0x000/ms-private
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity
Files
7aacc0b63f34187cc91a9cabd7e7c3ae1659171c
ms-private/outputs/01a0b6c2-22ad-7b62-9a5a-4a09014a9b42/register-data.json
T
unknown 7aacc0b63f first commit
2026-09-19 20:55:32 -04:00

2708 lines
100 KiB
JSON
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
{
"reviewed": "2026-09-18/19",
"counts": {
"controls": 85,
"tools": 19,
"identifiers": 21,
"claims": 20,
"todos": 24,
"scriptFindings": 12
},
"controls": [
[
"diagnostics",
"Minimum supported Windows diagnostic data",
"Windows policy",
"Default",
"Implemented",
"Not applied",
"Pending",
"Pro retains required diagnostics. Enterprise/Education use 0. Required service data is separate; this does not silence Microsoft connections.",
"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry. Standard=1; Strict=1; Enterprise/Education=0.",
"Reviewed Windows 11 Pro/Enterprise/Education builds 26100/26200. Home audit only. Windows 10 not validated.",
"Engine tests passed; reboot and effective-policy VM tests pending. Journal restores prior value; no network guarantee.",
"",
"https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-system#allowtelemetry",
"2026-09-18T12:00:00.000Z"
],
[
"advertising-id",
"Disable Windows advertising ID",
"Windows policy",
"Default",
"Implemented",
"Not applied",
"Pending",
"Affects the Windows advertising ID only, not GDID, browser fingerprints or account identifiers.",
"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\AdvertisingInfo\\DisabledByGroupPolicy. Standard=1; Strict=1.",
"Reviewed Windows 11 Pro/Enterprise/Education builds 26100/26200. Home audit only. Windows 10 not validated.",
"Engine tests passed; reboot and effective-policy VM tests pending. Journal restores prior value; no network guarantee.",
"",
"https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#disableadvertisingid",
"2026-09-18T12:00:00.000Z"
],
[
"location",
"Turn off Windows location feature",
"Windows policy",
"Default",
"Implemented",
"Not applied",
"Pending",
"Location-dependent features stop working. IP-based and other independent location inference remain possible.",
"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\LocationAndSensors\\DisableLocation. Standard=1; Strict=1.",
"Reviewed Windows 11 Pro/Enterprise/Education builds 26100/26200. Home audit only. Windows 10 not validated.",
"Engine tests passed; reboot and effective-policy VM tests pending. Journal restores prior value; no network guarantee.",
"",
"https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-admx-sensors#disablelocation_2",
"2026-09-18T12:00:00.000Z"
],
[
"camera",
"Disallow camera devices by policy",
"Windows policy",
"Default",
"Implemented",
"Not applied",
"Pending",
"Can break camera-dependent workflows. Not a physical disconnection; test Windows Hello and desktop applications after reboot.",
"HKLM\\SOFTWARE\\Policies\\Microsoft\\Camera\\AllowCamera. Standard=0; Strict=0.",
"Reviewed Windows 11 Pro/Enterprise/Education builds 26100/26200. Home audit only. Windows 10 not validated.",
"Engine tests passed; reboot and effective-policy VM tests pending. Journal restores prior value; no network guarantee.",
"",
"https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-camera#allowcamera",
"2026-09-18T12:00:00.000Z"
],
[
"microphone-apps",
"Deny Windows app microphone access by default",
"Windows policy",
"Default",
"Implemented",
"Not applied",
"Pending",
"Does not guarantee blocking all desktop applications. Existing per-app exceptions cause a conflict; use the device-wide Settings toggle or hardware disconnect for stronger restriction.",
"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy\\LetAppsAccessMicrophone. Standard=2; Strict=2.",
"Reviewed Windows 11 Pro/Enterprise/Education builds 26100/26200. Home audit only. Windows 10 not validated.",
"Engine tests passed; reboot and effective-policy VM tests pending. Journal restores prior value; no network guarantee.",
"",
"https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessmicrophone",
"2026-09-18T12:00:00.000Z"
],
[
"cloud-speech",
"Disallow online speech recognition",
"Windows policy",
"Default",
"Implemented",
"Not applied",
"Pending",
"Cloud speech functionality is unavailable. Does not govern every application's speech service.",
"HKLM\\SOFTWARE\\Policies\\Microsoft\\InputPersonalization\\AllowInputPersonalization. Standard=0; Strict=0.",
"Reviewed Windows 11 Pro/Enterprise/Education builds 26100/26200. Home audit only. Windows 10 not validated.",
"Engine tests passed; reboot and effective-policy VM tests pending. Journal restores prior value; no network guarantee.",
"",
"https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#allowinputpersonalization",
"2026-09-18T12:00:00.000Z"
],
[
"clipboard-sync",
"Disallow cross-device clipboard synchronization",
"Windows policy",
"Default",
"Implemented",
"Not applied",
"Pending",
"Stops Windows clipboard synchronization. Does not delete clipboard contents or copies already sent elsewhere.",
"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\AllowCrossDeviceClipboard. Standard=0; Strict=0.",
"Reviewed Windows 11 Pro/Enterprise/Education builds 26100/26200. Home audit only. Windows 10 not validated.",
"Engine tests passed; reboot and effective-policy VM tests pending. Journal restores prior value; no network guarantee.",
"",
"https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#allowcrossdeviceclipboard",
"2026-09-18T12:00:00.000Z"
],
[
"clipboard-history",
"Disallow Windows clipboard history",
"Windows policy",
"Strict",
"Implemented",
"Not applied",
"Pending",
"Win+V history unavailable. Past contents are not backed up or recoverable by this toolkit.",
"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\AllowClipboardHistory. Standard=unchanged; Strict=0.",
"Reviewed Windows 11 Pro/Enterprise/Education builds 26100/26200. Home audit only. Windows 10 not validated.",
"Engine tests passed; reboot and effective-policy VM tests pending. Journal restores prior value; no network guarantee.",
"",
"https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#allowclipboardhistory",
"2026-09-18T12:00:00.000Z"
],
[
"find-my-device",
"Disable Find My Device",
"Windows policy",
"Default",
"Implemented",
"Not applied",
"Pending",
"Loses Microsoft's device-location recovery feature. Does not erase cloud records already collected.",
"HKLM\\SOFTWARE\\Policies\\Microsoft\\FindMyDevice\\AllowFindMyDevice. Standard=0; Strict=0.",
"Reviewed Windows 11 Pro/Enterprise/Education builds 26100/26200. Home audit only. Windows 10 not validated.",
"Engine tests passed; reboot and effective-policy VM tests pending. Journal restores prior value; no network guarantee.",
"",
"https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#allowfindmydevice",
"2026-09-18T12:00:00.000Z"
],
[
"cloud-search",
"Disable cloud sources in Windows Search",
"Windows policy",
"Default",
"Implemented",
"Not applied",
"Pending",
"Stops searching cloud sources such as OneDrive and SharePoint. Does not establish that all Start web queries are disabled.",
"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search\\AllowCloudSearch. Standard=0; Strict=0.",
"Reviewed Windows 11 Pro/Enterprise/Education builds 26100/26200. Home audit only. Windows 10 not validated.",
"Engine tests passed; reboot and effective-policy VM tests pending. Journal restores prior value; no network guarantee.",
"",
"https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-search#allowcloudsearch",
"2026-09-18T12:00:00.000Z"
],
[
"delivery-optimization",
"Restrict Delivery Optimization",
"Windows policy",
"Default",
"Implemented",
"Not applied",
"Pending",
"Standard: HTTP without peering. Strict: HTTP without peering or DO cloud service. Neither blocks all update traffic or guarantees suppression of GDID reporting.",
"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\DeliveryOptimization\\DODownloadMode. Standard=0; Strict=99.",
"Reviewed Windows 11 Pro/Enterprise/Education builds 26100/26200. Home audit only. Windows 10 not validated.",
"Engine tests passed; reboot and effective-policy VM tests pending. Journal restores prior value; no network guarantee.",
"",
"https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-deliveryoptimization#dodownloadmode",
"2026-09-18T12:00:00.000Z"
],
[
"updates-auto",
"Automatic Windows Update choice",
"Windows policy",
"Optional",
"Implemented",
"Not applied",
"Pending",
"Manual requires the user to install security updates. Preserves update components; other update policies and products remain separate.",
"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\NoAutoUpdate. Standard=unchanged; Strict=unchanged.",
"Reviewed Windows 11 Pro/Enterprise/Education builds 26100/26200. Home audit only. Windows 10 not validated.",
"Engine tests passed; reboot and effective-policy VM tests pending. Journal restores prior value; no network guarantee.",
"",
"https://learn.microsoft.com/en-us/windows/deployment/update/waas-wu-settings",
"2026-09-18T12:00:00.000Z"
],
[
"updates-options",
"Windows Update download/install behavior",
"Windows policy",
"Optional",
"Implemented",
"Not applied",
"Pending",
"Notify requests download/install notification; Automatic requests scheduled automatic installation. Effective behavior needs Windows validation.",
"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\AUOptions. Standard=unchanged; Strict=unchanged.",
"Reviewed Windows 11 Pro/Enterprise/Education builds 26100/26200. Home audit only. Windows 10 not validated.",
"Engine tests passed; reboot and effective-policy VM tests pending. Journal restores prior value; no network guarantee.",
"",
"https://learn.microsoft.com/en-us/windows/deployment/update/waas-wu-settings",
"2026-09-18T12:00:00.000Z"
],
[
"tailored",
"Personalized offers and diagnostic personalization",
"Diagnostics",
"Default",
"Planned",
"Not applied",
"Pending",
"Turn off personalized offers based on diagnostics.",
"Separate from diagnostic collection; names and availability vary by build.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Verify Settings and effective policy after reboot.",
"",
"https://learn.microsoft.com/en-us/windows/privacy/configure-windows-diagnostic-data-in-your-organization",
"2026-09-18T12:00:00.000Z"
],
[
"feedback",
"Feedback prompts",
"Diagnostics",
"Optional",
"Planned",
"Not applied",
"Pending",
"Suppress unsolicited feedback requests.",
"Does not disable diagnostic transport.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Check supported setting on each edition.",
