Script	Scope
`Manage-WindowsTelemetry.ps1`	Windows 11 telemetry / diagnostic-data settings, services and scheduled tasks
`Manage-BrowserPrivacy.ps1`	Privacy / telemetry policies for Edge, Chrome, Firefox and Brave
`Manage-DefenderAntivirus.ps1`	Microsoft Defender Antivirus health, protection settings, scans and updates
`View-WindowsIdentifiers.ps1`	Read-only audit of the machine/user/hardware identifiers Windows exposes

The first three share the same UX: a color-coded status view, interactive per-item toggling, -Report, and CSV export. They are ASCII-only, BOM-free, and run in stock powershell.exe on Windows 11.

Intended audience: this is a privacy-enabling / telemetry-disabling toolkit for advanced users and administrators who understand the tradeoffs. It is not aimed at general users and it deliberately exposes switches that reduce data sharing and switches that reduce security protection. Know what each item does before you flip it.

Important difference in orientation: in the telemetry and browser tools, Disabled = hardened (you turn data collection off). In the Defender tool the polarity is reversed - On/Enabled = protected/recommended, and turning a protection off reduces security. Each tool's status view is labelled accordingly.

Disclaimer - USE AT YOUR OWN RISK. These scripts modify registry values, service startup types and scheduled tasks. They are provided as-is, with no warranty of any kind; you are solely responsible for what they do to your systems. Review the code before running it, test on a non-production machine first, and create a System Restore point (or equivalent backup) before applying changes.

Key risks

Read this before running either script with -DisableAll or the menu D/S commands:

Risk	Detail	Mitigation
Reduced malware/phishing protection	Disabling the `[SEC]` items (Windows SmartScreen, Edge SmartScreen, Chrome/Brave Safe Browsing) removes URL, download and app reputation warnings. Likewise the Defender tool's `-DisableAll` / menu `D` turns off real-time monitoring, cloud protection, network protection and controlled folder access - a direct antivirus downgrade that leaves the machine without Defender coverage.	Browser `[SEC]` items are excluded from bulk disable by default; the Defender bulk disable requires an explicit switch/confirmation. Only disable deliberately, and only if other controls (DNS/proxy/EDR) cover the gap.
Managed / corporate machines	On a domain-joined or Intune/MDM-managed device, these settings may be owned by your organisation. Changing them can conflict with GPO/MDM (which will usually re-apply), break compliance posture, or violate your IT policy.	Only run on machines you own or are authorised to change. Expect GPO/MDM to win any conflict.
MDM / provisioning breakage	Disabling `dmwappushservice` can break provisioning-package installation (`Add-ProvisioningPackage`) and some MDM enrolment flows.	Skip that item (or re-enable it) on devices that will be enrolled.
Lost crash reporting	Disabling Windows Error Reporting stops crash reports to Microsoft, and WER-based local workflows too (e.g. LocalDumps collection for debugging).	Re-enable WER while troubleshooting crashes.
Feature loss	Some features depend on the data flows being disabled: Find My Device, Windows Insider Program (requires Optional diagnostic data), inking/typing personalisation, cross-device Timeline/resume, cloud speech recognition, live search suggestions, Cortana, cross-device clipboard paste, settings sync across devices, location-aware apps (maps/weather/timezone), Windows Copilot and Recall.	Review the per-setting tables below and keep the items you use enabled.
"Managed by your organization" notices	While hardened, Windows Settings and browser settings pages show a managed/policy notice. This is expected policy behaviour, not malware - but it can alarm users and support desks.	`-EnableAll` removes all values written by the tools and clears the notice.
Updates can revert changes	Windows feature updates, cumulative updates and browser updates can re-enable items or re-create scheduled tasks.	Re-run `-Report` after major updates; re-apply as needed.
Upgrade readiness data	Disabling the Compatibility Appraiser stops the inventory Microsoft uses to assess upgrade compatibility for your device.	Low impact for most; re-enable before a major feature upgrade if you want Microsoft's compatibility safeguards.
Partial effect on Home/Pro	`AllowTelemetry=0` is only fully honoured on Enterprise/Education SKUs; Home/Pro still send Required diagnostic data.	Understand "hardened" is not "zero data" on consumer SKUs.

If any of these matter for your environment and you are unsure: run -Report (read-only) first, and change items one at a time instead of using the bulk commands.

1. Manage-WindowsTelemetry.ps1

Views and controls Windows 11 telemetry / diagnostic-data settings, services and scheduled tasks from one place.

Quick start

# View status only (read-only, safe anywhere)
.\Manage-WindowsTelemetry.ps1 -Report

# Interactive menu (run from an ELEVATED PowerShell to change HKLM/services/tasks)
.\Manage-WindowsTelemetry.ps1

# USER MODE - per-user (HKCU) items only, NO admin needed. Run as yourself.
.\Manage-WindowsTelemetry.ps1 -UserMode
.\Manage-WindowsTelemetry.ps1 -UserMode -DisableAll   # harden your profile
.\Manage-WindowsTelemetry.ps1 -UserMode -Report

# One-shot hardening: turn all telemetry OFF (keeps [SEC] SmartScreen ON)
.\Manage-WindowsTelemetry.ps1 -DisableAll

# ... also disable the SmartScreen reputation checks (see [SEC] note below)
.\Manage-WindowsTelemetry.ps1 -DisableAll -IncludeSecurity

# GO DARK - maximum privacy: everything incl [SEC] security + [NET] callbacks
.\Manage-WindowsTelemetry.ps1 -GoDark

# Restore Windows default behaviour: turn everything back ON
.\Manage-WindowsTelemetry.ps1 -EnableAll

# Export current status to CSV (exits after export)
.\Manage-WindowsTelemetry.ps1 -Csv .\telemetry-status.csv

# Report to screen AND CSV
.\Manage-WindowsTelemetry.ps1 -Report -Csv .\telemetry-status.csv

If script execution is blocked on your machine:

powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\Manage-WindowsTelemetry.ps1 -Report

Semantics

Term	Meaning
Enabled (yellow)	The telemetry / data-collection behaviour is ON
Enabled (default)	No override present; Windows out-of-box behaviour (ON)
Disabled (green)	The behaviour is OFF / hardened
Not present (gray)	Service or task does not exist on this system
`*` suffix	Requires Administrator to change (run elevated)

Two design rules worth knowing:

"Enable" restores the true Windows default. For policy-style registry values (where the Windows default is no value at all), enabling removes the policy value instead of writing one. This avoids leaving the machine in a "Some settings are managed by your organization" state after an enable/disable round trip.
Services are restored to their real default start types (DiagTrack = Automatic, dmwappushservice / WerSvc = Manual), not blanket Automatic.

User mode (`-UserMode`) - recommended for personal use

For personal privacy/telemetry hardening, run user mode as your normal (unelevated) account:

.\Manage-WindowsTelemetry.ps1 -UserMode

User mode shows only the per-user (HKCU) items - Advertising ID, tailored experiences, inking/typing, feedback frequency, search suggestions, Suggestions/Ads, Windows Copilot, and the Store-apps SmartScreen check. All of these change your account only and need no administrator rights.

Why it's the safer choice for a single-user machine:

No elevation, no hive mix-up. System-wide (HKLM) items require admin, and the usual way to get admin is to elevate. But if you elevate using a different admin account, HKCU inside that elevated session points at the admin's profile - so per-user toggles silently apply to the wrong user. Running user mode unelevated as yourself writes your own hive, every time.
Nothing you can't set from the Settings app - it's the same per-user switches, just scripted and repeatable.

The header shows MODE: USER or MODE: FULL. In the interactive menu press m to switch between them at any time; -DisableAll / -EnableAll / -Report / -Csv all respect the mode. To also harden system-wide items (diagnostic data, DiagTrack, scheduled tasks, etc.), run without -UserMode from an elevated PowerShell.

Command	Action
`<n>`	Toggle item n (Enabled <-> Disabled)
`e <n>` / `d <n>`	Enable / disable item n
`E` / `D` (uppercase)	Enable / disable ALL shown items (asks for `YES` confirmation; `D` keeps `[SEC]` items ON)
`S`	Disable the `[SEC]` SmartScreen/Defender-cloud features (requires typing `DISABLE-SECURITY`)
`G`	GO DARK - disable everything incl `[SEC]` + `[NET]` (requires typing `GO-DARK`)
`X`	Close `[CRIT]` items (Windows Update / Time) one-by-one, each with a `CLOSE` confirm
`m`	Toggle between USER mode (per-user only) and FULL mode (all items)

Go dark (`-GoDark` / menu `G`) - maximum privacy

Ordinary -DisableAll deliberately leaves two classes of item on, because turning them off has real costs:

[SEC] - anti-malware reputation checks: Windows SmartScreen (apps/files, Store, phishing) and Defender cloud (MAPS + sample submission). Off = no malicious-URL/app warnings and weaker AV.
[NET] - ambient Microsoft callbacks: NCSI connectivity probe, root-cert auto-update, Store app auto-update, font streaming, Media DRM online. Off can break captive-portal detection, new-CA trust, app updates and some fonts/DRM.

Go dark disables all of it - all telemetry plus every [SEC] and [NET] item - for the smallest practical Microsoft footprint. It requires an explicit switch/confirmation (GO-DARK) and is fully reversible with -EnableAll (menu E).

`[CRIT]` - the last-mile connections (confirm-close only)

Even go-dark won't touch these, because disabling them breaks core function. They exist as local-config stand-ins for what a hardened environment does properly (WSUS, a local NTP server, network isolation). Each is never bulk-disabled - not by -DisableAll and not by -GoDark - and can only be closed individually, with a per-item CLOSE confirmation:

`[CRIT]` item	Key/service	Cost of closing	Proper alternative
Windows Update Auto	`...\WindowsUpdate\AU\NoAutoUpdate=1`	No automatic security patching	WSUS / managed updates
Windows Time Sync	`W32Time` service disabled	Clock drift breaks Kerberos/TLS	Internal NTP time server

Close them from the menu with X (walks each with a confirm) or by toggling the item's number (a [CRIT] disable always prompts CLOSE). Reverse with -EnableAll / menu E, which restores auto-update and sets W32Time back to its default (Manual) start.

Activation and certificate revocation (OCSP/CRL) are not included: there is no clean single-key local toggle for them (disabling activation de-activates Windows; blanket revocation-off is dangerous and messy). In a locked-down build those are handled by network isolation / firewall, which is the right layer for them - a point you already make with WSUS + isolation + a time server.

Some [SEC] Defender items may be blocked by Tamper Protection (they'll report a failure rather than silently not applying) - turn it off in Windows Security first if you truly need them off. For the network callbacks that a registry setting cannot stop, pair go-dark with host-firewall rules. | r | Refresh the view | | c <path> | Export status to CSV | | q | Quit |

The menu is case-sensitive where it matters: a bare lowercase d/e will not trigger the ALL branches.

`[SEC]` items: Windows SmartScreen

Three controls check apps, files and URLs against Microsoft's cloud reputation service: SmartScreen for apps and files (shell), SmartScreen for Store apps, and Enhanced Phishing Protection. They are marked [SEC] because disabling them reduces protection against malware and phishing. The same guard rails as the browser tool apply: -DisableAll and menu D leave them ON; disabling requires -IncludeSecurity, the menu S command, or an individual item toggle. A red WARNING line appears in the status view whenever any [SEC] item is OFF.

What is covered

Registry settings reference

All values are REG_DWORD. "Hardened" is the value the tool writes when you disable an item. "Default" is Windows out-of-box behaviour: for most policy values that means the value is absent - which is why enabling an item usually removes the value rather than writing one.

Core telemetry

Key: HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection

Value	Hardened	Explanation
`AllowTelemetry`	`0`	The master diagnostic-data level sent by the DiagTrack service. `0` = Security (honoured only on Enterprise/Education), `1` = Required, `3` = Optional (full). Default: absent = user's Settings choice applies.
`DoNotShowFeedbackNotifications`	`1`	Stops Windows asking for feedback via notifications ("How is your experience?"). Collection-adjacent rather than collection itself.
`LimitDiagnosticLogCollection`	`1`	Blocks the upload of additional diagnostic logs Microsoft can request on top of the normal telemetry stream.
`DisableOneSettingsDownloads`	`1`	Stops Windows fetching remote telemetry configuration ("OneSettings"). With this off, Microsoft cannot remotely adjust what diagnostic data is sampled.

Key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection

Value	Hardened	Explanation
`AllowTelemetry`	`0`	Older, non-Group-Policy location for the same setting; some components read this path, so the tool sets both.

Application compatibility (appraiser)

Key: HKLM\SOFTWARE\Policies\Microsoft\Windows\AppCompat

Value	Hardened	Explanation
`AITEnable`	`0`	Application Impact Telemetry: usage/launch data about installed programs, gathered by the Compatibility Appraiser and sent to Microsoft to assess upgrade compatibility.
`DisableInventory`	`1`	Stops the Inventory Collector uploading a list of installed applications, devices and drivers.

Windows Error Reporting (successor to Dr. Watson)

Key / Value	Hardened	Explanation
`HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting` -> `Disabled`	`1`	Turns off crash/hang report generation and submission machine-wide (non-policy location, same one the old `serverweroptin` flow used).
`HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting` -> `Disabled`	`1`	Group Policy variant of the same switch; wins over the non-policy flag if both are set.
`...Policies...\Windows Error Reporting` -> `DontSendAdditionalData`	`1`	Blocks the second stage of WER: after the initial crash signature, Microsoft can request extra payloads (memory dumps, files). This stops those.
`HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Consent` -> `DefaultConsent`	`1`	How much WER may send without asking: `1` = always ask first, `2` = send parameters only, `3` = parameters + safe data, `4` = send everything automatically. Hardened = always ask.

Customer Experience Improvement Program

Key: HKLM\SOFTWARE\Microsoft\SQMClient\Windows

Value	Hardened	Explanation
`CEIPEnable`	`0`	Opts the machine out of CEIP/SQM ("Software Quality Metrics") - anonymous usage statistics collected by older Windows components and the CEIP scheduled tasks.

Cloud content and suggestions

Key: HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent

Value	Hardened	Explanation
`DisableWindowsConsumerFeatures`	`1`	Stops "consumer experiences": auto-installed sponsored/suggested Store apps, promotional tiles and app suggestions in Start.
`DisableTailoredExperiencesWithDiagnosticData`	`1`	Stops Microsoft using your diagnostic data to personalise tips, ads and recommendations shown inside Windows.

Activity history (Timeline)

Key: HKLM\SOFTWARE\Policies\Microsoft\Windows\System

Value	Hardened	Explanation
`PublishUserActivities`	`0`	Stops apps recording "activities" (documents opened, sites visited) into the local activity feed.
`UploadUserActivities`	`0`	Stops the activity feed being synced to the Microsoft cloud (cross-device timeline/resume).

Per-user privacy (HKCU - changeable without admin)

Key / Value	Hardened	Explanation
`HKCU\...\CurrentVersion\AdvertisingInfo` -> `Enabled`	`0`	Disables the per-user Advertising ID that apps use to correlate you across apps for ad targeting.
`HKCU\...\CurrentVersion\Privacy` -> `TailoredExperiencesWithDiagnosticDataEnabled`	`0`	User-level counterpart of Tailored Experiences: no diagnostic-data-driven tips/ads for this account.
`HKCU\SOFTWARE\Microsoft\Siuf\Rules` -> `NumberOfSIUFInPeriod`	`0`	Feedback frequency ("System Initiated User Feedback"). `0` = Windows never asks for feedback. Default: absent = automatic.
`HKCU\SOFTWARE\Microsoft\InputPersonalization` -> `RestrictImplicitInkCollection`	`1`	Blocks collection of handwriting/ink samples used to build your personal dictionary.
`HKCU\SOFTWARE\Microsoft\InputPersonalization` -> `RestrictImplicitTextCollection`	`1`	Same for typed text - stops typing history feeding personalization.
`HKCU\SOFTWARE\Microsoft\Input\TIPC` -> `Enabled`	`0`	The "Improve inking and typing" telemetry channel - samples of what you type/ink sent as diagnostic data.
`HKCU\...\Speech_OneCore\Settings\OnlineSpeechPrivacy` -> `HasAccepted`	`0`	Consent flag for cloud (online) speech recognition; `0` = voice audio is not sent to Microsoft speech services. Default is off until a user consents.
`HKLM\SOFTWARE\Policies\Microsoft\Windows\TextInput` -> `AllowLinguisticDataCollection`	`0`	Machine-wide policy blocking typing/inking samples (the policy behind TIPC). Requires admin, listed here as it belongs to the same feature.
`HKCU\SOFTWARE\Policies\Microsoft\Windows\Explorer` -> `DisableSearchBoxSuggestions`	`1`	Removes Bing web search/suggestions from the Start menu and taskbar Search on Windows 11 - queries stay local.
`HKCU\...\CurrentVersion\Search` -> `BingSearchEnabled`	`0`	The Windows 10-era equivalent of the above; largely ignored by Windows 11 but kept for completeness.

Search / Cortana cloud

Key: HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search

Value	Hardened	Explanation
`AllowCortana`	`0`	Disables Cortana, which sends voice/text queries and context to Microsoft.
`ConnectedSearchUseWeb`	`0`	Stops Start/Search sending typed queries to Bing for web results.
`AllowCloudSearch`	`0`	Disables searching your OneDrive/Outlook/SharePoint content from the local search box (each query hits Microsoft cloud).
`AllowSearchToUseLocation`	`0`	Stops the search/Cortana stack using your device location.

Cloud sync (clipboard / settings)

Keys: HKLM\SOFTWARE\Policies\Microsoft\Windows\System and ...\SettingSync

Value	Hardened	Explanation
`AllowClipboardHistory`	`0`	Disables local clipboard history (Win+V). Local only, but a data-retention surface.
`AllowCrossDeviceClipboard`	`0`	Disables syncing clipboard contents to the Microsoft cloud for cross-device paste - potentially very sensitive data.
`DisableSettingSync` (SettingSync key)	`2`	Stops Windows settings/credentials/preferences syncing across devices via your Microsoft account.

Suggestions / ads (Content Delivery Manager - per-user, HKCU)

Key: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager

Value	Hardened	Explanation
`SilentInstalledAppsEnabled`	`0`	Stops Windows silently installing sponsored/suggested apps.
`SystemPaneSuggestionsEnabled`	`0`	Removes app/content suggestions in the Start menu.
`SubscribedContent-338393Enabled`	`0`	Removes suggested content in the Settings app.
`SubscribedContent-338389Enabled`	`0`	Disables Windows tips/suggestion notifications.
`RotatingLockScreenOverlayEnabled`	`0`	Disables Spotlight ads/"fun facts" overlaid on the lock screen.

Location

Key: HKLM\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors

Value	Hardened	Explanation
`DisableLocation`	`1`	Turns off the system-wide location platform for all apps and services.

Find My Device

Key: HKLM\SOFTWARE\Policies\Microsoft\FindMyDevice

Value	Hardened	Explanation
`AllowFindMyDevice`	`0`	Stops Windows periodically reporting device location to your Microsoft account.

AI features (Copilot / Recall)

Key / Value	Hardened	Explanation
`HKCU\SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot` -> `TurnOffWindowsCopilot`	`1`	Disables the Windows Copilot assistant (prompts and context leave the device to Microsoft/OpenAI services).
`HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsAI` -> `DisableAIDataAnalysis`	`1`	Disables Recall screen-snapshot capture and analysis. Local-first, but a large capture surface; only present on Copilot+ PCs (24H2+).

Network

Key: HKLM\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization

Value	Hardened	Explanation
`DODownloadMode`	`0`	Delivery Optimization peer sharing: `0` = HTTP only (no peers), `1` = LAN peers, `3` = internet peers. Hardened = your PC neither pulls from nor advertises update chunks to other machines.

Windows SmartScreen `[SEC]` - reputation checks

Key / Value	Hardened	Explanation
`HKLM\SOFTWARE\Policies\Microsoft\Windows\System` -> `EnableSmartScreen`	`0`	The shell "Check apps and files" feature: hashes/metadata of downloaded executables are checked against Microsoft's reputation service before they run.
`HKCU\...\CurrentVersion\AppHost` -> `EnableWebContentEvaluation`	`0`	SmartScreen URL checking for web content loaded inside Microsoft Store apps.
`HKLM\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components` -> `ServiceEnabled`	`0`	Enhanced Phishing Protection (Windows 11): warns when you type your Windows password into a suspicious site or store it insecurely.

Services

Service	Default start	Note
`DiagTrack` (Connected User Experiences and Telemetry)	Automatic	Primary telemetry service
`dmwappushservice`	Manual	Disabling can break provisioning-package / MDM enrolment
`WerSvc` (Windows Error Reporting)	Manual	Runs WER report submission

Scheduled tasks

Application Experience: Compatibility Appraiser, ProgramDataUpdater, StartupAppTask
CEIP: Consolidator, UsbCeip, Autochk\Proxy (kernel CEIP)
Feedback (SIUF): DmClient, DmClientOnScenarioDownload
Windows Error Reporting: QueueReporting
DiskDiagnostic: DiskDiagnosticDataCollector

Known limitations

Home/Pro diagnostic-data floor: AllowTelemetry = 0 (Security) is only fully honoured on Enterprise/Education/IoT SKUs. On Home/Pro, Windows treats 0 as 1 (Required), so a small baseline of required diagnostic data may still flow even when everything here shows Disabled.
Some items are refreshed by Windows Update or feature updates; re-run -Report after major updates to verify state.
BingSearchEnabled is a Windows 10-era value kept for completeness; the effective Windows 11 control is DisableSearchBoxSuggestions (also included).
Changing WER/crash-reporting settings affects local crash-dump collection behaviour, which you may want during debugging.

CSV output columns

Name, Category, Type (Reg/Service/Task), State, AdminReq, Note

2. Manage-BrowserPrivacy.ps1

Views and hardens privacy / telemetry-related policy settings for the browsers installed on the machine. Browsers are auto-detected (via App Paths registration); only installed ones are shown unless you pass -IncludeAll.

Quick start

# View status only (read-only)
.\Manage-BrowserPrivacy.ps1 -Report

# Interactive menu (ELEVATED PowerShell required to change anything)
.\Manage-BrowserPrivacy.ps1

# One-shot: harden every detected browser
.\Manage-BrowserPrivacy.ps1 -DisableAll

# Restore all browser defaults (removes the policy values)
.\Manage-BrowserPrivacy.ps1 -EnableAll

# Export status to CSV / include browsers that are not installed
.\Manage-BrowserPrivacy.ps1 -Csv .\browser-status.csv
.\Manage-BrowserPrivacy.ps1 -Report -IncludeAll

# Harden everything AND turn off the malicious-URL checks (see warning below)
.\Manage-BrowserPrivacy.ps1 -DisableAll -IncludeSecurity

The menu supports the same commands as the Windows tool, plus b <browser> to harden a single browser, B <browser> to restore a single browser's defaults (e.g. b Edge / B Edge), and S to disable the malicious-URL checks (see below).

Safe Browsing / SmartScreen (URL reputation) - read this

Some controls check the domain / IP / URL you visit against a cloud reputation service (Microsoft SmartScreen for Edge, Google Safe Browsing for Chrome/Brave). These are security features - they warn you off phishing and malware sites - but they work by sending URL/host data off the machine, so they are also a privacy consideration. They are marked [SEC] in the status view.

Because turning them off reduces protection, they are handled separately:

-DisableAll and the menu D command leave [SEC] items ON. Bulk hardening will not silently disable your malware protection.
To disable them you must be explicit:
- CLI: -DisableAll -IncludeSecurity
- Menu: the dedicated S command (requires typing DISABLE-SECURITY to confirm)
- Or toggle the individual numbered item (that is always a deliberate act)
The status view prints a red WARNING line whenever any [SEC] feature is currently OFF, so a hardened-too-far machine is obvious at a glance.

[SEC] controls covered: Edge SmartScreen (site/URL check, PUA blocking, DNS reputation lookups, typosquatting checker); Chrome & Brave Safe Browsing protection level (0 = off, disables URL reputation checks entirely).

Recommendation: leave these ON unless you have a specific reason (e.g. you route all traffic through a separate filtering DNS/proxy that already does this). They are the browser's main defence against phishing and drive-by malware.

How it works

All controls are policy DWORD values under HKLM\SOFTWARE\Policies\... (the official enterprise policy locations each vendor documents). Because a browser's true default is no policy value at all, Enable always removes the value rather than writing one - so an enable/disable round trip leaves no permanent "managed" residue.

Two things to expect:

Policies apply on the next browser start - restart the browser after changes.
While hardened, browsers display a "Managed by your organization" notice on their settings pages. That is Chromium/Firefox correctly reporting that policies are active, not a malfunction; -EnableAll removes it again.

Registry settings reference

All values are REG_DWORD policies. "Hardened" is what the tool writes when you disable an item; enabling always removes the value (browser default = absent). Browsers pick up changes on next start.

Microsoft Edge

Key: HKLM\SOFTWARE\Policies\Microsoft\Edge

Value	Hardened	Explanation
`DiagnosticData`	`0`	Edge's own usage/crash telemetry level: `0` = off, `1` = required, `2` = optional (full). Separate from the Windows AllowTelemetry setting.
`PersonalizationReportingEnabled`	`0`	Stops Edge sending browsing history to Microsoft to personalise ads, news, search and shopping.
`UserFeedbackAllowed`	`0`	Removes the Send Feedback feature and its data uploads (screenshots, diagnostics attached to feedback).
`SearchSuggestEnabled`	`0`	Stops the address bar sending every keystroke to the search provider for live suggestions. Typed text stays local until you press Enter.
`AddressBarMicrosoftSearchInBingProviderEnabled`	`0`	Stops address-bar queries being sent to Microsoft Search in Bing (work/school results).
`EdgeShoppingAssistantEnabled`	`0`	Disables the shopping assistant (coupons, price comparison, cashback), which shares the pages you shop on with Microsoft.
`ShowMicrosoftRewards`	`0`	Hides Microsoft Rewards, which tracks Bing searches/purchases for points.
`WebWidgetAllowed`	`0`	Disables the Edge search bar widget (a persistent background process with web access).
`SpotlightExperiencesAndRecommendationsEnabled`	`0`	Disables Spotlight tips/recommendations delivered from Microsoft services.
`ConfigureDoNotTrack`	`1`	Hardened = Edge sends the "Do Not Track" (DNT) request header with all traffic. (Advisory only - sites may ignore it.)
`ResolveNavigationErrorsUseWebService`	`0`	Stops Edge using a Microsoft web service to diagnose connection problems (which reports the failing address).
`AlternateErrorPagesEnabled`	`0`	Stops Edge sending details of not-found/error pages to Microsoft to fetch suggestion pages.
`NetworkPredictionOptions`	`2`	Disables DNS prefetching / preconnecting to links the browser predicts you may visit (`0` = predict always, `2` = never). Prediction leaks hostnames you never actually clicked.
`SmartScreenEnabled` `[SEC]`	`0`	Microsoft Defender SmartScreen: checks visited sites and downloads against Microsoft's reputation service. Disabling removes phishing/malware warnings.
`SmartScreenPuaEnabled` `[SEC]`	`0`	SmartScreen blocking of potentially unwanted applications (PUA) in downloads.
`SmartScreenDnsRequestsEnabled` `[SEC]`	`0`	Stops the DNS requests SmartScreen makes for site reputation lookups.
`TyposquattingCheckerEnabled` `[SEC]`	`0`	Disables warnings when you mistype a domain and land on a lookalike (typosquatted) site.

Google Chrome

Key: HKLM\SOFTWARE\Policies\Google\Chrome

Value	Hardened	Explanation
`MetricsReportingEnabled`	`0`	UMA metrics: anonymised usage statistics and crash reports sent to Google.
`SearchSuggestEnabled`	`0`	Stops the omnibox sending keystrokes to the search provider for live suggestions.
`SafeBrowsingExtendedReportingEnabled`	`0`	Stops the extra Safe Browsing reports (page contents, system info) sent to Google. Safe Browsing protection itself stays on.
`SafeBrowsingProtectionLevel` `[SEC]`	`0`	The Safe Browsing URL check itself: `0` = off (no URL reputation checks at all), `1` = standard, `2` = enhanced (more data to Google, more protection).
`UrlKeyedAnonymizedDataCollectionEnabled`	`0`	Stops URL-keyed data collection - the URLs of pages you visit sent to Google to improve services.
`SpellCheckServiceEnabled`	`0`	Disables the cloud spell checker, which sends typed text to Google. Local spell check keeps working.
`AlternateErrorPagesEnabled`	`0`	Stops error-page details being sent to Google for "did you mean" suggestions.
`NetworkPredictionOptions`	`2`	Same as Edge: disables predictive DNS prefetch/preconnect (`0` = always, `2` = never).
`FeedbackSurveysEnabled`	`0`	Disables Google's in-browser Happiness Tracking Surveys.
`PrivacySandboxPromptEnabled`	`0`	Suppresses the Privacy Sandbox consent prompt; required for the three policies below to take effect.
`PrivacySandboxAdTopicsEnabled`	`0`	Disables the Topics API - Chrome deriving advertising interest categories from your browsing history.
`PrivacySandboxSiteEnabledAdsEnabled`	`0`	Disables site-suggested ads (Protected Audience / remarketing without third-party cookies).
`PrivacySandboxAdMeasurementEnabled`	`0`	Disables the Attribution Reporting API (ad click/conversion measurement).

Mozilla Firefox

Key: HKLM\SOFTWARE\Policies\Mozilla\Firefox

Firefox policies are inverted ("Disable..."), so hardened = 1.

Value	Hardened	Explanation
`DisableTelemetry`	`1`	Stops Firefox usage, performance and technical telemetry to Mozilla.
`DisableFirefoxStudies`	`1`	Stops Shield/Nimbus studies - remote experiments and preference rollouts Mozilla can push to your browser.
`DisableDefaultBrowserAgent`	`1`	Removes the Default Browser Agent - a scheduled task that pings Mozilla daily with default-browser and OS info, even when Firefox is closed.
`DisablePocket`	`1`	Disables Pocket integration and its sponsored/recommended stories on the new-tab page.

Note: Firefox's Safe Browsing cannot be toggled from the registry (it lives in browser.safebrowsing.* preferences / policies.json), so it is deliberately not included here.

Brave

Key: HKLM\SOFTWARE\Policies\BraveSoftware\Brave

Brave sends comparatively little telemetry by default; these harden its bundled feature surface, each of which contacts Brave services.

Value	Hardened	Explanation
`BraveRewardsDisabled`	`1`	Disables Brave Rewards (BAT ads/attention tracking).
`BraveWalletDisabled`	`1`	Disables the built-in crypto wallet.
`BraveVPNDisabled`	`1`	Disables the Brave VPN feature and its account checks.
`TorDisabled`	`1`	Disables "Private window with Tor". (Feature-surface reduction; Tor itself is a privacy feature - leave enabled if you use it.)
`SearchSuggestEnabled`	`0`	Chromium policy honoured by Brave: stops keystroke-by-keystroke search suggestions.
`SafeBrowsingProtectionLevel` `[SEC]`	`0`	Same as Chrome: `0` disables URL reputation checks entirely.

General notes

Under -DisableAll, Safe Browsing / SmartScreen ([SEC]) stay ON; full URL-check disabling requires -IncludeSecurity or the menu S command.
DNS-over-HTTPS policies are intentionally not touched - DoH is a privacy gain in most settings and is better configured deliberately per network.

CSV output columns

Name, Browser, Installed, Policy, State, Note ([SEC] items are named as such in the Name column).

3. Manage-DefenderAntivirus.ps1

Views the health of Microsoft Defender Antivirus and lets you view/toggle its protection settings, plus run common actions (update signatures, quick/full scan, view threats and exclusions).

Unlike the other two tools this is a security tool, so the polarity is reversed: On = protected (good, green), Off = reduced protection (red). It uses the built-in Defender PowerShell module (Get-MpComputerStatus, Get-MpPreference, Set-MpPreference, Update-MpSignature, Start-MpScan)

not the registry, because Tamper Protection and policy layering make direct registry edits to Defender unreliable.

Quick start

# View health + protection status (read-only, works as standard user)
.\Manage-DefenderAntivirus.ps1 -Report

# Interactive menu (run ELEVATED to change settings, scan or update)
.\Manage-DefenderAntivirus.ps1

# Set every protection to its recommended (ON) state
.\Manage-DefenderAntivirus.ps1 -EnableRecommended

# Turn ALL protections OFF (reduces security; also stops Defender cloud
# lookups and sample submission to Microsoft)
.\Manage-DefenderAntivirus.ps1 -DisableAll

# Update signatures / run a scan and exit
.\Manage-DefenderAntivirus.ps1 -Update
.\Manage-DefenderAntivirus.ps1 -QuickScan
.\Manage-DefenderAntivirus.ps1 -FullScan

# Export health + config to CSV
.\Manage-DefenderAntivirus.ps1 -Csv .\defender-status.csv

Tamper Protection

On Windows 11, Tamper Protection is on by default and deliberately blocks programmatic changes to core protection (real-time monitoring, etc.). When it is on, Set-MpPreference calls for those items will fail - the tool detects this, shows a NOTE, and reports the failure clearly rather than pretending the change succeeded. To change guarded items you must first turn Tamper Protection off in the Windows Security app (Virus & threat protection -> Manage settings) or via Intune. The tool intentionally cannot disable Tamper Protection for you - that is by design.

Health summary (read-only)

From Get-MpComputerStatus: running mode (Normal / Passive / EDR Block - passive means another AV is primary and Defender settings are inactive), AntiMalware service, real-time protection, behaviour monitor, on-access (IOAV), network inspection (NIS), Tamper Protection state, signature version and age in days (green <=2, yellow <=7, red older), engine version, and last quick/full scan times.

Configurable protections

Each maps to one Set-MpPreference parameter. "Recommended" is always On.

