Windows 11 · Privacy Hardening

Windows 11 Privacy Guide: Stop Telemetry, Strip Bloatware, and Block Microsoft Tracking

Windows 11 ships as a cloud-connected platform that talks to Microsoft servers all day long. This guide walks through a layered, practical approach to cutting that data flow down to size — without breaking the parts of Windows you actually want to keep.

A quick reality check before you start

Microsoft has spent years reshaping Windows from a stand-alone desktop operating system into a cloud-linked platform. Some of that connectivity is genuinely useful — security patches, malware signature updates, license activation, OneDrive, account sync, and the cloud services people actually choose to use all depend on it.

The trouble is everything that comes bundled with those features. A default Windows 11 install routinely phones home for diagnostics, crash reports, feature experiments, cloud configuration, advertising, personalized suggestions, Bing results, MSN content, widgets, location, account activity, and browser telemetry. Most users never get a clear explanation of what is being sent, why it is being sent, or how long it stays tied to their machine.

Microsoft does give you privacy switches — lots of them, in fact. The problem is that they are scattered across different parts of Settings, some only exist in Group Policy, a few reappear after major updates, and many of them only shut down one slice of a much larger collection pipeline.

If you are stuck on Windows, you will not make it fully private. What you can do is shrink the data leaving your machine by a very wide margin. That is what this guide is for.

Why the GDID story matters: persistent device identifiers

The GDID discussion drew attention to an uncomfortable piece of modern Windows: persistent device identification. A stable device identifier lets Microsoft link online activity back to the same Windows install — or even the same physical machine — over long stretches of time. Even when no individual request carries your real name, a constant identifier makes it easy to stitch separate events together.

Windows reaches out to a cluster of device-registration and connected-device endpoints, including: 

dds.microsoft.com
cs.dds.microsoft.com
aad.cs.dds.microsoft.com
fd.dds.microsoft.com
ztd.dds.microsoft.com
cdpcs.access.microsoft.com
activity.windows.com
assets.activity.windows.com
edge.activity.windows.com

These services are tied to device registration, connected experiences, Microsoft account integration, Entra ID, activity sync, and zero-touch deployment tools like Windows Autopilot.

Not every request to these domains proves Microsoft is tracking everything you do. Some have legitimate enterprise and device-management roles, and public documentation does not fully spell out every internal identifier or data flow. That said, the privacy concern does not simply disappear.

A persistent identifier can connect activity across sessions and Microsoft services. For a home PC that does not use Entra ID, Autopilot, cross-device sync, or corporate management, it is fair to ask why so many device-registration connections are even necessary. You can block these domains, but treat them as the aggressive end of the spectrum — blocking them can break Microsoft accounts, work or school enrollment, device registration, activity sync, and other connected features. There are safer changes to make first.

Step one: stop using Microsoft Edge as your main browser

The browser is the easiest place to begin. Edge is tightly woven into Microsoft's advertising, search, sync, shopping, content, and telemetry systems. Depending on its configuration, Edge can talk to Microsoft for:

You can turn many of these off, but if privacy is the priority there is little reason to keep Edge as your daily driver.

Brave is a solid replacement when you need Chromium compatibility. It runs on nearly every site that supports Chrome, blocks trackers by default, and needs less initial setup. Still, review Brave's own settings — disable Rewards, sponsored content, usage reporting, and anything else you do not need. No browser deserves a free pass just because it markets itself as private.

Firefox is the better pick if you want distance from the Chromium ecosystem. A reasonable Firefox setup includes:

Neither Brave nor Firefox makes you anonymous. Sites can still track you through accounts, cookies, fingerprinting, IP addresses, and analytics. They are simply better starting points than a browser deeply tied into the Windows ecosystem.

Remove bloatware, AI features, widgets, and suggestions

Windows 11 arrives with apps, promotional shortcuts, AI integrations, and cloud content that most people never asked for. Open Settings > Apps > Installed apps and remove what you do not use. The exact list depends on your edition, region, hardware, and install date, but common examples include:

Also open the taskbar settings and turn off Widgets, Copilot, Search highlights, and any other online features you do not want. If your hardware supports Recall or other Copilot+ features, review those settings on their own — never assume they are off just because you never opened the app.

