Don't launch privacy settings experience on user logon
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: At least Windows Server 2016, Windows 10 Version 1809
Path in the GPO console
Computer Configuration\Administrative Templates\Windows Components\OOBE User Configuration\Administrative Templates\Windows Components\OOBE Description
When logging into a new user account for the first time or after an upgrade in some scenarios, that user may be presented with a screen or series of screens that prompts the user to choose privacy settings for their account. Enable this policy to prevent this experience from launching. If this policy is enabled, the privacy experience will not launch for newly-created user accounts or for accounts that would have been prompted to choose their privacy settings after an upgrade. If this policy is disabled or not configured, then the privacy experience may launch for newly-created user accounts or for accounts that should be prompted to choose their privacy settings after an upgrade.
Registry
HKLM
Software\Policies\Microsoft\Windows\OOBE HKCU
Software\Policies\Microsoft\Windows\OOBE Value name: DisablePrivacyExperience
Enabled: DisablePrivacyExperience = 1
Disabled: DisablePrivacyExperience = 0
MDM / Intune (CSP)
Device
./Device/Vendor/MSFT/Policy/Config/Privacy/DisablePrivacyExperience User
./User/Vendor/MSFT/Policy/Config/Privacy/DisablePrivacyExperience Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
CSP values
-
0 (Default)- Allow the 'choose privacy settings for your device' screen for a new user during their first logon or when an existing user logs in for the first time after an upgrade. -
1- Don't allow the 'choose privacy settings for your device' screen when a new user logs in or an existing user logs in for the first time after an upgrade.
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
Applying both scopes creates an ambiguous configuration (computer takes precedence over user). Only do this intentionally.
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Don't launch privacy settings experience on user logon
; State: Enabled
; Scope: Computer (HKLM)
; Supported on: At least Windows Server 2016, Windows 10 Version 1809
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\OOBE]
"DisablePrivacyExperience"=dword:00000001More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Don't launch privacy settings experience on user logon
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: At least Windows Server 2016, Windows 10 Version 1809
$path = 'HKLM:\Software\Policies\Microsoft\Windows\OOBE'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisablePrivacyExperience' -Value 1 -Type DWordIntune XML
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Privacy/DisablePrivacyExperience
Data type: String
Value:
<enabled/>Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Don't launch privacy settings experience on user logon
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: At least Windows Server 2016, Windows 10 Version 1809
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\OOBE' -Name 'DisablePrivacyExperience' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Don't launch privacy settings experience on user logon
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: At least Windows Server 2016, Windows 10 Version 1809
$path = 'HKLM:\Software\Policies\Microsoft\Windows\OOBE'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisablePrivacyExperience' -Value 1 -Type DWordSCCM scripts
# Exported from gporais.com
# Policy: Don't launch privacy settings experience on user logon
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: At least Windows Server 2016, Windows 10 Version 1809
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Don't launch privacy settings experience on user logon
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: At least Windows Server 2016, Windows 10 Version 1809
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\OOBE' -Name 'DisablePrivacyExperience' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Don't launch privacy settings experience on user logon
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: At least Windows Server 2016, Windows 10 Version 1809
$path = 'HKLM:\Software\Policies\Microsoft\Windows\OOBE'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisablePrivacyExperience' -Value 1 -Type DWordBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.