Protection	Preference	Recommended	Explanation
Real-time Monitoring	`DisableRealtimeMonitoring`	On (`$false`)	Core on-access scanning. Guarded by Tamper Protection.
Behavior Monitoring	`DisableBehaviorMonitoring`	On (`$false`)	Detects malicious behaviour patterns at runtime.
Downloads/Attachment Scan	`DisableIOAVProtection`	On (`$false`)	Scans files downloaded from internet/email.
Script Scanning	`DisableScriptScanning`	On (`$false`)	Scans scripts before they execute.
Archive Scanning	`DisableArchiveScanning`	On (`$false`)	Scans inside .zip/.rar/etc.
Email Scanning	`DisableEmailScanning`	On (`$false`)	Parses mailbox/email files during scans.
Removable Drive Scanning	`DisableRemovableDriveScanning`	On (`$false`)	Includes USB media in full scans.
Cloud-delivered Protection	`MAPSReporting`	Advanced (`2`)	Real-time cloud lookups (`0` off, `1` basic, `2` advanced).
Automatic Sample Submission `[PRIV]`	`SubmitSamplesConsent`	SendSafeSamples (`1`)	Needed for full cloud protection; sends files to Microsoft. `2` = Never (privacy).
Cloud Block Level	`CloudBlockLevel`	High (`2`)	Aggressiveness of cloud blocking; higher = safer but more false positives.
PUA Protection	`PUAProtection`	Enabled (`1`)	Blocks potentially unwanted apps (adware/bundleware); `2` = audit.
Network Protection	`EnableNetworkProtection`	Enabled (`1`)	Blocks connections to malicious domains/IPs; `2` = audit.
Controlled Folder Access	`EnableControlledFolderAccess`	Enabled (`1`)	Anti-ransomware; blocks untrusted apps writing to protected folders. May need app allow-listing.

[PRIV] marks the one setting that improves protection but also sends data to Microsoft, so you can make an informed choice. Audit mode (for PUA / Network Protection / Controlled Folder Access) shows as Other (AuditMode) - it logs but does not block, useful for testing before enforcing.

Command	Action
`<n>`	Toggle protection n (disabling asks for `YES` confirmation)
`e <n>` / `d <n>`	Enable / disable item n (`d` warns and confirms)
`E`	Enable all recommended protections
`D`	Disable all protections (requires typing `DISABLE-ALL`)
`u`	Update signatures (`Update-MpSignature`)
`s` / `f`	Run quick / full scan (`Start-MpScan`)
`t`	Show recent threat detections
`x`	Show configured exclusions (paths/extensions/processes)
`r` / `c <path>` / `q`	Refresh / export CSV / quit

Bulk disable

This is a privacy/telemetry-hardening toolkit for advanced users, so a bulk disable is provided to match the other scripts:

CLI: -DisableAll runs immediately (scriptable), then reprints status.
Menu: D requires typing DISABLE-ALL to confirm.

Disabling here doubles as privacy hardening: it sets MAPSReporting to Disabled and SubmitSamplesConsent to Never, which stops Defender's cloud lookups and file/sample uploads to Microsoft. Note that with Tamper Protection on, core items (real-time monitoring, etc.) stay ON regardless - turn Tamper Protection off in the Windows Security app first if you need those off too. Individual protections can still be re-enabled with e <n> or restored wholesale with E / -EnableRecommended.

Requirements and caveats

Needs the built-in Defender module; the tool exits cleanly if the cmdlets are absent (e.g. Defender removed, or a Server SKU without the feature).
Viewing works as a standard user; changing settings, scanning and updating require Administrator.
If a third-party AV is installed, Defender runs in passive mode and most of these settings will not take effect until Defender is primary again. The running-mode line makes this visible.
Exclusions are shown (x) but not edited here - review them, as each exclusion is a gap in coverage that malware can hide behind.

CSV output columns

Group (Health/Protection), Name, State, Note

4. View-WindowsIdentifiers.ps1

A read-only privacy audit that enumerates the unique identifiers Windows, your account and the hardware expose about this machine - the values that can fingerprint or correlate the device. It changes nothing; it only reports.

Quick start

# Masked report with inline explanations (default; safe to screenshot/share)
.\View-WindowsIdentifiers.ps1

# Compact list, no explanations
.\View-WindowsIdentifiers.ps1 -Brief

# Full values - e.g. to back up your own product key (CONFIDENTIAL output)
.\View-WindowsIdentifiers.ps1 -Reveal

# Also extract the DEVICE account PUID (needs admin; runs a one-shot SYSTEM task)
.\View-WindowsIdentifiers.ps1 -ExtractDeviceId -Reveal

# Export (respects masking unless -Reveal is also passed)
.\View-WindowsIdentifiers.ps1 -Csv .\ids.csv
.\View-WindowsIdentifiers.ps1 -Reveal -Json .\ids.json

Inline explanations

Every identifier is explained inline by default - what it is, how unique and stable it is, and why it matters for privacy (e.g. that MachineGuid is a per-install cross-service correlator, or that hardware serials survive an OS reinstall). Pass -Brief for a compact list without the explanations. The CSV/JSON export includes an Explanation column regardless.

Masking

Because the output includes sensitive data, sensitive values are masked by default (MODE: MASKED) - the report is safe to share. Pass -Reveal to print full values (MODE: REVEAL, shown in red); the CSV/JSON export mirrors whichever mode you ran. Sensitive rows are marked with !. Product keys keep their first and last group (AAAAA-XXXXX-XXXXX-XXXXX-EEEEE); other IDs keep their first few characters.

What it reports

Category	Identifiers
Machine	Computer name, `MachineGuid` (Cryptography), Windows Product ID, Build GUID, install date, SMBIOS UUID, system IdentifyingNumber
Activation	Windows edition, license status/channel/description, partial product key, OEM firmware key (OA3), decoded installed product key (from `DigitalProductId`), and a consolidated Full product key (best available source, or the reason none exists)
Telemetry	SQM Machine ID, SQM User ID, DiagTrack Client ID
User	User name, user SID, Advertising ID + enabled flag, Microsoft account PUID / CID (the "Passport Unique Identifier"; read from the signed-in account, if any)
Device	Entra/Azure AD Device ID and join state (`dsregcmd /status`), Entra tenant ID, the wlidsvc device-registration note, and (with `-ExtractDeviceId`) the device account PUID/CID read from the SYSTEM hive
Hardware	BIOS serial, baseboard serial, CPU ProcessorId, per-disk serials, TPM presence/manufacturer, and the TPM EKpub (Endorsement Key public part + hash)
Network	Per-adapter MAC addresses (physical adapters)

Notes:

