Whilst users can turn it off today, Microsoft's history and lack of straightforward responses, suggests that won't be the case tomorrow.
Besides: Some of the concerns are that it can be utilised by people such as home abusers to track those who might be looking for help to leave that situation. It's a new, very powerful, avenue of control for people stuck there.
Being able to opt-out does not fix that. They've created a new way for people to be harmed.
I had other reasons, but that one set me off as the final straw. The other one was not being able to make offline accounts by default from installation, without using hacks.
Microsoft respects Group Policy because enterprise uses Group Policy.
Home also technically has Group Policy, but it's not supposed to and most workarounds to that effect are very janky.
We did have some tweaks as an outcome. But overall these policies have been in place for years. And since 2012R2 and later there have been multiple instances where windows updates policies wont apply in lieu of say... "maintenance windows" features being added to windows, so it ignores policies centered around deadlines etc.
I want my file system to have metadata that (along with things like name, last edited, checksum, etc...) puts all files into one of three buckets:
1. Pre-installed
2. User generated
3. External sources (e.g. Downloaded, transferred from network, transferred from device)
If a file from an external source becomes executable then starts affecting my pre-installed/user-generated files and it's checksum isn't already on microsoft's whitelist, then I want microsoft to quarantine that executable and look inside it to figure out what the heck it's doing to my computer.
Consider this:
No one is uploading your personal files, they don't do anything and trying to look into them wouldn't help anyone avoid viruses.
Only executables are worth looking at.
Every single executable that was generated from an external source has been checked by microsoft. That is how microsoft, apple, google, and every anti-virus provider out there gets new virus definitions added to their virus lists.
If those executables weren't sent, then every single virus definition would be empty.
Yes, but I want an audit log of it all. I doubt they'll ever add this, so I'm not going to blindly trust Microsoft. In my case most files are probably not whitelisted anyway. I download some really huge files sometimes, do those get uploaded too? Do they throttle the uploads and if they don't are they just killing my personal network bandwidth? Like there's too many questions that set me off.
I'm happy with my choice.
Again, they're not uploading all files, they're only uploading suspicious executables, which by their very nature of needing to be fully loaded before they can be executed tend to be fairly small.
> Yes, but I want an audit log of it all. I doubt they'll ever add this [...]
Microsoft already has audit logs to the point where you can even see who's trying to turn off microsoft defender in your organisation and on which devices.
Just remember, they're catering to big businesses who are actually getting attacked on the regular, and big businesses need crazy levels of auditing.
They're going to have more than you can handle.
> so I'm not going to blindly trust Microsoft.
All security is based on trust and nothing about what you've said so far is specific to Microsoft.
So, why not microsoft?
gaming and for sandboxes. It became obvious to me a while ago with the slow integration of ads where this was going, and that I could never treat windows as a serious work station, unfortunately. I don’t even do banking on windows machines anymore, and it sucks because I greatly prefer WSL 2 and windows tools for my work environment compared to something you typically see in a corporate setting like a Mac.
Most people don’t get any choice at all about what operating system they use. And those that do get a choice have extremely limited options.
The amount of effort I had to spend to turn off things like Search Indexer and Windows Defender is insane. You can disable things in the control panel but it's still not really disabled and you have to play tricks to really disable it somewhere else. And then sometimes it would come back on because ... reasons?
I have zero faith that if I disable something (anything!) on Windows that 1) I've actually disabled it, and 2) that it will stay off.
Current Windows is absolutely horrible giving any control over the internals – even more so than the old XP/7 systems were. Before my VM I hadn't touched Windows at all for more than ten years, and I was shocked just how difficult some of these things had become.
Microsoft is not maintaining a separate build of Windows for DoD. They may have bespoke licensing agreements and support contracts, but military and DoD workstations run regular windows.
https://learn.microsoft.com/en-us/office365/servicedescripti...
>> Subscriptions in the GCC High and DoD environments include the core Exchange Online, SharePoint, and Skype for Business features. Given the increased certification and accreditation of the infrastructure, there are some feature differences between the general commercial Office 365 offerings and those available in GCC High and DoD.
Whether or not "windows professional with group policies" constitutes "their own version of windows" as per bongodongobob is left as an exercise to the reader.
Okay, it's the same operating system, but DoD managed devices have a different set of features and capabilities that are allowed to run on that device so I would contend that counts as a different "version", if the disagreement is semantic so be it
Windows is "military-grade". That's a laugh.
In case of doubt I am referring to the US practice of marketing certain products as "military-grade". Perhaps to suggest something like, "If it is good enough for the military, then it is surely good enough for the civilian."
On the inside, the term of art for things like Windows is COTS - Commercial, Off-the-shelf.
Given time it will be twisted into a method for profiling consumers and delivering targeted marketing that goes far beyond cookie tracking and search histories. That doesn't work so effectively on a system exclusively handling medical records or school attendance.
I can't imagine the powers that be are too thrilled with this feature, and much like the Intel TPM High Assurance bit, I bet there's an undocumented way to remove it.