I'm not sure if I've mentioned this before, but like with the services post, this is something I've also been meaning to do for years. There's probably a lot more to adjust that I don't know about. Please let me know if you know any others.
This post will go over Group Policy settings in Windows 7 that you can disable for more performance, privacy, and security. This list is based off of the upcoming Windows 7 Updated v5. (Link here when finished) Windows 8 and 10 have more policies to change, lists for those will come soon.
There is nothing that I know of that would allow for batch applying these. I think you can only manually apply these.
To apply these, you need to be running Windows 7 Professional, Ultimate, or Enterprise. Lesser editions don't have access to Group Policy. To open the Group Policy Editor, press the windows key, type gpedit.msc, and press enter.
These two are less security focused and more how I prefer things to function. You can skip these if you want.
► Show Spoiler
You can access the below from User Configuration > Administrative Templates > Windows Explorer (Or just Explorer for 8+)
Enabled:
Turn off the caching of thumbnails in hidden thumbs.db files
These clutter my network drive and make moving files a pain. I disable them as they're more annoying than useful. This doesn't effect the display of thumbnails.
Remove CD Burning features
This stops Windows from ejecting the CD/DVD drive if you click on it when it has no disk. It also disables useless CD Burning features.
These are more security focused and the main ones you should consider. Most of these should be self explanatory, so if any features happen to be broken after this, try searching for the name of what you're trying to use.
► Show Spoiler
You can access the below from Computer Configuration > Administrative Templates > All Settings
Disabled:
Offer Remote Assistance
Remote access, potential security risk.
Solicited Remote Assistance
Remote access, potential security risk.
Turn on BranchCache
Seems only useful for weird office WAN configurations that no average person will use. Might as well in case some vulnerability is discovered.
Windows Firewall: Allow inbound Remote Desktop exceptions
There are two of these, not sure why. Inbound remote desktop connections could be a security risk.
Enabled:
Always use custom logon background
Not related to security, just enables replacing the logon background image with a custom one specified in C:\Windows\System32\oobe\info\backgrounds\backgroundDefault.jpg (Needs to be 256KB or less)
Disable remote Desktop Sharing
Remote desktop, potential security risk.
Disable Windows Error Reporting
Useless telemetry nowadays as I doubt Microsoft cares about error reports from 7 anymore.
Do not allow Windows Journal to be run
I don't use it, so I don't allow it to run in case some vulnerability is discovered.
Do not allow Windows Media Center to run
Same as above.
Do not allow Windows Messenger to be running
Same as above. This doesn't seem to impact WLM 2009 with Escargot, maybe only affects version originally bundled with XP.
Do not automatically start Windows Messenger initially
Same as above.
Do not send a Windows error report when a generic diver is installed on a device
Useless telemetry nowadays as I doubt Microsoft cares about error reports from 7 anymore.
Do not send additional data
Same as above.
No auto-restart with logged on users for scheduled automatic updates installations
Disables automatic restarting if a update was installed. Shouldn't be an issue since we later disable updates entirely but why not just in case.
Only allow local user profiles
Local meaning stored locally on the machine, disallows accounts stored on the network that sync across machines, could be security risk. Not related to Microsoft accounts as far as I know.
Prevent the computer from joining a homegroup
Homegroup, security risk.
Prevent Windows Anytime Upgrade from running.
I don't use it, so I don't allow it to run in case some vulnerability is discovered.
Prevent Windows from sending an error report when a device driver requests additional software during installation
Useless telemetry nowadays as I doubt Microsoft cares about error reports from 7 anymore.
Prevent Windows Media DRM Internet Access
I don't use it, so I don't allow it to run in case some vulnerability is discovered. Also DRM.
Prohibit Access of the Windows Connect Now wizards
Same as above.
Prohibit use of Internet Connection Sharing on your DNS domain network
Same as above.
Restrict Internet communication
Reduces the amount of telemetry Windows sends. Doesn't affect internet use.
Turn off access to all Windows Update features
Disables Windows Update, useless as these ISOs are already updated and any updates from Windows Update have telemetry.
Turn off Application Compatibility Engine
Maybe if you use very old applications very often it might be useful, but useless to me and disabling it improves performance.
Turn off Application Telemetry
Useless telemetry nowadays as I doubt Microsoft cares about error reports from 7 anymore.
Turn off Autoplay
Autoplay, security risk.
Turn off Autoplay for non-volume devices
Same as above.
Turn off desktop gadgets
Gadgets, security risk.
Turn off downloading of game information
I don't use it, so I don't allow it to run in case some vulnerability is discovered.
Turn off downloading of print drivers over HTTP
Same as above.
Turn off Event Viewer "Events.asp" links
Same as above.
Turn off game updates
Same as above.
Turn off handwriting recognition error reporting
Useless telemetry nowadays as I doubt Microsoft cares about error reports from 7 anymore.
Turn off Help and Support Center ‘Did you know?” content
I don't use it, so I don't allow it to run in case some vulnerability is discovered.
Turn off Help and Support Center Microsoft Knowledge Base search
Same as above.
Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com
Same as above.
Turn off Internet download for Web publishing and online ordering wizards
Same as above.
Turn off Internet File Association service
Same as above.
Turn off location
Location tracking.
Turn off location scripting
Same as above.
Turn off Microsoft Peer-to-Peer Networking Services
I don't use it, so I don't allow it to run in case some vulnerability is discovered.(Does not affect P2P torrenting.
Turn off printing over HTTP
Same as above.
Turn off Program Compatibility Assistant
Same as above.
Turn off Program Inventory
Telemetry.
Turn off Registration if URL connection is referring to Microsoft.com
Might affect official activation, but I think the servers are gone so doesn't matter.
Turn off Search Companion content file updates
I don't use it, so I don't allow it to run in case some vulnerability is discovered.
Turn off sensors
Same as above.
Turn off Tablet PC Pen Training
Same as above.
Turn off Tablet PC touch input
Same as above.
Turn off the “Order Prints” picture task
Same as above.
Turn off the "Publish to Web" task for files and folders
Same as above.
Turn off the Windows Messenger Customer Experience Improvement Program
Useless telemetry nowadays as I doubt Microsoft cares about error reports from 7 anymore.
Turn off tracking of last play time of games in the Games folder
I don't think the data is reported, but I'd rather it just not be tracked.
Turn off Windows Calendar
I don't use it, so I don't allow it to run in case some vulnerability is discovered.
Turn off Windows Customer Experience Improvement Program
Telemetry.
Turn off Windows Defender
Useless.
Turn off Windows Error Reporting
Useless telemetry nowadays as I doubt Microsoft cares about error reports from 7 anymore.
Turn off Windows Mail application
I don't use it, so I don't allow it to run in case some vulnerability is discovered.
Turn off Windows Mobility Center
Same as above.
Turn off Windows Network Connectivity Status Indicator active tests
Could be considered telemetry. I'd rather it not be tested.
Turn off Windows Update device driver search prompt
Windows Update drivers are notoriously horrible.
Turn off Windows Update device driver searching
Same as above.
Quick links
FAQ
Register
Login
