How to Completely Disable ‘Device Metadata Retrieval’ via Group Policy in Windows 11

Windows 11 features a sophisticated automated hardware identification system known as “Device Metadata Retrieval.” When a new peripheral (such as a printer, mouse, or specialized USB device) is connected, the OS automatically contacts Microsoft servers (WMIS-Windows Metadata and Internet Services) to download high-resolution icons, specialized applets, and detailed device capability XML files to populate the “Devices and Printers” interface. While this provides a rich, visually appealing user experience in consumer environments, it represents a massive data exfiltration and network telemetry risk in strict enterprise, military, or zero-trust deployment environments. In highly secure, air-gapped, or heavily monitored networks, allowing the OS to arbitrarily transmit hardware identification strings (Hardware IDs) to external Microsoft servers every time a USB device is enumerated is completely unacceptable, as it exposes internal hardware topologies to external telemetry.

This guide explains how to completely disable ‘Device Metadata Retrieval’ via Group Policy in Windows 11, enforcing a strict zero-trust model where all automated hardware telemetry to Microsoft servers is cryptographically blocked.

Disable Device Metadata Retrieval via Group Policy

To enforce a strict block that permanently neutralizes the OS’s ability to ping external servers for hardware metadata globally, we must deploy an administrative template. Note that this requires Windows 11 Pro, Enterprise, or Education editions.

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, strictly follow this exact path:

   Computer Configuration > Administrative Templates > System > Device Installation

5. In the right-hand pane, locate the policy named Prevent device metadata retrieval from the Internet.
6. Double-click the policy to open its configuration window.
7. Select the radio button next to Enabled. (By explicitly enabling this policy, we instruct the Windows kernel and the Plug and Play (PnP) subsystem to permanently sever all outbound API calls to WMIS servers, forcing the OS to rely exclusively on local, generic icons and drivers).
8. Click Apply, then click OK.

Verify the Configuration Lockdown

Group Policy changes affecting the PnP subsystem require the system to refresh its configuration.

To force the policy update immediately across the OS, open Command Prompt as Administrator and run gpupdate /force. To verify the restriction is active, open the classic Control Panel and navigate to “Devices and Printers,” or open Settings > Bluetooth & devices. Connect a new, unrecognized USB peripheral (like a flash drive or mouse). The OS will instantly apply a generic icon and standard driver without any delay, and packet capture tools (like Wireshark) will confirm that zero outbound HTTPS requests were made to Microsoft telemetry servers regarding the new hardware. The Windows 11 workstation is now cryptographically bound to a strict, offline hardware enumeration state.