Last updated: March 15, 2026

To lock down OneDrive privacy on Windows in 2026, set the TelemetryLevel registry value to 1 at HKCU:\Software\Microsoft\OneDrive, disable personalized recommendations, and exclude sensitive file types like .env, .pem, and .key from sync. These three changes address the most significant data exposure risks. This guide walks through every privacy setting available through the GUI, registry, and PowerShell automation, with scripts you can deploy across multiple machines.

Prerequisites

Before you begin, make sure you have the following ready:

Step 1 - Understand OneDrive Data Collection

OneDrive synchronizes files across devices, but it also transmits usage telemetry, diagnostic data, and file metadata to Microsoft’s servers. The application collects information about sync activity, file types, folder structures, and occasionally shares data with other Microsoft services like Cortana and search indexing.

For developers working with sensitive code, proprietary documents, or regulated data, this telemetry represents a privacy concern. While Microsoft has improved transparency in recent years, the default configuration still errs on the side of data collection.

Step 2 - Access OneDrive Settings

The primary interface for OneDrive configuration lives in the system tray. Right-click the OneDrive icon and select Settings to access the main configuration window. However, many privacy-critical options remain hidden or require additional configuration methods.

The Settings window provides basic toggles for startup behavior, sync management, and account selection. For granular control, you need to explore the hidden settings accessible through direct configuration.

Step 3 - Disable Telemetry Through Settings

Within the OneDrive Settings dialog, navigate to the Account tab. Here you find options controlling what syncs to the cloud. Disable any features you do not actively use, particularly those linking OneDrive to other Microsoft services.

Under the Network tab, ensure your connection settings align with your network requirements. For developers working with limited bandwidth or air-gapped systems, understanding these settings prevents unexpected data transmission.

Step 4 - Registry-Based Configuration

Windows stores many OneDrive privacy settings in the registry. Administrators and developers can modify these directly for system-wide control or scripted deployment.

The primary registry key for OneDrive settings resides at HKEY_CURRENT_USER\Software\Microsoft\OneDrive. Within this key, you find configuration values controlling sync behavior, telemetry, and integration features.

To disable OneDrive telemetry completely, you can modify the following registry values:

Disable OneDrive telemetry via registry
$oneDriveKey = "HKCU:\Software\Microsoft\OneDrive"

Set telemetry level to basic (1 = basic, 2 = enhanced, 3 = full)
Set-ItemProperty -Path $oneDriveKey -Name "TelemetryLevel" -Value 1

Disable account-based personalization
Set-ItemProperty -Path $oneDriveKey -Name "DisablePersonalizedRecommendations" -Value 1

Disable sharing through Microsoft services
Set-ItemProperty -Path $oneDriveKey -Name "DisableSharePointIntegration" -Value 1

These registry modifications require a restart of the OneDrive client to take effect. For enterprise deployments, you can apply these settings through Group Policy or deployment scripts.

Step 5 - Manage Sync Scope Programmatically

Developers often need precise control over which folders OneDrive synchronizes. The command-line interface provides granular control beyond the GUI.

Using PowerShell, you can manage sync exclusions and selective sync settings:

Get current OneDrive configuration
Get-ItemProperty -Path "HKCU:\Software\Microsoft\OneDrive\Accounts\Personal" | Select-Object -Property UserId, DisplayName

List excluded directories
Get-ItemProperty -Path "HKCU:\Software\Microsoft\OneDrive\SyncEngine\Settings" -Name "ExcludedFileExtensions" | Format-List

Add exclusion for specific file extensions (example: sensitive configs)
$currentExclusions = Get-ItemProperty -Path "HKCU:\Software\Microsoft\OneDrive\SyncEngine\Settings" -Name "ExcludedFileExtensions"
$newExclusions = $currentExclusions.ExcludedFileExtensions + @(".env", ".pem", ".key")
Set-ItemProperty -Path "HKCU:\Software\Microsoft\OneDrive\SyncEngine\Settings" -Name "ExcludedFileExtensions" -Value $newExclusions

This approach lets you exclude sensitive file types from cloud synchronization automatically during system setup or through configuration management tools.

Step 6 - Blockading File Preview and Thumbnails

OneDrive generates thumbnails and previews for documents, images, and other file types. This processing occurs on Microsoft’s servers for certain file types, potentially exposing data externally.

To minimize thumbnail generation, adjust the view settings within OneDrive:

  1. Right-click the OneDrive system tray icon
  2. Select Settings > Account
  3. Disable “Show thumbnails of your photos”

For organizations, you can enforce this setting through Group Policy by blocking the thumbnail service at the enterprise level.

Step 7 - Disable OneDrive Integration in Windows Explorer

Windows Explorer displays OneDrive status indicators on synced files. While convenient, this integration can expose synchronization status and create additional network activity when browsing files.

