.net",
|
||||
"Purpose": "Windows Widgets service endpoint",
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/privacy/manage-windows-11-endpoints"
|
||||
},
|
||||
{
|
||||
"Id": "spotlight-arc",
|
||||
"Fqdn": "arc.msn.com",
|
||||
"Purpose": "Windows Spotlight and personalized content endpoint",
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/privacy/manage-windows-11-endpoints"
|
||||
},
|
||||
{
|
||||
"Id": "spotlight-iris",
|
||||
"Fqdn": "ris.api.iris.microsoft.com",
|
||||
"Purpose": "Windows Spotlight recommendation endpoint",
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/privacy/manage-windows-11-endpoints"
|
||||
},
|
||||
{
|
||||
"Id": "spotlight-feed",
|
||||
"Fqdn": "fd.api.iris.microsoft.com",
|
||||
"Purpose": "Windows Spotlight feed endpoint",
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/privacy/manage-windows-11-endpoints"
|
||||
},
|
||||
{
|
||||
"Id": "spotlight-static-view",
|
||||
"Fqdn": "staticview.msn.com",
|
||||
"Purpose": "Windows Spotlight static-content endpoint",
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/privacy/manage-windows-11-endpoints"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -74,6 +74,210 @@
|
||||
"Impact": "Cloud speech functionality is unavailable. Does not govern every application's speech service.",
|
||||
"Exceptions": []
|
||||
},
|
||||
{
|
||||
"Id": "activity-feed",
|
||||
"Title": "Disable Windows Activity Feed and cloud roaming",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\System",
|
||||
"Name": "EnableActivityFeed",
|
||||
"Standard": 0,
|
||||
"Strict": 0,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#enableactivityfeed",
|
||||
"Impact": "Prevents Windows activities from being published and disables Activity Feed cloud sync.",
|
||||
"Exceptions": []
|
||||
},
|
||||
{
|
||||
"Id": "publish-user-activities",
|
||||
"Title": "Disallow publishing user activities",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\System",
|
||||
"Name": "PublishUserActivities",
|
||||
"Standard": 0,
|
||||
"Strict": 0,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#publishuseractivities",
|
||||
"Impact": "Stops applications and Windows from publishing supported User Activity records.",
|
||||
"Exceptions": []
|
||||
},
|
||||
{
|
||||
"Id": "upload-user-activities",
|
||||
"Title": "Disallow uploading user activities",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\System",
|
||||
"Name": "UploadUserActivities",
|
||||
"Standard": 0,
|
||||
"Strict": 0,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#uploaduseractivities",
|
||||
"Impact": "Prevents supported published User Activity records from being uploaded.",
|
||||
"Exceptions": []
|
||||
},
|
||||
{
|
||||
"Id": "app-account-info",
|
||||
"Title": "Deny Windows apps account-information access",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
||||
"Name": "LetAppsAccessAccountInfo",
|
||||
"Standard": 0,
|
||||
"Strict": 2,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessaccountinfo",
|
||||
"Impact": "Strict denies Windows apps access to account name, picture and related account information. Desktop applications are separate.",
|
||||
"Exceptions": ["LetAppsAccessAccountInfo_ForceAllowTheseApps", "LetAppsAccessAccountInfo_UserInControlOfTheseApps"]
|
||||
},
|
||||
{
|
||||
"Id": "app-calendar",
|
||||
"Title": "Deny Windows apps calendar access",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
||||
"Name": "LetAppsAccessCalendar",
|
||||
"Standard": 0,
|
||||
"Strict": 2,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccesscalendar",
|
||||
"Impact": "Strict blocks Windows apps from reading calendars; calendar-dependent apps can fail.",
|
||||
"Exceptions": ["LetAppsAccessCalendar_ForceAllowTheseApps", "LetAppsAccessCalendar_UserInControlOfTheseApps"]
|
||||
},
|
||||
{
|
||||
"Id": "app-contacts",
|
||||
"Title": "Deny Windows apps contacts access",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
||||
"Name": "LetAppsAccessContacts",
|
||||
"Standard": 0,
|
||||
"Strict": 2,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccesscontacts",
|
||||
"Impact": "Strict blocks Windows apps from reading contacts; contacts-dependent apps can fail.",
|
||||
"Exceptions": ["LetAppsAccessContacts_ForceAllowTheseApps", "LetAppsAccessContacts_UserInControlOfTheseApps"]
|
||||
},
|
||||
{
|
||||
"Id": "app-call-history",
|
||||
