iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The right way to block an AI agent depends on what it is. For Windows’ experimental Copilot Actions, disable Settings > System > AI components > Agent tools > Experimental agentic features. For a listed Windows app, use Settings > Privacy & security > File system to revoke access globally or per app. If the program is a desktop application that does not appear there, those controls may not apply; use the app’s own settings, uninstall it, or run it in Windows Sandbox when you do not trust it.
Identify which kind of AI agent you are stopping
Windows does not have one universal switch that blocks every AI agent from every file and application. The control you need depends on how the agent runs:
- Windows’ experimental Copilot Actions: controlled by a dedicated feature switch and a preview agent account.
- An app listed in Windows file-system privacy settings: controlled globally for the signed-in account or individually for entries shown in the list.
- A traditional desktop (Win32) application: often outside the privacy list, with access that Windows’ ordinary app-permission page cannot generally restrict.
- Untrusted Win32 software: best handled by running it in Windows Sandbox, where its files and state are discarded when the sandbox closes.
Before changing anything, find the agent’s executable or product name in Settings > Apps > Installed apps, Task Manager, or the agent’s own settings. A browser tab, Store-style app, desktop executable, and Windows feature can be subject to different permission models.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Choose the control that matches your situation
| Control | What it covers | Scope | Does it block ordinary desktop programs? | Type of protection |
|---|---|---|---|---|
| Experimental agentic features switch | Windows Copilot Actions during its experimental preview | Windows feature; preview agent account and workspace | Not a general desktop-app control | Turns the feature off |
| File-system privacy settings | Most apps represented in the Windows list | All covered apps for the signed-in user, or selected listed apps | No. Some desktop programs are absent and unaffected | Ongoing permission change |
| App’s own privacy or account settings | Whatever controls the developer provides | Usually that application, account, or workspace | Potentially, but behavior varies | Application-specific |
| Windows Sandbox | An application run inside an isolated Windows desktop | One sandbox session | It isolates the run rather than changing the host app’s permissions | Temporary isolation; state is deleted on close |
The distinction matters: revoking a listed app’s file-system permission changes what that app can request in the normal Windows session. Sandbox instead gives you a disposable environment for a particular run. Microsoft describes the agentic controls as preview features, so labels and behavior can change.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Turn off Windows Copilot Actions and experimental agentic features
If the agent is Windows’ experimental Copilot Actions feature, disable the feature itself rather than relying on the general privacy page. Microsoft’s instructions are documented in its Experimental Agentic Features support article.
- Open Settings.
- Select System.
- Open AI components.
- Select Agent tools.
- Turn off Experimental agentic features.
Microsoft says this feature is disabled by default and that enabling the setting activates it. If the switch is already off, Copilot Actions is not being enabled through that Windows preview control. A third-party desktop agent may still be running independently, so inspect installed applications and startup entries if you continue to see activity.
Understand the preview’s account and workspace boundaries
During the documented preview, Copilot Actions runs under a separate standard agent account rather than your signed-in account. Microsoft describes a limited set of known folders, including Documents, Downloads, Desktop, and Pictures, along with resources available to all system accounts. Access outside those locations requires user authorization. The implementation is described in Microsoft Learn’s Windows 11 security book: Agentic security.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
That scope is not a promise that every future release or third-party agent will behave the same way. Review any shared-folder permissions you granted to the agent and revoke them when the task is complete. The preview also describes visibility into activity and prompts for approval for sensitive actions or important decisions; treat those as characteristics of the preview, not as a universal safeguard.
Microsoft states the intended principle this way: “An agent starts with limited permissions and only obtains access to resources you explicitly provide permission to, like your local files.” The surrounding documentation explains that the details depend on the preview implementation.
Revoke file access for apps shown in Windows privacy settings
For an app that appears in Windows’ file-system privacy list, use the built-in setting:
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
- Open Start and select Settings.
- Choose Privacy & security.
- Select File system.
- To restrict covered apps for the account, turn off Let apps access your file system.
- To block only one listed app, leave the overall switch as required and turn off that app’s individual entry.
Microsoft’s Windows file-system access and privacy guidance notes that this setting applies to the signed-in user. A workplace can manage the setting, and another user on the same PC can have different choices under their own account.
After changing the switch, close and reopen the application before testing. Then attempt the specific operation you want to prevent, such as opening a document from a protected folder. A denied operation may produce an in-app error, a Windows permission prompt, or simply an empty file picker, depending on how the app handles failure.
Global versus per-app blocking
- Global switch: turning off Let apps access your file system is the broadest option available on that page for the covered apps.
- Individual switch: turning off one listed app limits the change to that entry while leaving other listed apps unchanged.