The same goes for suggested content. Microsoft plants recommendations in the Start menu, Settings, notifications, the lock screen, and File Explorer. Turn off as many of these as your version allows:

Avoid blind debloating
Do not just run a debloat tool with every checkbox selected. Some remove WebView2, codecs, Store dependencies, application installers, and shared frameworks that unrelated programs rely on. Remove things gradually, restart Windows, and test the apps you actually use.

Disable everything you can under Privacy & Security

Open Settings > Privacy & security and walk through every category. Microsoft reshuffles the wording and location of these controls between releases, but the important ones usually include:

Set diagnostic data to the lowest level your edition allows. Turn off optional diagnostic data, tailored experiences, ad personalization, feedback requests, typing personalization, and cloud search if you do not need them.

Then open Settings > System > Notifications > Additional settings and disable options such as:

Also review permissions for the camera, microphone, location, contacts, calendar, call history, messages, account info, and background apps. Do not grant an app permanent access to something it does not need.

Use a local Windows account when you can

A local account will not stop Windows telemetry, but it weakens the direct link between your Windows profile and a Microsoft identity. You can still sign in to individual apps — OneDrive, Microsoft 365, Xbox — separately while keeping the OS itself unlinked from your email, cloud storage, and subscriptions.

Microsoft keeps making local-account setup harder. The available methods shift between Windows versions, so check which one works for your current release before reinstalling.

Move to Enterprise for stronger privacy controls

Windows Home and Pro do not expose the same telemetry controls as Enterprise and Education. Enterprise gives you stricter diagnostic-data policies and a much wider set of Group Policy options. If privacy matters and you must stay on Windows, Enterprise is the edition I recommend.

Changing editions and owning a valid license are two different things. Edition conversion only changes the installed feature set — licensing and activation are separate. If you already have a legitimate Enterprise license through work, school, volume licensing, or another channel, use it.

If you have no other practical option, take a look at Massgrave. It can handle edition changes and related activation tasks in about half a minute. Use the real site, read what the script does, and understand that switching editions does not magically grant you a legal Enterprise license — that is between you, Microsoft, and any organization whose licensing may apply. The reason to move to Enterprise is access to better policy controls, not the name shown in the System window.

Disable telemetry through Group Policy

On Windows Enterprise, open the Run dialog with Win + R and type: 

gpedit.msc

Then navigate to Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds. Look for a policy named Allow Diagnostic Data or Allow Telemetry (depending on your version) and set collection to the lowest level available.

You should also review these Group Policy sections:

Useful policies include those that disable:

Policy names change over time, and Microsoft removes or replaces policies in newer releases, so revisit them after major feature updates.

SmartScreen and cloud protection come with a privacy cost

There is an uncomfortable privacy-versus-security trade-off inside Windows Security. Open Windows Security > App & browser control > Reputation-based protection. Microsoft Defender SmartScreen checks websites, downloads, apps, file reputation, and potentially unwanted software. To do that, Windows may send Microsoft information such as:

SmartScreen offers real security value — it can stop malicious downloads, phishing pages, and unknown apps before traditional antivirus catches up. It is also a cloud reputation service, which means Microsoft learns what your machine is checking.

I personally keep SmartScreen and reputation-based protection off because I find that level of cloud checking too invasive. That is my privacy call, not a universal recommendation.

The same concern applies to cloud-delivered protection and automatic sample submission in Microsoft Defender. Cloud-delivered protection sends information about suspicious files and behavior to Microsoft for instant analysis. Automatic sample submission can upload suspicious files — or parts of files — to Microsoft. Windows may ask before submitting certain files, but I do not want a security product deciding one of my files should be shipped to a third party. I keep both disabled.

That reduces Microsoft's insight into my files and activity, but it also weakens protection against brand-new malware. Everyone should weigh that trade-off for themselves.

Think before you disable cloud protection
If you regularly download unknown software, open email attachments, install game mods, use pirated software, or run random scripts, turning off cloud protection is probably a bad deal for you.

If you keep these features off, compensate with better habits:

Privacy matters, but an info-stealing malware infection is worse than Microsoft telemetry.