"Title": "Deny Windows apps call-history access",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
||||
"Name": "LetAppsAccessCallHistory",
|
||||
"Standard": 0,
|
||||
"Strict": 2,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccesscallhistory",
|
||||
"Impact": "Strict blocks Windows apps from reading call history.",
|
||||
"Exceptions": ["LetAppsAccessCallHistory_ForceAllowTheseApps", "LetAppsAccessCallHistory_UserInControlOfTheseApps"]
|
||||
},
|
||||
{
|
||||
"Id": "app-email",
|
||||
"Title": "Deny Windows apps email access",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
||||
"Name": "LetAppsAccessEmail",
|
||||
"Standard": 0,
|
||||
"Strict": 2,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessemail",
|
||||
"Impact": "Strict blocks Windows apps from reading or sending email through the Windows capability.",
|
||||
"Exceptions": ["LetAppsAccessEmail_ForceAllowTheseApps", "LetAppsAccessEmail_UserInControlOfTheseApps"]
|
||||
},
|
||||
{
|
||||
"Id": "app-messaging",
|
||||
"Title": "Deny Windows apps messaging access",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
||||
"Name": "LetAppsAccessMessaging",
|
||||
"Standard": 0,
|
||||
"Strict": 2,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessmessaging",
|
||||
"Impact": "Strict blocks Windows apps from reading or sending messages through the Windows capability.",
|
||||
"Exceptions": ["LetAppsAccessMessaging_ForceAllowTheseApps", "LetAppsAccessMessaging_UserInControlOfTheseApps"]
|
||||
},
|
||||
{
|
||||
"Id": "app-diagnostics",
|
||||
"Title": "Deny Windows apps diagnostic information",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
||||
"Name": "LetAppsGetDiagnosticInfo",
|
||||
"Standard": 0,
|
||||
"Strict": 2,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsgetdiagnosticinfo",
|
||||
"Impact": "Strict blocks Windows apps from getting diagnostic information about other apps, including user name.",
|
||||
"Exceptions": ["LetAppsGetDiagnosticInfo_ForceAllowTheseApps", "LetAppsGetDiagnosticInfo_UserInControlOfTheseApps"]
|
||||
},
|
||||
{
|
||||
"Id": "app-trusted-devices",
|
||||
"Title": "Deny Windows apps trusted-device access",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
||||
"Name": "LetAppsAccessTrustedDevices",
|
||||
"Standard": 0,
|
||||
"Strict": 2,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccesstrusteddevices",
|
||||
"Impact": "Strict blocks Windows apps from accessing trusted devices; device companion features can fail.",
|
||||
"Exceptions": ["LetAppsAccessTrustedDevices_ForceAllowTheseApps", "LetAppsAccessTrustedDevices_UserInControlOfTheseApps"]
|
||||
},
|
||||
{
|
||||
"Id": "app-unpaired-devices",
|
||||
"Title": "Deny Windows apps communication with unpaired devices",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
||||
"Name": "LetAppsSyncWithDevices",
|
||||
"Standard": 0,
|
||||
"Strict": 2,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappssyncwithdevices",
|
||||
"Impact": "Strict blocks Windows apps from communicating with unpaired wireless devices.",
|
||||
"Exceptions": ["LetAppsSyncWithDevices_ForceAllowTheseApps", "LetAppsSyncWithDevices_UserInControlOfTheseApps"]
|
||||
},
|
||||
{
|
||||
"Id": "app-voice-activation",
|
||||
"Title": "Deny Windows app voice activation",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
||||
"Name": "LetAppsActivateWithVoice",
|
||||
"Standard": 0,
|
||||
"Strict": 2,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsactivatewithvoice",
|
||||
"Impact": "Strict blocks Windows apps from activation by voice.",
|
||||
"Exceptions": ["LetAppsActivateWithVoice_ForceAllowTheseApps", "LetAppsActivateWithVoice_UserInControlOfTheseApps"]
|
||||
},
|
||||
{
|
||||
"Id": "app-voice-above-lock",
|
||||
"Title": "Deny Windows app voice activation while locked",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
||||
"Name": "LetAppsActivateWithVoiceAboveLock",
|
||||
"Standard": 0,
|
||||
"Strict": 2,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsactivatewithvoiceabovelock",
|
||||
"Impact": "Strict blocks Windows apps from voice activation while the session is locked.",
|
||||
"Exceptions": ["LetAppsActivateWithVoiceAboveLock_ForceAllowTheseApps", "LetAppsActivateWithVoiceAboveLock_UserInControlOfTheseApps"]
|
||||
},
|
||||
{
|
||||
"Id": "feedback-prompts",
|
||||
"Title": "Disable Microsoft feedback prompts",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection",