"",
"https://learn.microsoft.com/en-us/windows/privacy/configure-windows-diagnostic-data-in-your-organization",
"2026-09-18T12:00:00.000Z"
],
[
"crash-upload",
"Optional crash and error submissions",
"Diagnostics",
"Default",
"Planned",
"Not applied",
"Pending",
"Reduce optional diagnostic crash uploads; review Windows Error Reporting separately.",
"Dumps may contain user content. Preserve useful local troubleshooting and security records.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Test app crash handling and retention without uploading real user documents.",
"",
"https://learn.microsoft.com/en-us/windows/privacy/optional-diagnostic-data",
"2026-09-18T12:00:00.000Z"
],
[
"edge-url",
"Edge optional URL diagnostics",
"Browser",
"Default",
"Planned",
"Not applied",
"Pending",
"If Edge remains, disable optional URL/per-page diagnostics using its policy.",
"This is separate from SmartScreen, browsing sync and Windows diagnostics.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Check edge://policy and a lab traffic baseline; keep browser updates.",
"",
"https://learn.microsoft.com/en-us/deployedge/microsoft-edge-policies/urldiagnosticdataenabled",
"2026-09-18T12:00:00.000Z"
],
[
"recall",
"Recall snapshot retention",
"AI",
"Default",
"Planned",
"Not applied",
"Pending",
"Detect eligibility; turn off snapshot saving with supported controls.",
"Some Recall policies delete existing snapshots. Present deletion separately; rollback cannot recover them.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Test eligible hardware/VM where supported; confirm setting and storage outcome.",
"",
"https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis",
"2026-09-18T12:00:00.000Z"
],
[
"recall-export",
"Recall export and Click to Do",
"AI",
"Default",
"Research",
"Not applied",
"Pending",
"Review export settings and Click to Do separately from Recall saving.",
"Feature, region and edition restrictions apply. Click to Do policy does not control its Recall integration.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Inventory availability and verify each supported control.",
"",
"https://learn.microsoft.com/en-us/windows/client-management/manage-recall",
"2026-09-18T12:00:00.000Z"
],
[
"copilot",
"Copilot and application AI features",
"AI",
"Optional",
"Planned",
"Not applied",
"Pending",
"Offer per-app removal and cloud-AI settings for unused features.",
"One Copilot toggle does not cover Office, Edge, search, Recall and third-party AI.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Inventory exact packages; preserve shared runtimes; test reinstall.",
"",
"https://github.com/Raphire/Win11Debloat/wiki/Features",
"2026-09-18T12:00:00.000Z"
],
[
"cdp",
"Connected Devices Platform",
"Connected features",
"Optional",
"Research",
"Not applied",
"Pending",
"Evaluate documented AllowConnectedDevices deployment; reboot required.",
"No invented registry mapping. Suppressing CDP has not been shown here to eliminate GDID.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Test supported CSP/management route and cross-device breakage in a VM.",
"",
"https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-connectivity#allowconnecteddevices",
"2026-09-18T12:00:00.000Z"
],
[
"phone-link",
"Phone Link and cross-device experiences",
"Connected features",
"Optional",
"Planned",
"Not applied",
"Pending",
"Unlink and uninstall unused Phone Link features through supported interfaces.",
"Account-side records and other devices remain separate.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Test phone integration removal and restoration.",
"",
"https://learn.microsoft.com/en-us/windows/privacy/essential-services-and-connected-experiences",
"2026-09-18T12:00:00.000Z"
],
[
"windows-backup",
"Windows Backup and settings sync",
"Connected features",
"Optional",
"Planned",
"Not applied",
"Pending",
"Disable unwanted account backup and sync after reviewing recovery needs.",
"Do not silently delete recovery keys or existing backups.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Verify local data availability and supported recovery path.",
"",
"https://learn.microsoft.com/en-us/windows/privacy/essential-services-and-connected-experiences",
"2026-09-18T12:00:00.000Z"
],
[
"local-account",
"Local Windows account",
"Accounts",
"Optional",
"Planned",
"Not applied",
"Pending",
"Offer a local account where supported; avoid unnecessary Microsoft sign-in.",
"A local account is not proof of no device identifier; app sign-ins remain independent.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Preserve account access and recovery before any migration.",
"",
"Project engineering decision; not a verified Windows guarantee",
"2026-09-18T12:00:00.000Z"
],
[
"cloud-records",
"Existing provider records",
"Accounts",
"Optional",
"Planned",
"Not applied",
"Pending",
"Provide links to account privacy/export/deletion controls.",
"Local toggles cannot delete provider logs, retained records or other people's copies.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Document provider-specific deletion scope and retained categories.",
"",
"https://learn.microsoft.com/en-us/windows/privacy/essential-services-and-connected-experiences",
"2026-09-18T12:00:00.000Z"
],
[
"activity-history",
"Local activity history",
"Retention",
"Optional",
"Planned",
"Not applied",
"Pending",
"Stop local activity history and separately offer clear history.",
"Cloud upload option was deprecated on patched Windows 10/11 in January 2024. Avoid obsolete spying claims.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Check actual build and Settings; distinguish future retention from deletion.",
"",
"https://support.microsoft.com/en-us/windows/privacy/windows-activity-history-and-your-privacy",
"2026-09-18T12:00:00.000Z"
],
[
"start-web",
"Start web search and suggestions",
"Connected features",
"Optional",
"Research",
"Not applied",
"Pending",
"Review Start/Bing web queries independently from cloud-source search.",
"AllowCloudSearch alone does not establish that web queries stop.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Find supported edition-specific policy and test actual queries.",
"",
"https://support.microsoft.com/en-us/windows/privacy/windows-search-and-privacy",
"2026-09-18T12:00:00.000Z"
],
[
"widgets",
"Widgets, weather and news",
"Connected features",
"Optional",
"Planned",
"Not applied",
"Pending",
"Disable or remove unused Widgets through supported controls.",
"Changes functionality and may affect bundled app packages.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Test update/reinstall and taskbar behavior.",
"",
"https://github.com/Raphire/Win11Debloat/wiki/Features",
"2026-09-18T12:00:00.000Z"
],
[
"recommendations",
"Consumer suggestions and promotional content",
"Connected features",
"Default",
"Planned",
"Not applied",
"Pending",
"Review Start suggestions, Settings offers and Spotlight content individually.",
"Different settings and edition support; no single total-advertising switch.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Check visible result plus policy after feature updates.",
"",
"https://github.com/Raphire/Win11Debloat/wiki/Features",
"2026-09-18T12:00:00.000Z"
],
[
"typing",
"Typing, inking and personal dictionary",
"Input",
"Optional",
"Research",
"Not applied",
"Pending",
"Reduce online personalization and review local dictionary retention.",
"Local and cloud settings differ; existing cloud-speech policy covers only one route.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Check language/accessibility impact and supported controls.",
"",
"https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy",
"2026-09-18T12:00:00.000Z"
],
[
"app-permissions",
"Contacts, calendar, messages and account information",
"Permissions",
"Default",
"Planned",
"Not applied",
"Pending",
"Review covered app permissions and deny unused access.",
"Packaged-app controls do not constrain every desktop program.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Test covered apps and exceptions; do not report hardware isolation.",
"",
"https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy",
"2026-09-18T12:00:00.000Z"
],
[
"sensor-hardware",
"Camera and microphone hardware control",
"Sensors",
"Optional",
"Planned",
"Not applied",
"Pending",
"Offer device-wide settings, physical disconnect or hardware switches.",
"Software disablement is reversible by privileged software; some cameras support Windows Hello.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Test desktop apps, browsers, conferencing and authentication.",
"",
"https://support.microsoft.com/en-us/windows/privacy/windows-camera-microphone-and-privacy",
"2026-09-18T12:00:00.000Z"
],
[
"radio",
"Bluetooth, nearby sharing and Wi-Fi discovery",
"Network",
"Optional",
"Research",
"Not applied",
"Pending",
"Disable unused discovery and review Wi-Fi MAC randomization support.",
"May disconnect input devices; MAC changes concern local networks, not global anonymity.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Inventory adapters; test reconnect and recovery without disabling active input.",
"",
"Project engineering decision; not a verified Windows guarantee",
"2026-09-18T12:00:00.000Z"
],
[
"remote",
"Remote access and file sharing",
"Network",
"Optional",
"Planned",
"Not applied",
"Pending",
"Review unnecessary RDP, Remote Assistance and sharing exposure.",
"Managed devices and legitimate remote support need separate treatment.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Test reachability, account access and rollback in lab.",
"",
"Project engineering decision; not a verified Windows guarantee",
"2026-09-18T12:00:00.000Z"
],
[
"onedrive",
"OneDrive removal",
"Debloat",
"Optional",
"Planned",
"Not applied",
"Pending",
"Offer unlink/uninstall after local-copy and folder-redirection preflight.",
"Cloud-only files must be downloaded or separately backed up first; removal does not delete cloud copies.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Open sampled files offline; verify backup and known-folder paths.",
"",
"Project engineering decision; not a verified Windows guarantee",
"2026-09-18T12:00:00.000Z"
],
[
"edge-removal",
"Edge removal",
"Debloat",
"Optional",
"Research",
"Not applied",
"Pending",
"Use supported uninstall only where available; otherwise configure privacy.",
"Keep WebView2 separate. Do not force-delete servicing files to remove the browser.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Validate OS region/build, dependent apps and future security updates.",
