From Newsgroup: alt.comp.os.windows-10

Privacy Tutorial:
Disable all known Windows telemetry, ads, tips & tracking

As always, this is posted with the hope that it helps others garner more privacy. And, as always, if you know more than is written below, please add value so that everyone benefits from every post made in every thread.

All the following privacy tweaks were performed just now,
as admin, on my Windows 10 system. I'll let you know in a few days
if something bad happens.

Here's my ad hoc off-the-cuff summary of the privacy tweaks I made.
1. Disabled services
(DiagTrack and dmwappushservice).
2. Disabled scheduled tasks
(Appraiser, StartupAppTask, ProgramDataUpdater, Consolidator,
UsbCeip, DiskDiagnosticDataCollector).
3. Applied registry policies
(CEIP, AppCompat telemetry, Inventory, Steps Recorder, Error Reporting
(engine and UI), Advertising ID, Consumer Features, Cortana, Web Search,
Tailored Experiences, Location, Background apps, Tips, Spotlight
and Driver updates.
4. Optional registry policies applied
(Delivery Optimization, Maps updates, Wi-Fi Sense, Handwriting data).
5. Optional steps to pin to 22H2 (these were not applied)
(Locks system to Windows 10 22H2 and blocks forced upgrades).

Here's the state of my system after running the steps listed below.

Services:
DiagTrack (Connected User Experiences and Telemetry) > disabled
dmwappushservice (WAP Push Telemetry) > disabled

Scheduled Tasks:
Compatibility Appraiser > disabled
StartupAppTask > disabled
ProgramDataUpdater > disabled
Consolidator > disabled
UsbCeip > disabled
DiskDiagnosticDataCollector > disabled

Registry Policies:
CEIP > disabled
AppCompat telemetry (AIT) > disabled
Inventory Collector > disabled
Steps Recorder (UAR) > disabled
Windows Error Reporting (engine + UI) > disabled
Advertising ID > disabled
Consumer features > disabled
Cortana > disabled
Web search in Start menu > disabled
Tailored Experiences > disabled
Location services > disabled
Background apps > disabled
Windows Tips + Spotlight > disabled
Driver updates via Windows Update > disabled

By running the commands below, I've down services, tasks, registry policies
and update behaviors (i.e., essentially the full telemetry backbone).

SERVICES DISABLED
-----------------
DiagTrack (Connected User Experiences and Telemetry)
dmwappushservice (Device Management WAP Push)

Commands used:
Get-Service DiagTrack
Stop-Service DiagTrack -Force
Set-Service DiagTrack -StartupType Disabled

Get-Service dmwappushservice
Stop-Service dmwappushservice -Force
Set-Service dmwappushservice -StartupType Disabled

SCHEDULED TASKS DISABLED
------------------------
\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser
\Microsoft\Windows\Application Experience\StartupAppTask
\Microsoft\Windows\Application Experience\ProgramDataUpdater
\Microsoft\Windows\Customer Experience Improvement Program\Consolidator
\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip
\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector

Commands used:
schtasks /Change /TN "<task path>" /Disable

REGISTRY POLICIES APPLIED
-------------------------
Disable CEIP
Disable AppCompat telemetry (AIT)
Disable Inventory Collector
Disable Steps Recorder (UAR)
Disable Windows Error Reporting (engine and UI)
Disable Advertising ID
Disable Consumer Features
Disable Cortana
Disable Web Search in Start menu
Disable Tailored Experiences
Disable Location services
Disable Background apps
Disable Windows Tips (SoftLanding)
Disable Windows Spotlight features
Disable automatic driver updates via Windows Update

Commands used:
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppCompat" /v DisableUAR /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppCompat" /v DisableInventory /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" /v Disabled /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" /v DontShowUI /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo" /v DisabledByGroupPolicy /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v DisableConsumerFeatures /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v AllowCortana /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v DisableWebSearch /t REG_DWORD /d 1 /f
reg add "HKCU\Software\Policies\Microsoft\Windows\CloudContent" /v DisableTailoredExperiencesWithDiagnosticData /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors" /v DisableLocation /t REG_DWORD /d 1 /f
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications" /v GlobalUserDisabled /t REG_DWORD /d 1 /f
reg add "HKCU\Software\Policies\Microsoft\Windows\CloudContent" /v DisableSoftLanding /t REG_DWORD /d 1 /f
reg add "HKCU\Software\Policies\Microsoft\Windows\CloudContent" /v DisableWindowsSpotlightFeatures /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v ExcludeWUDriversInQualityUpdate /t REG_DWORD /d 1 /f