Product ID vs PUID. The Windows Product ID is a licensing/install identifier derived from the product key - it is not the PUID. The PUID (Passport Unique Identifier) is a permanent Microsoft account identifier from the legacy Microsoft Passport system (later Windows Live ID, now Microsoft account). Its native form is hexadecimal - the .NET Passport API exposed it as PassportIdentity.HexPUID (a hex string). On modern Windows that hex value is the signed-in account's CID (16 hex digits, also seen in OneDrive URLs); the tool reports the hex form and a derived decimal (~18 digits) under User, or (no Microsoft account signed in) on a local account.
Device identity vs account identity. Separately from your account PUID, Windows registers the device with Microsoft. On first internet connection the wlidsvc (Windows Live ID) service logs the device in using its hardware identity (disk serial, SMBIOS UUID, TPM) and receives a device PUID/GDID and device token. This is also why the hardware serials the registration is built from are enumerated under Hardware.
Extracting the device PUID (-ExtractDeviceId, admin). The device MSA identity is registered under the SYSTEM account (S-1-5-18), so it is not visible in a normal admin's HKCU. With -ExtractDeviceId the tool runs a one-shot scheduled task as SYSTEM that searches SYSTEM's IdentityCRL (recursively) and the IdentityStore\Cache\S-1-5-18 for any cid value, returns the device CID (hex) / PUID (decimal) via a temp file, then removes the task. It reads only the identity store (no changes) and does not extract the device token (that DPAPI-protected credential is deliberately left alone). Without this switch, the readable device ID shown is the Entra/Azure AD Device ID (via dsregcmd /status) plus join state.
Read-only. No registry, service or setting is modified (dsregcmd /status is read-only; no external network calls are made).
Admin-gated values: the OEM firmware key (OA3xOriginalProductKey), TPM WMI data, and the TPM EKpub (Get-TpmEndorsementKeyInfo) need Administrator; without it they show (needs admin). Run elevated to capture them.
TPM EKpub = strongest fingerprint. The Endorsement Key is burned into the TPM at manufacture and cannot be changed, reset or removed, so its public part uniquely identifies this exact device for its whole life. It is the same key Microsoft's device attestation/registration uses to pin the device. Windows returns the EKpub as AsnEncodedData (DER SubjectPublicKeyInfo) and usually leaves PublicKeyHash empty, so the tool derives everything from the DER bytes and reports several forms (all masked unless -Reveal):
- TPM EKpub (DER, b64) - the actual public key; from this you can compute any other format with openssl/tpm2-tools.
- TPM EKpub SHA-256 (SPKI) and SHA-1 (SPKI) - fingerprints over the whole DER SubjectPublicKeyInfo.
- TPM EKpub modulus SHA-256 - the "raw-modulus" hash (RSA modulus only, DER wrapper stripped) that some attestation formats use; absent for ECC EKs.
- TPM EKpub hash (Windows) - only if a build actually populates PublicKeyHash.
- TPM EKpub Name (TPM2B_NAME) is shown as not derivable here: the TPM Name hashes the raw TPMT_PUBLIC blob, which this cmdlet does not expose (use tpm2-tools/NCrypt if you need it).
Full product key. The consolidated Full product key row shows the complete 25-character key from the best available source - OEM firmware (OA3) first, else the DigitalProductId decode - masked unless -Reveal, and only when run elevated. It is only recoverable on retail/OEM installs. Volume MAK/KMS keys are not stored on the device by design (Windows keeps only the last 5 characters), so on those installs the row honestly reports (not recoverable - Volume/MAK/KMS ...) instead of a bogus value - no tool can display a full MAK/KMS key.
Every row lists its Source (registry path or WMI class) in the CSV/JSON so you can verify exactly where each value came from.

CSV / JSON output columns

Category, Name, Value, Sensitive, Source, Explanation

Files

File	Purpose
`Manage-WindowsTelemetry.ps1`	Windows telemetry view + control
`Manage-BrowserPrivacy.ps1`	Browser privacy view + hardening
`Manage-DefenderAntivirus.ps1`	Defender health + protection management
`View-WindowsIdentifiers.ps1`	Read-only identifier privacy audit
`README.md`	This file

All CSV exports are useful for fleet auditing: run with -Csv on multiple machines and diff or aggregate the results.

README.md

Windows Telemetry & Browser Privacy Tools

Key risks

1. Manage-WindowsTelemetry.ps1

Quick start

Semantics

User mode (-UserMode) - recommended for personal use

Interactive menu commands

Go dark (-GoDark / menu G) - maximum privacy

[CRIT] - the last-mile connections (confirm-close only)

[SEC] items: Windows SmartScreen

What is covered

Registry settings reference

Core telemetry

Application compatibility (appraiser)

Windows Error Reporting (successor to Dr. Watson)

Customer Experience Improvement Program

Cloud content and suggestions

Activity history (Timeline)

Per-user privacy (HKCU - changeable without admin)

Search / Cortana cloud

Cloud sync (clipboard / settings)

Suggestions / ads (Content Delivery Manager - per-user, HKCU)

Location

Find My Device

AI features (Copilot / Recall)

Network

Windows SmartScreen [SEC] - reputation checks

Services

Scheduled tasks

Known limitations

CSV output columns

2. Manage-BrowserPrivacy.ps1

Quick start

Safe Browsing / SmartScreen (URL reputation) - read this

How it works

Registry settings reference

Microsoft Edge

Google Chrome

Mozilla Firefox

Brave

General notes

CSV output columns

3. Manage-DefenderAntivirus.ps1

Quick start

Tamper Protection

Health summary (read-only)

Configurable protections

Menu commands

Bulk disable

Requirements and caveats

CSV output columns

4. View-WindowsIdentifiers.ps1

Quick start

Inline explanations

Masking

What it reports

CSV / JSON output columns

Files

User mode (`-UserMode`) - recommended for personal use

Go dark (`-GoDark` / menu `G`) - maximum privacy

`[CRIT]` - the last-mile connections (confirm-close only)

`[SEC]` items: Windows SmartScreen

Windows SmartScreen `[SEC]` - reputation checks