"",
"Project engineering decision; not a verified Windows guarantee",
"2026-09-18T12:00:00.000Z"
],
[
"app-removal",
"Unused consumer and OEM applications",
"Debloat",
"Optional",
"Planned",
"Not applied",
"Pending",
"Inventory and select exact packages; distinguish current-user and provisioned removal.",
"Keep dependencies, Store/update infrastructure and accessibility tools unless explicitly selected.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Preview removals; test reinstall and new-user provisioning.",
"",
"Project engineering decision; not a verified Windows guarantee",
"2026-09-18T12:00:00.000Z"
],
[
"third-party",
"OEM, GPU, game-launcher and application analytics",
"Third parties",
"Default",
"Research",
"Not applied",
"Pending",
"Audit each installed app's analytics, sync, crash and advertising controls.",
"Windows settings do not govern all third parties; anti-cheat and drivers need individual review.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Record app/version/publisher and official setting; observe residual connections.",
"",
"Project engineering decision; not a verified Windows guarantee",
"2026-09-18T12:00:00.000Z"
],
[
"office",
"Office and productivity cloud experiences",
"Third parties",
"Optional",
"Research",
"Not applied",
"Pending",
"Review diagnostics and optional connected experiences in each product.",
"Account sync, licensing and collaborative features have separate dependencies.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Use product-specific policy docs before implementation.",
"",
"Project engineering decision; not a verified Windows guarantee",
"2026-09-18T12:00:00.000Z"
],
[
"storage-sense",
"Temporary-file retention",
"Cleanup",
"Default",
"Planned",
"Not applied",
"Pending",
"Use Storage Sense with explicit retention; skip active files.",
"Exclude Downloads by default; recycle-bin deletion gets its own choice. This is housekeeping, not sanitization.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Preview candidates and exclusions; verify no deletion outside selected directories.",
"",
"https://support.microsoft.com/en-us/windows/experience/storage-filemanagement/manage-drive-space-with-storage-sense",
"2026-09-18T12:00:00.000Z"
],
[
"browser-retention",
"Browser cookies, cache and history",
"Cleanup",
"Optional",
"Planned",
"Not applied",
"Pending",
"Use browser-owned retention and clear-on-exit options.",
"Clearing cookies signs users out; downloaded files, sync and server records remain.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Test each browser; preserve passwords/bookmarks unless separately selected.",
"",
"Project engineering decision; not a verified Windows guarantee",
"2026-09-18T12:00:00.000Z"
],
[
"recent-files",
"Recent items, thumbnails and application MRUs",
"Cleanup",
"Optional",
"Research",
"Not applied",
"Pending",
"Minimize retention and offer scoped, app-specific cleanup.",
"Deleting caches is irreversible and they can reappear. No sweeping registry cleanup.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Inventory selected cache schema and test with disposable data.",
"",
"Project engineering decision; not a verified Windows guarantee",
"2026-09-18T12:00:00.000Z"
],
[
"temp-script",
"Scoped temporary-folder cleanup fallback",
"Cleanup",
"Optional",
"Planned",
"Not applied",
"Pending",
"If needed, build preview-first cleaner with age threshold and literal allowed roots.",
"Skip junctions/reparse points, locked files and active installer data; no recursive arbitrary paths.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Tests must prove no traversal outside approved directories.",
"",
"Project engineering decision; not a verified Windows guarantee",
"2026-09-18T12:00:00.000Z"
],
[
"registry-cleaner",
"Registry cleaner",
"Cleanup",
"Reject",
"Excluded",
"Not applied",
"Pending",
"Do not include a general registry cleaner.",
"Unrelated registry deletion has no demonstrated identifier-blocking benefit here and can break software.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Use exact documented setting changes with a recovery journal.",
"",
"Project engineering decision; not a verified Windows guarantee",
"2026-09-18T12:00:00.000Z"
],
[
"no-logs",
"Blanket Windows log deletion",
"Retention",
"Reject",
"Excluded",
"Not applied",
"Pending",
"Retain security, update and recovery logs; minimize toolkit data collection instead.",
"No-logs is not a credible OS-wide promise; disabling records harms diagnosis and incident response.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Ensure toolkit contains no analytics, browsing data, keys or identifiers.",
"",
"Project engineering decision; not a verified Windows guarantee",
"2026-09-18T12:00:00.000Z"
],
[
"ssd-wipe",
"Routine SSD free-space wiping",
"Cleanup",
"Reject",
"Excluded",
"Not applied",
"Pending",
"Do not use as routine privacy cleanup.",
"Wear, remapped blocks, backups and prior copies defeat simple erasure claims.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Use appropriate device sanitization procedures only for a separate disposal task.",
"",
"Project engineering decision; not a verified Windows guarantee",
"2026-09-18T12:00:00.000Z"
],
[
"ram-cleaner",
"RAM trimming and generic memory cleaners",
"Memory",
"Reject",
"Excluded",
"Not applied",
"Pending",
"Do not include as an anonymization feature.",
"Working-set reduction is not proof that sensitive memory was erased.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Use application lock/unmount and protected storage.",
"",
"https://learn.microsoft.com/en-us/windows/win32/memory/working-set",
"2026-09-18T12:00:00.000Z"
],
[
"lock-actions",
"Actions on session lock",
"Memory",
"Optional",
"Planned",
"Not applied",
"Pending",
"Lock password manager, clear clipboard and gracefully unmount selected non-system containers.",
"Win+L does not erase all keys, tokens or keystrokes. Do not kill LSASS or arbitrary apps.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Test every session-lock path, busy volumes, unsaved work and visible failure on unlock.",
"",
"https://veracrypt.io/en/Unencrypted%20Data%20in%20RAM.html",
"2026-09-18T12:00:00.000Z"
],
[
"sleep-shutdown",
"Sleep, hibernation and shutdown choices",
"Memory",
"Optional",
"Research",
"Not applied",
"Pending",
"Explain that a locked running OS can retain secrets; offer an intentional full-shutdown workflow.",
"Shutdown is not a guarantee of instantaneous physical RAM erasure; hibernation uses storage.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Test Fast Startup/hibernation behavior and preserve encryption/recovery.",
"",
"https://veracrypt.io/en/Unencrypted%20Data%20in%20RAM.html",
"2026-09-18T12:00:00.000Z"
],
[
"disk-encryption",
"System disk encryption",
"Security",
"Keep",
"Planned",
"Not applied",
"Pending",
"Keep or enable supported system encryption and review recovery-key custody.",
"Do not disable BitLocker/device encryption as a debloat tweak. Never collect recovery secrets in reports.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Verify encryption status and recovery access without logging keys.",
"",
"Project engineering decision; not a verified Windows guarantee",
"2026-09-18T12:00:00.000Z"
],
[
"veracrypt",
"VeraCrypt containers",
"Applications",
"Optional",
"Prepared",
"Not applied",
"Pending",
"Optional interactive installer is ready; containers and lock integration remain manual.",
"Installed does not mean encrypted; mounted data and other apps can retain plaintext.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Verify package publisher; create/test disposable container and graceful unmount.",
"",
"https://veracrypt.io/en/Unencrypted%20Data%20in%20RAM.html",
"2026-09-18T12:00:00.000Z"
],
[
"tor-browser",
"Tor Browser",
"Applications",
"Optional",
"Prepared",
"Not applied",
"Pending",
"Installer prepared; use stock protections for sessions requiring unlinkability.",
"Protects its configured browser traffic; personal logins identify a session.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Verify official release, connection and no profile import or added extensions.",
"",
"https://support.torproject.org/tor-browser/security/using-tb-safely/",
"2026-09-18T12:00:00.000Z"
],
[
"zen-browser",
"Zen",
"Applications",
"Optional",
"Prepared",
"Not applied",
"Pending",
"Installer prepared for everyday Firefox-based browsing.",
"Privacy policy acknowledges external requests; settings and releases require review.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Test updates, permissions, sync choices and retention.",
"",
"https://zen-browser.app/privacy-policy/",
"2026-09-18T12:00:00.000Z"
],
[
"helium-browser",
"Helium",
"Applications",
"Optional",
"Prepared",
"Not applied",
"Pending",
"Installer prepared for everyday Chromium-based browsing.",
"Optional crash reports and configured services are separate privacy decisions.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Test updates, extension services, permissions and optional reporting.",
"",
"https://helium.computer/privacy",
"2026-09-18T12:00:00.000Z"
],
[
"mullvad-vpn",
"Mullvad VPN",
"Applications",
"Optional",
"Prepared",
"Not applied",
"Pending",
"Installer prepared; add funded account, auto-connect and chosen Lockdown behavior.",
"Installation is not connection. VPN changes network observer and egress IP, not application identifiers.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Test disconnect, DNS, IPv6, reboot, sleep/wake and split-tunnel exceptions.",
"",
"https://mullvad.net/en/help/using-mullvad-vpn-app",
"2026-09-18T12:00:00.000Z"
],
[
"vpn-logs",
"VPN logging claims",
"Network",
"Keep",
"Research",
"Not applied",
"Pending",
"Describe provider activity-logging policy separately from local app diagnostics.",
"A provider no-logging policy is not a no-logs Windows guarantee.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Review current policy and local support-bundle contents before sharing.",
"",
"https://mullvad.net/en/help/no-logging-data-policy",
"2026-09-18T12:00:00.000Z"
],
[
"tor-vpn",
"Automatic VPN plus Tor stacking",
"Network",
"Reject",
"Excluded",
"Not applied",
"Pending",
"Do not turn on this combination by default.",
"Tor warns against casual VPN combinations; threat model and configuration matter.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Offer separate documented workflows if a user needs the combination.",
"",
"https://support.torproject.org/tor-browser/general/vpn-with-tor/",
"2026-09-18T12:00:00.000Z"
],
[
"dns-blocking",
"DNS tracker blocking",
