Cortana: Block outbound network connections completely

[Batu69]

The integration of Cortana with native search on Windows 10 devices have made the digital assistant, even if not used, a feature that cannot be easily disabled without losing access to search as well.

 

While there are options to use third-party search tools like Everything, XSearch or any of these desktop search programs reviewed here, it is probably not something that most users will resort to.

 

One thing that bothered me ever since Cortana was added to Windows 10 was that it added web search results to search.

I found those to be completely useful as I use search solely to find local items. I have talked about how to turn off web search on Windows before, and how to make the search in Windows 10 really fast.

 

Note: Before anyone jumps in stating that they like Cortana and Web Searches. That's fine, completely. I'm not saying, don't use Cortana or the built-in functionality, but if you don't, then there is little reason to keep it around, is there?

Cortana: Block outbound network connections

There are two types of outbound network connections that Cortana makes: web search, and "network traffic to Bing.com to evaluate if certain Cortana components are up-to-date or not".

I don't want to rehash what I described already, so please check out the link above that leads to a resource that explains how to turn off web search on Windows 10.

 

This article concentrates on the traffic to Bing.com instead.

 

Step 1. Open the Group Policy Editor with a tap on the Windows-key, typing gpedit.msc, and hitting enter.

Navigate to Computer Configuration > Windows Settings > Security Settings > Windows Firewall with Advanced Security > Windows Firewall with Advanced Security > > Outbound Rules (note: skip LDAP name if not present).

Right-click on Outbound Rules and select > New Rule from the selection menu.

 

 

Step 2: This opens the New Outbound Rule Wizard. On the Rule Type page, make sure that Program is selected. Click on the next button.

 

 

Step 3:  Select "this program path" on the Program page, and add the following path using copy and paste to it: %windir%\systemapps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe

Click on Next afterwards.

 

 

Step 4: Make sure "block the connection" is selected on the Action page. This prevents the program from making outbound connections. Click on the next button.

 

 

Step 5: Make sure Domain, Private and Public are checked on the Profile page.

• Domain: Applies when a computer is connected to its corporate domain.
• Private: Applies when a computer is connected to a private network location.
• Public: Applies when a computer is connected to a public network location.

Click on the next button afterwards.

 

 

Step 6: Add a name and an optional description for the new rule, e.g. Block Cortana Outbound Traffic. Click on Finish to close the wizard and add the new rule to the system.

You can hit cancel to prevent the rule from being added to Windows Firewall.

 

 

Step 7:  Right-click on the new rule that you have created in the Group Policy editor, and select properties from the context menu.

 

 

Step 8:  Switch to the "Protocols and Ports" tab, and make sure the following is listed there:

• Protocol Type: TCP
• Local Port: All Ports
• Remote Port: All ports

 

Undo the change

 

To undo the change, right-click on the firewall rule that you have created and select the delete option from the context menu.

Alternatively, useful for testing, select disable this rule instead which makes sure it is not applied but not deleted.

Third-party firewall

While the configuration path to block Cortana outbound connections may be different, the core parameters that you enter when configuring the new firewall rule are the same:

• Program path and name: %windir%\systemapps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
• Rule: Block all outbound traffic
• Protocol: TCP
• Ports: All

 

Credit to

[blueriver649]

Hi Batu69,

 

What the % symbol before and after Windir mean ? Thanks.

[Kalju]

This means that it is a Windows structure directory.

Some of them: http://mydigitalworld.ml/Windows_7_Special_Directories.html

or

https://en.wikipedia.org/wiki/Directory_structure

https://en.wikipedia.org/wiki/Special_folder

[Batu69]

1 hour ago, blueriver649 said:

What the % symbol before and after Windir mean

 

The Windows directory or SYSROOT. This corresponds to the %WINDIR% or %SYSTEMROOT% environment variables. A typical path is C:\Windows.

 

Quote

%windir%

This variable points to the Windows directory (on Windows NT-based operating systems it is identical to the %SystemRoot% variable, above). If the system is on drive C:, then the default values are "C:\WINDOWS" on Windows 95, Windows 98, Windows Me, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008 and Windows 7 and "C:\WINNT" for Windows NT 4, and Windows 2000. Windows NT 4 Terminal Server Edition by default installs to "C:\WTSRV".

 

https://en.wikipedia.org/wiki/Environment_variable