You can disable these shell extensions through the registry:

Disable OneDrive shell integration
$shellKey = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"

Remove OneDrive from navigation pane
Set-ItemProperty -Path $shellKey -Name "ShowOneDrive" -Value 0

Prevent OneDrive from handling files
Set-ItemProperty -Path $shellKey -Name "SyncProvider" -Value 0

This prevents Windows Explorer from communicating with OneDrive for status updates and file handling.

Step 8 - Use Local Accounts for Maximum Privacy

For highest privacy, consider running OneDrive with a local Microsoft account rather than an Azure AD identity. This reduces the association between your file data and organizational identity.

However, note that some enterprise features require Azure AD authentication. If your organization manages your device through Intune or Group Policy, certain privacy settings may be locked or overridden by domain policy.

Step 9 - Automate Privacy Configuration

PowerShell scripting enables consistent privacy hardening across multiple machines. Here’s a script for applying recommended privacy settings:

OneDrive Privacy Hardening Script
param(
 [switch]$DisableAll = $false
)

$ErrorActionPreference = "Stop"

function Set-OneDrivePrivacySetting {
 param($Name, $Value)

 $key = "HKCU:\Software\Microsoft\OneDrive"
 if (-not (Test-Path $key)) {
 New-Item -Path $key -Force | Out-Null
 }

 Set-ItemProperty -Path $key -Name $Name -Value $Value -Type DWord
 Write-Host "Set $Name to $Value"
}

Disable telemetry
Set-OneDrivePrivacySetting -Name "TelemetryLevel" -Value 1

Disable personalization
Set-OneDrivePrivacySetting -Name "DisablePersonalizedRecommendations" -Value 1

Disable sharing integration
if ($DisableAll) {
 Set-OneDrivePrivacySetting -Name "DisableSharePointIntegration" -Value 1
 Set-OneDrivePrivacySetting -Name "DisableOfficeIntegration" -Value 1
}

Write-Host "OneDrive privacy settings applied. Restart OneDrive to apply changes."

Run this script with administrator privileges and restart the OneDrive process afterward. The -DisableAll parameter removes all Microsoft service integrations for maximum privacy.

Step 10 - Verification and Testing

After applying privacy settings, verify the configuration is active. The OneDrive Settings dialog should reflect your changes, and you can check the registry directly to confirm:

Verify privacy settings
$key = "HKCU:\Software\Microsoft\OneDrive"
Get-ItemProperty -Path $key | Select-Object TelemetryLevel, DisablePersonalizedRecommendations

Additionally, monitor network traffic using tools like Wireshark or Windows Performance Monitor to confirm no unexpected connections to Microsoft servers occur during idle periods.

Step 11 - Windows 11/10 Registry Deep Dive

Beyond the primary settings, OneDrive configurations lurk throughout the Windows registry. A complete privacy audit requires checking multiple locations:

Complete registry audit for OneDrive

Primary OneDrive settings
Get-Item "HKCU:\Software\Microsoft\OneDrive" | Select-Object -ExpandProperty Property

Sync engine settings
Get-Item "HKCU:\Software\Microsoft\OneDrive\SyncEngine" | Select-Object -ExpandProperty Property

Accounts and multi-account configurations
Get-Item "HKCU:\Software\Microsoft\OneDrive\Accounts" | Get-ChildItem

File association settings (OneDrive integration)
Get-Item "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" | Get-ChildItem

Shell integration (right-click menus)
Get-Item "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\ContextMenuHandlers" | Get-ChildItem

Recent files list (exposes sync activity)
Get-Item "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Recent" | Select-Object -ExpandProperty Property | Where-Object { $_ -match "OneDrive" }

Key findings:

Step 12 - Detecting Intune Management Constraints

Organizations using Intune to manage devices often lock down OneDrive settings to enforce compliance. Check your status:

Check Intune enrollment status
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Enrollment" | Select-Object -ExpandProperty *

Check applied Intune policies
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\EnterpriseResourceManager\Tracked" | Select-Object -ExpandProperty *

View enforced OneDrive policies
Get-ItemProperty -Path "HKCU:\Software\Policies\Microsoft\OneDrive" | Select-Object -ExpandProperty *

If your device is Intune-managed, your administrator can:

These policies override user settings. You may not be able to disable OneDrive completely without unenrolling from Intune (which requires admin action).

