To lock down OneDrive privacy on Windows in 2026, set the TelemetryLevel registry value to 1 at HKCU:\Software\Microsoft\OneDrive, disable personalized recommendations, and exclude sensitive file types like .env, .pem, and .key from sync. These three changes address the most significant data exposure risks. This guide walks through every privacy setting available through the GUI, registry, and PowerShell automation, with scripts you can deploy across multiple machines.

Understanding OneDrive Data Collection

OneDrive synchronizes files across devices, but it also transmits usage telemetry, diagnostic data, and file metadata to Microsoft’s servers. The application collects information about sync activity, file types, folder structures, and occasionally shares data with other Microsoft services like Cortana and search indexing.

For developers working with sensitive code, proprietary documents, or regulated data, this telemetry represents a privacy concern. While Microsoft has improved transparency in recent years, the default configuration still errs on the side of data collection.

Accessing OneDrive Settings

The primary interface for OneDrive configuration lives in the system tray. Right-click the OneDrive icon and select Settings to access the main configuration window. However, many privacy-critical options remain hidden or require additional configuration methods.

The Settings window provides basic toggles for startup behavior, sync management, and account selection. For granular control, you need to explore the hidden settings accessible through direct configuration.

Disabling Telemetry Through Settings

Within the OneDrive Settings dialog, navigate to the Account tab. Here you find options controlling what syncs to the cloud. Disable any features you do not actively use—particularly those linking OneDrive to other Microsoft services.

Under the Network tab, ensure your connection settings align with your network requirements. For developers working with limited bandwidth or air-gapped systems, understanding these settings prevents unexpected data transmission.

Registry-Based Configuration

Windows stores many OneDrive privacy settings in the registry. Administrators and developers can modify these directly for system-wide control or scripted deployment.

The primary registry key for OneDrive settings resides at HKEY_CURRENT_USER\Software\Microsoft\OneDrive. Within this key, you find configuration values controlling sync behavior, telemetry, and integration features.

To disable OneDrive telemetry completely, you can modify the following registry values:

# Disable OneDrive telemetry via registry
$oneDriveKey = "HKCU:\Software\Microsoft\OneDrive"

# Set telemetry level to basic (1 = basic, 2 = enhanced, 3 = full)
Set-ItemProperty -Path $oneDriveKey -Name "TelemetryLevel" -Value 1

# Disable account-based personalization
Set-ItemProperty -Path $oneDriveKey -Name "DisablePersonalizedRecommendations" -Value 1

# Disable sharing through Microsoft services
Set-ItemProperty -Path $oneDriveKey -Name "DisableSharePointIntegration" -Value 1

These registry modifications require a restart of the OneDrive client to take effect. For enterprise deployments, you can apply these settings through Group Policy or deployment scripts.

Managing Sync Scope Programmatically

Developers often need precise control over which folders OneDrive synchronizes. The command-line interface provides granular control beyond the GUI.

Using PowerShell, you can manage sync exclusions and selective sync settings:

# Get current OneDrive configuration
Get-ItemProperty -Path "HKCU:\Software\Microsoft\OneDrive\Accounts\Personal" | Select-Object -Property UserId, DisplayName

# List excluded directories
Get-ItemProperty -Path "HKCU:\Software\Microsoft\OneDrive\SyncEngine\Settings" -Name "ExcludedFileExtensions" | Format-List

# Add exclusion for specific file extensions (example: sensitive configs)
$currentExclusions = Get-ItemProperty -Path "HKCU:\Software\Microsoft\OneDrive\SyncEngine\Settings" -Name "ExcludedFileExtensions"
$newExclusions = $currentExclusions.ExcludedFileExtensions + @(".env", ".pem", ".key")
Set-ItemProperty -Path "HKCU:\Software\Microsoft\OneDrive\SyncEngine\Settings" -Name "ExcludedFileExtensions" -Value $newExclusions

This approach lets you exclude sensitive file types from cloud synchronization automatically during system setup or through configuration management tools.