EXTRA REGISTRY POLICIES (OPTIONAL HARDENING)
--------------------------------------------
Disable Delivery Optimization (peer-to-peer update sharing)
Disable automatic Maps updates
Disable Wi-Fi Sense (auto-connect to open hotspots and shared networks)
Disable handwriting/inking data collection (if you never use pen input)

Commands used:
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization" /v DODownloadMode /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Maps" /v AutoDownloadAndUpdateMapData /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Microsoft\WcmSvc\wifinetworkmanager\config" /v AutoConnectAllowedOEM /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\TabletPC" /v PreventHandwritingDataSharing /t REG_DWORD /d 1 /f

OPTIONAL NEXT STEP (I didn't run this but I ran all of the above steps).
------------------
To pin the system to Windows 10 22H2 and block automatic upgrades:

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v TargetReleaseVersion /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v TargetReleaseVersionInfo /t REG_SZ /d 22H2 /f

--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: alt.comp.os.windows-10

Marion wrote:

Here's my ad hoc off-the-cuff summary of the privacy tweaks I made.
1. Disabled services
(DiagTrack and dmwappushservice).
2. Disabled scheduled tasks
(Appraiser, StartupAppTask, ProgramDataUpdater, Consolidator,
UsbCeip, DiskDiagnosticDataCollector).
3. Applied registry policies
(CEIP, AppCompat telemetry, Inventory, Steps Recorder, Error Reporting
(engine and UI), Advertising ID, Consumer Features, Cortana, Web Search,
Tailored Experiences, Location, Background apps, Tips, Spotlight
and Driver updates.
4. Optional registry policies applied
(Delivery Optimization, Maps updates, Wi-Fi Sense, Handwriting data).
5. Optional steps to pin to 22H2 (these were not applied)
(Locks system to Windows 10 22H2 and blocks forced upgrades).

UPDATE

I just now added these to further tighten telemetry and feedback channels
that remained even after the earlier 5 privacy oriented tweaking steps.

6. Advanced Telemetry & Feedback Restrictions
Objective: Disable additional services and feedback prompts
Commands:
Stop-Service -Name MapsBroker,RetailDemo,RemoteRegistry,SysMain,XblGameSave,WMPNetworkSvc -Force
Set-Service -Name <service> -StartupType Disabled
gpedit.msc > Computer Configuration > Administrative Templates >
Windows Components > Data Collection and Preview Builds
(Allow Telemetry = 1 Basic, Disable pre-release features = Enabled)
reg add "HKCU\Software\Microsoft\Siuf\Rules" /v NumberOfSIUFInPeriod /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\SQMClient\Windows" /v CEIPEnable /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppCompat" /v AITEnable /t REG_DWORD /d 0 /f

These go beyond baseline service disables (#1) & registry policies (#3).
These are a hybrid which combines service shutdowns such as
(MapsBroker, SysMain, etc.), Group Policy edits (telemetry level,
pre-release features), and registry rules (SIUF, CEIP, AIT).
--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: alt.comp.os.windows-10

Marion wrote:

These go beyond baseline service disables (#1) & registry policies (#3). These are a hybrid which combines service shutdowns such as
(MapsBroker, SysMain, etc.), Group Policy edits (telemetry level,
pre-release features), and registry rules (SIUF, CEIP, AIT).

UPDATE

I invested a few hours today finding more ways to modify Windows
to be more private, where I show the copy-&-paste steps below.

Optional Cloud & App Integration Restrictions
Objective: Reduce MSA, cloud sync, app store, & browser data sharing
Items:
Account & Cloud Integration
(local account, sync settings, OneDrive auto-start)
Edge / Browser Telemetry
(search suggestions, personalized ads, preloading)
Windows Store / Apps
(auto app updates, Start menu suggestions, bundled apps)
Notifications & Advertising
(tips, tricks, suggestions, ad ID double-check)
Network & Connectivity
(Hotspot 2.0, open Wi-Fi, SmartScreen review)
Miscellaneous Services
(Fax, Print Spooler, Remote Assistance, Bluetooth if unused)

Local vs Microsoft Account:
Since I have only a local account, there's nothing to do here.
But others may be on a Microsoft Account (MSA).
You can switch to a local account under:
Win+I > Settings > Accounts > Your info >
Sign in with a local account instead

Sync settings:
Even with a Microsoft Account, you can turn off sync under:
Win+I > Settings > Accounts > Sync your settings
OneDrive:
Disable OneDrive auto start:
Press {Ctrl+Shift+Esc} to open Task Manager
Go to the Startup tab
Find Microsoft OneDrive in the list
Right click and choose Disable

