Hackers News Hackers News
  • CyberSecurity News
  • Threats
  • Attacks
  • Vulnerabilities
  • Breaches
  • Comparisons

Social Media

Hackers News Hackers News
  • CyberSecurity News
  • Threats
  • Attacks
  • Vulnerabilities
  • Breaches
  • Comparisons
Search the Site
Popular Searches:
technology Amazon AI
Recent Posts
AiTM Phishing Attacks Target SharePoint, HubSpot, Google
May 2, 2026
Attackers Abuse AppSheet, Netlify, Telegram for Google Facebook
May 2, 2026
cPanelSniper PoC Exploit for cPanel Vulner Disclosed Vulnerability
May 2, 2026
Home/CyberSecurity News/Microsoft Group Policy Removes Windows 11 Copilot from
CyberSecurity News

Microsoft Group Policy Removes Windows 11 Copilot from

Microsoft has officially released a new Group Policy setting, enabling IT administrators to silently uninstall the Microsoft Copilot app from managed Windows 11 devices. This development signals a...

David kimber
David kimber
April 27, 2026 2 Min Read
0 0

Microsoft has officially released a new Group Policy setting, enabling IT administrators to silently uninstall the Microsoft Copilot app from managed Windows 11 devices. This development signals a broader enterprise shift away from bundled AI bloat and toward user-choice-driven deployments.

The policy, named RemoveMicrosoftCopilotApp, became broadly available on April 14, 2026, as part of the April 2026 Patch Tuesday security update.

It is included in Windows 11 version 25H2 with update KB5083769 and later builds, and is accessible via both Policy CSP and traditional Group Policy Object (GPO) management.

Group Policy to Remove Windows 11 Copilot

The RemoveMicrosoftCopilotApp setting provides IT teams a targeted, non-disruptive method to uninstall the consumer-facing Microsoft Copilot app from enterprise endpoints.

Once enabled, administrators set the policy value to 1 to trigger removal or 0 to disable it a clean integer-based toggle consistent with existing Windows policy frameworks.

However, the policy is deliberately constrained. It will only activate when all three of the following conditions are simultaneously met on a device:

  • Microsoft 365 Copilot is also installed on the same device
  • The Microsoft Copilot app was not manually installed by the end user
  • The Copilot app has not been launched in the last 28 days

This three-factor security mechanism ensures the policy does not disrupt active users who rely on the standalone Copilot app, making it a precision tool rather than a blunt removal instrument.

Administrators can locate the new policy within the Group Policy Editor by navigating to User Configuration → Administrative Templates → Windows AI → Remove Microsoft Copilot App.

It is also accessible via the Policy CSP OMA-URI path at ./User/Vendor/MSFT/Policy/Config/WindowsAI/RemoveMicrosoftCopilotApp and the device-level equivalent path.

The setting applies to Pro, Enterprise, Education, and IoT Enterprise SKUs, effectively covering the full spectrum of managed organizational environments.

It is important to note that this policy performs a one-time uninstall, not a persistent block. Users can reinstall the Copilot app from the Microsoft Store if they choose.

Administrators seeking to permanently prevent reinstallation will need to combine this policy with additional enforcement tools such as AppLocker, Windows Defender Application Control (WDAC), or Intune uninstall profiles.

The release comes amid a wider trend of Microsoft “unbundling” AI features from core Windows components following sustained enterprise feedback about unsolicited AI integrations.

By offering this controlled removal capability, Microsoft is positioning the enterprise Copilot experience around Microsoft 365 Copilot as the single, sanctioned AI assistant for managed corporate environments, streamlining the AI toolset while giving IT teams the control they have long demanded.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.

Tags:

PatchSecurity

Share Article

David kimber

David kimber

David is a penetration tester turned security journalist with expertise in mobile security, IoT vulnerabilities, and exploit development. As an OSCP-certified security professional, David brings hands-on technical experience to his reporting on vulnerabilities and security research. His articles often feature detailed technical analysis of exploits and provide actionable defense recommendations. David maintains an active presence in the security research community and has contributed to multiple open-source security tools.

Previous Post

Microsoft Store Vibing.exe App Harvested Screens Allegedly Audio

Next Post

ClickFix Attack Replaces PowerShell via Cmdkey With Remote

No Comment! Be the first one.

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Popular Posts
Attackers Abuse CAPTCHA, ClickFix for Cred Tactics Boost
May 1, 2026
DDoS Malware Exploits Jenkins to Attack Source Engine Games
May 1, 2026
DDoS Attack Hits Ubuntu Website & Canonical Web Services
May 1, 2026
Top Authors
Marcus Rodriguez
Marcus Rodriguez
Sarah simpson
Sarah simpson
Emy Elsamnoudy
Emy Elsamnoudy
Let's Connect
156k
2.25m
285k

Related Posts

Jennifer sherman
By Jennifer sherman
Threats

GlassWorm Attacks macOS via Malicious VS Code…

January 1, 2026
Emy Elsamnoudy
By Emy Elsamnoudy
Attacks

ClickFix Attack Hides Malicious Code via Stegan Security

January 1, 2026
Sarah simpson
By Sarah simpson
Vulnerabilities

MongoBleed Detector Tool Detects Critical MongoDB CVE-

January 1, 2026
Emy Elsamnoudy
By Emy Elsamnoudy
Breaches

Conti Ransomware Gang Leaders & Infrastructure Exposed

January 1, 2026
Hackers News Hackers News
  • [email protected]

Quick Links

  • Contact Us
  • Privacy Policy
  • Terms of service

Categories

Attacks
Breaches
Comparisons
CyberSecurity News
Threats
Vulnerabilities

Let's keep in touch

receive fresh updates and breaking cyber news every day and week!

All Rights Reserved by HackersRadar ©2026

Follow Us