Windows 11 privacy tools

Hello, I went through a thread that talks about different tools to disable telemetry of Windows 11.

I'm not sure which one I should use?






Also, this youtube video:
Or perhaps a combination of those?

If you have a strong opinion on how we don't have privacy online, thanks in advance for staying on topic :)

Use them all, I’ll find some others for you also.

Look they all pretty much do the same thing so it doesn’t really matter, not really. And regardless of if you want to hear it or not, they are ALL (in my opinion) a false sense of security. They prey on the unknowing and the paranoid. Sure they’ll have some effect but ultimately… nah, not really.
I’d like to add, you can’t post a thread in here and expect people to tell you what you want to hear just to make you feel warm and fuzzy, some of us members have a conscience.

There are different kinds of Telemetry. First you need to understand the different categories of Telemetry and then you can decide which ones you consider unacceptable.

• Device specifications and health
• App usage and performance
• Error reports and crash dumps
• Feedback and ratings
• Browser history and search queries
• Location and activity history
• Advertising ID and interests

[Source: geekforgeeks.org]

For a start, I always allow error diagnostics and reporting as that gives OS users like me a voice. But there are options and levels of data collection if it is inconvenient for your organisation.


Second, I never allow detect location in my browser or on websites, unless I am on my mobile.

Website activity history allows websites to improve their website, so I allow that as fair usage. Advertising is weird. I don't like people flogging stuff that I don't want, but there again some websites say they need advertising to fund their activity, so I allow it if I use that website.

Website push notifications I usually disable, except for this site, as I am rarely on most sites long enough to benefit from such notifications.

Feedback and ratings I usually ignore for myself however I've also recommended it for people who have discovered OS bugs or some other OS behavioural problem. So that stays.

App usage I always review on an app by app basis. On Android I can select for app to use specific data "only once." On windows, I always check to see which app has access to my camera. And so on. So far, I find developers are being fair. I can leave negative feedback on the App Store, if I discover something I do not like.

If you want to make decisions that are different to me, the these good articles cover most issues of concern:




Telemetry essentially means the OS have inevitably become more dependent on the Internet. that is what makes it possible. The Internet serves me in my way, and I think that Internet Telemetry serves the other organisations in their way. But yes, review each one individually and decide whether their requests are fair or acceptable for your organisation.

iko22 said:

I've also recommended it for people who have discovered OS bugs or some other OS behavioural problem.

Click to expand...

Like this?

Microsoft says April Windows updates break VPN connections

Use a Wifi card? Windows uses nearby access points to determine location. There are allegedly many companies that have huge databases of WiFi networks with their positions that are used by Microsoft to pin down locations.

I don't use VPNs . Although they provide privacy by bypassing detection in my country they also put me in a situation where my activities are judged by a foreign country. I could unwittingly break their laws and get extradited, and I am not bothered to research their laws. So tough luck to VPNs .

iko22 said:

they also put me in a situation where my activities are judged by a foreign country

Click to expand...

Can’t win any way we try.

Win11help said:

Also, this youtube video:

Click to expand...

You can just use DNS and manage it from there with stats what is blocked/allowed without a slowdown.
You can have separate profiles for Windows and browsers and block anything to your heart's content.

Ultimate Windows Tweaker 5.1

iko22 said:

I don't use VPNs . Although they provide privacy by bypassing detection in my country they also put me in a situation where my activities are judged by a foreign country. I could unwittingly break their laws and get extradited, and I am not bothered to research their laws. So tough luck to VPNs .

Click to expand...

Nonsense.

I don't block Windows telemetry (except what can be disabled in the interface) and I don't use programs unless it's clear what they do.
You can try the Windows Firewall add-on, for example SimpleWall

Thank you all for the answers!

iko22 said:

Telemetry essentially means the OS have inevitably become more dependent on the Internet. that is what makes it possible. The Internet serves me in my way, and I think that Internet Telemetry serves the other organisations in their way. But yes, review each one individually and decide whether their requests are fair or acceptable for your organisation.

Click to expand...

I basically want to disable all telemetry. I've already tweaked all my Windows settings, but there are some settings I can't change except with a program or code through powershell.

hdmi said:

Ultimate Windows Tweaker 5.1

Click to expand...

Is this one any better then the other ones I suggested?

Simplewall seems complex, but I've seen it couple of times.

