Unsolicited Connections in Windows 11 Pro, aka: it takes a GPO to turn off widgets

How well are you controlling your domain policy or windows workstation images?

Things like the following bother me, especially at scale, just for the traffic component alone. 500 workstations would be making any place between 5000 and 10,000 unsolicited connections.

You could also call this a privacy violation.

You could also call this another case of Windows ignoring its own settings.

I found that the workstation, even if set to not launch widgets would still launch `widgets.exe`

I noticed this because I was wondering why `msedgewebview2.exe` was making dozens of connections to msn at domains for news, windows settings, api, login, and dns queries that are made outside of configured dns methods, policies, and server settings.

[https://pasteboard.co/w3A04VPlUK7l.png](https://pasteboard.co/w3A04VPlUK7l.png)

After closing all other apps and services, double checking settings, `msedgewebview2.exe` would run as a set of six child processes on average, of `widgets.exe`.

`C:\Windows\System32>taskkill /im msedgewebview2.exe /f`

`SUCCESS: The process "msedgewebview2.exe" with PID 10784 has been terminated.`

`SUCCESS: The process "msedgewebview2.exe" with PID 7116 has been terminated.`

`SUCCESS: The process "msedgewebview2.exe" with PID 9084 has been terminated.`

`SUCCESS: The process "msedgewebview2.exe" with PID 9800 has been terminated.`

`SUCCESS: The process "msedgewebview2.exe" with PID 8500 has been terminated.`

`SUCCESS: The process "msedgewebview2.exe" with PID 9784 has been terminated.`

They start right back up since they are spawned by widgets.exe.

Well that's strange, because the news appx app has been uninstalled and no widgets are enabled.

ok, lets export policy..

`LGPO.exe /b C:\temp\ /n backup`

`Creating LGPO backup in "C:\temp\{86BF5418-AAD3-43FF-80F7-995A8D24C735}"`

`C:\temp\{86BF5418-AAD3-43FF-80F7-995A8D24C735}>LGPO.exe /parse /m DomainSysvol\GPO\Machine\registry.pol > machine.txt`

`Parse machine registry.pol: DomainSysvol\GPO\Machine\registry.pol`

I'm just gonna look through that policy with wsl.

`$ grep -iR edge -A3 .`

`./DomainSysvol/machine.txt:MicrosoftEdgeDataOptIn`

`./DomainSysvol/machine.txt-DWORD:0`

`./DomainSysvol/machine.txt-Computer`

`--`

`./DomainSysvol/machine.txt:SOFTWARE\Policies\Microsoft\MicrosoftEdge\BooksLibrary`

`./DomainSysvol/machine.txt-EnableExtendedBooksTelemetry`

`./DomainSysvol/machine.txt-DWORD:0`

`--`

`./DomainSysvol/machine.txt:SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main`

`./DomainSysvol/machine.txt-AllowPrelaunch`

`./DomainSysvol/machine.txt-DWORD:0`

`--`

`./DomainSysvol/machine.txt:SOFTWARE\Policies\Microsoft\MicrosoftEdge\TabPreloader`

`./DomainSysvol/machine.txt-AllowTabPreloading`

`./DomainSysvol/machine.txt-DWORD:0`

`--`

`./DomainSysvol/machine.txt:SOFTWARE\Policies\Microsoft\Windows\EdgeUI`

`./DomainSysvol/machine.txt-DisableHelpSticker`

`./DomainSysvol/machine.txt-DWORD:1`

`$ grep -iR news -A2 .`

**./DomainSysvol/machine.txt:AllowNewsAndInterests**

**./DomainSysvol/machine.txt-DWORD:1**

`--`

`./DomainSysvol/machine.txt:SOFTWARE\Policies\Microsoft\Windows\AppCompat`

`./DomainSysvol/machine.txt-DisableUAR`

`./DomainSysvol/machine.txt-DWORD:1`