Blockading File Preview and Thumbnails

OneDrive generates thumbnails and previews for documents, images, and other file types. This processing occurs on Microsoft’s servers for certain file types, potentially exposing data externally.

To minimize thumbnail generation, adjust the view settings within OneDrive:

  1. Right-click the OneDrive system tray icon
  2. Select Settings > Account
  3. Disable “Show thumbnails of your photos”

For organizations, you can enforce this setting through Group Policy by blocking the thumbnail service at the enterprise level.

Disabling OneDrive Integration in Windows Explorer

Windows Explorer displays OneDrive status indicators on synced files. While convenient, this integration can expose synchronization status and create additional network activity when browsing files.

You can disable these shell extensions through the registry:

# Disable OneDrive shell integration
$shellKey = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"

# Remove OneDrive from navigation pane
Set-ItemProperty -Path $shellKey -Name "ShowOneDrive" -Value 0

# Prevent OneDrive from handling files
Set-ItemProperty -Path $shellKey -Name "SyncProvider" -Value 0

This prevents Windows Explorer from communicating with OneDrive for status updates and file handling.

Using Local Accounts for Maximum Privacy

For highest privacy, consider running OneDrive with a local Microsoft account rather than an Azure AD identity. This reduces the association between your file data and organizational identity.

However, note that some enterprise features require Azure AD authentication. If your organization manages your device through Intune or Group Policy, certain privacy settings may be locked or overridden by domain policy.

Automating Privacy Configuration

PowerShell scripting enables consistent privacy hardening across multiple machines. Here’s a comprehensive script for applying recommended privacy settings:

# OneDrive Privacy Hardening Script
param(
    [switch]$DisableAll = $false
)

$ErrorActionPreference = "Stop"

function Set-OneDrivePrivacySetting {
    param($Name, $Value)
    
    $key = "HKCU:\Software\Microsoft\OneDrive"
    if (-not (Test-Path $key)) {
        New-Item -Path $key -Force | Out-Null
    }
    
    Set-ItemProperty -Path $key -Name $Name -Value $Value -Type DWord
    Write-Host "Set $Name to $Value"
}

# Disable telemetry
Set-OneDrivePrivacySetting -Name "TelemetryLevel" -Value 1

# Disable personalization
Set-OneDrivePrivacySetting -Name "DisablePersonalizedRecommendations" -Value 1

# Disable sharing integration
if ($DisableAll) {
    Set-OneDrivePrivacySetting -Name "DisableSharePointIntegration" -Value 1
    Set-OneDrivePrivacySetting -Name "DisableOfficeIntegration" -Value 1
}

Write-Host "OneDrive privacy settings applied. Restart OneDrive to apply changes."

Run this script with administrator privileges and restart the OneDrive process afterward. The -DisableAll parameter removes all Microsoft service integrations for maximum privacy.

Verification and Testing

After applying privacy settings, verify the configuration is active. The OneDrive Settings dialog should reflect your changes, and you can check the registry directly to confirm:

# Verify privacy settings
$key = "HKCU:\Software\Microsoft\OneDrive"
Get-ItemProperty -Path $key | Select-Object TelemetryLevel, DisablePersonalizedRecommendations

Additionally, monitor network traffic using tools like Wireshark or Windows Performance Monitor to confirm no unexpected connections to Microsoft servers occur during idle periods.

Conclusion

OneDrive provides valuable cloud synchronization capabilities, but default privacy settings may not align with developer and power user requirements. Through a combination of GUI settings, registry modifications, and PowerShell automation, you can significantly reduce telemetry and data exposure while maintaining productive sync functionality.

For teams managing multiple systems, integrate these privacy configurations into your imaging and deployment processes. Regular review of OneDrive settings remains important as Microsoft periodically updates the application and its default behaviors.

Review these related guides for additional privacy hardening:

Built by theluckystrike — More at zovo.one