Block Microsoft telemetry through the hosts file

After adjusting Windows settings and Group Policy, the next layer is blocking selected Microsoft domains. The Windows hosts file lives here: 

C:\Windows\System32\drivers\etc\hosts

A hosts entry maps a hostname to an address. Pointing it at 0.0.0.0 blocks the IPv4 connection; :: covers IPv6. For example: 

0.0.0.0 telemetry.example.com
:: telemetry.example.com

The hosts file does not support wildcards — blocking example.com does not automatically block data.example.com. It also cannot stop apps that use hardcoded IP addresses, a different hostname, a proxy, or their own DNS resolver. Even so, it is a useful and transparent layer.

Back up and edit the hosts file

Open Command Prompt as administrator and create a backup:

copy "%SystemRoot%\System32\drivers\etc\hosts" ^
"%USERPROFILE%\Desktop\hosts-backup.txt"

Then edit the file:

  1. Open the Start menu.
  2. Search for Notepad.
  3. Right-click Notepad.
  4. Select Run as administrator.
  5. Select File > Open.
  6. Open C:\Windows\System32\drivers\etc.
  7. Change the file type from Text Documents to All Files.
  8. Open the file named hosts.
  9. Add the entries at the bottom.
  10. Save the file.

Flush the DNS cache afterward:

ipconfig /flushdns

Restart apps that were already open, since they may have cached DNS results.

Level 1: Basic telemetry and event collection safe

These are the safest entries to start with. They are mostly tied to telemetry, event collection, diagnostics, usage reporting, and test environments. Blocking them should not break normal Windows Update downloads, Microsoft account sign-in, or activation. It may reduce Microsoft's ability to diagnose problems or analyze how features are used. 

0.0.0.0 alpha.telemetry.microsoft.com
:: alpha.telemetry.microsoft.com
0.0.0.0 au-v10.events.data.microsoft.com
:: au-v10.events.data.microsoft.com
0.0.0.0 au-v20.events.data.microsoft.com
:: au-v20.events.data.microsoft.com
0.0.0.0 au.vortex-win.data.microsoft.com
:: au.vortex-win.data.microsoft.com
0.0.0.0 browser.events.data.msn.com
:: browser.events.data.msn.com
0.0.0.0 de-v20.events.data.microsoft.com
:: de-v20.events.data.microsoft.com
0.0.0.0 de.vortex-win.data.microsoft.com
:: de.vortex-win.data.microsoft.com
0.0.0.0 df.telemetry.microsoft.com
:: df.telemetry.microsoft.com
0.0.0.0 eu-v10.events.data.microsoft.com
:: eu-v10.events.data.microsoft.com
0.0.0.0 eu-v10c.events.data.microsoft.com
:: eu-v10c.events.data.microsoft.com
0.0.0.0 eu-v20.events.data.microsoft.com
:: eu-v20.events.data.microsoft.com
0.0.0.0 eu.vortex-win.data.microsoft.com
:: eu.vortex-win.data.microsoft.com
0.0.0.0 events-sandbox.data.microsoft.com
:: events-sandbox.data.microsoft.com
0.0.0.0 events.data.microsoft.com
:: events.data.microsoft.com
0.0.0.0 jp-v10.events.data.microsoft.com
:: jp-v10.events.data.microsoft.com
0.0.0.0 jp-v20.events.data.microsoft.com
:: jp-v20.events.data.microsoft.com
0.0.0.0 onecollector.cloudapp.aria.akadns.net
:: onecollector.cloudapp.aria.akadns.net
0.0.0.0 self.events.data.microsoft.com
:: self.events.data.microsoft.com
0.0.0.0 sqm.df.telemetry.microsoft.com
:: sqm.df.telemetry.microsoft.com
0.0.0.0 sqm.telemetry.microsoft.com
:: sqm.telemetry.microsoft.com
0.0.0.0 tele.trafficmanager.net
:: tele.trafficmanager.net
0.0.0.0 telemetry.appex.bing.net
:: telemetry.appex.bing.net
0.0.0.0 telemetry.microsoft.com
:: telemetry.microsoft.com
0.0.0.0 telemetry.remoteapp.windowsazure.com
:: telemetry.remoteapp.windowsazure.com
0.0.0.0 telemetry.urs.microsoft.com
:: telemetry.urs.microsoft.com
0.0.0.0 uk-v20.events.data.microsoft.com
:: uk-v20.events.data.microsoft.com
0.0.0.0 uk.vortex-win.data.microsoft.com
:: uk.vortex-win.data.microsoft.com
0.0.0.0 us-v10.events.data.microsoft.com
:: us-v10.events.data.microsoft.com
0.0.0.0 us-v10c.events.data.microsoft.com
:: us-v10c.events.data.microsoft.com
0.0.0.0 us-v20.events.data.microsoft.com
:: us-v20.events.data.microsoft.com
0.0.0.0 us.vortex-win.data.microsoft.com
:: us.vortex-win.data.microsoft.com
0.0.0.0 us4-v20.events.data.microsoft.com
:: us4-v20.events.data.microsoft.com
0.0.0.0 us5-v20.events.data.microsoft.com
:: us5-v20.events.data.microsoft.com
0.0.0.0 v10-win.vortex.data.microsoft.com.akadns.net
:: v10-win.vortex.data.microsoft.com.akadns.net
0.0.0.0 v10.events.data.microsoft.com
:: v10.events.data.microsoft.com
0.0.0.0 v10.vortex-win.data.microsoft.com
:: v10.vortex-win.data.microsoft.com
0.0.0.0 v10c.events.data.microsoft.com
:: v10c.events.data.microsoft.com
0.0.0.0 v10c.vortex-win.data.microsoft.com
:: v10c.vortex-win.data.microsoft.com
0.0.0.0 v20.events.data.microsoft.com
:: v20.events.data.microsoft.com
0.0.0.0 v20.vortex-win.data.microsoft.com
:: v20.vortex-win.data.microsoft.com
0.0.0.0 vortex-sandbox.data.microsoft.com
:: vortex-sandbox.data.microsoft.com
0.0.0.0 vortex-win-sandbox.data.microsoft.com
:: vortex-win-sandbox.data.microsoft.com
0.0.0.0 vortex-win.data.microsoft.com
:: vortex-win.data.microsoft.com
0.0.0.0 vortex.data.glbdns2.microsoft.com
:: vortex.data.glbdns2.microsoft.com
0.0.0.0 vortex.data.microsoft.com
:: vortex.data.microsoft.com

Level 2: Crash reporting, Watson, and feedback safe

Watson is Microsoft's crash-reporting and error-analysis infrastructure. It can collect crash details, diagnostic information, application state, and memory dump data. Blocking these domains prevents or reduces the submission of crash reports. Windows and apps should still run, but Microsoft will receive less information when something fails. Feedback Hub and Microsoft's support diagnostics may also stop working correctly. 

0.0.0.0 ceuswatcab01.blob.core.windows.net
:: ceuswatcab01.blob.core.windows.net
0.0.0.0 ceuswatcab02.blob.core.windows.net
:: ceuswatcab02.blob.core.windows.net
0.0.0.0 diagnostics.support.microsoft.com
:: diagnostics.support.microsoft.com
0.0.0.0 eaus2watcab01.blob.core.windows.net
:: eaus2watcab01.blob.core.windows.net
0.0.0.0 eaus2watcab02.blob.core.windows.net
:: eaus2watcab02.blob.core.windows.net
0.0.0.0 eu-watsonc.events.data.microsoft.com
:: eu-watsonc.events.data.microsoft.com
0.0.0.0 feedback.microsoft-hohm.com
:: feedback.microsoft-hohm.com
0.0.0.0 feedback.search.microsoft.com
:: feedback.search.microsoft.com
0.0.0.0 feedback.windows.com
:: feedback.windows.com
0.0.0.0 kmwatsonc.events.data.microsoft.com
:: kmwatsonc.events.data.microsoft.com
0.0.0.0 modern.watson.data.microsoft.com
:: modern.watson.data.microsoft.com
0.0.0.0 modern.watson.data.microsoft.com.akadns.net
:: modern.watson.data.microsoft.com.akadns.net
0.0.0.0 oca.microsoft.com
:: oca.microsoft.com
0.0.0.0 oca.telemetry.microsoft.com
:: oca.telemetry.microsoft.com
0.0.0.0 reports.wes.df.telemetry.microsoft.com
:: reports.wes.df.telemetry.microsoft.com
0.0.0.0 services.wes.df.telemetry.microsoft.com
:: services.wes.df.telemetry.microsoft.com
0.0.0.0 survey.watson.microsoft.com
:: survey.watson.microsoft.com
0.0.0.0 umwatson.events.data.microsoft.com
:: umwatson.events.data.microsoft.com
0.0.0.0 umwatsonc.events.data.microsoft.com
:: umwatsonc.events.data.microsoft.com
0.0.0.0 watson.live.com
:: watson.live.com
0.0.0.0 watson.microsoft.com
:: watson.microsoft.com
0.0.0.0 watson.ppe.telemetry.microsoft.com
:: watson.ppe.telemetry.microsoft.com
0.0.0.0 watson.telemetry.microsoft.com
:: watson.telemetry.microsoft.com
0.0.0.0 watsonc.events.data.microsoft.com
:: watsonc.events.data.microsoft.com
0.0.0.0 wes.df.telemetry.microsoft.com
:: wes.df.telemetry.microsoft.com
0.0.0.0 weus2watcab01.blob.core.windows.net
:: weus2watcab01.blob.core.windows.net
0.0.0.0 weus2watcab02.blob.core.windows.net
:: weus2watcab02.blob.core.windows.net

Level 3: MSN, Bing, ads, widgets, and Spotlight safe

These domains supply MSN feeds, Bing assets, widgets, promotional content, thumbnails, suggested content, and Windows Spotlight material. They are generally safe to block if you do not use those features. Possible side effects include blank widgets, missing weather cards, an empty Edge new-tab page, missing thumbnails, and Windows Spotlight falling back to a static background. 

0.0.0.0 api.msn.com
:: api.msn.com
0.0.0.0 arc.msn.com
:: arc.msn.com
0.0.0.0 assets.msn.com
:: assets.msn.com
0.0.0.0 business.bing.com
:: business.bing.com
0.0.0.0 c.bing.com
:: c.bing.com
0.0.0.0 c.msn.com
:: c.msn.com
0.0.0.0 choice.microsoft.com
:: choice.microsoft.com
0.0.0.0 creativecdn.com
:: creativecdn.com
0.0.0.0 edgeassetservice.azureedge.net
:: edgeassetservice.azureedge.net
0.0.0.0 evoke-windowsservices-tas.msedge.net
:: evoke-windowsservices-tas.msedge.net
0.0.0.0 fd.api.iris.microsoft.com
:: fd.api.iris.microsoft.com
0.0.0.0 fp-afd-nocache-ccp.azureedge.net
:: fp-afd-nocache-ccp.azureedge.net
0.0.0.0 fp-vs.azureedge.net
:: fp-vs.azureedge.net
0.0.0.0 g.msn.com
:: g.msn.com
0.0.0.0 ntp.msn.com
:: ntp.msn.com
0.0.0.0 prod-azurecdn-akamai-iris.azureedge.net
:: prod-azurecdn-akamai-iris.azureedge.net
0.0.0.0 ris.api.iris.microsoft.com
:: ris.api.iris.microsoft.com
0.0.0.0 srtb.msn.com
:: srtb.msn.com
0.0.0.0 staticview.msn.com
:: staticview.msn.com
0.0.0.0 th.bing.com
:: th.bing.com
0.0.0.0 tse1.mm.bing.net
:: tse1.mm.bing.net
0.0.0.0 widgetcdn.azureedge.net
:: widgetcdn.azureedge.net
0.0.0.0 widgetservice.azurefd.net
:: widgetservice.azurefd.net
0.0.0.0 www.msn.com
:: www.msn.com

Level 4: Location, maps, weather, OneNote, and activity careful

These domains back real Windows features. They are only safe to block if you do not use those features.

Blocking location services may affect:

Blocking OneNote's CDN may cause missing resources or loading problems inside OneNote. Blocking activity domains may disable activity sync and connected-device features. 

0.0.0.0 activity.windows.com
:: activity.windows.com
0.0.0.0 assets.activity.windows.com
:: assets.activity.windows.com
0.0.0.0 cdn.onenote.net
:: cdn.onenote.net
0.0.0.0 ecn.dev.virtualearth.net
:: ecn.dev.virtualearth.net
0.0.0.0 ecn-us.dev.virtualearth.net
:: ecn-us.dev.virtualearth.net
0.0.0.0 edge.activity.windows.com
:: edge.activity.windows.com
0.0.0.0 inference.location.live.net
:: inference.location.live.net
0.0.0.0 location-inference-westus.cloudapp.net
:: location-inference-westus.cloudapp.net
0.0.0.0 maps.windows.com
:: maps.windows.com
0.0.0.0 tile-service.weather.microsoft.com
:: tile-service.weather.microsoft.com
0.0.0.0 weathermapdata.blob.core.windows.net
:: weathermapdata.blob.core.windows.net

Level 5: Edge configuration and feature experiments careful

These domains appear to be tied to Edge feature rollout rings, configuration, experiments, fallback services, and Microsoft-delivered browser content. Blocking them makes sense if you do not use Edge and do not want Microsoft remotely changing or testing browser features. Keep in mind that Windows still uses Edge WebView2 for some apps, so test those afterward. 

0.0.0.0 a-ring-fallback.msedge.net
:: a-ring-fallback.msedge.net
0.0.0.0 c-ring.msedge.net
:: c-ring.msedge.net
0.0.0.0 config.edge.skype.com
:: config.edge.skype.com
0.0.0.0 dual-s-ring.msedge.net
:: dual-s-ring.msedge.net
0.0.0.0 fp.msedge.net
:: fp.msedge.net
0.0.0.0 i-ring.msedge.net
:: i-ring.msedge.net
0.0.0.0 ln-ring.msedge.net
:: ln-ring.msedge.net
0.0.0.0 s-ring.msedge.net
:: s-ring.msedge.net
0.0.0.0 t-ring.msedge.net
:: t-ring.msedge.net
0.0.0.0 t-ring-fdv2.msedge.net
:: t-ring-fdv2.msedge.net

Level 6: Cloud settings, commands, and functional events careful

These endpoints are more aggressive because they may handle cloud configuration, feature flags, experiments, telemetry instructions, and functional event processing. Blocking them can reduce Microsoft's remote control over connected Windows features, but it may also cause cloud-managed settings or Microsoft components to behave unexpectedly. 

0.0.0.0 asimov-win.settings.data.microsoft.com.akadns.net
:: asimov-win.settings.data.microsoft.com.akadns.net
0.0.0.0 co4.telecommand.telemetry.microsoft.com
:: co4.telecommand.telemetry.microsoft.com
0.0.0.0 cy2.settings.data.microsoft.com.akadns.net
:: cy2.settings.data.microsoft.com.akadns.net
0.0.0.0 cy2.vortex.data.microsoft.com.akadns.net
:: cy2.vortex.data.microsoft.com.akadns.net
0.0.0.0 db5-eap.settings-win.data.microsoft.com.akadns.net
:: db5-eap.settings-win.data.microsoft.com.akadns.net
0.0.0.0 db5.settings-win.data.microsoft.com.akadns.net
:: db5.settings-win.data.microsoft.com.akadns.net
0.0.0.0 db5.vortex.data.microsoft.com.akadns.net
:: db5.vortex.data.microsoft.com.akadns.net
0.0.0.0 functional.events.data.microsoft.com
:: functional.events.data.microsoft.com
0.0.0.0 geo.settings-win.data.microsoft.com.akadns.net
:: geo.settings-win.data.microsoft.com.akadns.net
0.0.0.0 geo.vortex.data.microsoft.com.akadns.net
:: geo.vortex.data.microsoft.com.akadns.net
0.0.0.0 query.prod.cms.rt.microsoft.com
:: query.prod.cms.rt.microsoft.com
0.0.0.0 settings-sandbox.data.microsoft.com
:: settings-sandbox.data.microsoft.com
0.0.0.0 settings-win.data.microsoft.com
:: settings-win.data.microsoft.com
0.0.0.0 settings.data.glbdns2.microsoft.com
:: settings.data.glbdns2.microsoft.com
0.0.0.0 settings.data.microsoft.com
:: settings.data.microsoft.com
0.0.0.0 telecommand.telemetry.microsoft.com
:: telecommand.telemetry.microsoft.com
0.0.0.0 www.telecommandsvc.microsoft.com
:: www.telecommandsvc.microsoft.com

Level 7: Statistics, delivery telemetry, and traffic shaping careful

These hostnames are tied to statistics, CDN infrastructure, and traffic-management services. They should not be casually described as the servers that deliver Windows Update packages. A name like statsfe2.update.microsoft.com points to reporting or statistics about updates — not the update payload itself. Blocking these may affect statistics, download coordination, traffic shaping, or reporting around Microsoft services. It is not the same as disabling Windows Update. 

0.0.0.0 cs11.wpc.v0cdn.net
:: cs11.wpc.v0cdn.net
0.0.0.0 cs1137.wpc.gammacdn.net
:: cs1137.wpc.gammacdn.net
0.0.0.0 statsfe1.ws.microsoft.com
:: statsfe1.ws.microsoft.com
0.0.0.0 statsfe2.update.microsoft.com.akadns.net
:: statsfe2.update.microsoft.com.akadns.net
0.0.0.0 statsfe2.ws.microsoft.com
:: statsfe2.ws.microsoft.com
0.0.0.0 tsfe.trafficshaping.dsp.mp.microsoft.com
:: tsfe.trafficshaping.dsp.mp.microsoft.com

Level 8: Device registration and GDID-related endpoints aggressive

This is the most aggressive privacy category in the list. These domains can be involved in device registration, connected experiences, Microsoft account integration, Entra ID, Autopilot, and persistent device identification. Do not block them on a work-managed computer without understanding how your organization manages the device.

Possible side effects include:

0.0.0.0 aad.cs.dds.microsoft.com
:: aad.cs.dds.microsoft.com
0.0.0.0 cdpcs.access.microsoft.com
:: cdpcs.access.microsoft.com
0.0.0.0 cs.dds.microsoft.com
:: cs.dds.microsoft.com
0.0.0.0 dds.microsoft.com
:: dds.microsoft.com
0.0.0.0 fd.dds.microsoft.com
:: fd.dds.microsoft.com
0.0.0.0 mucp.api.account.microsoft.com
:: mucp.api.account.microsoft.com
0.0.0.0 ztd.dds.microsoft.com
:: ztd.dds.microsoft.com

Level 9: Microsoft account authentication aggressive

The final category contains Microsoft account authentication endpoints. Blocking these is technically possible, but it can stop account-based Microsoft services from working. If your goal is to prevent Microsoft account use entirely and keep Windows local-only, these are the last entries to add.

Possible side effects include problems with:

0.0.0.0 account.live.com
:: account.live.com
0.0.0.0 login.live.com
:: login.live.com

Test the blocks in stages

Do not add every category at once unless you are prepared to troubleshoot the result. Start with telemetry and crash reporting. Use the computer normally for a few days. Then add content, widgets, location, cloud settings, and device registration categories one at a time.

After each change, test the features you care about:

You can test a blocked domain in PowerShell:

Resolve-DnsName telemetry.microsoft.com

You can also use:

ping telemetry.microsoft.com

A blocked hostname should resolve to 0.0.0.0 or ::, depending on which address Windows chooses. Some apps cache DNS results, so close and reopen them after changing the hosts file.

If something stops working, remove the entries from the most recently added category and run: 

ipconfig /flushdns

To restore the original hosts file from the backup:

copy /y "%USERPROFILE%\Desktop\hosts-backup.txt" ^
"%SystemRoot%\System32\drivers\etc\hosts"

ipconfig /flushdns

Windows privacy requires maintenance

There is no single privacy switch for Windows 11. The most effective setup stacks several layers:

Microsoft changes Windows constantly. New endpoints appear, old hostnames disappear, settings move around, and unwanted apps sometimes return after updates. The goal is not to break Windows or blindly block every Microsoft server — it is to remove unnecessary data collection while keeping the specific features and security protections you actually want.

Microsoft designed Windows 11 around cloud connectivity and continuous data collection. If you have to use it, accepting every default is not your only option.

↑ Back to top