|
||||
"Name": "DoNotShowFeedbackNotifications",
|
||||
"Standard": 1,
|
||||
"Strict": 1,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#donotshowfeedbacknotifications",
|
||||
"Impact": "Stops Windows Feedback prompts. This setting does not by itself change diagnostic-data transmission.",
|
||||
"Exceptions": []
|
||||
},
|
||||
{
|
||||
"Id": "windows-error-reporting",
|
||||
"Title": "Disable Windows Error Reporting transmission",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Error Reporting",
|
||||
"Name": "Disabled",
|
||||
"Standard": 1,
|
||||
"Strict": 1,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/win32/wer/wer-settings",
|
||||
"Impact": "Stops Windows Error Reporting. Automatic crash analysis and solution lookup are unavailable; local security event channels are unaffected.",
|
||||
"Exceptions": []
|
||||
},
|
||||
{
|
||||
"Id": "wer-additional-data",
|
||||
"Title": "Prevent Windows Error Reporting second-level data",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Error Reporting",
|
||||
"Name": "DontSendAdditionalData",
|
||||
"Standard": 1,
|
||||
"Strict": 1,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/win32/wer/wer-settings",
|
||||
"Impact": "Adds a defense-in-depth restriction on second-level WER data if another component re-enables reporting.",
|
||||
"Exceptions": []
|
||||
},
|
||||
{
|
||||
"Id": "clipboard-sync",
|
||||
"Title": "Disallow cross-device clipboard synchronization",
|
||||
@@ -122,6 +326,286 @@
|
||||
"Impact": "Stops searching cloud sources such as OneDrive and SharePoint. Does not establish that all Start web queries are disabled.",
|
||||
"Exceptions": []
|
||||
},
|
||||
{
|
||||
"Id": "tailored-experiences",
|
||||
"Title": "Disable tailored experiences from diagnostic data",
|
||||
"Hive": "CurrentUser",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent",
|
||||
"Name": "DisableTailoredExperiencesWithDiagnosticData",
|
||||
"Standard": 1,
|
||||
"Strict": 1,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#allowtailoredexperienceswithdiagnosticdata",
|
||||
"Impact": "Stops Windows from using diagnostic data to personalize tips, advertisements and recommendations for the current user.",
|
||||
"Exceptions": []
|
||||
},
|
||||
{
|
||||
"Id": "implicit-text-collection",
|
||||
"Title": "Restrict implicit typing collection",
|
||||
"Hive": "CurrentUser",
|
||||
"Path": "SOFTWARE\\Microsoft\\InputPersonalization",
|
||||
"Name": "RestrictImplicitTextCollection",
|
||||
"Standard": 1,
|
||||
"Strict": 1,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-gb/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services",
|
||||
"Impact": "Restricts typing personalization collection for the current user. It does not block input observed by applications receiving keystrokes.",
|
||||
"Exceptions": []
|
||||
},
|
||||
{
|
||||
"Id": "implicit-ink-collection",
|
||||
"Title": "Restrict implicit inking collection",
|
||||
"Hive": "CurrentUser",
|
||||
"Path": "SOFTWARE\\Microsoft\\InputPersonalization",
|
||||
"Name": "RestrictImplicitInkCollection",
|
||||
"Standard": 1,
|
||||
"Strict": 1,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-gb/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services",
|
||||
"Impact": "Restricts handwriting personalization collection for the current user; recognition and personalization quality can be reduced.",
|
||||
"Exceptions": []
|
||||
},
|
||||
{
|
||||
"Id": "search-location",
|
||||
"Title": "Prevent Windows Search from using location",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search",
|
||||
"Name": "AllowSearchToUseLocation",
|
||||
"Standard": 0,
|
||||
"Strict": 0,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-search#allowsearchtouselocation",
|
||||
"Impact": "Search results will not use device location for local relevance.",
|
||||
"Exceptions": []
|
||||
},
|
||||
{
|
||||
"Id": "search-highlights",
|
||||
"Title": "Disable dynamic search highlights",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search",
|
||||
"Name": "EnableDynamicContentInWSB",
|
||||
"Standard": 0,
|
||||
"Strict": 0,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-search#enabledynamiccontentinwsb",
|
||||
"Impact": "Removes rotating web content and highlights from the Windows search box.",
|
||||
"Exceptions": []
|
||||
},
|
||||
{
|
||||
"Id": "widgets",
