Disable Windows Quick Assist and Windows Share Experiences

Here's a "how to" on disabling Windows Quick Assist and Windows Shared Experiences. Windows Quick Assist has become a go-to tool for malware actors to gain remote access to a social-engineering-scammed user's PC without having to do any sort of software installation. