Group Policy tweaking guide for Windows 8.0 and 8.1
Posted: 17 Oct 2024, 12:40
by K4sum1
I'm specifically basing this list off of 8.1, but I figure it will mostly apply to 8.0 as well due to 8.1 basically being a renamed service pack.
This post will go over Group Policy settings in Windows 8.1 that you can disable for more performance, privacy, and security. This list is based off of the upcoming Windows 8.1 Updated v2. (Link here when finished)
There is nothing that I know of that would allow for batch applying these. I think you can only manually apply these.
To apply these, you need to be running Windows 8.1 Pro or Enterprise. Lesser editions don't have access to Group Policy. To open the Group Policy Editor, press the windows key, type gpedit.msc, and press enter.
These two are less security focused and more how I prefer things to function. You can skip these if you want.
These are more security focused and the main ones you should consider. Most of these should be self explanatory, so if any features happen to be broken after this, try searching for the name of what you're trying to use.
This post will go over Group Policy settings in Windows 8.1 that you can disable for more performance, privacy, and security. This list is based off of the upcoming Windows 8.1 Updated v2. (Link here when finished)
There is nothing that I know of that would allow for batch applying these. I think you can only manually apply these.
To apply these, you need to be running Windows 8.1 Pro or Enterprise. Lesser editions don't have access to Group Policy. To open the Group Policy Editor, press the windows key, type gpedit.msc, and press enter.
These two are less security focused and more how I prefer things to function. You can skip these if you want.
► Show Spoiler
You can access the below from User Configuration > Administrative Templates > Windows Components > File Explorer
Enabled:
Turn off the caching of thumbnails in hidden thumbs.db files
These clutter my network drive and make moving files a pain. I disable them as they're more annoying than useful. This doesn't effect the display of thumbnails.
Remove CD Burning features
This stops Windows from ejecting the CD/DVD drive if you click on it when it has no disk. It also disables useless CD Burning features.
Enabled:
Turn off the caching of thumbnails in hidden thumbs.db files
These clutter my network drive and make moving files a pain. I disable them as they're more annoying than useful. This doesn't effect the display of thumbnails.
Remove CD Burning features
This stops Windows from ejecting the CD/DVD drive if you click on it when it has no disk. It also disables useless CD Burning features.
► Show Spoiler
You can access the below from Computer Configuration > Administrative Templates > All Settings
Disabled:
Turn on behavior monitoring
Telemetry.
Turn on BranchCache
Seems only useful for weird office WAN configurations that no average person will use. Might as well in case some vulnerability is discovered.
Windows Firewall: Allow ICMP exceptions
ICMP connections could be a security risk. There are two of these, disable both.
Windows Firewall: Allow inbound file and printer sharing exceptions
File and printer sharing connections could be a security risk. This does not appear to break SMB NAS. There are two of these, disable both.
Windows Firewall: Allow inbound remote administration exceptions
Inbound remote administration connections could be a security risk. There are two of these, disable both.
Windows Firewall: Allow inbound Remote Desktop exceptions
Inbound remote desktop connections could be a security risk. There are two of these, disable both.
Windows Firewall: Allow inbound UPnP framework exceptions
Inbound UPnP framework connections could be a security risk. There are two of these, disable both.
Enabled:
Disable remote Desktop Sharing
Remote desktop, potential security risk.
Disable Windows Error Reporting
Useless telemetry nowadays as I doubt Microsoft cares about error reports from 7 anymore.
Do not allow Windows Journal to be run
I don't use it, so I don't allow it to run in case some vulnerability is discovered.
Do not allow Windows Media Center to run
Same as above.
Do not allow Windows Messenger to be running
Same as above. This doesn't seem to impact WLM 2009 with Escargot, maybe only affects version originally bundled with XP.
Do not automatically start Windows Messenger initially
Same as above.
Do not send a Windows error report when a generic diver is installed on a device
Useless telemetry nowadays as I doubt Microsoft cares about error reports from 7 anymore.
Do not send additional data
Same as above.
Do not use NetBIOS-based discovery for domain controller location when DNS-based discovery fails
NetBIOS, potential security risk.
No auto-restart with logged on users for scheduled automatic updates installations
Disables automatic restarting if a update was installed. Shouldn't be an issue since we later disable updates entirely but why not just in case.
Only allow local user profiles
Local meaning stored locally on the machine, disallows accounts stored on the network that sync across machines, could be security risk. Not related to Microsoft accounts as far as I know.
Prevent the computer from joining a homegroup
Homegroup, security risk.
Prevent Windows from sending an error report when a device driver requests additional software during installation
Useless telemetry nowadays as I doubt Microsoft cares about error reports from 7 anymore.
Prevent Windows Media DRM Internet Access
I don't use it, so I don't allow it to run in case some vulnerability is discovered. Also DRM.
Prohibit Access of the Windows Connect Now wizards
Same as above.
Prohibit use of Internet Connection Sharing on your DNS domain network
Same as above.
Restrict Internet communication
Reduces the amount of telemetry Windows sends. Doesn't affect internet use.
Turn off access to all Windows Update features
Disables Windows Update, useless as these ISOs are already updated and any updates from Windows Update have telemetry.
Turn off access to the Store
I don't use it, so I don't allow it to run in case some vulnerability is discovered. Also servers are dead anyways.
Turn off Application Compatibility Engine
Maybe if you use very old applications very often it might be useful, but useless to me and disabling it improves performance.
Turn off Application Telemetry
Useless telemetry nowadays as I doubt Microsoft cares about error reports from 7 anymore.
Turn off Autoplay
Autoplay, security risk.
Turn off desktop gadgets
Gadgets, security risk. Although no longer part of Windows so useless leftover. Still disabling it since it was in the 7 guide.
Turn off downloading of game information
I don't use it, so I don't allow it to run in case some vulnerability is discovered.
Turn off downloading of print drivers over HTTP
Same as above.
Turn off Event Viewer "Events.asp" links
Same as above.
Turn off game updates
Same as above.
Turn off handwriting personalization data sharing
Useless telemetry nowadays as I doubt Microsoft cares about error reports from 7 anymore.
Turn off handwriting recognition error reporting
Same as above.
Turn off Help and Support Center ‘Did you know?” content
I don't use it, so I don't allow it to run in case some vulnerability is discovered.
Turn off Help and Support Center Microsoft Knowledge Base search
Same as above.
Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com
Same as above.
Turn off Internet download for Web publishing and online ordering wizards
Same as above.
Turn off Internet File Association service
Same as above.
Turn off Inventory Collector
Telemetry.
Turn off location
Location tracking.
Turn off location scripting
Same as above.
Turn off Microsoft Peer-to-Peer Networking Services
I don't use it, so I don't allow it to run in case some vulnerability is discovered.(Does not affect P2P torrenting.
Turn off printing over HTTP
Same as above.
Turn off Program Compatibility Assistant
Same as above.
Turn off Registration if URL connection is referring to Microsoft.com
Might affect official activation, but I think the servers are gone so doesn't matter.
Turn off Search Companion content file updates
I don't use it, so I don't allow it to run in case some vulnerability is discovered.
Turn off sensors
Same as above.
Turn off smart multi-homed name resolution
Security/Privacy risk.
Turn off smart protocol reordering
Linked to the above.
Turn off Steps Recorder
Telemetry.
Turn off Tablet PC Pen Training
I don't use it, so I don't allow it to run in case some vulnerability is discovered.
Turn off Tablet PC touch input
Same as above.
Turn off the “Order Prints” picture task
Same as above.
Turn off the "Publish to Web" task for files and folders
Same as above.
Turn off the advertising ID
Telemetry, or more specifically the advertising data collection.
Turn off the offer to update to the latest version of Windows
Disables upgrading to a newer version of Windows through the Windows Store.
Turn off the Windows Messenger Customer Experience Improvement Program
Useless telemetry nowadays as I doubt Microsoft cares about error reports from 7 anymore.
