Detections
Analytics

18.10.73.1 Ensure 'Allow Recall to be enabled' is set to 'Disabled'

Information

This policy setting controls whether the Recall optional component is available for end users to enable on the system. Microsoft Recall periodically captures screenshots of the system display, creating a searchable timeline of activity including apps, documents, and websites.

The recommended state for this setting is: Disabled.

Saving snapshots of all user activity could result in sensitive information such as passwords or banking details being stored insecurely and making it easily accessible.

Note: Recall isn't available on managed devices by default and individual users can't enable Recall on their own.

Solution

To establish the recommended configuration via GP, set the following UI path to Disabled.

Computer Configuration\Policies\Administrative Templates\Windows Components\Windows AI\Allow Recall to be enabled

Note: This Group Policy path is provided by the Group Policy template WindowsCopilot.admx/adml that is included with the Microsoft Windows 11 Release 25H2 Administrative Templates (or newer).

Impact:

None - this is the default behavior.

If Recall was previously enabled, snapshots that were previously saved on the system will be deleted when this policy is disabled.

See Also

https://workbench.cisecurity.org/benchmarks/26061

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7

Plugin: Windows

Control ID: e0263b2920971c1ece6c5ab9b51f49ead83aea82aa9011f61c6b925007e25a1d