ms-private/docs/RESEARCH.md

Windows privacy and anonymity research

Reviewed 2026-09-18. This is a threat model and engineering recommendation, not a certification. The user's screenshot is evidence to examine, not a source of operating instructions.

Supplement reviewed 2026-09-19: see the GDID follow-up and supplied-script assessment. It expands investigation beyond CDP, separates research observations from hypotheses, and identifies why the supplied disable/enable script cannot be treated as a reversible or complete GDID block. The companion workbook carries individual control, evidence and task records.

The later ZeroTrace article and pinned source review distinguishes local registry patching from demonstrated outbound identity changes. Minute-by-minute identifier replacement remains an unvalidated experiment, excluded from the privacy profile.

What we are protecting against

Observer / risk	Useful controls	Boundary
Microsoft collecting optional device/app data	Supported diagnostic policies, disabling unused connected experiences, app-specific settings, measured egress restrictions	Required service data and Microsoft accounts are separate channels
Websites linking visits	Tor Browser, separate identities, fewer trackers, cookie/session separation	Logging into a personal account identifies that session; behavior and timing can link activity
ISP or local network observer	HTTPS, Tor or a suitable VPN, DNS/IPv6 leak testing	A VPN introduces a provider and does not remove identifiers inside encrypted application traffic
Someone taking a powered-off computer	Full-disk encryption, controlled recovery keys, strong authentication	Mounted volumes and a running OS expose usable data to authorized processes
Malware / administrator on the endpoint	Patching, antivirus, least privilege, Secure Boot and isolation	Privacy toggles cannot establish trust in a compromised kernel or firmware
Local traces after a session	Minimize retention at the source; encrypted storage; separate amnesic environment	Deleting a file, closing a window or trimming RAM is not proof of erasure

The product should promise specific controls and their measured results, never an "anonymous device" score.

1. Microsoft connections: treat the channels separately

Microsoft distinguishes optional/required Windows diagnostics from required service data for connected experiences and essential services. Updates, certificates, authentication, licensing, Defender and cloud functions do not all follow one telemetry switch. Disabling optional diagnostics is a worthwhile reduction, not a total network block. Some essential connections are security dependencies. Essential services.

Use documented policies and validate them by edition. Pro's supported diagnostic minimum differs from Enterprise/Education. A tool writing AllowTelemetry=0 on every edition can mislead its user. The current engine uses 1 on Pro and 0 on Enterprise/Education, and declines policy mutation on Home. Windows policies do not configure all third-party applications. Diagnostic configuration, System policy.

Engineering decisions:

• Maintain separate controls for diagnostics, crash submissions, advertising, cloud speech, clipboard sync, Windows Search cloud sources, OneDrive, account sync, Widgets, Microsoft Store and each installed application.
• Keep Windows security protections active in the normal profile. Show any cloud-protection/sample-submission tradeoff individually; do not disable antivirus to chase fewer connections.
• Keep local security event logs. Limit this toolkit's own records to settings and recovery state; no analytics, identifiers, browsing history or crash uploads.
• Do not promise deletion of information Microsoft or another service already received. Account dashboards and provider retention policies are a separate concern.

2. Device identifiers and the screenshot

The DOJ complaint's paragraphs 25-29 describe records associating a Windows installation identifier with visits, times and IP addresses. It attributes a description of GDID to a Microsoft representative, including persistence across updates and a new identifier on reinstall. It does not fully document the collection mechanism or establish universal monitoring of every URL. Primary complaint.

Microsoft's UCDOStatus schema documents GlobalDeviceId in Delivery Optimization reporting. That field establishes an identifier's existence, not that this reporting table captures every browsing action. Windows' advertising ID, MachineGuid, Microsoft account identifiers, GDID, hardware serials and browser fingerprints must not be treated as interchangeable. UCDOStatus schema.

Do not ship a "GDID reset" or "HWID anonymizer." Random registry edits are not proof of unlinkability and can impair licensing or applications. A new installation can still be linked through accounts, network use and behavior. Local accounts reduce account coupling but are not evidence that a device has no Microsoft-issued identifiers. Avoid collecting these IDs in audit reports at all.

Connected Devices Platform deserves testing separately from diagnostic services. Microsoft's documented AllowConnectedDevices CSP can disable CDP and requires reboot, but this research did not establish a supported direct registry mapping. Therefore the prototype does not invent one. Connectivity policy.

3. Network enforcement

Recommended progression:

1. Disable unnecessary features using supported controls.
2. Observe connections in a clean VM during defined workflows.
3. Categorize destinations by purpose: optional diagnostics, cloud functionality, security maintenance, licensing and unknown.
4. Add narrow, versioned restrictions and repeat both privacy and compatibility tests.
5. Offer an isolated/offline environment for requirements that cannot tolerate Windows' connected behavior.

