Disable DNS cache service so that all your apps resolve DNS themselves (can only be done via the registry, change the service's startup type from 2 (auto) to 4 (disabled)).
In CIS, create a new group for all files under c:/windows.
Create a rule denying all in/out requests to that group.
Create a rule allowing only DHCP and NTP requests (255.255.255.255:67 and <whatever-timeserver-you-trust>:123) for svchost.exe (place that rule above the one for c:/windows to ensure precedence).
Use third-party utilities instead of the likes of ping.exe, e.g. hrping.
Refer to CIS documentation in case of any troubles.
Enjoy your privacy-hardened windows.
And please elaborate what's the ill effect using a third-party ping tool?
concerning the intentional breaking of the windows updater and then using a third party update tool: such workarounds don't make the recommendation less bad. The question is: why break the onboard updater in the first place? And all those other features? Sure you have an alternative to office365 and to onedrive and live without the companion app is possible and happy, and maybe you even have a third party crl updater as well and a workaround for the side effects of blocking oscp.
But honestly if you want to replace everything because microsoft is bad and can't be trusted, then start by replacing the kernel.
Because none of those features are irreplaceable and/or crucial to run a perfectly fine workstation.
> if you want to replace everything because microsoft is bad and can't be trusted, then start by replacing the kernel.
Unless Windows kernel phones home over some covert physical channel which is undetectable by tools like Wireshark running on a separate gateway (and secretly supported by all routers in existence), there's absolutely zero need to replace the kernel when all said phoning home can be stopped with a properly configured firewall.
I'm currently using Binisoft (now Malware Bytes) Windows Firewall Control to block unwanted traffic. I'm quite happy with it.
The amount of traffic that it regularly blocks is insane. Windows and installed apps constantly want to chat with their cloud friends.
Someone else has some suggestions?
For example an internal app starts up fine and works, but then can't connect to github. Instead of showing cert errors, I've had ones show errors that make it appear that you may have a DNS problem or that the connection to github itself was broken.
The issue is you can only control your firewall at home. Whenever you are out you are pretty sure that MS and Apple bypass any rule you'd put on the local firewall.
I prefer running sane operating systems.
Not at all.
Of course you won't have access to some services in that case, like Windows Update, etc. One particular weird thing I have noticed is that the process that checks CRL on behalf on others is LSASS. So basically you have some extra tuning to do to get a system to your liking if using just the Windows Firewall, after you block everything but "Core Networking" (and programs you want to authorise), but it looks reasonable. I would suggest saving the initial state before you go that route, though.
If you trace connections you will find funny things, like cl.exe phoning home.
Yank your internet cord out and start windows.
It can be easily configured to block any host or path.