Windows 11 ships with a lot of settings that quietly work against you. Telemetry running in the background. Your search queries bouncing off Bing servers. Apps peeking at your camera without asking twice. None of it is exactly secret, but Microsoft buries the controls deep enough that most people never find them. This list fixes that. Ten settings, ranked by how much they actually matter, with exact steps so you're not hunting through menus.
1. Switch to a Local Account
Every time you sign into Windows with a Microsoft account, your activity, settings, and device behaviour get tied to Microsoft's cloud. A local account breaks that link completely.
This is the single biggest privacy change you can make. Everything else on this list trims the edges. This one cuts the main wire.
On an existing install it's straightforward. If you're setting up a fresh machine, Microsoft now makes local accounts genuinely awkward to create during setup, but the workaround still works: disconnect from the internet before you reach the sign-in screen and Windows will offer a local account option. With an existing install, go to Settings > Accounts > Your Info and look for "Sign in with a local account instead." Follow the wizard, set a strong password, and that's it.
You'll lose a few things. OneDrive sync, Microsoft Store (partly), and cross-device settings backup all rely on a Microsoft account. For most home users that's a reasonable trade.
- During fresh setup: disconnect your ethernet or turn off Wi-Fi before reaching the sign-in screen. Windows will eventually offer a local account option.
- On an existing install: open Settings > Accounts > Your Info.
- Select Sign in with a local account instead and follow the prompts.
- Set a username, a strong password, and fill in the security questions (or use a password manager instead).
- Restart when prompted. You're now signed in locally.
- Disable automatic sign-in while you're here: Settings > Accounts > Sign-in options and set "Require sign-in" to "Every time."
How to verify it worked
Go to Settings > Accounts > Your Info. If you see "Local Account" rather than an email address, you're done.
Gotchas
- Microsoft keeps changing the OOBE (out-of-box experience) to discourage local accounts. The workaround above may shift with major Windows updates, so check current guidance if it stops working.
- Apps like the Microsoft Store and OneDrive won't function fully without a Microsoft account. You can still add a Microsoft account to specific apps without using it as your Windows sign-in.
- Local accounts don't support settings sync across devices, which is the whole point.
2. Turn Down Telemetry and Diagnostic Data
Windows is continuously sending data about your device, your habits, and how you use apps back to Microsoft. You can't turn it off entirely on Home or Pro, but you can turn it down.
Go to Settings > Privacy & Security > Diagnostics & Feedback. Set Diagnostic data to Required diagnostic data. That's the lowest level available on Home and Pro editions. Then switch off "Improve inking and typing recognition," "Tailored experiences," and "View diagnostic data." While you're there, hit the Delete button under "Delete diagnostic data" to clear what's already been sent.
If you're comfortable in the registry and want to go further, you can disable the DiagTrack service and set HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection to AllowTelemetry = 0. Be aware that doing so may trigger a warning in Windows Security. Enterprise editions are the only ones that support the full Security (0) level natively.
- Open Settings > Privacy & Security > Diagnostics & Feedback.
- Set Diagnostic data to Required diagnostic data.
- Toggle off Improve inking and typing recognition.
- Toggle off Tailored experiences.
- Toggle off View diagnostic data.
- Scroll to "Delete diagnostic data" and click Delete.
- Optional registry step: open regedit, navigate to
HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection, create a DWORD value namedAllowTelemetry, and set it to0.
How to verify it worked
Return to Diagnostics & Feedback. "Required diagnostic data" should be selected and the three toggles should be off.
Gotchas
- Windows 11 Home and Pro cannot fully disable telemetry. The Security level (0) is only available on Enterprise and Education editions.
- Major Windows updates can quietly re-enable telemetry settings. Check this page after every big update.
- Disabling the DiagTrack service via the registry may produce a yellow warning in Windows Security. It's cosmetic, not a genuine threat, but worth knowing about.
3. Audit App Permissions: Camera, Microphone, and Location
Apps you've half-forgotten about may have ongoing access to your camera, microphone, and location. A quick audit takes five minutes and it's genuinely worth doing.
Head to Settings > Privacy & Security and work through Camera, Microphone, and Location one at a time. For each one, you'll see a master toggle at the top (which cuts access for all apps) and then per-app toggles below. Go through the per-app list and ask yourself: does this app actually need this? A news reader with microphone access? Off. A game with location access? Off.
Don't stop there. Scroll further down the Privacy & Security menu and check Contacts, Calendar, Call history, and Notifications too. These are less obvious, but just as leaky.
- Open Settings > Privacy & Security > Camera. Toggle off access for any app that doesn't need your camera.
- Go back and open Microphone. Repeat the process.
- Open Location. Consider turning off the global toggle if you don't use location-based apps, or restrict it per app.
- Work through Contacts, Calendar, Call history, and Notifications the same way.
- For each permission, toggle off the master switch if no app on your device has a legitimate need for it.
How to verify it worked
Open a restricted app and try to use the feature you've blocked (for example, try to start a video call without camera permission). Windows should prompt the app that access is denied.
Gotchas
- Traditional desktop (Win32) apps often don't appear in the per-app permission lists. They can bypass the UWP permission system entirely. There's no clean fix for this short of using a firewall or process monitor.
- Revoking microphone or camera access from a productivity app like Teams or Zoom will break video calls. Only restrict apps where the permission makes no sense.
- Some permissions get reset after major Windows version upgrades. Worth re-checking after each big update.
4. Kill the Advertising ID
Windows assigns every user account a unique Advertising ID. Apps use it to build a profile of your behaviour across applications and serve you targeted ads. Turning it off takes about thirty seconds.
Go to Settings > Privacy & Security > General. The very first toggle is "Let apps use my advertising ID for experiences across apps." Switch it off. While you're on that screen, also turn off "Show me suggested content in the Settings app," "Show me notifications in the Settings app," and "Let websites provide locally relevant content by accessing my language list."
That covers the Windows side. Microsoft account-level ad personalisation is a separate thing managed at account.microsoft.com/privacy. If you still have a Microsoft account (even just for the Store), it's worth visiting that page and opting out there too.
- Open Settings > Privacy & Security > General.
- Toggle off Let apps use my advertising ID for experiences across apps.
- Toggle off Show me suggested content in the Settings app.
- Toggle off Show me notifications in the Settings app.
- Toggle off Let websites provide locally relevant content by accessing my language list.
- If you have a Microsoft account: visit account.microsoft.com/privacy and opt out of personalised ads there as well.
How to verify it worked
Return to Settings > Privacy & Security > General. All four toggles should be off.
Gotchas
- Disabling the Advertising ID doesn't block all ads, only targeted ones. You'll still see ads in apps that use their own tracking systems.
- Some third-party apps ignore the Windows advertising ID setting entirely and do their own tracking regardless.
- Microsoft account-level ad personalisation is completely separate and needs to be managed on Microsoft's privacy dashboard, not here.
5. Stop Bing Swallowing Your Start Menu Searches
Type anything into the Windows Start menu and it goes straight to Bing. Local file searches. App names. Random thoughts you half-typed and deleted. All of it hits Microsoft's servers by default.
There's no toggle for this in Settings. You have to go into the registry. Open regedit, navigate to HKCU\SOFTWARE\Policies\Microsoft\Windows\Explorer (create the Explorer key if it doesn't exist), and add a new DWORD value named DisableSearchBoxSuggestions set to 1. Restart Explorer (or just reboot) and your Start menu searches stay local.
On Pro and above, you can use Group Policy instead: User Configuration > Administrative Templates > Windows Components > File Explorer > Turn off display of recent search entries. Set it to Enabled.
- Press Win + R, type
regedit, and press Enter. - Navigate to
HKCU\SOFTWARE\Policies\Microsoft\Windows. - Right-click the Windows key, select New > Key, and name it Explorer (if it doesn't already exist).
- Inside the Explorer key, right-click and select New > DWORD (32-bit) Value.
- Name it
DisableSearchBoxSuggestionsand set the value to1. - Close regedit and restart your PC (or restart Explorer via Task Manager).
How to verify it worked
Open the Start menu and type a word. You should see local results only, with no "Search the web" suggestions appearing below.
Gotchas
- Group Policy edits require Windows 11 Pro or higher. Home users need the registry method.
- Major Windows updates have been known to re-enable Bing search integration. Check after every big update.
- Disabling web search also removes weather and news snippets from Start menu search results, which some people actually want. Your call.
6. Disable Activity History and Turn Off Recall
Windows logs which apps you open, which files you access, and which websites you visit, then stores that history locally (and potentially in the cloud). On Copilot+ PCs, Recall takes this further by taking regular AI-analysed screenshots of everything you do.
Activity History is the older feature. Go to Settings > Privacy & Security > Activity History, uncheck "Store my activity history on this device," uncheck "Send my activity history to Microsoft," and then hit the Clear history button to wipe what's already there.
Recall is the newer, more alarming one. If you have a Copilot+ PC, go to Settings > Privacy & Security > Recall & Snapshots and turn off "Save snapshots." You can also disable Recall entirely via Settings > System > Optional Features, or through Group Policy if you're on Pro or above.
- Open Settings > Privacy & Security > Activity History.
- Uncheck Store my activity history on this device.
- Uncheck Send my activity history to Microsoft.
- Click Clear history to delete existing records.
- On Copilot+ PCs: open Settings > Privacy & Security > Recall & Snapshots and toggle off Save snapshots.
- Optional: go to Settings > System > Optional Features, find Recall, and uninstall it entirely.
How to verify it worked
Check the Activity History page, both toggles should be off. For Recall, the "Save snapshots" toggle should be off and no new snapshots should appear in the Recall interface.
Gotchas
- Recall only exists on Copilot+ PCs (those with a qualifying NPU). If you don't see it in Settings, your hardware doesn't have it.
- Disabling Activity History means you lose the ability to pick up tasks across devices using the Timeline feature.
- Activity history may quietly re-enable itself if you turn on Windows Backup or account sync settings. Check after enabling any sync features.
7. Stop OneDrive Auto-Syncing Your Personal Folders
By default, Windows nudges OneDrive to back up your Desktop, Documents, and Pictures folders to Microsoft's cloud. You may never have agreed to that explicitly. It just happens.
Right-click the OneDrive icon in your system tray and go to Settings > Sync and Backup > Manage Backup. Stop the backup for Desktop, Documents, and Pictures. If you want to go further, go to Settings > Account > Unlink this PC to stop all syncing entirely.
To stop OneDrive loading at startup: Settings > Apps > Startup, find Microsoft OneDrive, and toggle it off. To remove it completely, go to Settings > Apps > Installed Apps, search for OneDrive, and uninstall it.
Also worth doing: Settings > Accounts > Windows Backup and turn off "Remember my apps" and "Remember my preferences." These are separate from OneDrive but use the same cloud infrastructure.
- Right-click the OneDrive icon in the system tray (bottom-right corner). If it's hidden, click the arrow to show hidden icons.
- Select Settings > Sync and Backup > Manage Backup.
- Stop backup for Desktop, Documents, and Pictures.
- To unlink completely: in OneDrive Settings, go to Account > Unlink this PC.
- To disable autostart: Settings > Apps > Startup, find Microsoft OneDrive, toggle off.
- To uninstall: Settings > Apps > Installed Apps, search OneDrive, select Uninstall.
- Disable settings sync: Settings > Accounts > Windows Backup, turn off "Remember my apps" and "Remember my preferences."
How to verify it worked
Open File Explorer and check your Desktop, Documents, and Pictures folders. You should no longer see the blue cloud sync icons on files, and the OneDrive icon in the system tray should be gone (or show "OneDrive is not running").
Gotchas
- Unlinking OneDrive does not delete anything from the cloud. Your files remain at onedrive.live.com until you delete them there manually.
- Some Windows updates reinstall OneDrive after you've removed it. Check your startup apps after major updates.
- Stopping sync means you lose the convenience of accessing your files from other devices or browsers. Keep a local backup strategy in place.
8. Harden Microsoft Edge's Privacy Settings
Edge is the default browser on Windows 11 and its out-of-the-box settings let tracking cookies run freely, send optional telemetry back to Microsoft, and pipe your browsing through Bing-connected features. None of that needs to be on.
Type edge://settings/privacy into the address bar. Set Tracking Prevention to Strict. Turn off "Help improve Microsoft products by sending optional diagnostic data about how you use the browser." Under Cookies, switch to blocking third-party cookies at minimum. Disable "Show suggestions from history, favourites and other data on device using my browsing history."
Consider switching your default search engine to something that doesn't track queries: DuckDuckGo or Brave Search are both solid. Go to Settings > Privacy, Search and Services > Address Bar and Search to change it. If you use a dedicated password manager, turn off Edge's built-in one under Settings > Passwords.
- Open Edge and type edge://settings/privacy in the address bar.
- Set Tracking Prevention to Strict.
- Turn off Help improve Microsoft products by sending optional diagnostic data.
- Under "Cookies and site permissions," set cookies to block third-party cookies (or use Balance mode at minimum).
- Disable Show suggestions from history, favourites and other data on device using my browsing history.
- Go to Settings > Privacy, Search and Services > Address Bar and Search and change the default search engine to DuckDuckGo or Brave Search.
- If using a password manager like Bitwarden: go to Settings > Passwords and turn off Edge's built-in password manager.
- If signed into Edge with a Microsoft account: either sign out or go to Settings > Profiles > Sync and disable all sync categories.
How to verify it worked
Visit a site like coveryourtracks.eff.org and run the test. Strict tracking prevention should produce a notably better result than Edge's defaults.
Gotchas
- Strict tracking prevention breaks some websites, particularly those that rely on third-party login flows ("Sign in with Google," for example). You can whitelist individual sites by clicking the shield icon in the address bar.
- Edge syncs your browsing data, history, and passwords to your Microsoft account if you're signed in. Sign out of Edge (not just Windows) to stop this, or disable sync per category.
- Microsoft has been known to reset certain Edge privacy settings after browser updates. Worth a quick check after any major Edge version bump.
9. Enable BitLocker or Device Encryption
All the software privacy settings in the world don't help if someone physically takes your laptop and reads the drive directly. Encryption is the fix. And on most modern Windows 11 machines, it's just a toggle.
Search for Device Encryption in Settings. If it appears and shows as off, turn it on. This works on supported Home editions. On Pro or Enterprise, search for Manage BitLocker and turn it on for your system drive (usually C:). You'll be asked where to save the recovery key: print it, write it down, or save it to a USB drive and store it somewhere separate from the laptop. Do not skip this step.
For extra protection, enable BitLocker on secondary drives and any external drives you use for sensitive files. If you want open-source encryption for specific files or containers, VeraCrypt is the tool to look at.
- Search Device Encryption in the Start menu. If available, click it and toggle encryption on.
- On Pro/Enterprise: search Manage BitLocker and select Turn on BitLocker for the C: drive.
- Choose how to back up your recovery key: save to a file, print it, or save to a USB. Store it securely, separate from the device.
- Choose whether to encrypt used disk space only (faster for a new drive) or the entire drive (better for a drive already in use).
- Run the BitLocker system check and restart when prompted.
- Optionally enable BitLocker on secondary or external drives via the same Manage BitLocker panel.
How to verify it worked
Open Manage BitLocker or search "Device Encryption" in Settings. The status should read "On" for your system drive. You can also open File Explorer, right-click the C: drive, and look for a padlock icon on the drive.
Gotchas
- BitLocker requires TPM 2.0. Most machines made after 2017 have this, but older hardware may not without registry workarounds to enable software encryption instead.
- Losing the recovery key means permanent, total data loss if Windows ever asks for it (which happens more often than you'd expect, including after firmware updates). Back it up properly.
- Device Encryption on Home editions automatically backs the recovery key to your Microsoft account. If you'd rather that didn't happen, use BitLocker on Pro instead and save the key yourself.
10. Turn Off Shared Experiences and Nearby Sharing
Windows has a cluster of features designed to share activity, files, and even network credentials across devices and contacts. Most people don't use them. Most people don't know they're on.
Go to Settings > Apps > Advanced App Settings > Share Across Devices (this is the Shared Experiences setting) and either turn it off entirely or restrict it to "My devices only." Then go to Settings > System > Nearby Share and set it to "No one" unless you actively use it for file transfers between Windows machines.
In Settings > Network & Internet > Wi-Fi, check for Wi-Fi Sense options. On newer Windows 11 builds these are largely removed, but if you see "Connect to suggested open hotspots" or "Connect to networks shared by my contacts," turn them off. Both features have a history of sharing Wi-Fi credentials more broadly than intended.
Finally, go to Settings > Bluetooth & Devices and turn Bluetooth off when you're not using it. Proximity-based sharing features rely on Bluetooth being discoverable.
- Open Settings > Apps > Advanced App Settings > Share Across Devices. Set to Off or "My devices only."
- Go to Settings > System > Nearby Share and select No one.
- Open Settings > Network & Internet > Wi-Fi and check for Wi-Fi Sense options. Disable "Connect to suggested open hotspots" and "Connect to networks shared by my contacts" if present.
- Go to Settings > Bluetooth & Devices and toggle Bluetooth off when not in use.
- While in Settings > Privacy & Security > General, confirm the advertising ID toggle is still off (you should have done this in tip 4, but it's worth a second look).
How to verify it worked
Go to Settings > System > Nearby Share and confirm it reads "No one." Go to Settings > Apps > Advanced App Settings > Share Across Devices and confirm it's off or restricted to your own devices.
Gotchas
- Wi-Fi Sense is largely deprecated in current Windows 11 builds. If you don't see it, that's fine. It may reappear on older builds.
- Turning off Nearby Share means you can't quickly throw files between two Windows laptops using that feature. It's convenient when you need it, so consider leaving it on "My devices only" rather than "No one" if you use multiple Windows machines.
- Shared Experiences works better with a Microsoft account. If you've already switched to a local account (tip 1), its functionality is already limited.