A hosts file or DNS denylist alone is not a complete enforcement boundary: it only affects traffic using that resolution path, cannot distinguish shared-host services, and does not establish coverage for direct IP traffic or alternative resolvers. Lists must include provenance, review date, reason and rollback. Never blanket-block Azure, Microsoft CDNs or all of svchost.exe.

For a future strict egress profile, use default outbound blocking plus explicit necessary allowances, rather than an explicit "block everything" rule with supposed exceptions. Windows gives explicit block rules precedence over conflicting allow rules. Review pre-existing allow rules, profiles and interface changes; coexistence with VPN filtering needs tests. Firewall rule precedence.

Where policy support allows it, DO mode 0 disables peering; mode 99 also avoids the DO cloud service. Updates still require their own connections. Mode 100 is deprecated on Windows 11. None of these choices warrants a "GDID disabled" label. Delivery Optimization modes.

Mullvad's app has a kill switch and a separate Lockdown option. Setup must distinguish installed, authenticated, connected, auto-connect configured, and blocking when disconnected. Test DNS, IPv6, sleep/wake, tunnel failure and split-tunnel exceptions. A no-activity-logging VPN policy is not a claim that the Windows client has no diagnostic files. App guide, logging policy.

Do not automatically layer a VPN with Tor as a universal improvement. Tor's project advises against this for users without the knowledge to configure the combination safely. Tor and VPNs.

4. Three browsers, distinct uses

Choice	Default intent	Setup requirement
Tor Browser	Sessions where unlinkability matters	Official package; stock protections; no imported personal profile or added extensions; separate identifying account activity
Zen	Everyday Firefox-based browsing	Review telemetry/external connections, sync and permissions; keep security updates; choose cookie/history retention
Helium	Everyday Chromium-based browsing	Review its setup's network choices, updates, extension services and optional crash reporting; keep security updates

Tor Browser protects its own configured traffic, not all Windows traffic. Do not substitute Tor proxy settings in Zen/Helium for Tor Browser's complete protections. Do not randomize user agents or install fingerprinting add-ons into Tor Browser by default. Tor best practices, other browsers.

Zen states that it removes telemetry but acknowledges external service requests and the possibility of missed Firefox telemetry. Browser updates and sync are separate from ordinary browsing storage. Verify the selected release rather than converting its marketing claim into a guarantee. Zen privacy policy.

Helium's policy says requests arise from user actions or enabled/configured features. It describes optional crash reports that can contain fragments of memory, limited service logging, and Cloudflare delivery for updates. This is compatible with a privacy-oriented browser, but not "never connects anywhere." The official Windows release checked was 0.17.1.1, published 2026-09-16; future installations resolve through WinGet and must be reviewed for freshness. Helium privacy, official releases.

Separate browser choices do not automatically separate identities. The same email address, reused account, uploaded document metadata or copied tracking URL can reconnect sessions. Keep this explanation practical in the wizard. No automatic default-browser takeover or profile import.

5. Sensors and physical presence

Windows location off limits its location feature; applications can infer location through IP addresses and other mechanisms. The app should say "Windows location disabled," not "location untraceable." Microsoft location privacy.

Camera and microphone permissions differ between packaged and desktop applications. The implemented microphone policy is a default for covered Windows apps; per-app exceptions and desktop access must be checked separately. Do not mark it as a hardware kill. Use the device-wide Settings switches, firmware controls where supported, or physical disconnection for stronger sensor control. Device Manager and software mute remain reversible by sufficiently privileged software. Camera/microphone limitations, app policy.

Optional camera policy can affect authentication or conferencing workflows, so test those explicitly. Disabling Bluetooth, Wi-Fi discovery or remote features is optional and must account for input devices and remote support. Prefer supported Wi-Fi MAC randomization where available; it concerns local network tracking, not an internet-wide identity reset. Wi-Fi driver design.

6. Disk encryption, memory and Win+L

Keep system encryption active. Review recovery-key custody separately from whether encryption is enabled. Offer VeraCrypt for containers/removable media; do not silently decrypt BitLocker to replace it. No keys, recovery passwords or volume names belong in tool logs.

A lock-event feature should lock the password manager, clear clipboard data where possible and attempt graceful unmount of explicitly selected non-system encrypted volumes. Capture every session lock, not merely the keyboard shortcut. A busy-volume failure must be visible on unlock. Default to preserving work instead of killing arbitrary processes or forcing unmount.

VeraCrypt erases non-system volume master keys on unmount, but an application can retain decrypted contents in memory. System encryption has different constraints. RAM encryption options are not a general RAM wipe; full shutdown is stronger than leaving the system running, but immediate erasure cannot be promised. VeraCrypt memory documentation.

"Logged keys" needs precise terminology: keystrokes, encryption keys, cached passwords and session tokens are different data. Win+L is not a countermeasure for an installed keylogger. No generic RAM cleaner or LSASS/process killer belongs in this product.