- Account scope: the setting is not automatically a policy for every user profile on the computer.
- Management override: an organization may control or lock the setting through its Windows policies.
These controls concern file-system access. They do not automatically prevent an app from using its own cloud service, reading data that you explicitly paste into it, or interacting with resources governed by a different permission system.
Why an AI agent may not appear in the permission list
Seeing no entry for an agent does not prove that it cannot read files. Microsoft Support explicitly says, “Not all apps will appear in the list where you can choose which apps can access your file system.” Its app-permissions guidance explains that desktop apps with permission to use all system resources are not listed and that most of their capabilities cannot be controlled in Privacy settings.
Microsoft also identifies cases involving programs downloaded from the internet or installed from removable media that may be absent from the list. Such an application is therefore not blocked by turning off the listed-app switch.
What to do when the agent is absent
- Check the application’s own controls. Look for file pickers, workspace folders, connected accounts, automation permissions, or a setting that limits which directories the agent can use.
- Remove access you granted inside the app. Disconnect cloud drives, shared folders, integrations, and saved credentials that are not required.
- Uninstall or avoid the application if its access model does not meet your requirements.
- Use an isolated run for software you need to test but do not trust. Windows Sandbox is intended for this case.
Do not assume that adding a desktop program to, or removing it from, the Windows privacy list is possible. The absence is a property of the application’s Windows permission model, not evidence that the agent has no access.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Use Windows Sandbox to isolate an untrusted Win32 agent
Windows Sandbox provides a separate desktop for running untrusted Win32 applications. Microsoft describes it as a lightweight environment backed by hardware virtualization technology. An application installed inside the sandbox remains there and cannot affect the host in the normal way; when you close the sandbox, Windows permanently deletes the software, files, and state created in that session. See Microsoft Learn’s Windows 11 Security Book: Application Isolation.
Practical workflow
- Enable Windows Sandbox on a Windows edition that provides the feature, following your organization’s approved Windows component-management process.
- Start Windows Sandbox from the Start menu.
- Within the sandbox desktop, install or launch the AI agent you want to evaluate.
- Keep the agent’s files and test data inside the sandbox. Do not map host folders or copy sensitive information into the session unless the test requires it.
- When finished, close the Sandbox window and confirm that you want to close it. The session’s installed software, files, and state are discarded.
Sandbox is not a per-agent permission toggle for software running in your ordinary desktop session. If you launch the same program outside Sandbox, its host-session permissions and the desktop-app exceptions described above still apply. Isolation also does not make it safe to supply secrets: anything you place inside the disposable environment is available to the software during that session.
Lock down shared folders and agent workspaces
For Copilot Actions’ preview workspace, inspect the folders that are readable by all accounts and any locations you explicitly authorized. Move confidential material out of shared locations before enabling an agent, or change the folder’s permissions using the account and sharing controls appropriate to your Windows setup. After a task, revoke access that is no longer necessary.
Free tools Windows power users keep installed
One-click scans. No signup required.
A workspace permission is different from the file-system privacy switch. The former determines what the agent’s workspace or account can reach; the latter applies only to apps covered by Windows’ privacy model. Check both when an agent uses a folder through a workspace, integration, or shared account.
Separate local files from cloud and pasted data
Blocking local file-system access does not erase information the agent already received. If you uploaded a document, pasted text into a chat, or connected a cloud drive through the application, that data is governed by the application or service’s own account and workspace controls. Remove connected accounts, shared drives, saved credentials, and previously authorized folders inside the agent when they are no longer needed.
Likewise, a shared folder readable by all system accounts can remain reachable to an agent account even when a different app’s privacy entry is disabled. Review both the Windows account or folder permissions and the app-level integration instead of treating the File system page as a complete firewall.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Verify the change instead of assuming it worked
- Record which Windows account and executable actually run the agent.
- Note every folder, cloud integration, or workspace authorization the agent has received.
- Change the matching control, then fully close and reopen the agent.
- Test the exact operation you want to deny, such as opening a file in a protected location.
- If the operation still succeeds, determine whether a desktop helper, cached copy, cloud service, shared folder, or different account performed it.
- For an untrusted Win32 program, stop testing on the host and repeat only inside Sandbox.
During the Copilot Actions preview, Microsoft also describes activity visibility and approval prompts for sensitive actions or important decisions. Use those signals to review what the agent is attempting, but do not treat them as a permanent guarantee for other agents or later releases.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsWhy an organization or another user may see different results
File-system privacy choices are associated with the signed-in Windows user. A second user on the same PC can have different settings, while a workplace can manage or lock the option through its policies. Test under the account that actually launches the agent and check whether an organizational setting is overriding your choice.
