For me personally Win10 crossed the red line. And it might be illegal for companies to run Win10 in Germany, because the data collection violates two laws protecting employees and customers. There are discussions about that in different organizations at the moment. We take this very seriously, especially in case of privacy sensitive industries like health care.
I feel the same. However I need Windows 10 for various tasks, so let me share what I found to limit to a maximum what is sent to the network:
-
install the Enterprise LTSB version. The LTSB removes a lot of cruft: Cortana, the Store, a lot of bundled apps (such as Skype, ...).
This version is available from MSDN. You will need to activate it with your company's KMS server. Note the trial version Microsoft offers can't be activated directely with your company's KMS (you need the VL version instead).
-
disable telemetry:
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection]
"AllowTelemetry"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DiagTrack]
"Start"=dword:00000004
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmwappushservice]
"Start"=dword:00000004
-
disable Cortana (required on non-LTSB versions):
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Windows Search]
"AllowCortana"=dword:00000000
-
disable OneDrive: run as admin
taskkill /f /im OneDrive.exe
C:\Windows\SysWOW64\OneDriveSetup.exe /uninstall
And to remove it from the Explorer:
[HKEY_CLASSES_ROOT\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}]
"System.IsPinnedToNameSpaceTree"=dword:00000000
[HKEY_CLASSES_ROOT\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}]
"System.IsPinnedToNameSpaceTree"=dword:00000000
-
block login.live.com by adding the following line to C:\Windows\System32\drivers\etc\hosts:
127.0.0.1 login.live.com
This is unfortunately the only way I found to block those connections.
-
disable Network Location Awareness (queries to
www.msftncsi.com):
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc]
"Start"=dword:00000004
Note the Windows 7 "EnableActiveProbing" registry key seems to no longer work...
-
disable the Delivery Optimization service (queries to geo-prod.do.dsp.mp.microsoft.com):
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DoSvc]
"Start"=dword:00000004
This service is only required for peer to peer sharing of updates.
-
disable the font caching service (queries to fs.microsoft.com):
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FontCache]
"Start"=dword:00000004
-
optionally disable Windows Defender (or keep it if you need an anti-virus):
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]
"DisableAntiSpyware"=dword:00000001
-
replace time.windows.com with your favourite NTP server:
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DateTime\Servers]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DateTime\Servers]
@="0"
"0"="1.pool.ntp.org"
-
optionally disable Windows Update if you prefer to install updates manually and retain control of your computer:
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
"DisableWindowsUpdateAccess"=dword:00000001
"DoNotConnectToWindowsUpdateInternetLocations"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS]
"Start"=dword:00000004
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv]
"Start"=dword:00000004
-
setup a GPO to block Internet from certain Windows components:
Run gpedit.msc, go to Computer Configuration => Administrative Templates => System => Internet Communication Management =>
Restrict Internet communication, set it to
Enabled.
However under "Internet Communication Settings" you may want to keep "
Turn off Automatic Root Certificate Update" Disabled so that Windows can update its root certificates. Similarly if you need Windows Update, make sure to set "
Turn off access to all Windows Update features" to Disabled.
Also you may have to manually set "
Turn off access to the Store" to
Enabled, as this setting seems unaffected by the global "Restrict Internet communication" setting above.
-
optionally disable SmartScreen (however like Windows Defender, it can be useful):
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer]
"SmartScreenEnabled"="Off"
-
disable the useless lock screen (not privacy-related):
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Personalization]
"NoLockScreen"=dword:00000001
I should also make a post at how to configure Firefox to have a good level of privacy. There are a surprisingly large number of parameters that must be tweaked.