Windows Lockdown Checklist for Remote / Unattended / Gateway PCs

A practical, operator-centric baseline for Windows 10 and Windows 11

1. Account & Sign-In

Use local accounts only Disable Microsoft account sign-in prompts Disable OneDrive setup prompts Disable passwordless sign-in suggestions

Why: Prevents cloud sync, Store personalization, and background chatter.

2. Network Discipline

Set the primary network to Metered Connection Turn OFF: Download updates over metered connections Turn OFF: Receive updates for other Microsoft products Disable Wi-Fi Sense / Hotspot 2.0 (if Wi-Fi is used)

Why: Prevents large updates, Store traffic, and background downloads.

3. Windows Update Control

Disable automatic driver updates Disable feature updates Disable optional updates If using Windows 10 ESU: manually trigger updates only when needed If Windows 11: pause updates for 5 weeks, renew as needed

Why: Keeps bandwidth predictable and prevents surprise reboots.

4. Disable Cloud-Driven Features

Windows 10:

Taskbar → News and Interests → Turn off Start Menu → Turn off Live Tiles

Windows 11:

Settings → Personalization → Taskbar → Widgets OFF Settings → System → Notifications → Turn off: Windows welcome experience Tips and suggestions Suggested content

Why: These features constantly poll MSN and Microsoft endpoints.

5. Microsoft Store

Turn OFF Store auto-updates Windows 10 local accounts: Use Windows Update → Advanced options → Receive updates for other Microsoft products → OFF Disable background Store activity Avoid signing into the Store

Why: Store updates are huge and unpredictable.

6. Background Apps & Telemetry

Settings → Apps → Installed apps → Set Background app permissions → Never Settings → Privacy → Diagnostics & feedback: Turn off Tailored experiences Turn off Improve inking & typing Disable advertising ID

Why: Cuts down telemetry and background sync.

7. OneDrive

Uninstall OneDrive Or disable it via Group Policy Or block it via firewall

Why: OneDrive is one of the biggest background traffic generators.

8. Services to Disable (Safe for SYSOP Environments)

Connected User Experiences and Telemetry RetailDemo Service Windows Error Reporting Service Xbox services (Game Bar, Game DVR, etc.) Print Spooler (if no printer is attached)

Why: Reduces chatter and attack surface.

9. Browser Lockdown

Avoid browsing from the remote PC Use your main PC to download Winlink/VARA updates Transfer via remote-access file transfer

Why: Eliminates the highest-risk activity on an out-of-support OS.

10. Firewall Hardening

Block outbound traffic for: Widgets News feeds OneDrive Xbox Microsoft consumer services Allow only: Winlink VARA Remote-access tool Windows Update (if ESU is used)

Why: Ensures the machine only talks to what it needs.

11. Reliability & Power

Enable auto-restart after power loss in BIOS Disable Fast Startup Disable Sleep / Hibernation Set NIC to not power-down on idle

Why: Ensures the gateway comes back after outages — critical in rural sites.

What This Checklist Achieves

Predictable bandwidth usage Minimal attack surface No cloud chatter No surprise updates No Store traffic No MSN feeds No OneDrive sync Stable, unattended operation Perfect for Winlink gateways, VARA nodes, and rural deployments

This is the exact kind of list that other SYSOPs will appreciate — practical, field-tested, and focused on operator control rather than Microsoft defaults.

If you want, I can turn this into a one-page printable version or a step-by-step guide you can hand out at club meetings or include in documentation for new gateway operators.