5.6 KiB
Windows Home and browser setup guide
These are Settings-backed controls; the machine-policy engine does not pretend to enforce them on Home. Run Home.ps1 -Page <name> or use the graphical wizard's Home tab to open the supported Windows Settings page. Labels vary by Windows build, so verify the visible toggle and representative behavior. ms-private does not automate localized clicks or mark a setting complete merely because it opened the page.
| Page / URI | Recommended choice | Verify |
|---|---|---|
Privacy & security > Diagnostics & feedback (ms-settings:privacy-feedback) |
Optional diagnostic data off; tailored/personalized offers off where available | Required data can remain on Home; read the descriptions |
Privacy & security > General (ms-settings:privacy-general) |
Advertising ID and suggested content off | Recheck per-user settings |
Privacy & security > Location (ms-settings:privacy-location) |
Location services off | Check representative apps; IP geolocation remains possible |
Privacy & security > Camera (ms-settings:privacy-webcam) |
Camera access off unless needed | Test packaged and desktop apps and Windows Hello |
Privacy & security > Microphone (ms-settings:privacy-microphone) |
Microphone access off unless needed | Test conferencing and browser recording; hardware switch for stronger restriction |
Privacy & security > Speech (ms-settings:privacy-speech) |
Online speech recognition off | Recheck dictation needs |
System > Clipboard (ms-settings:clipboard) |
Cross-device sync off; history off for Strict | Clear existing history separately if wanted |
Privacy & security > Find my device (ms-settings:findmydevice) |
Off if cloud location recovery is unwanted | Accept losing that recovery feature |
Privacy & security > Search permissions (ms-settings:search-permissions) |
Microsoft/work-account cloud search off | This is not proof that all Start web search is disabled |
System > Storage (ms-settings:storagesense) |
Configure Temp cleanup; leave Downloads deletion off | Review recycle-bin retention; not secure erasure |
Windows Update (ms-settings:windowsupdate) |
Updates on; use supported temporary pause and active hours | Resume on the chosen date; keep browsers and antivirus updated |
Apps > Installed apps (ms-settings:appsfeatures) |
Review Copilot, OneDrive and unwanted apps individually | Make OneDrive documents local/backed up first; preserve app dependencies |
Also review Windows backup/settings sync, Phone Link, Widgets, online account use, notifications on the lock screen, browser location permissions and installed OEM utilities. A local Windows account reduces account coupling but is not an anonymity guarantee. Do not disable encryption or antivirus for performance/privacy presets.
Use Accounts.ps1 -Mode Plan -Scope AllAppAccounts to preview current-user Microsoft application sign-outs. Apply permanently resets the listed app packages and deletes matching stored application credentials; it does not convert or remove the Windows logon account. Existing work or school registration must be reviewed under Settings > Accounts > Access work or school because ms-private refuses changes on a managed device.
On eligible devices, Recall settings are under Privacy & security > Recall & snapshots. Review deletion effects before disabling by policy or removing the feature. Existing snapshot data is not backed up by ms-private.
Browser choices
- Tor Browser: official build, standard protections, no profile import, no extra extensions. Use it for sessions that need separation from your everyday identity. Personal logins still identify you to their providers. Tor Browser does not route other Windows applications through Tor.
- Zen: everyday browser; review sync, search suggestions, site permissions, history/cookie retention and external connections. Keep updates enabled. Choose whether you want persistent account sessions.
- Helium: everyday Chromium-based option; review setup network choices, update behavior and optional crash reporting. Keep security updates. Its local history/profile and logged-in accounts still need separate retention decisions.
Install only the selected browsers; none becomes the default automatically:
./Install-Apps.ps1 -App Tor,Zen,Helium -WhatIf
./Install-Apps.ps1 -App Tor,Zen,Helium
WinGet contacts its community source and publisher download infrastructure and can produce local logs. WinGet and publisher installers have their own diagnostic/privacy settings; this installer wrapper does not override them. These installation connections are separate from ms-private's offline policy engine. Verify displayed package identity/version/publisher before accepting installer prompts. WinGet manifests are community-maintained; their presence is not a security audit.
Mullvad and storage
Mullvad installation is optional: ./Install-Apps.ps1 -App Mullvad. It needs an account with service time; this tool does not purchase, log in or capture account numbers. After setup, review launch at startup, auto-connect, Lockdown mode, local-network access and split tunneling. Test disconnect/reconnect and DNS/IPv6 behavior. Do not assume a VPN stops Windows telemetry; it can carry that traffic too.
VeraCrypt installation is optional: ./Install-Apps.ps1 -App VeraCrypt. Configure containers and unmount behavior within VeraCrypt. Keep system encryption and recovery keys; do not decrypt the OS as a prerequisite. Win+L does not wipe all RAM or revoke every session token.
The source-backed rationale and limitations are in PRIVACY.md. Verify controls on the actual Windows build and hardware.