Listen to this Post
Microsoft’s new feature, called Recall, is part of Windows 11 on Copilot+ PCs. It automatically takes frequent screenshots of your screen every few seconds to create a searchable timeline of your activity. While designed to boost productivity, it raises serious privacy concerns as it could capture sensitive data.
Step-by-Step: Turn Off Microsoft Recall (Activity Screenshot Feature)
Option 1: During Setup (OOBE)
If setting up a new PC:
- During Windows setup, look for the “Recall” or “Activity History” prompt.
2. Choose “Don’t enable” or “Turn off”.
Option 2: After Setup (Disable from Settings)
If Recall is already running:
- Open Settings (
Win + Ior search for Settings in Start Menu).
2. Navigate to:
- Privacy & Security → Recall & snapshots (if available).
3. Toggle “Save snapshots” to Off.
4. Optionally, delete all stored snapshots.
Option 3: Disable Using Group Policy Editor (Windows Pro and above)
1. Press Win + R, type gpedit.msc, and press Enter.
2. Navigate to:
- Computer Configuration → Administrative Templates → Windows Components → Recall.
3. Set “Allow Recall to run” to Disabled.
Option 4: Disable via Registry Editor (Advanced Users)
- Press
Win + R, typeregedit, hit Enter.
2. Navigate to:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Recall.
3. Create a DWORD (32-bit) Value:
- Name: `DisableRecall`
- Value: `1`
4. Restart your PC.
Option 5: Delete Snapshots
If Recall was previously enabled:
- Go to: Settings → Privacy & Security → Recall & snapshots.
- Select Delete all snapshots.
You Should Know: Blocking Recall via Firewall & Additional Security Measures
Block Recall via Windows Defender Firewall
To prevent Recall from syncing with Microsoft servers:
- Open Windows Defender Firewall (
Win + R→wf.msc).
2. Go to Outbound Rules → New Rule.
3. Block the following executables:
– `Recall.exe`
– `Copilot.exe`
– `Microsoft.Telemetry` (optional)
Alternative: Use GlassWire for Network Monitoring
- Install GlassWire (https://www.glasswire.com).
- Monitor and block suspicious connections from Recall-related processes.
Linux Alternative: Disabling Unwanted Tracking
If using WSL (Windows Subsystem for Linux), ensure no background telemetry is running:
sudo systemctl disable diagnostics.azure.com --now
Check Running Processes in Windows
Open Command Prompt (Win + R → cmd) and run:
tasklist | findstr "Recall"
If any process is found, terminate it:
taskkill /IM Recall.exe /F
What Undercode Say
Microsoft’s Recall is a double-edged sword—useful for productivity but risky for privacy. Disabling it via Group Policy, Registry, or Firewall ensures your data isn’t silently logged. For Linux/WSL users, disabling telemetry adds extra security. Always monitor running processes and block unnecessary network traffic to stay safe.
Expected Output:
- Recall disabled via Settings, GPO, or Registry.
- Firewall blocking Recall.exe & Copilot.exe.
- No residual snapshots stored locally.
- No unauthorized background processes running.
Related URLs:
References:
Reported By: Feroz Khan – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
