How to Audit AI App Permissions on Windows 11

To audit AI access on Windows 11, start in Settings > Privacy & security, then check Recall, installed apps, startup apps, browser extensions, agent configs and stored keys. Privacy settings cover less than many people expect, because classic desktop apps usually run with your account's normal file access. So the most useful question is often which AI apps are installed at all.

This guide takes about 20 minutes. Keep a short list of each AI app you find and whether you still need it. Menu names can differ slightly by Windows build, and a work device may have some settings locked by IT.

Why Windows permissions work differently

Windows shows per-app controls mainly for apps from the Microsoft Store and similar packaged apps. Desktop apps behave differently, in three ways:

• Microsoft says desktop apps cannot be individually toggled on the camera and microphone pages. One switch covers them all.
• Microsoft also warns that desktop apps may not appear in those lists, and may still reach the camera or microphone when the settings are off.
• The file system setting does not affect certain programs, such as those downloaded from the internet or installed from media.

So a clean privacy page does not prove an AI desktop app has no reach. Uninstalling it, or limiting what you run under your account, gives you more control.

Step 1: List your AI apps

1. Open Start > Settings > Apps > Installed apps.
2. Scroll through the list and note every AI assistant, note taker, voice tool, coding tool and agent.
3. For anything you no longer use, select More (three dots) > Uninstall.
4. If an app is missing or cannot be removed there, try Control Panel > Programs > Programs and Features. Microsoft documents this route in its uninstall guide.

Step 2: Check privacy settings

Open Start > Settings > Privacy & security. The App permissions section has a page for each type of access. Open each of these in turn:

1. Microphone: turn off apps that should not listen. Note the Let desktop apps access your microphone switch and the list below it. Select an entry to see details of the file that used the microphone.
2. Camera: do the same with Let desktop apps access your camera.
3. File system: turn off apps that should not read all your files.
4. Documents, Pictures and Videos: where shown, check each list.
5. Screenshots and apps: where shown, check which apps can take screenshots of your screen.
6. Text and Image Generation: on recent builds, this page shows apps that recently used on-device AI models from Windows, and lets you choose which are allowed.

Turning off the desktop app switch affects every desktop app on that page, and can affect Windows features such as dictation. If you need the microphone for calls, leave it on and remove the apps you do not trust instead.

Step 3: Check Recall

Recall saves snapshots of your screen so you can search them later. It runs only on Copilot+ PCs that meet Microsoft's requirements. Saving snapshots is opt-in. Snapshots are stored and analyzed on the device, and Microsoft says they are not sent to Microsoft. They can still hold anything that appeared on your screen, so it is worth knowing the state of this setting.

1. Open Settings > Privacy & security > Recall & snapshots. If you do not see the page, your PC may not have Recall.
2. Check whether Save snapshots is on or off. Turn it off if you do not want it.
3. If you keep it on, add sensitive apps and websites to the filter lists.
4. Confirm Sensitive information filtering is on. Microsoft enables it by default.
5. Delete existing snapshots on the same page if you no longer want them.

To remove Recall fully, search the Start menu for Turn Windows features on or off and clear Recall. Microsoft says saved snapshots are deleted when the feature is removed. On managed work devices, Recall is removed by default unless an admin allows it.

Step 4: Check agent features

Windows has preview settings for AI agents, so check whether they are on. The experimental agentic features setting is off by default, and only an administrator can turn it on.

1. Open Settings > System > AI components.
2. Look for Experimental agentic features. It may sit under Agent tools on some builds, and it may not appear on yours.
3. If it is on and you did not choose that, ask who did, then turn it off.

Step 5: Check startup apps

1. Open Start > Settings > Apps > Startup.
2. Turn off AI apps that do not need to run at sign-in.
3. For a deeper look, open Task Manager and check Startup apps.
4. Open Task Scheduler from the Start menu and look for tasks from AI tools you removed.

Step 6: Check browser extensions

1. In Edge, go to edge://extensions.
2. In Chrome, go to chrome://extensions.
3. In Firefox, go to about:addons.
4. Remove AI extensions you do not use. For those you keep, open Details and limit site access.

Our guide to AI browser extensions explains what each permission means.

Step 7: Check agent configs and keys

Coding agents and MCP servers often store settings in your user folder. They run with your rights, so settings here can matter more than any privacy switch.

1. Press Windows + R, type %APPDATA%\Claude and press Enter. Open claude_desktop_config.json if it exists.
2. Check %USERPROFILE%\.cursor\mcp.json and %USERPROFILE%\.claude.json if you use those tools.
3. Read each server's command, args and env entries. Remove servers you do not recognize.
4. Search the Start menu for Edit environment variables for your account. Look for names that contain KEY or TOKEN.
5. Look through project folders for .env files.
6. Rotate any key you find in plain text, then store the new one somewhere safer.

If you prefer not to do all of this by hand, one way to check this quickly is Prycheck. It is a local app that shows AI apps, privacy consents, Recall status, AI extensions, agent configs and plain text keys, and it sends nothing anywhere. It shows what can be reached, not what an app actually does, and it is not an antivirus.

After the audit

• Review your list again after major Windows updates and after you install any AI tool.
• Use a standard user account for daily work, not an administrator account.
• Keep Microsoft Defender or your chosen security software running. An access review does not replace it.
• Confirm that BitLocker or Device Encryption is on, if your edition supports it.

Frequently asked questions

Can I block a single desktop app from my microphone in Windows 11?

Not with the built-in page. The switch for desktop apps applies to all of them together. To stop one app, check its own settings or uninstall it.

Is Recall on by default?

Saving snapshots is opt-in, so it stays off until you choose it. Recall also needs a Copilot+ PC and Windows Hello. You can check the state in Settings > Privacy & security > Recall & snapshots.

Does turning off File system access stop all apps from reading my files?

No. Microsoft notes that certain programs are not affected, such as those downloaded from the internet. Those programs generally have your account's file access, so check their own settings.