"Network",
"Optional",
"Planned",
"Not applied",
"Pending",
"Use a reviewed resolver/filter with narrow lists and a clear logging policy.",
"Direct IP, alternate resolvers and shared domains limit coverage; DNS blocking is not all egress control.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Test false positives and IPv4/IPv6/DoH behavior; version lists and rollback.",
"",
"Project engineering decision; not a verified Windows guarantee",
"2026-09-18T12:00:00.000Z"
],
[
"egress",
"Application egress control",
"Network",
"Optional",
"Research",
"Not applied",
"Pending",
"Evaluate one network enforcement tool in a VM; start from measured workflows.",
"Keep recovery access; do not stack competing WFP tools blindly.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Test VPN coexistence, update paths, reconnect, reboot and uninstallation.",
"",
"https://github.com/henrypp/simplewall",
"2026-09-18T12:00:00.000Z"
],
[
"denylist",
"Microsoft endpoint denylist",
"Network",
"Optional",
"Research",
"Not applied",
"Pending",
"Classify optional endpoints by feature, owner, purpose and capture evidence before blocking.",
"Do not block all Microsoft/Azure/CDN IPs or svchost.exe. Published lists are edition/version-specific.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Prove both reduced traffic and successful security workflows.",
"",
"https://learn.microsoft.com/en-us/windows/privacy/manage-windows-11-endpoints",
"2026-09-18T12:00:00.000Z"
],
[
"outbound-default",
"Strict outbound default policy",
"Network",
"Optional",
"Research",
"Not applied",
"Pending",
"For an advanced profile, use default-block with reviewed required allowances.",
"Explicit block rules override conflicting allows. Existing allows and all network profiles must be audited.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Disposable VM first; timed recovery and firewall-export rollback.",
"",
"https://learn.microsoft.com/en-us/windows/security/operating-system-security/network-security/windows-firewall/rules",
"2026-09-18T12:00:00.000Z"
],
[
"defender",
"Antivirus and cloud-delivered protection",
"Security",
"Keep",
"Planned",
"Not applied",
"Pending",
"Keep active antivirus, tamper protection and cloud protection in the standard design.",
"Some security metadata leaves the device; this is an explicit retained security tradeoff.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Verify provider status, signatures and vendor-supported protection checks.",
"",
"https://learn.microsoft.com/en-us/defender-endpoint/cloud-protection-microsoft-antivirus-sample-submission",
"2026-09-18T12:00:00.000Z"
],
[
"sample-consent",
"Antivirus file sample submission",
"Security",
"Optional",
"Research",
"Not applied",
"Pending",
"Expose supported submission choices with their security cost.",
"Turning samples off can impair block-at-first-sight; metadata can still be sent.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Test exact edition/product behavior. Never label samples-off as cloud-off.",
"",
"https://learn.microsoft.com/en-us/defender-endpoint/cloud-protection-microsoft-antivirus-sample-submission",
"2026-09-18T12:00:00.000Z"
],
[
"smartscreen",
"SmartScreen and reputation checks",
"Security",
"Keep",
"Planned",
"Not applied",
"Pending",
"Keep reputation protection in the standard design.",
"Security URL checks differ from optional URL diagnostics and browser sync.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Use vendor demonstration checks, not live malware; test after network restrictions.",
"",
"https://learn.microsoft.com/en-us/deployedge/microsoft-edge-security-smartscreen",
"2026-09-18T12:00:00.000Z"
],
[
"trust",
"Certificate trust, revocation and time",
"Security",
"Keep",
"Planned",
"Not applied",
"Pending",
"Preserve certificate trust/revocation, time sync, activation and servicing dependencies.",
"An endpoint may support essential security; broad domain blocking risks silent failures.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Verify TLS trust and OS servicing after restrictions.",
"",
"https://learn.microsoft.com/en-us/windows/privacy/essential-services-and-connected-experiences",
"2026-09-18T12:00:00.000Z"
],
[
"patching",
"Security update workflow",
"Security",
"Keep",
"Planned",
"Not applied",
"Pending",
"Default to current update behavior; optional notify/manual choice remains visible.",
"Manual has missed-patch risk. Do not remove servicing components or disable all update services.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Install actual cumulative update and AV/browser updates; reboot and rescan.",
"",
"https://learn.microsoft.com/en-us/windows/deployment/update/waas-wu-settings",
"2026-09-18T12:00:00.000Z"
],
[
"windows10",
"Windows 10 coverage",
"Security",
"Keep",
"Research",
"Not applied",
"Pending",
"Require supported edition or verified ESU enrollment before deployment.",
"Standard support ended 2025-10-14. Consumer page currently lists 2027-10-12; verify region/program at release.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Record exact SKU, coverage and installed security update. Windows 10 engine support is pending.",
"",
"https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/windows-10-support-has-ended-on-october-14-2025",
"2026-09-18T12:00:00.000Z"
],
[
"boot-hardening",
"Secure Boot, TPM, VBS and exploit mitigations",
"Security",
"Keep",
"Planned",
"Not applied",
"Pending",
"Preserve supported hardware and OS security protections.",
"Do not trade them for a privacy or performance preset; firmware updates remain necessary.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Inventory status and compatibility before any optional change.",
"",
"Project engineering decision; not a verified Windows guarantee",
"2026-09-18T12:00:00.000Z"
],
[
"third-party-av",
"Bitdefender or Zillya",
"Security",
"Optional",
"Research",
"Not applied",
"Pending",
"Do not replace working Defender automatically; evaluate a chosen product separately.",
"This project has not established a comparative privacy/security advantage or tested these vendors.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Review current privacy policy, independent protection tests, update support and uninstall behavior.",
"",
"Project engineering decision; not a verified Windows guarantee",
"2026-09-18T12:00:00.000Z"
],
[
"identifier-spoof",
"GDID, MachineGuid and hardware-ID spoofing",
"Identifiers",
"Reject",
"Excluded",
"Not applied",
"Pending",
"Do not ship undocumented identifier edits or a universal ID reset.",
"Changing one value cannot prove unlinkability and may break licensing or apps.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Investigate mechanisms in a disposable lab without exporting actual personal identifiers.",
"",
"Project engineering decision; not a verified Windows guarantee",
"2026-09-18T12:00:00.000Z"
],
[
"tails",
"Separate amnesic environment",
"Isolation",
"Optional",
"Planned",
"Not applied",
"Pending",
"Document Tails USB for a separate session with explicit persistence choice.",
"Does not protect against malicious hardware or voluntary identity disclosure.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Verify official image and usable hardware/network before relying on it.",
"",
"https://tails.net/about/index.en.html",
"2026-09-18T12:00:00.000Z"
],
[
"identity-habits",
"Accounts, posts and shared metadata",
"Behavior",
"Default",
"Planned",
"Not applied",
"Pending",
"Reduce unnecessary disclosure; separate contexts and review document/photo metadata before publishing.",
"Reused accounts, shared content and personal details can reconnect sessions despite device settings.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Use a practical publishing checklist; never promise technical anonymity.",
"",
"Project engineering decision; not a verified Windows guarantee",
"2026-09-18T12:00:00.000Z"
],
[
"tool-retention",
"Toolkit data minimization",
"Toolkit",
"Default",
"Implemented",
"Not applied",
"Pending",
"No analytics added; local settings journal supports restoration.",
"A recovery journal exists, so the tool is not literally log-free. Audit deliberately avoids GDID and recovery keys.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Review code and generated audit; document optional journal removal after recovery window.",
"",
"Local project: docs/STATUS.md; config/policies.json; tests/Run-Tests.ps1",
"2026-09-18T12:00:00.000Z"
],
[
"cdp-experiment",
"Experimental CDP restrictions",
"Identifiers",
"Optional",
"Research",
"Not applied",
"Pending",
"Investigate CDP independently from other identity consumers.",
"Supplied script is not integration-ready; review records status and rollback defects.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Reproduce effects in disposable Windows environments; no host deployment.",
"",
"https://github.com/SmtimesIWndr/We-running-GDID-back/blob/b4daa443d73433127b59ad6f006eb507072848b3/README.md",
"2026-09-19T12:00:00.000Z"
],
[
"wns-review",
"WNS notification blocking",
"Identifiers",
"Optional",
"Research",
"Not applied",
"Pending",
"Keep general WNS blocking out of the default design.",
"Notifications and management may be affected; a hosts entry is not a complete egress block.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Verify exact consumer and retained security functionality before any narrow restriction.",
"",
"https://learn.microsoft.com/en-us/windows/privacy/manage-windows-11-endpoints",
"2026-09-19T12:00:00.000Z"
],
[
"store-id-review",
"Store identifier path",
"Identifiers",
"Optional",
"Research",
"Not applied",
"Pending",
"Investigate Store requests separately; preserve app security updates.",
"Do not block the entire Store or edit its identifier based on one report.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Lab observation with disposable accounts and redacted evidence.",
"",
"https://github.com/SmtimesIWndr/We-running-GDID-back/blob/b4daa443d73433127b59ad6f006eb507072848b3/README.md",
"2026-09-19T12:00:00.000Z"
],
[
"offline-verifier",
"Offline bundle integrity verifier",
"Update architecture",
"Optional",
"Implemented",
"Not applied",
"Pending",
"Verify local manifest, hashes, target build/architecture and declared dependency order.",
"Authenticity, applicability, coverage and containment remain unverified. No downloads or installation.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"19 synthetic-package tests passed in PowerShell 7 and 5.1; real host inventory read.",
"",
"Local project: Offline-Updates.ps1; src/Wind.OfflineUpdates.psm1; docs/OFFLINE-UPDATES.md",