The same distinction applies to the preview agent account: it is separate from your interactive account, so permissions granted to one account do not automatically describe the other. Shared locations and resources available to all system accounts deserve special review.
Windows version note
The paths in this guide use the current Windows 11 labels. Microsoft support for Windows 10 ended on October 14, 2025; do not assume that a Windows 10 installation has the same AI-components page or preview features. Use the controls available on the supported Windows version and confirm the exact labels shown on your PC.
Troubleshoot continued file or app access
The agent still reads files after I turned off File system access
- Confirm that you changed the setting under the same Windows account that runs the agent.
- Check whether the agent is a desktop application missing from the list; the privacy switch does not cover every such program.
- Look for a separate browser, service, helper process, or companion application that is actually performing the read.
- Inspect the agent’s own connected folders and cloud integrations, then remove any authorization you do not need.
- For an untrusted program, stop running it on the host and repeat the test inside Windows Sandbox.
The Copilot Actions switch is missing
The setting belongs to an experimental Windows feature and may not be present on every installation, account, or release. Verify that you are following the current path under Settings > System > AI components > Agent tools. If the feature is unavailable, that does not identify or disable a separately installed third-party agent; investigate the installed application instead.
Recommended Free Tools
An app works after permission changes even though access should be blocked
- Retest after fully closing and reopening the app.
- Determine whether the app is using a file it already cached, a cloud copy, or data supplied through its own service.
- Check whether the operation uses a folder shared with all accounts or a separate integration rather than the app permission covered by File system settings.
- Remember that Windows’ privacy page is not a general firewall for desktop programs with broad system-resource access.
What Windows’ controls do—and do not—establish
- Turning off the global file-system switch blocks most covered apps for that signed-in account; it does not establish that every AI agent is blocked.
- An individual app switch affects only an app represented in the list. Programs absent from the list are not controlled by that switch.
- The Copilot Actions setting disables the documented experimental feature; it is not a universal kill switch for third-party agents.
- Preview descriptions of a separate agent account, approval prompts, monitoring, and known-folder access should not be treated as permanent guarantees for future releases.
- Windows Sandbox isolates a particular run and deletes its state when closed; it does not change the permissions of the same program launched normally.
If you need a high-confidence boundary, combine controls: disable the Windows preview feature when you do not use it, revoke listed-app permissions, remove application-level integrations, keep sensitive data out of shared folders, and run untrusted Win32 software only in a disposable isolated environment.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
A decision checklist
- Is it Copilot Actions? Turn off Experimental agentic features in the AI components settings.
- Is the agent listed under File system? Turn off its individual entry or the overall file-system access switch.
- Is it a desktop program missing from the list? Use its own permissions, uninstall it, or do not run it on the host.
- Do you need to test untrusted software? Use Windows Sandbox and keep sensitive host data out of the session.
- Did you authorize a workspace or shared folder? Review and revoke that authorization when the task ends.
Frequently Asked Questions
How do I stop an AI agent from accessing files in Windows?
First identify the agent. Disable Experimental agentic features for Copilot Actions, revoke access on Settings > Privacy & security > File system for listed apps, and use the app’s own controls or Windows Sandbox for desktop programs that are not listed.
Can I block a Windows app from accessing my files using Settings?
Yes, if it appears in the File system privacy list. Turn off its individual entry or the global Let apps access your file system switch. Some desktop apps are absent and are unaffected.
Why can an AI agent still access files after I changed privacy settings?
It may be a desktop program outside the list, a helper process, a different Windows account, a shared folder, a cached copy, or a cloud integration. The File system page is not a complete firewall for desktop applications.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchIs the Copilot Actions switch a universal kill switch for AI agents?
No. It disables Windows’ documented experimental feature only. A separately installed third-party agent can continue running under its own permission model.
Which folders can Copilot Actions access?
During the documented preview, it uses a separate standard agent account with limited access to known folders such as Documents, Downloads, Desktop, and Pictures, plus resources available to all system accounts. Access beyond those locations requires user authorization.
How can I isolate an untrusted AI agent on Windows?
Run the Win32 program inside Windows Sandbox. Its software, files, and state are deleted when the sandbox closes. Do not map host folders or place secrets in the disposable session.
Does changing File system access affect every user on a shared PC?
No. The choice applies to the signed-in user. Another user can have different settings, and an organization may manage or override the option.
The Bottom Line
Match the control to the agent: disable Copilot Actions, revoke File system access for apps Windows lists, and treat an absent desktop app as unrestricted by that page. Remove workspace and cloud authorizations, keep sensitive files out of shared locations, and use Windows Sandbox for untrusted Win32 software.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
