3

Even with all the privacy, sync, and p2p settings off, using an offline account, I don't feel safe using Windows 10 for a business. I would like to restrict its ability to communicate to Microsoft (or vice versa) as much as I can.

Is there a list, or any way info out there, about what IP's Windows 10 is using to, for lack of better words, "phone home"? Or is there some way I can find/initiate the push listeners and see incoming? It seems mysteriously sparse in the resource monitor considering the amount of junk that's internet facing. I would like to block all possibilities of push/pull besides updates. However I don't know the plethora of "connected" services available in Win 10 yet and I feel that they would use massive ranges of IP's [v6] or proxies, which would be hard to capture fully. Or perhaps they may even mask com in some abstract layer, underneath the reach of monitors such as netstat or Fiddler.

So far I see some, svchost (netsvcs) perma connected occasionally calling system using the classic 157.56.106.189 range and some new IPv6, then there is system using MS limited in europe at 94.245.121.253 (I'm in USA), followed by system hitting MS denver 64.4.54.254. Im sure there are plenty more of these too that pop up. Also there are mysterious system connection bogons that are way out of our network range such as 169.254.255.255, and some other IP's I've seen checking in for just a second.

Do you know any more IP's like these? Any insights on how to force stop the non-essential communications or what to hardware firewall would be very much appreciated.

Improve this question
8
  • 2
    Fundamentally if you don't trust Microsoft to some degree here, you'd be better off not using Windows 10 or otherwise, as realistically specific IP address ranges could be changed at any time.
    – Rory McCune
    Aug 18, 2015 at 15:42
  • 1
    @Roy McCune Yeah thats what I'm thinking too -- a futile battle, especially considering the gigantic range of ipv6 or proxies available. Figured it wouldn't hurt to ask regardless. A few people at work clicked yes to install the Win10 update...rollback to Win7 could be the best solution for this.
    – dhaupin
    Aug 18, 2015 at 15:49
  • Why would you roll back - Microsoft has long had the ability to do this. Win10 just has the defaults set a little oddly.
    – Rory Alsop ♦
    Aug 18, 2015 at 15:50
  • @RoryAlsop Yeah noticed some of the same sockets open in Win7, although I only slightly disagree due to a lack of perma rooted Onedrive, no Bing search/indexing integration, and no "predictive" abilities such as Cortana, it seems less liable on the surface, albeit a farce too. They don't wanna go the *nix route here since they still are software based accounting and things, so Win is what we gotta live with I suppose.
    – dhaupin
    Aug 18, 2015 at 15:54
  • 2
    I do not think rolling back to Win7 would solve your worries: how could you even trust an operating system of which you have no idea how it is coded?
    – user45139
    Aug 18, 2015 at 16:16

4 Answers 4

Reset to default
3

As mentioned in comments, I think that ultimately you can't block all avenues an OS vendor may use to gather information from a machine, ultimately if you don't trust them the only avenue is to use a different OS.

With that said there are some things you can do to try and reduce exposures for Windows 10 specifically.

This script contains a good list of changes including a list of hosts to block which you could use to reduce potential information leaks. Obviously you should read/understand all the changes before using it, as it may affect the operation of the OS.

Improve this answer
1
  • Totally agree on switching OS. That script is much needed for Onedrive removal alone (instead of using linux to do it), and the hosts seem very encompassing. Thanks man.
    – dhaupin
    Aug 19, 2015 at 15:48
6

Since I think this is a battle you can't win, I've resorted to simply not having Internet available by default for my Windows 10 box. Instead, to get access to the internet, you have to go through a firewall with a proxy setup.

If an Application needs internet access, I configure its proxy server settings (but NOT the native Windows proxy). This covers 99% of my needs, as Firefox, Chrome (with plugin) and Thunderbird all have these settings available.

For the other 1% of my Internet needs, I configure the firewall to allow certain IP ranges only (for a few games I play).

This also convienently blocks almost anything that normally annoys me (applications that are not supposed to use the Internet, incessant checking for updates, giving me news, etc..)

Sure, the Tiles etc won't work -- I don't care.

Runs like this for 3 months now, I'm happy.

Improve this answer
1
  • 1
    Update on this: for other use cases I now use Proxifier to allow certain applications to go through a Socks5 proxy. You can configure this on a per executable basis. Windows itself still has no internet access.
    – john16384
    Aug 30, 2017 at 21:09
2

The literal answer to your question is yes. It is possible to block the type of connections you mentioned.

But in practice there is no foolproof way to prevent your networked windows machines from phoning home or taking remote instructions from Microsoft because, fundamentally, Microsoft - not you -owns your machines. Microsoft's abilities to see your data and change your system are baked into the OS at a basic level and cannot be meaningfully circumvented while retaining normal functionality. In particular, the features of Windows 10 that allow for remote access to and potential manipulation of your files and information have been widely documented and discussed on both stack exchange and the wider Internet.

If you are truly concerned about your privacy and are willing to invest some time and effort I highly recommend investigating the possibility of switching to Debian for a (somewhat) safer, but still user-friendly, environment. But a switch to linux might not be possible for you and if that is the case then you must assume that your data is just as much Microsoft's as it is yours.

Improve this answer
1
  • Agree with the Debian switch. For others reading this, the most vetted Debian distros include Debian itself, Ubuntu, Mint, and ElemantaryOS. Also, in a business environment, you should use the "Long Term Support" (LTS) release(s) for more stable scripts and extended updatability.
    – dhaupin
    Aug 19, 2015 at 15:52
2

While, I am pretty agree with the previous experts that it's the race you can't win, I am also pretty sure you can try :)
There are lists of such IPs and I am proud to present these lists to you:

All lists are updated frequently by these kind Japan guys.

Improve this answer
1
  • Thanks you + kind Japan guys. That ambiguous subdomain range is helpful to understand, esp at the edge.
    – dhaupin
    Feb 14, 2017 at 3:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .