The Private Windows: A Step-by-Step Setup Guide for Microsoft Devices

for JeremyAbram.net

This guide walks you through a clean, practical, privacy-first setup for Windows 11 (and most steps also apply to Windows 10). It covers OS setup, Microsoft account controls, app permissions, Edge, Office, device encryption, Recall on Copilot+ PCs, networking/DNS, and more—with exact menu paths and what each toggle actually does.

0) Before you begin (2 mins)

Update Windows first (Settings → Windows Update → Check for updates). New builds sometimes move or rename settings, so start current.
Decide account type:
- Microsoft Account (MSA) = sync, backup, and cloud restore convenience, but more cloud data.
- Local account = fewer cloud ties, more privacy by default.
  You can switch later in Settings → Accounts.

1) Control your Microsoft Account data (web)

A lot of Windows privacy flows through your Microsoft Account. Visit the Microsoft Privacy Dashboard and review, clear, or turn off categories like search, location, browsing, voice, and app activity; you can also adjust ad personalization here. Microsoft Support+2Microsoft+2

Do this:

Sign in at the Privacy Dashboard and open Activity history → Clear for any category you don’t want stored. Microsoft Support
Open Ad settings and turn Personalized ads off (applies to Microsoft properties even beyond Windows). Microsoft

2) Lock down Windows core privacy switches (15–20 mins)

A) Stop targeted suggestions & the Advertising ID

Settings → Privacy & security → General (or “Recommendations & offers”)
- Turn Advertising ID Off
- Turn Improve Start and search results Off (stops app-launch tracking)
- Turn Recommendations and offers in Settings Off
- Turn Show notifications in Settings Off
  These switches reduce OS-level personalization and suggestions. Microsoft Support+1

B) App-by-app permissions

Settings → Privacy & security → App permissions and review these one by one:
- Camera and Microphone – disable globally unless needed; then allow per-app. Microsoft Support+1
- Location, Contacts, Calendar, Phone calls, File system, Pictures/Videos/Music library – restrict to the few apps that truly require access. (Desktop apps may not appear here and can access broader resources.) Microsoft Support

C) Background apps = fewer pings, less exhaust

Settings → Apps → Installed apps → (⋯) Advanced options → Background app permissions → Never per app you don’t want chattering in the background. Microsoft Support

D) Diagnostic data & tailored experiences

Settings → Privacy & security → Diagnostics & feedback
- Set Send optional diagnostic data to Off.
- Turn Tailored experiences Off (stops using diagnostic data to personalize tips/ads). Microsoft Learn

E) Delivery Optimization (P2P updates)

Windows can share update chunks with other PCs. For privacy and bandwidth:

Settings → Windows Update → Advanced options → Delivery Optimization
- Toggle Allow downloads from other PCs Off, or choose Devices on my local network (LAN-only) if you want the speed without internet P2P. Microsoft Support+1

F) “Find my device”

If you value privacy over recovery, disable; if you travel, consider leaving it on (requires an MSA and Location).

Settings → Privacy & security → Find my device (toggle). Learn more about how it works and its limits. Windows Central

3) Device encryption & your recovery key (5 mins)

Modern Windows often enables Device encryption/BitLocker automatically—especially on Windows 11 24H2 and newer—backing up the recovery key to your Microsoft Account (or Entra ID at work). That’s good for security; privacy-wise, know where your key lives. Microsoft Learn

Do this now:

Settings → Privacy & security → Device encryption (or BitLocker on Pro): ensure it’s On.
Visit account.microsoft.com/devices and confirm your recovery key is present; store an offline copy in a password manager or USB. Microsoft Support

Note: On many 24H2+ installs, encryption can auto-enable if you sign in with an MSA during setup; clean installs tend to trigger it more consistently. Microsoft Learn+1

4) Edge browser: private by default (10 mins)

A) Tracking Prevention

Edge → Settings → Privacy, search, and services → Tracking prevention
Set to Strict for maximum blocking (some sites may break; Balanced is Microsoft’s default). Microsoft Learn+1

B) Clear on close

Privacy, search, and services → Clear browsing data → Choose what to clear every time you close the browser → enable Browsing history, Download history, Cookies, Cached images/files (pick what you need). Microsoft Support+1

C) Sign-in & Sync

If you don’t want cloud ties, Profiles → Sync → Turn off. (You can still sign into websites without syncing the browser.) Microsoft Support

5) Office/Teams: rein in “connected experiences” (5–10 mins)

Office apps can use cloud-backed “connected experiences” and send diagnostics.

For personal Microsoft 365/Office apps

Open Word/Excel → File → Account → Account Privacy → Manage Settings
- Disable optional connected experiences (and experiences that analyze your content) if you don’t need them. Microsoft Learn

For organizations/admins

Use policy to disable or limit connected experiences and set diagnostic level to Required only. Key docs: Use policy settings to manage privacy controls and the overview of Office privacy controls. Microsoft Learn+1

6) Copilot+ PCs only: Decide on Recall (5 mins)

Recall (on Copilot+ PCs) periodically snapshots your screen locally so you can search your past work. It’s opt-in, can be paused or turned off, and you can delete snapshots or remove the feature entirely. If you don’t want a searchable record of your screen, leave it off. Windows Blog+2Microsoft Support+2

Controls:

Settings → Privacy & security → Recall & snapshots to toggle, pause, filter apps/sites, or delete snapshots. You can also remove Recall from Turn Windows features on or off. Microsoft Support+1

Context: Microsoft delayed and reworked Recall in 2024, later rolling it out with added opt-in and security measures; third-party apps have even added blocks due to privacy concerns—so review carefully. The Verge+3Windows Blog+3Reuters+3

7) Network privacy: encrypted DNS (3–5 mins)

Encrypting DNS hides your domain lookups from local observers and ISPs.

Windows 11 GUI:

Settings → Network & Internet → (Wi-Fi/Ethernet) → Hardware properties → DNS server assignment → Edit
- Set to Manual → add your preferred DNS (e.g., Cloudflare 1.1.1.1 / 1.0.0.1) and choose Encrypted (DNS over HTTPS) for Preferred/Alternate. Microsoft Learn+1

(Advanced policies exist for DoH in Group Policy if you manage multiple PCs.) Microsoft Learn

8) Windows Backup & Sync: choose what roams (3 mins)

Windows Backup can sync apps, settings, Wi-Fi passwords, and more to your MSA. For a tighter privacy profile, turn off categories you don’t want in the cloud.

Settings → Accounts → Windows backup → Remember my preferences (toggle specific items) and Back up my apps as desired. Microsoft Support+1

9) OneDrive: optional by design (2 mins)

If you don’t want cloud file sync: open OneDrive → Settings → Accounts → Unlink this PC or disable folder backup for Desktop/Documents/Pictures. Super User

10) Fine-tune per-app privacy (ongoing)

For each app you install from Microsoft Store, immediately check Settings → Privacy & security → App permissions to revoke unneeded access. (Desktop installers often request access at runtime instead of via the system list.) Microsoft Support
For Edge, Teams, Skype, Xbox apps, repeat the same discipline: audit sign-in, sync, telemetry/feedback, and content-personalization settings inside the app.

Quick “Private Windows” Checklist (copy/paste)

Privacy Dashboard (web): clear activity; disable personalized ads. Microsoft Support+1
General: turn Advertising ID off; disable suggestions & app-launch tracking. Microsoft Support+1
App permissions: lock down Camera, Microphone, Location, Files. Microsoft Support+1
Background apps: set noisy apps to Never. Microsoft Support
Diagnostics: Optional diagnostic data Off; Tailored experiences Off. Microsoft Learn
Delivery Optimization: disable internet P2P (Off or LAN-only). Microsoft Support
BitLocker/Device encryption: On; verify and store recovery key safely. Microsoft Learn+1
Edge: Tracking Prevention → Strict; clear data on close; turn off sync. Microsoft Learn+1
Office: disable optional connected experiences; set diagnostics to Required only. Microsoft Learn+1
Recall (Copilot+): leave Off unless you truly need it; if on, set filters & deletion schedule. Microsoft Support
DoH: enable encrypted DNS for your adapters. Microsoft Learn
Windows Backup: turn off cloud sync for preferences you don’t want roaming. Microsoft Support
OneDrive: Unlink or disable folder backup if you prefer local-only. Super User

What you give up when you harden privacy

Fewer smart recommendations and less personalization in Start/Search/Settings. Microsoft Support
Potential site breakage with Strict tracking prevention in Edge (use Balanced per-site if needed). Microsoft Learn
Without Find my device and cloud backup, recovery from loss/theft or a new-PC move requires your own backups and good key management. Windows Central

Bonus: Admin/Pro tips (optional)

Use Group Policy or Intune to enforce diagnostics, Delivery Optimization, DoH, and Office privacy baselines across fleets. Microsoft Learn+1
On shared PCs, consider Edge’s Clear on close + no-sync profile as a “guest mode.” Microsoft Learn