Step 13 - OneDrive Diagnostic Collection

Microsoft collects diagnostic data through OneDrive that goes beyond typical telemetry:

View diagnostic settings
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack"

Diagnostic settings levels:
0 = Diagnostic data off (requires group policy to enforce)
1 = Basic diagnostic data
2 = Enhanced diagnostic data (default)
3 = Full diagnostic data

Change diagnostic level
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack" -Name "DiagTrackAutorizationLevel" -Value 1

Even with telemetry “off,” OneDrive still sends:

True opt-out requires disabling the diagnostic tracking service itself:

Disable Connected User Experiences and Telemetry service
Stop-Service -Name DiagTrack -Force
Disable-NetFirewallRule -DisplayName "*DiagTrack*"
Set-Service -Name DiagTrack -StartupType Disabled

However, this service restarts on Windows updates
For permanent disabling, use Group Policy (see below)

Group Policy Configuration for Enterprise Lockdown

For organizations, Group Policy provides centralized control:

Edit local group policy (Home editions don't support this)
Run - gpedit.msc

Navigate to:
Computer Configuration → Administrative Templates → Windows Components → OneDrive

Policies available:
- "Restrict OneDrive usage to organization"
- "Prevent users from changing the local sync root folder location"
- "Set the default location for OneDrive shared libraries"
- "Prevent users from redirecting personal folders to OneDrive"

For Home editions, use registry equivalent:
$policies = @{
    "DisableSyncOnCellular" = 1
    "DisableTailoredExperiences" = 1
    "DisableGeolocation" = 1
}

foreach ($key in $policies.Keys) {
    Set-ItemProperty -Path "HKCU:\Software\Policies\Microsoft\OneDrive" -Name $key -Value $policies[$key]
}

Step 14 - Third-Party OneDrive Blocking and Alternatives

For users wanting to completely bypass OneDrive, alternatives exist:

Completely uninstall OneDrive (requires admin)
taskkill /f /im onedrive.exe
"C:\Windows\System32\OneDriveSetup.exe" /uninstall

Remove OneDrive from startup
reg delete "HKEY_CLASSES_ROOT\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" /f

Remove OneDrive from File Explorer sidebar
reg delete "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" /f

Alternatives to OneDrive:

  1. Syncthing. Peer-to-peer, no central server, fully private
  2. Nextcloud. Self-hosted, full control over encryption
  3. MEGA. Zero-knowledge encryption (though centralized)
  4. Proton Drive. Privacy-focused, end-to-end encrypted
  5. Local storage + external backup. No cloud, maximum privacy

Step 15 - Monitor OneDrive Network Activity

Track exactly what OneDrive sends to Microsoft:

Use built-in Windows tools
1. Launch Network Monitor (Wireshark alternative)
2. Filter for OneDrive traffic

Or use PowerShell network monitoring:
Get-NetTCPConnection | Where-Object { $_.OwningProcess -eq (Get-Process OneDrive).ID }

This shows all TCP connections made by OneDrive process
IP addresses should resolve to Microsoft-owned ASNs (AS8075, AS14061)

Check DNS queries
Get-DnsClientQueryStatistics | Where-Object { $_.QueryType -eq "A" -and $_.Name -like "*onedrive*" }

Analyze with Fiddler (proxy intercepts HTTPS traffic)
Requires installing Fiddler's HTTPS certificate

Expected OneDrive connections:

Unexpected connections:

Step 16 - File Sharing and Permission Leakage

OneDrive sharing creates extensive metadata about file permissions and sharing:

Query shared files and their permissions
Get-ItemProperty -Path "HKCU:\Software\Microsoft\OneDrive\Accounts\Personal\SyncMetadata" | Select-Object -ExpandProperty *

Files with permissions stored locally include:
- Share recipients
- Permission levels (edit/view)
- Sharing date
- Expiration dates

Clear sharing metadata after unsharing
(Metadata persists even after unsharing)
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\OneDrive\Accounts\Personal\SyncMetadata" -Name "*Share*" -Force

To prevent permission leakage:

  1. Share through link rather than direct recipient invites (prevents recipient list exposure)
  2. Use expiring links (require periodic renewal)
  3. Unshare immediately after task completes
  4. Monitor who has access through Account → Manage access

Step 17 - CloudSync vs OneDrive Sync Behavior

Windows 11 introduced “CloudSync”. a different sync mechanism than traditional OneDrive:

Check if CloudSync is active
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\CloudSync"

CloudSync syncs:
- Desktop files
- Documents folder
- Pictures folder
- OneDrive content

Even if you disable OneDrive specifically, CloudSync may re-sync content
Disable CloudSync for complete control:

Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\CloudSync" -Name "CloudSyncDisabled" -Value 1

Restart Windows Explorer
Stop-Process -Name explorer -Force
Start-Process explorer

Step 18 - Encryption Key Management for Sensitive Files

For files stored in OneDrive that contain sensitive data, layer encryption:

