How to Disable Windows Recall on Company Devices

A client reads that Windows now takes screenshots of everything and wants it gone from every laptop by Friday. Recall only exists on Copilot+ PCs, it starts life switched off, and on managed devices Microsoft removes it before anyone signs in. Here's how to disable Windows Recall on company devices in a way that holds after the next feature update, and what to fence off if a team decides to keep it.

What Recall Saves, and Where It Goes

Recall takes a snapshot of the screen every few seconds when the content changes, runs OCR and image analysis on the device, and lets the user search the timeline in plain language. Microsoft's Manage Recall page (updated December 2025) says snapshots are stored and analyzed locally, aren't sent to Microsoft, and can't be opened by IT admins or by other users on the same PC. Each snapshot and its search index are encrypted with keys held by the TPM and tied to the user's Windows Hello identity, inside a Virtualization-based Security enclave.

None of that runs on an ordinary fleet laptop. Recall needs a Copilot+ PC with a 40 TOPS NPU, 16 GB of RAM, 256 GB of storage with 50 GB free, Device Encryption or BitLocker on, and Windows Hello Enhanced Sign-in Security with a fingerprint or face enrolled. Recall reached general availability on Copilot+ PCs on April 25, 2025. If a machine doesn't meet the list, the Recall page in Settings isn't there, which is why half the "how do I disable it" tickets end with "you can't see it because it was never installed".

The privacy questions are fair, though. A snapshot store is a searchable record of every document, chat and web page a user had open. Sensitive information filtering is on by default and skips snapshots when it spots passwords, card numbers and the like, and private browsing in Edge, Chrome, Firefox and Opera is never captured. It's still a screenshot archive, and Microsoft's own documentation calls allowing screenshots of protected content "a general security risk".

Managed Devices Start With Recall Removed

The part that saves you a rollout: on commercially managed devices, Recall is disabled and its files are removed by default. Microsoft's definition of managed covers Enterprise and Education editions, any device joined to a domain or Microsoft Entra, any device with a volume license key, and any device enrolled in an endpoint management tool. Users can't switch it on themselves while it's in that state, and admins can't turn on snapshot saving for a user either. Saving snapshots always needs the user's own opt-in.

Two policies decide the whole thing. Allow Recall to be enabled controls whether the Recall component is present on the device at all. Turn off saving snapshots for Recall controls whether the user is offered the choice to save them. Both have to be set for Recall to work in an organization, and leaving both unconfigured on a managed device keeps it off.

The default only protects devices that count as managed. A Copilot+ laptop someone bought at retail and uses under a BYOD arrangement has Recall available, waiting for that user to opt in. Microsoft's documentation also notes there are no built-in Conditional Access policies in Intune or Entra for Recall, so you can't block sign-in based on it. If the BYOD policy for those clients doesn't mention Recall yet, our BYOD policy template is the place to add a line.

How to Disable Windows Recall With Group Policy

Both settings live under Computer Configuration, Administrative Templates, Windows Components, Windows AI. They shipped in the WindowsCopilot.admx template with the April 2025 update (KB5055627) for Windows 11 24H2, so a domain with an older central store needs the newer ADMX files first.

Set Allow Recall to be enabled to Disabled. That puts the component in a disabled state, removes the Recall files from the device, and deletes any snapshots that were saved. The removal needs a restart. Then set Turn off saving snapshots for Recall to Enabled, which exists under both Computer and User Configuration. It's belt and braces: even if someone later flips the first policy to allow Recall, no snapshots get saved until this one is changed too.

The registry values behind them, for anyone pushing a preference or checking a machine by hand:

code
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsAI
  AllowRecallEnablement   REG_DWORD  0   (0 = Recall not available, 1 = available)
  DisableAIDataAnalysis   REG_DWORD  1   (1 = snapshots never saved)

Set the values through policy rather than by editing the registry directly. A registry write on its own doesn't remove the component, and the next policy refresh overwrites it anyway. If your domain still runs the older Turn off Windows Copilot policy from 2023, leave it in place for the old Copilot pane, but don't expect it to touch Recall. Microsoft lists it as deprecated, and it does nothing for the app-based Copilot either, which our guide to turning off Copilot covers switch by switch.

The Intune and PowerShell Routes

In Intune, open a Settings catalog profile and search the Windows AI category. Both Recall settings are there with the same names as Group Policy, and they apply to Pro as well as Enterprise. If you'd rather write a custom OMA-URI, the paths are ./Device/Vendor/MSFT/Policy/Config/WindowsAI/AllowRecallEnablement with an integer value of 0, and ./Device/Vendor/MSFT/Policy/Config/WindowsAI/DisableAIDataAnalysis with a value of 1. The second one also exists under the ./User path if you assign policies to user groups.

