Set a list of URIs to be filtered from snapshots for Recall
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: At least Windows 11 Pro, Enterprise, or Education with Windows Sandbox
Path in the GPO console
Computer Configuration\Administrative Templates\Windows Components\Windows AI User Configuration\Administrative Templates\Windows Components\Windows AI Description
This policy setting lets you define a list of URIs that won't be included in snapshots for Recall when a supported browser is used. People within your organization can use Recall settings to add more websites to the list. Define the list using a semicolon to separate URIs. For example: https://www.Contoso.com;https://www.WoodgroveBank.com;https://www.Adatum.com Adding https://www.WoodgroveBank.com to the list would also filter https://Account.WoodgroveBank.com and https://www.WoodgroveBank.com/Account. Important: This setting applies to Enterprise and Education client SKUs only. Changes to this policy take effect after device restart.
Registry
HKLM
SOFTWARE\Policies\Microsoft\Windows\WindowsAI HKCU
SOFTWARE\Policies\Microsoft\Windows\WindowsAI Value name: SetDenyUriListForRecall
MDM / Intune (CSP)
Device
./Device/Vendor/MSFT/Policy/Config/WindowsAI/SetDenyUriListForRecall User
./User/Vendor/MSFT/Policy/Config/WindowsAI/SetDenyUriListForRecall Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
Applying both scopes creates an ambiguous configuration (computer takes precedence over user). Only do this intentionally.
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Set a list of URIs to be filtered from snapshots for Recall
; State: Enabled
; Scope: Computer (HKLM)
; Supported on: At least Windows 11 Pro, Enterprise, or Education with Windows Sandbox
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsAI]
"SetDenyUriListForRecall"=dword:00000001
"DenyUriListForRecall"=""More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Set a list of URIs to be filtered from snapshots for Recall
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: At least Windows 11 Pro, Enterprise, or Education with Windows Sandbox
$path = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'SetDenyUriListForRecall' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'DenyUriListForRecall' -Value '' -Type StringIntune XML
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/WindowsAI/SetDenyUriListForRecall
Data type: String
Value:
<enabled/>
<data id="SetDenyUriListForRecall_Name" value=""/>Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Set a list of URIs to be filtered from snapshots for Recall
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: At least Windows 11 Pro, Enterprise, or Education with Windows Sandbox
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI' -Name 'SetDenyUriListForRecall' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI' -Name 'DenyUriListForRecall' -Expected '' -Kind String)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Set a list of URIs to be filtered from snapshots for Recall
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: At least Windows 11 Pro, Enterprise, or Education with Windows Sandbox
$path = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'SetDenyUriListForRecall' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'DenyUriListForRecall' -Value '' -Type StringSCCM scripts
# Exported from gporais.com
# Policy: Set a list of URIs to be filtered from snapshots for Recall
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: At least Windows 11 Pro, Enterprise, or Education with Windows Sandbox
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Set a list of URIs to be filtered from snapshots for Recall
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: At least Windows 11 Pro, Enterprise, or Education with Windows Sandbox
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI' -Name 'SetDenyUriListForRecall' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI' -Name 'DenyUriListForRecall' -Expected '' -Kind String)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Set a list of URIs to be filtered from snapshots for Recall
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: At least Windows 11 Pro, Enterprise, or Education with Windows Sandbox
$path = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'SetDenyUriListForRecall' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'DenyUriListForRecall' -Value '' -Type StringBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.