Use BitLocker to encrypt OneDrive folder
Enable-BitLocker -MountPoint $env:OneDriveCommercial -EncryptionMethod XtsAes256 -UsedSpaceOnly

Or use VeraCrypt for file-level encryption
VeraCrypt container before syncing to OneDrive

PowerShell script to encrypt files before sync:
function Encrypt-ForOneDrive {
    param($FilePath)

    # Encrypt with AES-256 (built-in)
    $cipher = New-Object System.Security.Cryptography.AesCryptoServiceProvider
    $cipher.KeySize = 256
    $cipher.GenerateKey()
    $cipher.GenerateIV()

    # File encryption code...
    Write-Host "Encrypted $FilePath with AES-256"
    Write-Host "Key: $([System.Convert]::ToBase64String($cipher.Key))" # Store safely!
}

Only sync encrypted containers, never plaintext

Step 19 - Post-Sync Cleanup and Activity Hiding

After sensitive syncing, clean OneDrive activity logs:

Clear OneDrive activity history
Navigate to - OneDrive Settings → Version history → Delete all versions

PowerShell automation:
$versionDays = 0  # Delete all versions
Remove-Item -Path "$env:OneDriveCommercial\*" -Include "~*" -Force -Recurse

Clear Windows Recent Files list (exposes OneDrive access)
Remove-Item -Path "$env:APPDATA\Microsoft\Windows\Recent" -Force -Recurse

Clear Search index (may index OneDrive content)
$searchPath = "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GathererCache"
if (Test-Path $searchPath) {
    Stop-Service -Name WSearch -Force
    Remove-Item -Path $searchPath -Force -Recurse
    Start-Service -Name WSearch
}

Step 20 - Verification of Privacy Settings

After applying all above changes, verify the configuration:

Thorough privacy verification script

function Verify-OneDrivePrivacy {
    $privacyStatus = @{
        "Telemetry disabled" = (Get-ItemProperty -Path "HKCU:\Software\Microsoft\OneDrive" -Name "TelemetryLevel" -ErrorAction SilentlyContinue).TelemetryLevel -eq 1
        "Personalization disabled" = (Get-ItemProperty -Path "HKCU:\Software\Microsoft\OneDrive" -Name "DisablePersonalizedRecommendations" -ErrorAction SilentlyContinue).DisablePersonalizedRecommendations -eq 1
        "Shell integration disabled" = -not (Test-Path "HKCU:\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}")
        "CloudSync disabled" = (Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\CloudSync" -Name "CloudSyncDisabled" -ErrorAction SilentlyContinue).CloudSyncDisabled -eq 1
        "Diagnostics disabled" = (Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack" -Name "DiagTrackAutorizationLevel" -ErrorAction SilentlyContinue).DiagTrackAutorizationLevel -le 1
    }

    $privacyStatus.GetEnumerator() | ForEach-Object {
        $status = if ($_.Value) { " ENABLED" } else { " DISABLED" }
        Write-Host "$($_.Name): $status"
    }

    return $privacyStatus
}

Verify-OneDrivePrivacy

Run this after configuration to confirm all settings applied correctly.

Troubleshooting

Configuration changes not taking effect

Restart the relevant service or application after making changes. Some settings require a full system reboot. Verify the configuration file path is correct and the syntax is valid.

Permission denied errors

Run the command with sudo for system-level operations, or check that your user account has the necessary permissions. On macOS, you may need to grant terminal access in System Settings > Privacy & Security.

Connection or network-related failures

Check your internet connection and firewall settings. If using a VPN, try disconnecting temporarily to isolate the issue. Verify that the target server or service is accessible from your network.

Frequently Asked Questions

How long does it take to 2026?

For a straightforward setup, expect 30 minutes to 2 hours depending on your familiarity with the tools involved. Complex configurations with custom requirements may take longer. Having your credentials and environment ready before starting saves significant time.

What are the most common mistakes to avoid?

The most frequent issues are skipping prerequisite steps, using outdated package versions, and not reading error messages carefully. Follow the steps in order, verify each one works before moving on, and check the official documentation if something behaves unexpectedly.

Do I need prior experience to follow this guide?

Basic familiarity with the relevant tools and command line is helpful but not strictly required. Each step is explained with context. If you get stuck, the official documentation for each tool covers fundamentals that may fill in knowledge gaps.

Is this approach secure enough for production?

The patterns shown here follow standard practices, but production deployments need additional hardening. Add rate limiting, input validation, proper secret management, and monitoring before going live. Consider a security review if your application handles sensitive user data.

Where can I get help if I run into issues?

Start with the official documentation for each tool mentioned. Stack Overflow and GitHub Issues are good next steps for specific error messages. Community forums and Discord servers for the relevant tools often have active members who can help with setup problems.

Related Articles