Turn off tracking of last play time of games in the Games folder
I don't think the data is reported, but I'd rather it just not be tracked.
Turn off Windows Calendar
I don't use it, so I don't allow it to run in case some vulnerability is discovered.
Turn off Windows Customer Experience Improvement Program
Telemetry.
Turn off Windows Defender
Useless.
Turn off Windows Error Reporting
Useless telemetry nowadays as I doubt Microsoft cares about error reports from 7 anymore.
Turn off WIndows Location Provider
Location tracking.
Turn off Windows Mail application
I don't use it, so I don't allow it to run in case some vulnerability is discovered.
Turn off Windows Mobility Center
Same as above.
Turn off Windows Network Connectivity Status Indicator active tests
Could be considered telemetry. I'd rather it not be tested.
Turn off Windows Update device driver search prompt
Windows Update drivers are notoriously horrible.
Turn off Windows Update device driver searching
Same as above.
Windows Firewall: Prohibit unicast response to multicast or broadcast requests
Block unicast connections from other computers, better security. There are two of these, enable both.
Windows Firewall: Protect all network connections
Force enables Windows Firewall. There are two of these, enable both.
Disabled:
Turn on behavior monitoring
Telemetry.
Turn on BranchCache
Seems only useful for weird office WAN configurations that no average person will use. Might as well in case some vulnerability is discovered.
Windows Firewall: Allow ICMP exceptions
ICMP connections could be a security risk. There are two of these, disable both.
Windows Firewall: Allow inbound file and printer sharing exceptions
File and printer sharing connections could be a security risk. This does not appear to break SMB NAS. There are two of these, disable both.
Windows Firewall: Allow inbound remote administration exceptions
Inbound remote administration connections could be a security risk. There are two of these, disable both.
Windows Firewall: Allow inbound Remote Desktop exceptions
Inbound remote desktop connections could be a security risk. There are two of these, disable both.
Windows Firewall: Allow inbound UPnP framework exceptions
Inbound UPnP framework connections could be a security risk. There are two of these, disable both.
Enabled:
Disable remote Desktop Sharing
Remote desktop, potential security risk.
Disable Windows Error Reporting
Useless telemetry nowadays as I doubt Microsoft cares about error reports from 7 anymore.
Do not allow Windows Journal to be run
I don't use it, so I don't allow it to run in case some vulnerability is discovered.
Do not allow Windows Media Center to run
Same as above.
Do not allow Windows Messenger to be running
Same as above. This doesn't seem to impact WLM 2009 with Escargot, maybe only affects version originally bundled with XP.
Do not automatically start Windows Messenger initially
Same as above.
Do not send a Windows error report when a generic diver is installed on a device
Useless telemetry nowadays as I doubt Microsoft cares about error reports from 7 anymore.
Do not send additional data
Same as above.
Do not use NetBIOS-based discovery for domain controller location when DNS-based discovery fails
NetBIOS, potential security risk.
No auto-restart with logged on users for scheduled automatic updates installations
Disables automatic restarting if a update was installed. Shouldn't be an issue since we later disable updates entirely but why not just in case.
Only allow local user profiles
Local meaning stored locally on the machine, disallows accounts stored on the network that sync across machines, could be security risk. Not related to Microsoft accounts as far as I know.
Prevent the computer from joining a homegroup
Homegroup, security risk.
Prevent Windows from sending an error report when a device driver requests additional software during installation
Useless telemetry nowadays as I doubt Microsoft cares about error reports from 7 anymore.
Prevent Windows Media DRM Internet Access
I don't use it, so I don't allow it to run in case some vulnerability is discovered. Also DRM.
Prohibit Access of the Windows Connect Now wizards
Same as above.
Prohibit use of Internet Connection Sharing on your DNS domain network
Same as above.
Restrict Internet communication
Reduces the amount of telemetry Windows sends. Doesn't affect internet use.
Turn off access to all Windows Update features
Disables Windows Update, useless as these ISOs are already updated and any updates from Windows Update have telemetry.