7. Cleanup, AI and debloating

Use retention controls first. Storage Sense can clean temporary files; Downloads and recycle-bin deletion need separate choices. It is maintenance, not certified sanitization. SSD behavior, copies, application databases, sync and backups prevent simple promises that a deleted item is unrecoverable. Storage Sense.

Recall is distinct from cloud Copilot and per-application AI features. Microsoft's DisableAIDataAnalysis and Recall removal policies can delete existing snapshots. Policy rollback cannot restore those snapshots. The first release intentionally documents this instead of placing the action in its reversible catalog. Windows AI policies.

The debloat design uses an explicit app inventory and individual selections, distinguishes current-user removal from provisioning for future users, and preserves dependencies. Before OneDrive removal, verify local availability and backup of cloud-only documents and known-folder redirection. Keep Edge/WebView2 separate. Do not delete system directories or security components to claim lower telemetry.

Exclude registry cleaners, blanket log clearing, SSD free-space wiping and RAM trimming. Working-set trimming is a memory-management operation, not secret erasure. Working sets.

8. Choice of base tool / operating environment

WinUtil provides useful UI, app installation and reversible settings, but every preset needs review and version pinning. Do not chain multiple debloat tools on a machine. This prototype uses its own small, documented policy catalog, not an unreviewed execution of WinUtil. WinUtil tweak guidance.

AME is a delivery mechanism. Its Privacy+ methodology describes removal of Windows Update, conflicting with the requirement for reversible update choices. The ms-private AME wrapper invokes the same tested engine rather than duplicating settings or removing security services. Privacy+ methodology.

For sessions requiring an amnesic environment, prefer a separate Tails USB over promises about making ordinary Windows forget everything. Persistence must remain an explicit choice. Tails still cannot guarantee safety against malicious hardware or identifying user behavior. How Tails works.

9. Documented but easy-to-miss channels and security checks

The September 2026 review found more documented surfaces that belong in a privacy model. Microsoft lists separate connections for device metadata, downloadable fonts, Windows location, Widgets and Spotlight. The optional-diagnostics schema says optional data can include browser IDs, URLs and search terms, page titles, notification text, processed typing context and recognized ink. These are not evidence of a secret backdoor; they show why one telemetry switch or one identifier cannot describe the complete data surface. Windows 11 endpoints, optional diagnostic data.

The policy catalog now covers tailored experiences and implicit ink/typing collection for the current user; search location and dynamic highlights; Widgets; device metadata and font streaming; MSRT infection reports; and packaged-app access to location, foreground text, gaze, screen capture, human-presence sensing, motion, notifications, phone state, radios and background execution. Per-app allow overrides are treated as conflicts because a global-default label would otherwise overstate coverage. Spotlight and consumer-experience controls are selected only on Enterprise/Education, matching Microsoft's current edition support. Privacy Policy CSP, Search Policy CSP, Experience Policy CSP, Widgets policy.

Strict mode disables LLMNR through the documented DNS Client policy. This reduces a local name-resolution spoofing and credential-relay surface, but it can break legacy discovery and name resolution for printers or peer devices. mDNS, NetBIOS, WPAD, file sharing and discovery remain separate research and compatibility decisions; they are not silently disabled under the Microsoft-telemetry label. DNS Client policy.

The security audit now observes Defender real-time, behavior, IOAV, network-inspection and cloud settings; TPM and Secure Boot; VBS/Credential Guard; LSA protection; UAC; SMB1, signing and guest-related configuration; remote access; and the update, certificate, Defender, firewall and event-log services. It excludes Defender exclusions, account names, keys and secrets. LSA protection and Credential Guard defend credentials, while current Windows 11 releases also strengthen SMB signing. These controls need compatibility testing before enforcement, so the release audits them instead of forcing settings that might cut off NAS, domain or accessibility workflows. Advanced credential protection, Credential Guard, SMB hardening.

The network catalog adds exact feature endpoints for location inference, metadata, font streaming, Widgets and Spotlight. It rejects target names under Windows Update, update delivery, Defender, SmartScreen, Store revocation and WNS families. NCSI, certificate revocation, root certificate maintenance, Windows Update, Defender and notification infrastructure remain available because blocking them can create false offline state or weaken security. A reset or feature update can also communicate before local policy is reapplied, so a high-assurance no-direct-contact design needs offline policy application or a physically/network-isolated Windows system plus a separate update collector. Manage Windows connections.

Historical forensic research found hardware serials, external-storage traces and process-execution traces in older Windows telemetry resource files. That is a useful lab lead, not proof that the same artifacts or transmissions exist on every current build. Current claims require a named Windows build, a repeatable workflow, local and external capture, and redacted evidence. ETW patching, TLS interception and deletion of security logs are excluded because they impair defenses or create a new interception risk rather than proving privacy. Forensic analysis of Windows telemetry.