"2026-09-19T12:00:00.000Z"
],
[
"update-collector",
"Separate update collector",
"Update architecture",
"Optional",
"Planned",
"Not applied",
"Pending",
"Download generic publisher packages on another machine for controlled transfer.",
"Collector still contacts publishers. Do not forward protected-PC requests or credentials.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Authenticate sources, packages and current revocation state; test transfer and supply chain.",
"",
"https://learn.microsoft.com/en-us/windows/deployment/update/catalog-checkpoint-cumulative-updates",
"2026-09-19T12:00:00.000Z"
],
[
"offline-scan",
"Offline Windows Update Agent scan",
"Update architecture",
"Optional",
"Planned",
"Not applied",
"Pending",
"Use a fresh signed scan CAB and explicit offline search in an isolated lab.",
"Scan catalog is metadata, not update binaries or complete third-party coverage.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Verify temporary service cleanup, freshness, missing-update scope and external isolation.",
"",
"https://learn.microsoft.com/en-us/windows/win32/wua_sdk/using-wua-to-scan-for-updates-offline",
"2026-09-19T12:00:00.000Z"
],
[
"isolation",
"No direct Internet from protected Windows",
"Update architecture",
"Optional",
"Research",
"Not applied",
"Pending",
"Use a disconnected Windows environment and a separate maintenance/browsing environment.",
"Online cloud protection and reputation queries are unavailable. A denylist is not proof of isolation.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"No attached VM NIC or physical disconnection; independent verification and local recovery.",
"",
"Project engineering decision; not a verified Windows guarantee",
"2026-09-19T12:00:00.000Z"
],
[
"ncsi",
"Connectivity probes",
"Connected features",
"Optional",
"Research",
"Not applied",
"Pending",
"Review NCSI; consider supported private probes on managed networks.",
"Turning off probes can affect perceived connectivity and applications.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Test captive portals, network changes and update behavior.",
"",
"https://learn.microsoft.com/en-us/windows-server/networking/ncsi/ncsi-overview",
"2026-09-19T12:00:00.000Z"
],
[
"offline-trust",
"Offline certificate trust maintenance",
"Update architecture",
"Keep",
"Planned",
"Not applied",
"Pending",
"Provide trusted/disallowed certificate-list maintenance for the isolated profile.",
"Never disable certificate validation; offline revocation knowledge can become stale.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Verify provenance, freshness and package trust after transfer.",
"",
"https://learn.microsoft.com/en-us/windows-server/identity/ad-cs/configure-trusted-roots-disallowed-certificates",
"2026-09-19T12:00:00.000Z"
],
[
"patch-coverage",
"Whole-system patch coverage",
"Update architecture",
"Keep",
"Planned",
"Not applied",
"Pending",
"Track Windows, .NET, Defender, browsers, firmware, drivers and recovery separately.",
"Current OS build or a zero-result scan does not establish full patch coverage.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Record actual installed versions, reboot outcomes and emergency-update process.",
"",
"https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-updates",
"2026-09-19T12:00:00.000Z"
],
[
"local-discovery",
"Local-network identity disclosure",
"Local network",
"Optional",
"Research",
"Not applied",
"Pending",
"Inventory hostname discovery, LLMNR/mDNS, NetBIOS and sharing.",
"These are not automatically Microsoft-bound flows; disabling discovery can break local devices.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Use disposable network captures and test printers/sharing before restrictions.",
"",
"Project engineering decision; not a verified Windows guarantee",
"2026-09-19T12:00:00.000Z"
],
[
"credential-exclusion",
"Exclude credential stores from cleanup",
"Cleanup",
"Default",
"Planned",
"Not applied",
"Pending",
"Keep identity caches, login tokens, recovery material and servicing stores out of generic cleanup.",
"Deleting a cache does not establish deletion of remote records and may break login or updates.",
"Edition/build and installed-feature checks required unless stated otherwise.",
"Verify exclusions and exact allowed roots before implementing cleanup.",
"",
"Project engineering decision; not a verified Windows guarantee",
"2026-09-19T12:00:00.000Z"
]
],
"identifiers": [
[
"I01",
"GDID / GlobalDeviceId",
"Installation/device linkage",
"Microsoft reports and case records",
"Do not equate with advertising ID. No verified universal reset control here.",
"Investigate feature paths and effective network reductions in lab.",
"Documented field; collection path incomplete",
"",
"https://learn.microsoft.com/en-us/windows/deployment/update/wufb-reports-schema-ucdostatus",
"2026-09-18T12:00:00.000Z"
],
[
"I02",
"PCFP",
"Hardware-derived identifier",
"Windows 11 required diagnostic schema",
"Documented as an identifier calculated from hardware identifiers.",
"Use supported diagnostic minimum; do not assume reinstall removes hardware correlation.",
"Documented schema; emission not measured",
"",
"https://learn.microsoft.com/en-us/windows/privacy/required-diagnostic-events-fields-windows-11-24h2",
"2026-09-18T12:00:00.000Z"
],
[
"I03",
"CensusId",
"Hardware identifier",
"Appraiser RunContext schema",
"Documented hardware identifier in compatibility-related events.",
"Preserve compatibility/update testing; no verified per-field suppression in this project.",
"Documented schema; emission not measured",
"",
"https://learn.microsoft.com/en-us/windows/privacy/required-diagnostic-events-fields-windows-11-24h2",
"2026-09-18T12:00:00.000Z"
],
[
"I04",
"Advertising ID",
"Advertising personalization",
"Windows and participating applications",
"One specific advertising identifier; disabling it does not disable other IDs.",
"Implemented catalog control; not applied to host.",
"Official policy",
"",
"https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#disableadvertisingid",
"2026-09-18T12:00:00.000Z"
],
[
"I05",
"Microsoft account / app accounts",
"Account identity",
"Signed-in services",
"Local Windows account does not sign every application out.",
"Minimize unnecessary sign-in and sync; preserve recovery access.",
"Architecture / design assessment",
"",
"https://learn.microsoft.com/en-us/windows/privacy/essential-services-and-connected-experiences",
"2026-09-18T12:00:00.000Z"
],
[
"I06",
"MachineGuid / serials / TPM identity",
"Local and service-specific identifiers",
"OS, firmware and application-dependent",
"No evidence here that one registry edit removes all remote identification.",
"Avoid collecting them; no spoofing feature.",
"Scope limitation, not a measured traffic claim",
"",
"Project engineering decision; not a verified Windows guarantee",
"2026-09-18T12:00:00.000Z"
],
[
"I07",
"Public IP / timestamps",
"Network correlation",
"Destination services and network intermediaries",
"VPN changes visible egress but not IDs inside app traffic.",
"Mullvad configuration and leak tests; minimize account linkage.",
"Network design assessment",
"",
"https://mullvad.net/en/help/using-mullvad-vpn-app",
"2026-09-18T12:00:00.000Z"
],
[
"I08",
"Wi-Fi MAC",
"Local radio/network identity",
"Nearby Wi-Fi infrastructure",
"Not normally the same identifier as a remote website sees.",
"Evaluate supported MAC randomization; retain network compatibility.",
"Design item; adapter testing pending",
"",
"Project engineering decision; not a verified Windows guarantee",
"2026-09-18T12:00:00.000Z"
],
[
"I09",
"Cookies / browser storage / fingerprint",
"Web session linkage",
"Websites and embedded third parties",
"Multiple browsers do not automatically separate identities.",
"Tor stock protections; appropriate retention and account separation.",
"Browser threat-model guidance",
"",
"https://support.torproject.org/tor-browser/security/using-tb-safely/",
"2026-09-18T12:00:00.000Z"
],
[
"I10",
"Optional browser URL diagnostics",
"Browsing data",
"Optional Microsoft browser diagnostics",
"Windows optional-data documentation includes Microsoft browser activity; not proof for every browser.",
"Disable optional collection; Edge URL policy separately.",
"Official documentation",
"",
"https://learn.microsoft.com/en-us/windows/privacy/optional-diagnostic-data",
"2026-09-18T12:00:00.000Z"
],
[
"I11",
"Crash dumps",
"Potential memory contents",
"Diagnostic collection and local storage",
"Optional crash reports can contain portions of documents or pages.",
"Minimize uploads and retention without discarding all troubleshooting logs.",
"Official documentation",
"",
"https://learn.microsoft.com/en-us/windows/privacy/configure-windows-diagnostic-data-in-your-organization",
"2026-09-18T12:00:00.000Z"
],
[
"I12",
"Defender security metadata",
"File, process and network context",
"Cloud protection services",
"Metadata may still be sent with sample submission disabled.",
"Keep standard protection; explain data flow and optional tradeoff.",
"Official documentation",
"",
"https://learn.microsoft.com/en-us/defender-endpoint/cloud-protection-microsoft-antivirus-sample-submission",
"2026-09-18T12:00:00.000Z"
],
[
"I13",
"Recall snapshots",
"Local visual history / optional export",
"Eligible Recall installations",
"Distinct from Copilot chat; export and retention have separate controls.",
"Disable unused snapshot saving; preview irreversible deletion.",
"Official documentation",
"",
"https://learn.microsoft.com/en-us/windows/client-management/manage-recall",
"2026-09-18T12:00:00.000Z"
],
[
"I14",
"Activity history",
"Local activity record",
"Supported Windows feature",
"Patched Windows deprecated its cloud-upload option in January 2024.",
"Control local retention; avoid repeating outdated upload claims.",
"Official documentation",
"",
"https://support.microsoft.com/en-us/windows/privacy/windows-activity-history-and-your-privacy",
"2026-09-18T12:00:00.000Z"
],
[
"I15",
"Third-party app identifiers",
"Product-specific telemetry",
"OEM utilities, browsers, launchers and apps",
"Requires app-specific evidence; no blanket Windows toggle.",
"Inventory publishers/settings and measure each application.",
"Research task",
"",
"Project engineering decision; not a verified Windows guarantee",
"2026-09-18T12:00:00.000Z"
],
[
"I16",
"Multiple device PUIDs",
"Context-specific identity",
"Independent follow-up research",
"Author reports several device PUIDs on one installation.",
"Extend lab scope beyond the interactive user.",
