---
type: concept
title: Windows 10 Hardening and Privacy
created: 2026-07-01
updated: 2026-07-01
tags: [windows-10, privacy, telemetry, security]
related: [universitatsrechenzentrum-urz]
sources: ["output/rz_uni_greifswald_de_support_faq_sicherheit.md"]
---

# Windows 10 Hardening and Privacy

Windows 10 hardening involves configuring the operating system to reduce the attack surface and limit the transmission of private data to external entities.

## Windows Telemetry
Telemetry is the automatic transmission of diagnostic and usage data from Windows 10 to Microsoft. While standard settings allow for some restriction, full disabling requires administrative tools.

### Management Levels
1. **Centrally Managed (University Devices):** Devices registered in the `uni-greifswald.de` domain and connected to the university network are restricted centrally via Group Policy by the [[universitatsrechenzentrum-urz]].
2. **Manual Restriction (Private/Other Devices):**
    - **Basic:** Via `Settings` $\rightarrow$ `Privacy` $\rightarrow$ `General` and `Feedback & Diagnostics`.
    - **Enterprise:** Using the Group Policy Editor (`gpedit.msc`) $\rightarrow$ Administrative Templates $\rightarrow$ All Settings $\rightarrow$ "Allow Telemetry" set to `0`.
    - **Home/Pro/Education:** 
        - **Registry:** Create a DWORD value `AllowTelemetry` set to `0` at `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection`.
        - **Services:** Disable the following services:
            - Diagnoseverfolgungsdienst (Diagnostic Tracking Service)
            - Benutzererfahrung und Telemetrie im verbundenen Modus (Connected User Experiences and Telemetry)
            - `dmwappushsvc`

## Endpoint Security Basics
To improve security on Windows endpoints, the following configurations are recommended:
- **File Extension Visibility:** Enabling file name extensions in Folder Options (View tab $\rightarrow$ uncheck "Hide extensions for known file types") to prevent users from being deceived by files with misleading names (e.g., `document.pdf.exe`).
- **Macro Management:** Disabling macros in [[microsoft-office]] and LibreOffice by default, as they can be used to execute malicious scripts.
- **Cloud Storage:** Disabling [[queries/onedrive]] if it is not required for the specific workflow to reduce data synchronization to external clouds.