|
||||
"Title": "Disable Windows Widgets",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Dsh",
|
||||
"Name": "AllowNewsAndInterests",
|
||||
"Standard": 0,
|
||||
"Strict": 0,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-newsandinterests#allownewsandinterests",
|
||||
"Impact": "Disables the Widgets experience and its news, weather and personalized-content requests.",
|
||||
"Exceptions": []
|
||||
},
|
||||
{
|
||||
"Id": "device-metadata",
|
||||
"Title": "Disable device metadata downloads",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\Device Metadata",
|
||||
"Name": "PreventDeviceMetadataFromNetwork",
|
||||
"Standard": 0,
|
||||
"Strict": 1,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-gb/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services",
|
||||
"Impact": "Strict stops device metadata downloads; device icons, names or companion information can be less complete.",
|
||||
"Exceptions": []
|
||||
},
|
||||
{
|
||||
"Id": "font-streaming",
|
||||
"Title": "Disable downloadable fonts",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\System",
|
||||
"Name": "EnableFontProviders",
|
||||
"Standard": 1,
|
||||
"Strict": 0,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-gb/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services",
|
||||
"Impact": "Strict prevents Windows from downloading missing fonts; documents or sites can render with fallback fonts.",
|
||||
"Exceptions": []
|
||||
},
|
||||
{
|
||||
"Id": "msrt-reporting",
|
||||
"Title": "Disable Malicious Software Removal Tool infection reports",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\MRT",
|
||||
"Name": "DontReportInfectionInformation",
|
||||
"Standard": 1,
|
||||
"Strict": 1,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-gb/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services",
|
||||
"Impact": "Stops MSRT infection reports while preserving the tool and its delivery through Windows Update.",
|
||||
"Exceptions": []
|
||||
},
|
||||
{
|
||||
"Id": "llmnr",
|
||||
"Title": "Disable multicast name resolution",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows NT\\DNSClient",
|
||||
"Name": "EnableMulticast",
|
||||
"Standard": 1,
|
||||
"Strict": 0,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-admx-dnsclient#pol-llmnr",
|
||||
"Impact": "Strict disables LLMNR and reduces local-network name-resolution spoofing exposure. Legacy printers or peer discovery that depend on LLMNR can stop resolving by name.",
|
||||
"Exceptions": []
|
||||
},
|
||||
{
|
||||
"Id": "app-location",
|
||||
"Title": "Deny Windows apps location access",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
||||
"Name": "LetAppsAccessLocation",
|
||||
"Standard": 0,
|
||||
"Strict": 2,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccesslocation",
|
||||
"Impact": "Strict denies covered Windows apps access to Windows location; IP and network-based inference remain possible.",
|
||||
"Exceptions": ["LetAppsAccessLocation_ForceAllowTheseApps", "LetAppsAccessLocation_UserInControlOfTheseApps"]
|
||||
},
|
||||
{
|
||||
"Id": "app-foreground-text",
|
||||
"Title": "Deny Windows apps foreground-window text access",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
||||
"Name": "LetAppsAccessForegroundText",
|
||||
"Standard": 0,
|
||||
"Strict": 2,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessforegroundtext",
|
||||
"Impact": "Strict denies covered apps access to text in the active window; accessibility and assistive workflows can be affected.",
|
||||
"Exceptions": ["LetAppsAccessForegroundText_ForceAllowTheseApps", "LetAppsAccessForegroundText_UserInControlOfTheseApps"]
|
||||
},
|
||||
{
|
||||
"Id": "app-gaze-input",
|
||||
"Title": "Deny Windows apps gaze input",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
||||
"Name": "LetAppsAccessGazeInput",
|
||||
"Standard": 0,
|
||||
"Strict": 2,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessgazeinput",
|
||||
"Impact": "Strict denies covered apps access to eye-tracking input; gaze-based accessibility can stop working.",
|
||||
"Exceptions": ["LetAppsAccessGazeInput_ForceAllowTheseApps", "LetAppsAccessGazeInput_UserInControlOfTheseApps"]
|
||||
},
|
||||
{
|
||||
"Id": "app-screen-capture",
|
||||
"Title": "Deny programmatic screen capture by Windows apps",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
||||