"Reported; not reproduced here",
"",
"https://github.com/SmtimesIWndr/We-running-GDID-back/blob/b4daa443d73433127b59ad6f006eb507072848b3/README.md",
"2026-09-19T12:00:00.000Z"
],
[
"I17",
"Widgets identifier emission",
"Additional application path",
"Independent follow-up research",
"Author reports Widgets sending a SYSTEM-context identifier.",
"Test Widgets independently from CDP.",
"Reported; not reproduced here",
"",
"https://github.com/SmtimesIWndr/We-running-GDID-back/blob/b4daa443d73433127b59ad6f006eb507072848b3/README.md",
"2026-09-19T12:00:00.000Z"
],
[
"I18",
"SQMClient MachineID / Store",
"Separate identifier family",
"Independent follow-up research",
"Author reports a matching Store request identifier.",
"Preserve Store updates; investigate separately.",
"Reported; not reproduced here",
"",
"https://github.com/SmtimesIWndr/We-running-GDID-back/blob/b4daa443d73433127b59ad6f006eb507072848b3/README.md",
"2026-09-19T12:00:00.000Z"
],
[
"I19",
"Connectivity probes",
"IP / timing at probe destination",
"Microsoft NCSI documentation",
"Connectivity detection is another independent network function.",
"Optional control with compatibility tests.",
"Documented; host traffic not captured",
"",
"https://learn.microsoft.com/en-us/windows-server/networking/ncsi/ncsi-overview",
"2026-09-19T12:00:00.000Z"
],
[
"I20",
"Update request metadata",
"Requests / network metadata",
"Online update architecture",
"Direct downloads need outbound protocol traffic.",
"Separate collector for no direct protected-PC contact.",
"Protocol constraint / design",
"",
"https://learn.microsoft.com/en-us/windows/deployment/update/catalog-checkpoint-cumulative-updates",
"2026-09-19T12:00:00.000Z"
],
[
"I21",
"Windows Error Reporting",
"Fault reporting",
"Microsoft WER documentation",
"Separate from third-party application reporters.",
"Review reporting and local retention individually.",
"Documented; host traffic not captured",
"",
"https://learn.microsoft.com/en-us/windows/win32/wer/windows-error-reporting",
"2026-09-19T12:00:00.000Z"
]
],
"tools": [
[
"T01",
"Chris Titus WinUtil",
"Tweaks and app deployment",
"Current docs: Windows 11; Windows 10 unsupported",
"Useful UI and selective settings reference.",
"Inspect exact tweaks; exclude security/BitLocker reductions and blanket presets.",
"Candidate reference; not executed",
"",
"https://github.com/ChrisTitusTech/winutil",
"https://github.com/ChrisTitusTech/winutil/blob/main/docs/src/content/docs/guides/getting-started.mdx",
"2026-09-18T12:00:00.000Z"
],
[
"T02",
"Raphire Win11Debloat",
"Selective debloat and settings",
"Windows 10/11 project; exact build still needs testing",
"Per-app selection, previews and current feature catalog.",
"Exclude encryption-disabling choices; distinguish default restoration from original-state rollback.",
"Candidate for selected debloat; not executed",
"",
"https://github.com/Raphire/Win11Debloat",
"https://github.com/Raphire/Win11Debloat/wiki/Features",
"2026-09-18T12:00:00.000Z"
],
[
"T03",
"privacy.sexy",
"Generated privacy scripts",
"Windows catalog; validate each script/build",
"Source-linked scripts and individual selection help review.",
"Do not select all scripts. Review reversals and license before code reuse.",
"Reference library; not executed",
"",
"https://github.com/undergroundwires/privacy.sexy",
"https://github.com/undergroundwires/privacy.sexy",
"2026-09-18T12:00:00.000Z"
],
[
"T04",
"Sophia Script",
"PowerShell customization",
"Version-specific Windows 10/11 variants",
"Function-by-function design and corresponding default functions.",
"Default functions are not proof of restoring every original user value.",
"Selective reference; not executed",
"",
"https://github.com/farag2/Sophia-Script-for-Windows",
"https://github.com/farag2/Sophia-Script-for-Windows",
"2026-09-18T12:00:00.000Z"
],
[
"T05",
"SophiApp",
"Graphical tweak tool",
"Repository warns about deprecated 1.0.97",
"Related GUI project; inspect current supported replacement.",
"Do not deploy deprecated build based on a promised future version.",
"Legacy build excluded; recheck release",
"",
"https://github.com/Sophia-Community/SophiApp",
"https://github.com/Sophia-Community/SophiApp",
"2026-09-18T12:00:00.000Z"
],
[
"T06",
"xd-AntiSpy",
"Privacy/settings UI",
"Windows 11 focus; Windows 10 partial",
"Readable choices and plugin-based configuration.",
"Plugins expand trust surface; check exact changes and reversals.",
"Candidate for review; not executed",
"",
"https://github.com/builtbybel/xd-AntiSpy",
"https://github.com/builtbybel/xd-AntiSpy",
"2026-09-18T12:00:00.000Z"
],
[
"T07",
"simplewall",
"WFP application filtering",
"Windows 10/11 included",
"Useful per-app egress enforcement candidate.",
"Its filters can remain after uninstall unless removed/disabled. Test temporary filtering and recovery.",
"Lab candidate; not installed",
"",
"https://github.com/henrypp/simplewall",
"https://github.com/henrypp/simplewall",
"2026-09-18T12:00:00.000Z"
],
[
"T08",
"WindowsSpyBlocker",
"Traffic research and blocklists",
"Windows-oriented; current endpoint validation required",
"Traffic classification is useful input for lab analysis.",
"Treat lists as hypotheses, not permanent safe blocks. Separate update dependencies.",
"Research input; no rules imported",
"",
"https://github.com/crazy-max/WindowsSpyBlocker",
"https://crazymax.dev/WindowsSpyBlocker/",
"2026-09-18T12:00:00.000Z"
],
[
"T09",
"Portmaster",
"Application firewall and DNS filtering",
"Windows/Linux; verify current installer compatibility",
"Alternative to simplewall for evaluation.",
"WFP/VPN coexistence and uninstall connectivity need testing. Avoid stacking both by default.",
"Alternative lab candidate; not installed",
"",
"https://github.com/safing/portmaster",
"https://docs.safing.io/portmaster/faq",
"2026-09-18T12:00:00.000Z"
],
[
"T10",
"BleachBit",
"Local cleanup",
"Windows/Linux",
"Preview and app-specific cleaners can support optional retention work.",
"Deletion is irreversible; no secure-SSD or internet anonymity guarantee.",
"Optional cleanup candidate; not run",
"",
"https://github.com/bleachbit/bleachbit",
"https://github.com/bleachbit/bleachbit",
"2026-09-18T12:00:00.000Z"
],
[
"T11",
"W4RH4WK Debloat-Windows-10",
"Legacy debloat scripts",
"Archived 2025-09-23; deprecated",
"Historical examples only.",
"Not a maintained deployment choice for current Windows.",
"Excluded",
"",
"https://github.com/W4RH4WK/Debloat-Windows-10",
"https://github.com/W4RH4WK/Debloat-Windows-10",
"2026-09-18T12:00:00.000Z"
],
[
"T12",
"Sycnex Windows10Debloater",
"Legacy Windows 10 debloat",
"Windows 10 project; Windows 11 not established here",
"Historical app-removal patterns.",
"Do not infer current build support or exact-original restoration.",
"Excluded from current deployment",
"",
"https://github.com/Sycnex/Windows10Debloater",
"https://github.com/Sycnex/Windows10Debloater",
"2026-09-18T12:00:00.000Z"
],
[
"T13",
"Atlas",
"Windows modification playbook",
"Version-specific Windows deployment",
"Reviewable playbook architecture.",
"Broad OS changes exceed a small privacy profile; test each release rather than rely on old reputation.",
"Comparison only; not applied",
"",
"https://github.com/Atlas-OS/Atlas",
"https://github.com/Atlas-OS/Atlas",
"2026-09-18T12:00:00.000Z"
],
[
"T14",
"AME / Privacy+",
"Playbook delivery / privacy changes",
"Depends on playbook and target build",
"AME could eventually package the reviewed Wind engine.",
"Privacy+ methodology includes Windows Update removal, conflicting with this project's patching requirement.",
"Do not adopt Privacy+ wholesale",
"",
"https://download.amelabs.net/Privacy%2B%20Testing%20Methodology.pdf",
"https://download.amelabs.net/Privacy%2B%20Testing%20Methodology.pdf",
"2026-09-18T12:00:00.000Z"
],
[
"T15",
"gdid-reversal",
"Independent reverse-engineering research",
"Reported observations; not reproduced here",
"Suggests identity/CDP/Delivery Optimization investigation paths.",
"Not a validated anonymizer. Separate static findings, observations and hypotheses.",
"Research lead only",
"",
"https://github.com/SmtimesIWndr/gdid-reversal/blob/dd4dd5dfcd5e1af24592ccbce44dac7cf5b38d2d/README.md",
"https://github.com/SmtimesIWndr/gdid-reversal/blob/dd4dd5dfcd5e1af24592ccbce44dac7cf5b38d2d/README.md",
"2026-09-18T12:00:00.000Z"
],
[
"T16",
"We-running-GDID-back",
"Follow-up identifier research",
"Pinned b4daa443; Windows 11 observations",
"Expands the investigation beyond one CDP identifier.",
"Client symbols and token scopes alone do not prove backend reconciliation or every transmission.",
"Research lead only",
"",
"https://github.com/SmtimesIWndr/We-running-GDID-back/blob/b4daa443d73433127b59ad6f006eb507072848b3/README.md",
"https://github.com/SmtimesIWndr/We-running-GDID-back/blob/b4daa443d73433127b59ad6f006eb507072848b3/README.md",
"2026-09-19T12:00:00.000Z"
],
[
"T17",
"Win-Debloat-Tools",
"Legacy debloat",
"Archived 2025-10-03; last documented builds limited",
"Historical reference.",
"Removal may not be easily reversed; not a current supported deployment base.",
"Excluded",
"",
"https://github.com/LeDragoX/Win-Debloat-Tools",
"https://github.com/LeDragoX/Win-Debloat-Tools",
"2026-09-19T12:00:00.000Z"
],
[
"T18",
"Harden-Windows-Security",
"Security hardening",
"Current Windows security focus; exact app requirements need review",
"Individual security controls can inform preservation tests.",
"Connected-service recommendations are not our privacy profile; do not import all defaults.",
"Selective reference only",
"",
"https://github.com/HotCakeX/Harden-Windows-Security",
"https://github.com/HotCakeX/Harden-Windows-Security",
"2026-09-19T12:00:00.000Z"
],
[
"T19",
"wumgr",
"Update management",
"Project described for Windows 10",
"Update-management UI comparison.",
"Does not create a no-contact boundary. Current Windows 11/ESU behavior unvalidated.",
"Evaluation only",
"",
"https://github.com/DavidXanatos/wumgr",
"https://github.com/DavidXanatos/wumgr",
"2026-09-19T12:00:00.000Z"
]
],
"claims": [
[
"C01",
"Microsoft tracked Stokes through GDID",
"Supported as allegation",
"Complaint associates the identifier with attributed activity.",
"Affidavit paragraphs 25–29; this is not a conviction.",
"",
"https://www.justice.gov/usao-ndil/media/1450651/dl?inline=",
"2026-09-18T12:00:00.000Z"
],
[
"C02",
"Assigned per install; survives updates; changes on reinstall",
"Attributed description",
"The affidavit attributes this lifecycle to a Microsoft representative.",
"Paragraph 25 attribution; follow-up research raises additional lifecycle/context questions.",
"",
"https://www.justice.gov/usao-ndil/media/1450651/dl?inline=",
"2026-09-18T12:00:00.000Z"
],
[
"C03",
"Unique to physical device",
"Overstated",
"The description includes physical and virtual Windows installations.",
"Installation identity and immutable hardware identity differ.",
"",
"https://www.justice.gov/usao-ndil/media/1450651/dl?inline=",
"2026-09-18T12:00:00.000Z"
],
[
"C04",
"Ngrok, URLs, IPs and timestamps",
"Supported for this case",
"The complaint describes these associations.",
"Paragraphs 26–28 do not specify every collection component.",
"",
"https://www.justice.gov/usao-ndil/media/1450651/dl?inline=",
"2026-09-18T12:00:00.000Z"
],
[
"C05",
"It records every game played",
"Overstated",
"Growtopia login activity was correlated with Ubisoft records.",
"Paragraph 29 does not establish a complete installed-game history.",
"",
"https://www.justice.gov/usao-ndil/media/1450651/dl?inline=",
"2026-09-18T12:00:00.000Z"
],
[
"C06",
"Only documented in one obscure page",
"Unsupported absolute",
"GlobalDeviceId appears in published Microsoft reporting schemas.",
"Documentation of a field is not a complete explanation of collection.",
"",
"https://learn.microsoft.com/en-us/windows/deployment/update/wufb-reports-schema-ucdostatus",
"2026-09-18T12:00:00.000Z"
],
[
"C07",
"UCDOStatus proves universal web-history collection",
"Not established",
"UCDOStatus is a Delivery Optimization reporting schema.",
"A named field does not prove that this table records all URLs.",
"",
"https://learn.microsoft.com/en-us/windows/deployment/update/wufb-reports-schema-ucdostatus",
"2026-09-18T12:00:00.000Z"
],
[
"C08",
"Every browser on every Windows PC reports every URL",
"Not established",
"Neither cited source demonstrates this universal claim.",
"Do not present it as the blog's conclusion.",
"",
"https://www.justice.gov/usao-ndil/media/1450651/dl?inline=",
"2026-09-18T12:00:00.000Z"
],
[
"C09",
"Local account guarantees no Microsoft identifier",
"Not established",
"Independent research reports a path without Microsoft-account sign-in.",
"Useful lead; not independently reproduced by this project.",
"",
"https://github.com/SmtimesIWndr/gdid-reversal/blob/dd4dd5dfcd5e1af24592ccbce44dac7cf5b38d2d/README.md",
"2026-09-18T12:00:00.000Z"
],
[
"C10",
"GDID is the only persistent identifier worth checking",
"False simplification",
"Microsoft also documents PCFP and CensusId in required diagnostic schemas.",
"Documented fields do not prove emission on this host.",
"",
"https://learn.microsoft.com/en-us/windows/privacy/required-diagnostic-events-fields-windows-11-24h2",
"2026-09-18T12:00:00.000Z"
],
[
"C11",
"Disabling advertising ID blocks GDID",
"Not established",
"The advertising-ID policy governs a different identifier.",
"Use exact scope labels and lab measurements.",
"",
"https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#disableadvertisingid",
"2026-09-18T12:00:00.000Z"
],
[
"C12",
"No telemetry toggle means no Microsoft traffic",
"False simplification",
"Essential services and connected experiences have separate data flows.",
"Preserve agreed security dependencies and document residual traffic.",
"",
"https://learn.microsoft.com/en-us/windows/privacy/essential-services-and-connected-experiences",
"2026-09-18T12:00:00.000Z"
],
[
"C13",
"Win+L erases all secrets from memory",
"Unsupported",
"Locking is not a general memory-erasure mechanism.",
"Plan app-specific locking and graceful unmount; do not claim total erasure.",
"",
"https://veracrypt.io/en/Unencrypted%20Data%20in%20RAM.html",
"2026-09-18T12:00:00.000Z"
],
[
"C14",
"Humans can identify themselves despite privacy tools",
"Design principle",
"Accounts, posts and shared content can reconnect contexts.",
"A practical privacy plan includes disclosure habits.",
"",
"Project engineering decision; not a verified Windows guarantee",
"2026-09-18T12:00:00.000Z"
],
[
"C15",
"One identifier per installation is the complete model",
"Incomplete",
"Follow-up research reports multiple device PUIDs.",
"Treat as a lab hypothesis; retain court attribution separately.",
"",
"https://github.com/SmtimesIWndr/We-running-GDID-back/blob/b4daa443d73433127b59ad6f006eb507072848b3/README.md",
"2026-09-19T12:00:00.000Z"
],
[
"C16",
"Disabling CDP proves all device IDs stopped",
"Not established",
"No test here establishes complete identifier suppression.",
"Test each emitting feature and retained service separately.",
"",
"https://github.com/SmtimesIWndr/We-running-GDID-back/blob/b4daa443d73433127b59ad6f006eb507072848b3/README.md",
"2026-09-19T12:00:00.000Z"
],
[
"C17",
"An ETW HTTPS URL means cleartext on the wire",
"Incorrect inference",
"Local instrumentation can reveal data before transport encryption.",
"Differentiate local visibility, destination visibility and network-observer visibility.",
"",
"Project engineering decision; not a verified Windows guarantee",
"2026-09-19T12:00:00.000Z"
],
[
"C18",
"Download directly from Microsoft while sending it nothing",
"Not technically achievable",
"Requests and transport traffic are needed for a direct download.",
"Use a separate collector if the protected PC must not contact Microsoft.",
"",
"Project engineering decision; not a verified Windows guarantee",
"2026-09-19T12:00:00.000Z"
],
[
"C19",
"A proxy or VPN removes identifiers from update requests",
"Not established",
"Relaying a request does not necessarily alter its contents.",
"Only a reviewed design that serves pre-fetched content avoids forwarding those requests.",
"",
"Project engineering decision; not a verified Windows guarantee",
"2026-09-19T12:00:00.000Z"
],
[
"C20",
"Offline patches retain every online security capability",
"Incorrect",
"Online cloud analysis and reputation checks require connectivity.",
"Preserve local protections and explain the cloud-security tradeoff.",
"",
"https://learn.microsoft.com/en-us/defender-endpoint/cloud-protection-microsoft-antivirus-sample-submission",
"2026-09-19T12:00:00.000Z"
]
],
"roadmap": [
[
"R01",
"P0",
"VM support matrix",
"Pro, Enterprise, Education and Home; reviewed Windows 11 builds; separate Windows 10 ESU track",
"Effective setting after reboot and update, not just registry readback.",
"Policy behavior",
"Open",
"Unassigned",
null,
null
],
[
"R02",
"P0",
"Security preservation baseline",
"Record antivirus, firewall, boot/encryption and update status without secrets",
"Cumulative update installs; AV signatures and browser updates succeed; protection checks pass.",
"Security",
"Open",
"Unassigned",
null,
null
],
[
"R03",
"P0",
"Network baseline",
"Disposable VM, documented workflows, Windows build, network path and capture duration",
"Compare before/after idle, reboot, browsing, sync and update traffic; no universal absence claim.",
"Network",
"Open",
"Unassigned",
null,
null
],
[
"R04",
"P0",
"Endpoint provenance register",
"Process/service attribution, hostname/IP, purpose, evidence, expiry and rollback",
"No unknown destination becomes a default block; validate DNS/IPv6/VPN behavior.",
"Network",
"Open",
"Unassigned",
null,
null
],
[
"R05",
"P0",
"Recoverability of networking",
"Local recovery access and exported firewall configuration",
"Timed recovery and uninstall restore connectivity; explicit block precedence tested.",
"Network",
"Open",
"Unassigned",
null,
null
],
[
"R06",
"P0",
"Original-state recovery engine",
"Existing mock and file journal tests; real Windows registry test in disposable VM",
"Crash/interruption, conflicting external changes and restoration verified.",
"Engine",
"Open",
"Unassigned",
null,
null
],
[
"R07",
"P1",
"Home Settings workflow",
"Current host is Core/Home build 26200",
"Guide accurately maps real Settings; no unsupported policy-enforcement labels.",
"Compatibility",
"Open",
"Unassigned",
null,
null
],
[
"R08",
"P1",
"Sensor verification",
"Camera/mic devices and covered vs desktop app permissions",
"Conferencing, browser access and Windows Hello tested; hardware state labelled separately.",
"Sensors",
"Open",
"Unassigned",
null,
null
],
[
"R09",
"P1",
"AI and debloat inventory",
"Package dependencies and Recall eligibility",
"Data-deletion preview, OneDrive offline-copy checks and reinstall path pass.",
"Apps",
"Open",
"Unassigned",
null,
null
],
[
"R10",
"P1",
"Retention implementation",
"Storage Sense first; browser/app-owned cleanup; scoped fallback only",
"Exclusions, age cutoff, reparse-point protection and active-file handling tested.",
"Cleanup",
"Open",
"Unassigned",
null,
null
],
[
"R11",
"P1",
"Lock-session integration",
"Password manager adapters and selected non-system volumes",
"Unsaved work protected; busy-volume failure reported; no system-process killing.",
"Memory",
"Open",
"Unassigned",
null,
null
],
[
"R12",
"P1",
"Identifier investigation",
"Documented fields plus independent GDID/CDP research",
"Reproducible lab notes; no claim of a suppression mechanism without measured evidence.",
"Research",
"Open",
"Unassigned",
null,
null
],
[
"R13",
"P1",
"Third-party application register",
"Installed publishers, versions, controls and official privacy sources",
"Each app has separate collection/update decisions; no silent global disablement.",
"Research",
"Open",
"Unassigned",
null,
null
],
[
"R14",
"P1",
"Pin upstream artifacts",
"Selected repository commit, release signature/hash and license review",
"No download-and-execute one-liners; reviewed local content only.",
"Supply chain",
"Open",
"Unassigned",
null,
null
],
[
"R15",
"P1",
"Browser and VPN acceptance",
"Tor, Zen, Helium, Mullvad selected individually",
"Update, publisher, profile separation and leak/Lockdown tests pass.",
"Applications",
"Open",
"Unassigned",
null,
null
],
[
"R16",
"P2",
"Graphical wizard / AME wrapper",
"Use same reviewed engine and recovery model",
"UI shows intended change, compatibility, deletion and restoration limits.",
"Delivery",
"Open",
"Unassigned",
null,
null
],
[
"R17",
"P2",
"Blog publication check",
"Re-read primary case and current product documentation",
"Claims retain attribution; screenshots and logs contain no private identifiers.",
"Editorial",
"Open",
"Unassigned",
null,
null
],
[
"R18",
"P2",
"Revalidation after Windows updates",
"Repeat on feature/security updates and changed app releases",
"Record build/version, deviations and regression outcomes before widening support.",
"Maintenance",
"Open",
"Unassigned",
null,
null
],
[
"R19",
"P0",
"Replace unsafe pasted-script patterns",
"See Script review findings and pinned source revisions",
"No integration until exact-state rollback, honest status and independent cleanup pass tests.",
"Engine",
"Open",
"Unassigned",
null,
null
],
[
"R20",
"P1",
"Reproduce follow-up identifier findings",
"Disposable accounts; context-specific identifiers; Widgets and Store independently",
"Record observed flows without raw IDs/tokens in reports; retain update/security acceptance tests.",
"Research",
"Open",
"Unassigned",
null,
null
],
[
"R21",
"P0",
"Validate offline update end to end",
"Separate collector; authentic packages; isolated target; supported edition",
"Install known applicable updates and prerequisites; reboot and rescan; verify no target WAN access.",
"Updates",
"Open",
"Unassigned",
null,
""
],
[
"R22",
"P0",
"Implement offline WUA scanner",
"Signed current catalog, explicit offline search, temporary service registration",
"No online search or fallback; cleanup on failure; no full-coverage claim from empty results.",
"Updates",
"Open",
"Unassigned",
null,
""
],
[
"R23",
"P0",
"Offline security-maintenance coverage",
"Defender platform/engine/intelligence, trust lists, apps and firmware",
"Each required component has a tested source, freshness policy and installation evidence.",
"Security",
"Open",
"Unassigned",
null,
""
],
[
"R24",
"P1",
"Collector authenticity and transfer workflow",
"Publisher signatures and package catalogs; protect manifest and files",
"Hashes never stand in for publisher identity; reverify immediately before execution.",
"Supply chain",
"Open",
"Unassigned",
null,
""
]
],
"delivered": [
[
"D01",
"Policy catalog",
"Implemented",
13,
"config/policies.json",
"Includes two optional update entries; Standard selects 10, Strict 11.",
"Not applied"
],
[
"D02",
"Audit / plan / apply / restore engine",
"Implemented",
1,
"Wind.ps1; src/Wind.Core.psm1",
"Edition/build gates, journal and conflict-aware restoration.",
"Not applied"
],
[
"D03",
"Transaction and recovery tests",
"Passed",
23,
"tests/Run-Tests.ps1; docs/STATUS.md",
"Same suite passed in PowerShell 7.6.5 and Windows PowerShell 5.1. Mock registry plus file journal checks.",
"Not an OS enforcement test"
],
[
"D04",
"Host read-only audit",
"Completed",
1,
"reports/host-audit.json",
"Core/Home build 26200. Automatic policy enforcement declined. No private IDs collected.",
"Read only"
],
[
"D05",
"Interactive app choices",
"Prepared",
5,
"config/apps.json; Install-Apps.ps1",
"Tor, Zen, Helium, Mullvad, VeraCrypt. Installer previews only.",
"Not installed"
],
[
"D06",
"Research, Home guide and validation plan",
"Prepared",
1,
"docs/RESEARCH.md; docs/HOME-GUIDE.md; docs/VALIDATION.md",
"Implementation scope and known limits documented.",
"Documents only"
],
[
"D07",
"GitHub comparison and control workbook",
"Prepared",
1,
"Windows-privacy-register.xlsx",
"Sources reviewed 2026-09-18/19; execution and lab validation remain pending.",
"Documents only"
],
[
"D08",
"Blog draft",
"Prepared",
1,
"Windows-privacy-blog-draft.md",
"Evidence, motivation, privacy choices and honest completion status.",
"Not published"
],
[
"D09",
"Pasted script and follow-up research",
"Reviewed",
1,
"docs/GDID-SCRIPT-REVIEW.md",
"Static review, parse check and three in-memory defect probes. No supplied script executed.",
"Read only"
],
[
"D10",
"Offline bundle verifier and OS inventory",
"Implemented",
1,
"Offline-Updates.ps1; src/Wind.OfflineUpdates.psm1",
"19 tests passed in PowerShell 7 and 5.1. No download, scan, installation or isolation applied.",
"Read only"
]
],
"scriptReview": [
[
"S01",
"High",
"False status result",
"24–25; 120",
"Writes GDID-BLOCKER but searches GDID-BLOCK.",
"Match constants exactly; verify entries and effective behavior.",
"Confirmed in-memory",
"Not integrated",
"",
"User attachment Pasted text.txt; SHA256 0603A1073072CCC55B78692ACC93FAED4363CCFC0AF700472FBC862788B97E13",
"2026-09-19T12:00:00.000Z"
],
[
"S02",
"High",
"False success after partial failure",
"19; 49–64; 132; 138",
"Continues after errors and ignores native exit codes.",
"Check every result and effective service state; report partial failures.",
"Static finding",
"Not integrated",
"",
"User attachment Pasted text.txt; SHA256 0603A1073072CCC55B78692ACC93FAED4363CCFC0AF700472FBC862788B97E13",
"2026-09-19T12:00:00.000Z"
],
[
"S03",
"High",
"Policy rollback destroys prior state",
"68; 72",
"Overwrites three values then deletes them on enable.",
"Journal original presence/type/value and detect conflicts.",
"Static finding",
"Not integrated",
"",
"User attachment Pasted text.txt; SHA256 0603A1073072CCC55B78692ACC93FAED4363CCFC0AF700472FBC862788B97E13",
"2026-09-19T12:00:00.000Z"
],
[
"S04",
"High",
"Per-user service template handling",
"44; 49; 52",
"Template inventory differs from generated service instances.",
"Use documented template handling; test sign-in and reboot.",
"Official docs + static review",
"Not integrated",
"",
"https://learn.microsoft.com/en-us/windows/application-management/per-user-services-in-windows",
"2026-09-19T12:00:00.000Z"
],
[
"S05",
"Medium",
"Incomplete service restoration",
"44; 57–64",
"Does not preserve delayed-start metadata or running state.",
"Record exact state; do not guess Manual or always start.",
"Static finding",
"Not integrated",
"",
"User attachment Pasted text.txt; SHA256 0603A1073072CCC55B78692ACC93FAED4363CCFC0AF700472FBC862788B97E13",
"2026-09-19T12:00:00.000Z"
],
[
"S06",
"High",
"Nontransactional hosts edits",
"76–97",
"Backup is not used by enable; whole file is rewritten.",
"Preserve bytes/encoding, journal, atomically replace and detect concurrent edits.",
"Static finding",
"Not integrated",
"",
"User attachment Pasted text.txt; SHA256 0603A1073072CCC55B78692ACC93FAED4363CCFC0AF700472FBC862788B97E13",
"2026-09-19T12:00:00.000Z"
],
[
"S07",
"High",
"Malformed marker removes other entries",
"79–84; 90–95",
"Missing end marker drops every following line.",
"Reject unmatched or duplicate markers before mutation.",
"Confirmed in-memory",
"Not integrated",
"",
"User attachment Pasted text.txt; SHA256 0603A1073072CCC55B78692ACC93FAED4363CCFC0AF700472FBC862788B97E13",
"2026-09-19T12:00:00.000Z"
],
[
"S08",
"Medium",
"ASCII conversion changes content",
"86; 96",
"Non-ASCII comments do not survive.",
"Preserve detected encoding and original bytes.",
"Confirmed in-memory",
"Not integrated",
"",
"User attachment Pasted text.txt; SHA256 0603A1073072CCC55B78692ACC93FAED4363CCFC0AF700472FBC862788B97E13",
"2026-09-19T12:00:00.000Z"
],
[
"S09",
"High",
"Irreversible cache deletion / user scope",
"100–105",
"Targets elevated LOCALAPPDATA; enable cannot restore deleted data.",
"Separate explicit deletion; resolve intended profile and reject path escapes.",
"Static finding",
"Not integrated",
"",
"User attachment Pasted text.txt; SHA256 0603A1073072CCC55B78692ACC93FAED4363CCFC0AF700472FBC862788B97E13",
"2026-09-19T12:00:00.000Z"
],
[
"S10",
"High",
"Hosts list overclaims suppression",
"30–38",
"Exact names do not prove all paths or identifiers are blocked.",
"Measured per-feature controls and residual-traffic reporting.",
"Design limitation",
"Not integrated",
"",
"User attachment Pasted text.txt; SHA256 0603A1073072CCC55B78692ACC93FAED4363CCFC0AF700472FBC862788B97E13",
"2026-09-19T12:00:00.000Z"
],
[
"S11",
"Medium",
"Notification side effects",
"34–37",
"WNS is shared infrastructure, not a GDID-only endpoint.",
"Keep default notifications intact pending narrow tests.",
"Official endpoint docs",
"Not integrated",
"",
"https://learn.microsoft.com/en-us/windows/privacy/manage-windows-11-endpoints",
"2026-09-19T12:00:00.000Z"
],
[
"S12",
"Medium",
"Status elevates and creates state",
"11–27",
"Read-only mode enters the mutation setup path.",
"Audit without elevation or filesystem writes.",
"Static finding",
"Not integrated",
"",
"User attachment Pasted text.txt; SHA256 0603A1073072CCC55B78692ACC93FAED4363CCFC0AF700472FBC862788B97E13",
"2026-09-19T12:00:00.000Z"
]
],
"maintenance": [
[
"U01",
"Windows cumulative / .NET",
"Normal supported online servicing",
"Reviewed Catalog packages and required checkpoints",
"Authenticity, applicability, order, installed KB/build and reboot",
"Workflow prepared",
"",
"https://learn.microsoft.com/en-us/windows/deployment/update/catalog-checkpoint-cumulative-updates",
"2026-09-19T12:00:00.000Z"
],
[
"U02",
"Defender intelligence / engine / platform",
"Keep normal cloud and update services",
"Supported offline package distribution for all three components",
"Versions and freshness; cloud capability explicitly unavailable",
"Workflow prepared",
"",
"https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-updates",
"2026-09-19T12:00:00.000Z"
],
[
"U03",
"Trusted / disallowed certificates",
"Retain trust-list and revocation maintenance",
"Plan authenticated local trust-list refresh",
"Current provenance and revocation limitations; validation remains enabled",
"Research",
"",
"https://learn.microsoft.com/en-us/windows-server/identity/ad-cs/configure-trusted-roots-disallowed-certificates",
"2026-09-19T12:00:00.000Z"
],
[
"U04",
"Tor / Zen / Helium / apps",
"Keep publisher security update channels",
"Transfer authenticated installers and dependencies",
"Versions, signatures and browser launch/security behavior",
"Research",
"",
"Project engineering decision; not a verified Windows guarantee",
"2026-09-19T12:00:00.000Z"
],
[
"U05",
"Firmware / drivers / Secure Boot / WinRE",
"Retain vendor and OS maintenance",
"Separate vendor-supported offline methods",
"Per-component coverage; OS build alone is insufficient",
"Research",
"",
"Project engineering decision; not a verified Windows guarantee",
"2026-09-19T12:00:00.000Z"
],
[
"U06",
"Offline scan metadata",
"Online scan remains available",
"Fresh signed Wsusscn2.cab with offline WUA search",
"Catalog date, limited scope, temporary registration cleanup",
"Scanner planned",
"",
"https://learn.microsoft.com/en-us/windows/win32/wua_sdk/using-wua-to-scan-for-updates-offline",
"2026-09-19T12:00:00.000Z"
],
[
"U07",
"Bundle integrity",
"Local verifier available",
"Same verifier; no network calls or installers invoked",
"19 synthetic tests; hashes do not establish publisher authenticity",
"Implemented",
"",
"Local project: Offline-Updates.ps1; src/Wind.OfflineUpdates.psm1; docs/OFFLINE-UPDATES.md",
"2026-09-19T12:00:00.000Z"
],
[
"U08",
"Isolation boundary",
"Online traffic intentionally permitted",
"Disconnected protected Windows; separate connected collector",
"External verification; online cloud protection unavailable",
"Not deployed",
"",
"Project engineering decision; not a verified Windows guarantee",
"2026-09-19T12:00:00.000Z"
]
]
}
Reference in new issue View Git Blame Copy Permalink