Turn off access to the Store
I don't use it, so I don't allow it to run in case some vulnerability is discovered. Also servers are dead anyways.
Turn off Application Compatibility Engine
Maybe if you use very old applications very often it might be useful, but useless to me and disabling it improves performance.
Turn off Application Telemetry
Useless telemetry nowadays as I doubt Microsoft cares about error reports from 7 anymore.
Turn off Autoplay
Autoplay, security risk.
Turn off desktop gadgets
Gadgets, security risk. Although no longer part of Windows so useless leftover. Still disabling it since it was in the 7 guide.
Turn off downloading of game information
I don't use it, so I don't allow it to run in case some vulnerability is discovered.
Turn off downloading of print drivers over HTTP
Same as above.
Turn off Event Viewer "Events.asp" links
Same as above.
Turn off game updates
Same as above.
Turn off handwriting personalization data sharing
Useless telemetry nowadays as I doubt Microsoft cares about error reports from 7 anymore.
Turn off handwriting recognition error reporting
Same as above.
Turn off Help and Support Center ‘Did you know?” content
I don't use it, so I don't allow it to run in case some vulnerability is discovered.
Turn off Help and Support Center Microsoft Knowledge Base search
Same as above.
Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com
Same as above.
Turn off Internet download for Web publishing and online ordering wizards
Same as above.
Turn off Internet File Association service
Same as above.
Turn off Inventory Collector
Telemetry.
Turn off location
Location tracking.
Turn off location scripting
Same as above.
Turn off Microsoft Peer-to-Peer Networking Services
I don't use it, so I don't allow it to run in case some vulnerability is discovered.(Does not affect P2P torrenting.
Turn off printing over HTTP
Same as above.
Turn off Program Compatibility Assistant
Same as above.
Turn off Registration if URL connection is referring to Microsoft.com
Might affect official activation, but I think the servers are gone so doesn't matter.
Turn off Search Companion content file updates
I don't use it, so I don't allow it to run in case some vulnerability is discovered.
Turn off sensors
Same as above.
Turn off smart multi-homed name resolution
Security/Privacy risk.
Turn off smart protocol reordering
Linked to the above.
Turn off Steps Recorder
Telemetry.
Turn off Tablet PC Pen Training
I don't use it, so I don't allow it to run in case some vulnerability is discovered.
Turn off Tablet PC touch input
Same as above.
Turn off the “Order Prints” picture task
Same as above.
Turn off the "Publish to Web" task for files and folders
Same as above.
Turn off the advertising ID
Telemetry, or more specifically the advertising data collection.
Turn off the offer to update to the latest version of Windows
Disables upgrading to a newer version of Windows through the Windows Store.
Turn off the Windows Messenger Customer Experience Improvement Program
Useless telemetry nowadays as I doubt Microsoft cares about error reports from 7 anymore.
Turn off tracking of last play time of games in the Games folder
I don't think the data is reported, but I'd rather it just not be tracked.
Turn off Windows Calendar
I don't use it, so I don't allow it to run in case some vulnerability is discovered.
Turn off Windows Customer Experience Improvement Program
Telemetry.
Turn off Windows Defender
Useless.
Turn off Windows Error Reporting
Useless telemetry nowadays as I doubt Microsoft cares about error reports from 7 anymore.
Turn off WIndows Location Provider
Location tracking.
Turn off Windows Mail application
I don't use it, so I don't allow it to run in case some vulnerability is discovered.
Turn off Windows Mobility Center
Same as above.
Turn off Windows Network Connectivity Status Indicator active tests
Could be considered telemetry. I'd rather it not be tested.
Turn off Windows Update device driver search prompt
Windows Update drivers are notoriously horrible.
Turn off Windows Update device driver searching
Same as above.
Windows Firewall: Prohibit unicast response to multicast or broadcast requests
Block unicast connections from other computers, better security. There are two of these, enable both.
Windows Firewall: Protect all network connections
Force enables Windows Firewall. There are two of these, enable both.