I'm still not sure which program to use. Does anyone know the ones I listed and could explain what each do and if they're safe (they don't themselves collect anything)?

Thanks! :)

Win11help said:

Is this one any better then the other ones I suggested?

Click to expand...

How do you define "better"?

simplewall's primary value proposition is that it operates through the WFP/BFE (windows filtering protocol/base filtering engine).

this is a lower/deeper level system compared with the windows firewall.

the upside is that, by all evidence, it is "trustworthy" and does not have built-in hard coded white listing of MS backbone ips an system dll services and exes like the firewall (not everyone grasps this: hosts file blocking and "null routing,"and service/exe blocking, and possibly port/protocol blocking through the built in MMC.exe UI Advanced Firewall DO NOT provide consistent, persistent, reliable blocking..... either due to MS sneeky stealthed update of (dynamic) MS servers, which comes with the weekly certificate & revocations lists and cannot be broken apart AFAIK, and therefore becomes obsolete so rapidly that blocklists must be micromanaged, or due to fully invisible-to-user whitelisting that would only show up by logging at the NAT/gateway)

its also much faster/lower overhead relative to the advanced firewall

the downside is that the WFP is, generously, governed by convoluted and seemingly contradictory and paradoxical rules making it difficult to understand.

the result is that many users will open huge holes in their security model, as they struggle to make applications work while trying to block OS and 3rd party spyware.

*assume*, at the outset, that everything more complicated than a browser will break and require fiddling iteratively to get functionality back

i use Openvpn (the separate client; not configured within windows) with DNSCrypt-proxy, Sabnzbd for usenet, SMB protocol file sharing amongst my LAN, ClamAV for antivirus, various Python utilities, Brave, and Tor Browser.

still, cumulatively, it likely took 10+ hours of baldness inducing stress and direct hair pulling before everything worked properly while still blocking everything else

the easiest, and *usually* effective, way to make the above work properly in "default block all":

divide everything into "LAN Only", "LAN+WAN OK", "2 Sneaky 4 Me", and "Pure spyware"

LAN + WAN: checkbox "enable" the EXE and services associated with all, which will require rebooting to force the software to see new or schedule launched services, as well as manual "adding" of EXEs

LAN OK: local IP - your local IP (eg 192.168.1.100, 10.0.0.100, or 10.0.0.0/24 for dynamic); Remote can be enabled by port (135-139 + 445/5445/8445 + 1900 + 2869 +3702+ 5353 + 5355-5357 + 5000-5010 + 67-68 + 546-547 + 3389 covers most exclusively LAN side functionality), or you can add the full local IP range by subnet (10.0.0.0/24) as well as multicast and link local ips (224.0.0/4, 169.254.100.0/24, etc)

note: 10.0.0.0/24 and 192.168.1.0/24 include the default gateways 10.0.0.1 and 192.168.1.1, meaning its possible for apps or services configured properly to see outside or traverse the gateway (usually via services that are advertised by the router alongside other info set by the ISP or provisioned by user control: obvious examples include network time or special VOIP or media streaming)

2 SNEAKY: scrupulously enable by single port or IP

PURE SPYWARE: create a rule called "block" with blank local and remote rules, any protocol, any direction, and any IP version

in theory this would be redundant, but "block" rules have higher WFP priority than allow rules, making it useful to prevent accidentally too-permissive rules from giving access to unwanted apps.

its useful to add various System32 exes to ensure they are blocked from the earliest phase of boot (most applicable for ethernet connected computers; some Wifi as well, as some modern wifi hardware preserve active sessions across Windows' now standard "soft reboot")

for example blocking the System Guard Runtime Broker, which "Monitors and attests to the integrity of the Windows platform" is strongly encouraged, as it is pure telemetry spyware (albeit pure technical telemetry, not usage telemetry)


remember:

even with careful deliberate provisioning, some functionality may still be broken.

the simple reality is that you probably CANNOT have a high-privacy internet connection (eg with DNSSEC or dynamic port TCP with TOR) along with multimedia LAN streaming, network printing, VPN, torrents/usenet, and Windows updates all fully operational seamlessly enough to setup for your grandmother to use tech support free.

edit:

the trustworthiness of this system mAay become obsolete with a future update of Windows 11, and most assuredly by the next full version of Windows, promised/predicted to be fully "OS as a Service