"Name": "LetAppsAccessGraphicsCaptureProgrammatic",
|
||||
"Standard": 0,
|
||||
"Strict": 2,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessgraphicscaptureprogrammatic",
|
||||
"Impact": "Strict denies covered apps programmatic screen capture; conferencing, recording and support tools can fail.",
|
||||
"Exceptions": ["LetAppsAccessGraphicsCaptureProgrammatic_ForceAllowTheseApps", "LetAppsAccessGraphicsCaptureProgrammatic_UserInControlOfTheseApps"]
|
||||
},
|
||||
{
|
||||
"Id": "app-borderless-capture",
|
||||
"Title": "Deny borderless screen capture by Windows apps",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
||||
"Name": "LetAppsAccessGraphicsCaptureWithoutBorder",
|
||||
"Standard": 0,
|
||||
"Strict": 2,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessgraphicscapturewithoutborder",
|
||||
"Impact": "Strict denies covered apps capture without the Windows capture border; recording workflows can change.",
|
||||
"Exceptions": ["LetAppsAccessGraphicsCaptureWithoutBorder_ForceAllowTheseApps", "LetAppsAccessGraphicsCaptureWithoutBorder_UserInControlOfTheseApps"]
|
||||
},
|
||||
{
|
||||
"Id": "app-human-presence",
|
||||
"Title": "Deny Windows apps human-presence sensing",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
||||
"Name": "LetAppsAccessHumanPresence",
|
||||
"Standard": 0,
|
||||
"Strict": 2,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccesshumanpresence",
|
||||
"Impact": "Strict denies covered apps presence-sensor access; presence-aware lock, wake and attention features can be affected.",
|
||||
"Exceptions": ["LetAppsAccessHumanPresence_ForceAllowTheseApps", "LetAppsAccessHumanPresence_UserInControlOfTheseApps"]
|
||||
},
|
||||
{
|
||||
"Id": "app-motion",
|
||||
"Title": "Deny Windows apps motion data",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
||||
"Name": "LetAppsAccessMotion",
|
||||
"Standard": 0,
|
||||
"Strict": 2,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessmotion",
|
||||
"Impact": "Strict denies covered apps accelerometer and motion data.",
|
||||
"Exceptions": ["LetAppsAccessMotion_ForceAllowTheseApps", "LetAppsAccessMotion_UserInControlOfTheseApps"]
|
||||
},
|
||||
{
|
||||
"Id": "app-notifications",
|
||||
"Title": "Deny Windows apps notification access",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
||||
"Name": "LetAppsAccessNotifications",
|
||||
"Standard": 0,
|
||||
"Strict": 2,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessnotifications",
|
||||
"Impact": "Strict denies covered apps access to other apps' notifications; automation and notification aggregation can fail.",
|
||||
"Exceptions": ["LetAppsAccessNotifications_ForceAllowTheseApps", "LetAppsAccessNotifications_UserInControlOfTheseApps"]
|
||||
},
|
||||
{
|
||||
"Id": "app-phone",
|
||||
"Title": "Deny Windows apps phone access",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
||||
"Name": "LetAppsAccessPhone",
|
||||
"Standard": 0,
|
||||
"Strict": 2,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessphone",
|
||||
"Impact": "Strict denies covered apps access to telephony state and functions.",
|
||||
"Exceptions": ["LetAppsAccessPhone_ForceAllowTheseApps", "LetAppsAccessPhone_UserInControlOfTheseApps"]
|
||||
},
|
||||
{
|
||||
"Id": "app-radios",
|
||||
"Title": "Deny Windows apps radio control",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
||||
"Name": "LetAppsAccessRadios",
|
||||
"Standard": 0,
|
||||
"Strict": 2,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessradios",
|
||||
"Impact": "Strict denies covered apps control of radios such as Bluetooth; it does not power off radio hardware.",
|
||||
"Exceptions": ["LetAppsAccessRadios_ForceAllowTheseApps", "LetAppsAccessRadios_UserInControlOfTheseApps"]
|
||||
},
|
||||
{
|
||||
"Id": "app-background",
|
||||
"Title": "Deny Windows apps background execution",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
||||
"Name": "LetAppsRunInBackground",
|
||||
"Standard": 0,
|
||||
"Strict": 2,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsruninbackground",
|
||||
"Impact": "Strict prevents covered Windows apps from running in the background; notifications and synchronization can be delayed or stop.",
|
||||
"Exceptions": ["LetAppsRunInBackground_ForceAllowTheseApps", "LetAppsRunInBackground_UserInControlOfTheseApps"]
|
||||
},
|
||||
{
|
||||
"Id": "consumer-experiences",
|
||||
"Title": "Disable Microsoft consumer experiences where supported",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent",
|
||||
"Name": "DisableWindowsConsumerFeatures",
|
||||
"Standard": null,
|
||||
"Strict": null,
|
||||
"EnterpriseValue": 1,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#allowwindowsconsumerfeatures",
|
||||
"Impact": "Enterprise and Education only: prevents Microsoft consumer experiences and suggested app promotion. Pro and Home are not claimed as supported.",
|
||||
"Exceptions": []
|
||||
},
|
||||
{
|
||||
"Id": "windows-spotlight",
|
||||
"Title": "Disable Windows Spotlight where supported",
|
||||
"Hive": "CurrentUser",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent",
|
||||
"Name": "DisableWindowsSpotlightFeatures",
|
||||
"Standard": null,
|
||||
"Strict": null,
|
||||
"EnterpriseValue": 1,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#allowwindowsspotlight",
|
||||
"Impact": "Enterprise and Education only: disables Windows Spotlight for the current user, including rotating cloud content and suggestions.",
|
||||
"Exceptions": []
|
||||
},
|
||||
{
|
||||
"Id": "delivery-optimization",
|
||||
"Title": "Restrict Delivery Optimization",
|
||||
@@ -134,6 +618,42 @@
|
||||
"Impact": "Standard: HTTP without peering. Strict: HTTP without peering or DO cloud service. Neither blocks all update traffic or guarantees suppression of GDID reporting.",
|
||||
"Exceptions": []
|
||||
},
|
||||
{
|
||||
"Id": "block-consumer-microsoft-auth",
|
||||
"Title": "Block consumer Microsoft-account authentication in apps and services",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\MicrosoftAccount",
|
||||
"Name": "DisableUserAuth",
|
||||
"Standard": 0,
|
||||
"Strict": 1,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-admx-msapolicy#microsoftaccount_disableuserauth",
|
||||
"Impact": "Strict prevents applications and services from authenticating with consumer Microsoft accounts after cached tokens expire. It does not change the Windows logon account or browser-based authentication.",
|
||||
"Exceptions": []
|
||||
},
|
||||
{
|
||||
"Id": "block-adding-microsoft-accounts",
|
||||
"Title": "Block adding Microsoft accounts to Windows",
|
||||
"Path": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System",
|
||||
"Name": "NoConnectedUser",
|
||||
"Standard": 0,
|
||||
"Strict": 1,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/accounts-block-microsoft-accounts",
|
||||
"Impact": "Strict blocks adding new Microsoft accounts while preserving existing Windows logon accounts. Value 3 is deliberately not used because it can prevent an existing Microsoft-account user from signing in to Windows.",
|
||||
"Exceptions": []
|
||||
},
|
||||
{
|
||||
"Id": "block-workplace-registration",
|
||||
"Title": "Block adding work or school accounts to the device",
|
||||
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\WorkplaceJoin",
|
||||
"Name": "BlockAADWorkplaceJoin",
|
||||
"Standard": 0,
|
||||
"Strict": 1,
|
||||
"EnterpriseValue": null,
|
||||
"Source": "https://learn.microsoft.com/en-us/entra/identity/devices/howto-device-identity-virtual-desktop-infrastructure",
|
||||
"Impact": "Strict blocks new Microsoft Entra workplace registration. Existing organizational enrollment is not removed; ms-private refuses mutation on domain-joined or MDM-enrolled devices.",
|
||||
"Exceptions": []
|
||||
},
|
||||
{
|
||||
"Id": "updates-auto",
|
||||
"Title": "Automatic Windows Update choice",
|
||||
|
||||
@@ -0,0 +1,164 @@
|
||||
{
|
||||
"Schema": 2,
|
||||
"FreshInstallMaxAgeDays": 7,
|
||||
"DefaultFreshPreset": "FreshInstall",
|
||||
"DefaultEstablishedPreset": "EstablishedSafe",
|
||||
"Presets": [
|
||||
{
|
||||
"Id": "EstablishedSafe",
|
||||
"Label": "Established PC - conservative",
|
||||
"Description": "For an existing daily-use computer. Applies only the Standard policy profile and leaves applications, accounts, services, devices, Recall data, files and network behavior unchanged.",
|
||||
"Profile": "Standard",
|
||||
"Updates": "Keep",
|
||||
"Services": false,
|
||||
"Accounts": false,
|
||||
"Browsers": [],
|
||||
"RemoveBundled": false,
|
||||
"RemovePersonal": false,
|
||||
"RemoveStore": false,
|
||||
"RemoveOneDrive": false,
|
||||
"RemoveEdge": false,
|
||||
"Recall": false,
|
||||
"RemoveRecall": false,
|
||||
"Network": "Observe",
|
||||
"RollbackMinutes": 10,
|
||||
"Cleanup": false,
|
||||
"PrivacyCleanup": false,
|
||||
"CleanupSchedule": false,
|
||||
"Lock": false,
|
||||
"InstallMullvad": false,
|
||||
"InstallVeraCrypt": false,
|
||||
"DisableSensors": false
|
||||
},
|
||||
{
|
||||
"Id": "FreshInstall",
|
||||
"Label": "Fresh install - complete privacy setup",
|
||||
"Description": "For a new Windows installation. Applies Strict privacy, removes every unambiguously removable app including Store, Edge and OneDrive, purges Microsoft app credentials, removes Recall, disables reviewed services and detected sensors, blocks reviewed optional endpoints, cleans artifacts and installs Mullvad, VeraCrypt, Zen and Tor.",
|
||||
"Profile": "Strict",
|
||||
"Updates": "Automatic",
|
||||
"Services": true,
|
||||
"Accounts": true,
|
||||
"Browsers": ["Zen", "Tor"],
|
||||
"RemoveBundled": true,
|
||||
"RemovePersonal": true,
|
||||
"RemoveStore": true,
|
||||
"RemoveOneDrive": true,
|
||||
"RemoveEdge": true,
|
||||
"Recall": true,
|
||||
"RemoveRecall": true,
|
||||
"Network": "BlockOptionalTelemetry",
|
||||
"RollbackMinutes": 10,
|
||||
"Cleanup": true,
|
||||
"PrivacyCleanup": true,
|
||||
"CleanupSchedule": true,
|
||||
"Lock": true,
|
||||
"InstallMullvad": true,
|
||||
"InstallVeraCrypt": true,
|
||||
"DisableSensors": true
|
||||
},
|
||||
{
|
||||
"Id": "Gentle",
|
||||
"Label": "Gentle",
|
||||
"Description": "Core privacy policy and curated promotional-app removal. Keeps personal apps, Store, Edge, OneDrive, accounts, sensors and network behavior.",
|
||||
"Profile": "Standard",
|
||||
"Updates": "Keep",
|
||||
"Services": false,
|
||||
"Accounts": false,
|
||||
"Browsers": ["Zen"],
|
||||
"RemoveBundled": true,
|
||||
"RemovePersonal": false,
|
||||
"RemoveStore": false,
|
||||
"RemoveOneDrive": false,
|
||||
"RemoveEdge": false,
|
||||
"Recall": false,
|
||||
"RemoveRecall": false,
|
||||
"Network": "Observe",
|
||||
"RollbackMinutes": 10,
|
||||
"Cleanup": false,
|
||||
"PrivacyCleanup": false,
|
||||
"CleanupSchedule": false,
|
||||
"Lock": false,
|
||||
"InstallMullvad": false,
|
||||
"InstallVeraCrypt": false,
|
||||
"DisableSensors": false
|
||||
},
|
||||
{
|
||||
"Id": "Medium",
|
||||
"Label": "Medium - automatic removal",
|
||||
"Description": "Strict privacy, account purge, Recall removal, privacy services, cleanup and every unambiguously removable app including Microsoft Store, Edge, OneDrive and third-party apps. Security and runtime dependencies remain protected.",
|
||||
"Profile": "Strict",
|
||||
"Updates": "Automatic",
|
||||
"Services": true,
|
||||
"Accounts": true,
|
||||
"Browsers": ["Zen"],
|
||||
"RemoveBundled": true,
|
||||
"RemovePersonal": true,
|
||||
"RemoveStore": true,
|
||||
"RemoveOneDrive": true,
|
||||
"RemoveEdge": true,
|
||||
"Recall": true,
|
||||
"RemoveRecall": true,
|
||||
"Network": "BlockOptionalTelemetry",
|
||||
"RollbackMinutes": 10,
|
||||
"Cleanup": true,
|
||||
"PrivacyCleanup": true,
|
||||
"CleanupSchedule": true,
|
||||
"Lock": true,
|
||||
"InstallMullvad": true,
|
||||
"InstallVeraCrypt": true,
|
||||
"DisableSensors": false
|
||||
},
|
||||
{
|
||||
"Id": "Strong",
|
||||
"Label": "Strong - automatic plus sensors",
|
||||
"Description": "Medium plus Tor Browser and automatic selection of camera, microphone and sensor devices. Windows Hello or conferencing hardware can be disabled.",
|
||||
"Profile": "Strict",
|
||||
"Updates": "Automatic",
|
||||
"Services": true,
|
||||
"Accounts": true,
|
||||
"Browsers": ["Zen", "Tor"],
|
||||
"RemoveBundled": true,
|
||||
"RemovePersonal": true,
|
||||
"RemoveStore": true,
|
||||
"RemoveOneDrive": true,
|
||||
"RemoveEdge": true,
|
||||
"Recall": true,
|
||||
"RemoveRecall": true,
|
||||
"Network": "BlockOptionalTelemetry",
|
||||
"RollbackMinutes": 10,
|
||||
"Cleanup": true,
|
||||
"PrivacyCleanup": true,
|
||||
"CleanupSchedule": true,
|
||||
"Lock": true,
|
||||
"InstallMullvad": true,
|
||||
"InstallVeraCrypt": true,
|
||||
"DisableSensors": true
|
||||
},
|
||||
{
|
||||
"Id": "Maximum",
|
||||
"Label": "Maximum - timed isolation",
|
||||
"Description": "Strong plus all three browsers and default-outbound network isolation with a mandatory timed rollback. Retaining isolation prevents normal online updates until connectivity is restored or explicitly allowed.",
|
||||
"Profile": "Strict",
|
||||
"Updates": "Notify",
|
||||
"Services": true,
|
||||
"Accounts": true,
|
||||
"Browsers": ["Zen", "Helium", "Tor"],