For a single PC, or a script in your RMM, Microsoft documents a PowerShell removal:

powershell
Disable-WindowsOptionalFeature -Online -FeatureName "Recall" -Remove

The -Remove switch is the part that matters. Without it the feature is switched off but its files stay staged, ready to come back with a Enable-WindowsOptionalFeature. To confirm the state afterwards, run Get-WindowsOptionalFeature -Online -FeatureName "Recall" and look for Disabled or DisabledWithPayloadRemoved. On a machine that was never a Copilot+ PC, the command returns nothing useful, and that's the answer: there's nothing to remove.

That's the situation behind this r/WindowsHelp thread, where the Settings page people kept describing didn't exist on the poster's machine:

One route per fleet is enough. Pick policy for anything managed, the PowerShell removal for the odd unmanaged Copilot+ PC that comes through the door, and record which one applies to which client so the next tech doesn't run both.

If You Allow It, Fence It

Some teams will want Recall, and the sales pitch of finding a slide you saw three weeks ago is a good one. If you enable it, the fences are policies too, but check the edition column first: the storage, retention, app and website filters apply to Enterprise and Education only. On Windows 11 Pro you can allow or block Recall and nothing in between.

For Enterprise and Education, Set maximum storage for snapshots used by Recall caps the store at 10, 25, 50, 75, 100 or 150 GB. Left unconfigured, Windows allocates 25 GB on a 256 GB drive, 75 GB on 512 GB and 150 GB on 1 TB or more, and deletes the oldest snapshots when the cap is hit. Set maximum duration for storing snapshots limits retention to 30, 60, 90 or 180 days; the policy reference (September 2026) gives 90 days as the default when nothing is set. Whichever limit is reached first wins.

The two filter lists are the ones worth an afternoon. Set a list of URIs to be filtered from snapshots takes semicolon-separated sites, including the scheme, and filters subdomains and paths under them. Set a list of apps to be filtered from snapshots takes executable names or app IDs. Put the line-of-business app, the password manager and the ticketing system on it. Both take effect after a restart, and users can add to the lists but not remove your entries. Remote Desktop Connection, VMConnect and the Azure Virtual Desktop client are filtered by default, and any app that sets the Windows no-capture display flag stays out of snapshots like it stays out of screen recordings.

There's also a Data Loss Prevention hook, added with the September 2025 update (KB5065789): Set Data Loss Prevention Provider lets Recall drop the specific window a DLP engine flags while keeping the rest of the snapshot. Microsoft Purview endpoint DLP is the only provider listed so far.

This walkthrough from Control Alt Delete Tech Bits shows the Intune side, including where the Recall settings sit in the catalog on Windows 11 25H2:

Verifying Across a Fleet

Policy reports tell you what was sent. The device tells you what happened. This script checks both the policy values and the feature state, and prints one line per machine you can drop into a spreadsheet:

powershell
$p = Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI" -ErrorAction SilentlyContinue
$f = Get-WindowsOptionalFeature -Online -FeatureName "Recall" -ErrorAction SilentlyContinue
"{0},{1},{2},{3}" -f $env:COMPUTERNAME,
    ($p.AllowRecallEnablement -as [string]),
    ($p.DisableAIDataAnalysis -as [string]),
    ($f.State -as [string])

You want 0,1,DisabledWithPayloadRemoved on a managed Copilot+ PC, and an empty feature state on everything that isn't one. Run it after the restart the removal asks for, not before, or you'll log a machine as done while the files are still on disk. With OpenFrame, the same check runs as a script across a client's devices and comes back with each device's output collected in one place.

Do the check after every feature update as well. The r/Windows11 thread below dates from 2024, when Microsoft's first plan made Recall a non-removable part of Windows, and the thread's worry is the reason the removal policy exists at all. The rules changed once; they can change again.

Recall is also one line in a longer list of things a fresh Windows 11 image ships with that a business image shouldn't. If you're building that list, start with our guide to debloating Windows 11, which covers the apps and the policies that keep them from returning.

The Short Version

On managed devices Recall is already removed; set Allow Recall to be enabled to Disabled and Turn off saving snapshots to Enabled anyway, so the state is yours and not a default. Use the PowerShell removal with -Remove on unmanaged Copilot+ PCs. If a client keeps Recall, cap storage and retention, filter the sensitive apps and sites, and check the feature state after every restart and every feature update. For the rest of the Copilot pieces, our guide to uninstalling Copilot picks up where this one stops.