[German]There are currently discussions that Microsoft's controversial Recall feature cannot be uninstalled [without collateral damage] under Windows 11 24H2, contrary to Microsoft's promise – but this is currently still in flux. In addition, Microsoft seems to have introduced something like "poor mans recall" in the snipping tool in Windows. I'll take up the two facts here in the article and summarize what I currently know.
The recall fiasco in retrospect
The Recall feature allows Windows to constantly take screenshots of the user's screen and use a generative AI model to process the data and make it searchable. Microsoft's promise was that the user would then only have to type in a keyword to find out when they might have done something or where the documents with that keyword can be found on their computer.
In the blog post Microsoft's AI PC with Copilot – some thoughts – Part 1, I first discussed Recall as part of the "Copilot+PC" concept presented by Microsoft. With Recall, "a surveillance feature" is implemented in Windows that precisely records everything the user does and then makes it searchable. The computer that once started out as a "personal PC" then no longer has anything personal about it – everyone becomes transparent – a nightmare for every user.
Security researchers tore the concept apart and Microsoft was forced to withdraw Recall and fundamentally revise it. I took up that in the article Copilot+AI: Recall, a security disaster – AI-assisted theft. At the beginning of September 2024, Recall was reintroduced via an update in Windows 11 24H2 (see Windows 11 24H2: Update KB5041865 ships Recall).
Microsoft promise: Recall can be uninstalled
On September 27, 2024, David Weston, Vice President Enterprise and OS Security at Microsoft, explained the fixes to the new version of Recall in more detail in the article Update on Recall security and privacy architecture.
I had noted from this post that Recall is provided as an opt-in during setup – only for Copilot+ PCs according to my reading. According to Microsoft, users should have the option of deciding whether to save snapshots with Recall.
If a user decides against the feature, Recall will be switched off and no snapshots will be taken or saved, they said. And very importantly, Microsoft's promise: users can also remove Recall completely by using the settings for optional features in Windows (see also my blog post Microsoft explains Windows 11 Recall in a revised version).
Windows 11 24H2: Recall cannot simply be uninstalled
Back on October 12, 2024, a blog reader on X pointed out the following tweet to me. Youtuber Chris Titus Tech, explains that Recall is delivered on every system with Windows 11 24H2 – and not just on Copilot+ PCs.
He asks why the feature, which supposedly cannot be used on x86 systems, is nevertheless activated and installed on Windows 11 24H2? The individual states that he cannot yet say what the feature does in his system.
But Titus has noticed that the Recall function is included and integrated into File Explorer. When he then tried to uninstall Recall – as promised – it "destroyed Explorer" on his Windows 11 24H2. *1)
There is a discussion on GitHub on the topic. According to previous findings, Recall is deeply interwoven into Windows as a system tool and cannot be removed in the future. However, the function is currently still deactivated.
The colleagues from deskmodder state in this German article that Explorer is not broken by the uninstallation. Its display "falls back" to the old Windows version (probably because individual features that are required for the new Explorer display are broken as a result of the uninstall).
*1) Youtuber Chris Titus Tech discusses the details in the video Microsoft Recall is MANDATORY. Recall functions are integrated in the shell – i.e. in explorer.exe. Titus says (as far as I understand it) that there are dependencies (in Explorer, in search, in RDP etc.) – so that the Recall components must be left in Windows. They should then be "deactivated" instead. At the moment, the whole thing is probably a major construction site for Microsoft and the big question that Titus is asking is "what does Microsoft do with all the recall stuff?" – which brings us back to the question "Microsoft is currently promising a lot, but I don't see how much of that can be kept in the long term."
Poor man's Recall within the Snipping Tool
On October 9, 2024, a blog reader contacted me by email and wrote that he had noticed something strange about the Snipping Tool, which can be found in Windows. He inspected the Snipping Tool version 11.2401.37.0 (thanks for that).
Due to the message that in Windows 11 24H2 the path of the Snipping Tool can be adjusted with regard to the storage of images, the reader became curious and went looking for a corresponding setting option in Windows 11 23H2. In doing so, he came across something he describes as "Poor man's Recall".
In the settings of the snipping tool, there is an option to Automatically save screenshots, which is highlighted in red in the image above. The setting is also mentioned in this MS Answers forum post from October 6, 2024. This option was active by default on 90% of all Windows 11 clients that the reader checked. I installed Windows 11 24H2 yesterday in a fresh virtual machine, and the option was set to On.
Older versions of the Snipping Tool do not have this feature. I looked at Windows 10 version 1909 IoT Enterprise LTSC and the settings page with the options looks completely different. The above page was only introduced with newer versions of the Snipping Tool – the reader is using version 11.2401.37.0.
And in this version, the automatic recording of screenshots is active by default, according to the reader's analysis. He says "The bad thing is, in my opinion, nobody knows that" – and I agree with the reader. He wrote: "There were clients where there were sometimes 5000+ images in the default folder of the snipping tool". There's no need to mention how critical this can be.
The reader states that no GPO has yet been found to deactivate this option. However, it should be possible to deactivate it via a config file of the snipping tool.
Similar articles:
Copilot+AI: Recall, a security disaster – AI-assisted theft
Microsoft improves AI feature Recall and adds "security measures" – is that enough?
Windows 11 Copilot+PC will be released without recall
Windows 11: Recall to get a second chance, coming in October 2024 as a preview for Insiders
Windows 11 24H2: Update KB5041865 ships Recall
Microsoft explains Windows 11 Recall in a revised version
Microsoft's AI PC with Copilot – some thoughts – Part 1
Windows 11 24H released (Oktober 1, 2024)
Windows 11 24H2: Numerous show-stoppers and known bugs
Windows 11 24H2: Serious issues after upgrade
Windows: DirectAccess discontinued; Always On VPN recommended
Attention: Windows 11 24H2 changed default settings for standby
Windows 11 24H2: Administrative templates (.admx)
Windows 11 24H2: Activation lost?
Windows 11 24H2: SMB read/write transfer rate extremely slow?
Windows 11 24H2: Issues with VPN connections, Direct Access …
Windows 11 24H2: Recall can't be uninstalled; and "poor mans recall" found