Or unlink the PC in OneDrive settings:
Click the OneDrive cloud icon in the system tray
Select Help and Settings > Settings
Go to the Account tab
Click Unlink this PC

Edge and Browser Telemetry
Objective: Reduce browser data collection and background activity
Items:
Turn off search and site suggestions
Disable tracking and ad personalization
Disable background preloading of pages

Search and site suggestions:
Runbox > msedge > edge://settings/search
Turn off "Show me search and site suggestions using my typed characters"
(if present)
Set "Search on new tabs" from "Search Box" to "Address bar"

Tracking prevention:
Runbox > msedge > edge://settings/privacy
Set Tracking prevention to "Strict" (or Balanced if needed)

Optional form and payment autofill:
Runbox > msedge > edge://settings/payments
Turn off "Save and fill payment info" if not needed
Runbox > msedge > edge://settings/addresses
Turn off "Save and fill addresses" if not needed
Runbox > msedge > edge://settings/passwords
Turn off "Offer to save passwords" if not needed

Background preloading:
Runbox > msedge > edge://settings/system
Turn off "Startup boost"
Turn off "Continue running background apps when Microsoft Edge is closed"
Turn off "Preload the new tab page" (if present)

Windows Store and Apps
Objective: Limit automatic app installs, updates, and suggested content
Items:
Disable automatic app updates
Turn off Start menu suggestions
Remove or disable bundled apps you do not use

Disable automatic app updates:
Win+I > Settings > Update and Security > Windows Update > Advanced
options
Turn off "Receive updates for other Microsoft products when you update Windows"
(This reduces Store app auto updates tied to Windows Update)

Turn off Start menu suggestions:
Win+I > Settings > Personalization > Start
Turn off "Show suggestions occasionally in Start"

Remove or disable bundled apps:
Runbox > powershell > right click > Run as administrator
Use command: Get-AppxPackage *appname* | Remove-AppxPackage
(Replace *appname* with the package name, e.g. xboxapp, skypeapp, etc.)
Or uninstall directly from Start menu > right click app > Uninstall

Notifications and Advertising
Objective: Reduce Windows tips, suggestions, and advertising ID
tracking
Items:
Turn off Windows tips, tricks, and suggestions
Disable Start and lock screen suggestions
Double check advertising ID setting

Turn off Windows tips, tricks, and suggestions:
Win+I > Settings > System > Notifications and actions
Turn off "Get tips, tricks, and suggestions as you use Windows"

Disable Start and lock screen suggestions:
Win+I > Settings > Personalization > Start
Turn off "Show suggestions occasionally in Start"
Win+I > Settings > Personalization > Lock screen
Turn off "Get fun facts, tips, tricks, and more on your lock screen"

Advertising ID:
Win+I > Settings > Privacy > General
Turn off "Let apps use advertising ID to make ads more interesting to
you"

Network and Connectivity
Objective: Reduce automatic network connections and review SmartScreen
Items:
Disable Hotspot 2.0 networks
Disable automatic connection to open Wi-Fi
Review SmartScreen settings

Disable Hotspot 2.0 networks:
Win+I > Settings > Network and Internet > Wi-Fi > Manage known networks
Look for "Hotspot 2.0 networks" and turn it Off (if present)

Disable automatic connection to open Wi-Fi:
Win+I > Settings > Network and Internet > Wi-Fi
Turn off "Connect to suggested open hotspots"
Turn off "Connect to networks shared by my contacts" (if present)

Review SmartScreen settings:
Win+I > Settings > Update and Security > Windows Security > App and
browser control
Under "Check apps and files" and "SmartScreen for Microsoft Edge"
Choose your preferred level (Warn or Off if you want less Microsoft data collection)

Miscellaneous Services
Objective: Disable background or legacy services not needed on most systems
Items:
Fax service
Print Spooler (if you never print)
Remote Assistance
Bluetooth (if unused)

Fax service:
Runbox > services.msc
Find "Fax"
Right click > Properties > Startup type: Disabled
Click Stop if running

Print Spooler:
Runbox > services.msc
Find "Print Spooler"
Right click > Properties > Startup type: Disabled
Click Stop if running
(Only do this if you never print or use PDF printers)

Remote Assistance:
Win+I > Settings > System > Remote Desktop
Turn off "Enable Remote Assistance connections to this computer"

Bluetooth (if unused):
Win+I > Settings > Devices > Bluetooth & other devices
Turn off Bluetooth
Runbox > services.msc > Find "Bluetooth Support Service"
Right click > Properties > Startup type: Disabled
--- Synchronet 3.21a-Linux NewsLink 1.2