|
||||
"RemoveBundled": true,
|
||||
"RemovePersonal": true,
|
||||
"RemoveStore": true,
|
||||
"RemoveOneDrive": true,
|
||||
"RemoveEdge": true,
|
||||
"Recall": true,
|
||||
"RemoveRecall": true,
|
||||
"Network": "Isolate",
|
||||
"RollbackMinutes": 10,
|
||||
"Cleanup": true,
|
||||
"PrivacyCleanup": true,
|
||||
"CleanupSchedule": true,
|
||||
"Lock": true,
|
||||
"InstallMullvad": true,
|
||||
"InstallVeraCrypt": true,
|
||||
"DisableSensors": true
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,89 @@
|
||||
{
|
||||
"Schema": 1,
|
||||
"Services": [
|
||||
{
|
||||
"Id": "connected-telemetry",
|
||||
"Name": "DiagTrack",
|
||||
"Instances": false,
|
||||
"SetUserServiceFlags": false,
|
||||
"Standard": "Keep",
|
||||
"Strict": "Disabled",
|
||||
"Impact": "Stops the Connected User Experiences and Telemetry service. Required service traffic and application telemetry remain separate.",
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/privacy/manage-windows-11-endpoints"
|
||||
},
|
||||
{
|
||||
"Id": "wap-push-routing",
|
||||
"Name": "dmwappushservice",
|
||||
"Instances": false,
|
||||
"SetUserServiceFlags": false,
|
||||
"Standard": "Keep",
|
||||
"Strict": "Disabled",
|
||||
"Impact": "Stops WAP push message routing used by device-management scenarios. Managed devices are rejected by ms-private before mutation.",
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services"
|
||||
},
|
||||
{
|
||||
"Id": "connected-devices-platform",
|
||||
"Name": "CDPSvc",
|
||||
"Instances": false,
|
||||
"SetUserServiceFlags": false,
|
||||
"Standard": "Keep",
|
||||
"Strict": "Disabled",
|
||||
"Impact": "Breaks cross-device and connected-device experiences. This is evidence of a stopped local component, not proof that every GDID-like identifier is suppressed.",
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/application-management/per-user-services-in-windows"
|
||||
},
|
||||
{
|
||||
"Id": "connected-devices-user",
|
||||
"Name": "CDPUserSvc",
|
||||
"Instances": true,
|
||||
"SetUserServiceFlags": true,
|
||||
"Standard": "Keep",
|
||||
"Strict": "Disabled",
|
||||
"Impact": "Prevents future per-user CDP instances and stops current instances. Nearby Sharing, Phone Link, Miracast/DLNA/DIAL and related device experiences can stop working.",
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/application-management/per-user-services-in-windows"
|
||||
},
|
||||
{
|
||||
"Id": "cloud-sync-user",
|
||||
"Name": "OneSyncSvc",
|
||||
"Instances": true,
|
||||
"SetUserServiceFlags": true,
|
||||
"Standard": "Keep",
|
||||
"Strict": "Disabled",
|
||||
"Impact": "Disables the per-user host for mail, contacts, calendar and other synchronized user data.",
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/application-management/per-user-services-in-windows"
|
||||
},
|
||||
{
|
||||
"Id": "cloud-backup-user",
|
||||
"Name": "CloudBackupRestoreSvc",
|
||||
"Instances": true,
|
||||
"SetUserServiceFlags": true,
|
||||
"Standard": "Keep",
|
||||
"Strict": "Disabled",
|
||||
"Impact": "Disables Windows cloud backup and restore monitoring for user application and setting state.",
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/application-management/per-user-services-in-windows"
|
||||
},
|
||||
{
|
||||
"Id": "location-service",
|
||||
"Name": "lfsvc",
|
||||
"Instances": false,
|
||||
"SetUserServiceFlags": false,
|
||||
"Standard": "Keep",
|
||||
"Strict": "Disabled",
|
||||
"Impact": "Disables Windows geolocation service in addition to policy. IP-based location and application-specific collection remain possible.",
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/privacy/manage-windows-11-endpoints"
|
||||
},
|
||||
{
|
||||
"Id": "windows-error-reporting",
|
||||
"Name": "WerSvc",
|
||||
"Instances": false,
|
||||
"SetUserServiceFlags": false,
|
||||
"Standard": "Keep",
|
||||
"Strict": "Disabled",
|
||||
"Impact": "Stops Windows Error Reporting service. Crash diagnosis and automatic solution lookup are reduced.",
|
||||
"Source": "https://learn.microsoft.com/en-us/windows/win32/wer/wer-settings"
|
||||
}
|
||||
],
|
||||
"ProtectedServices": [
|
||||
"wuauserv", "UsoSvc", "BITS", "CryptSvc", "WinDefend", "WdNisSvc", "SecurityHealthService",
|
||||
"mpssvc", "BFE", "EventLog", "wlidsvc", "LicenseManager", "ClipSVC", "WpnService", "WpnUserService"
|
||||
]
|
||||
}
|
||||
Reference in new issue
Block a user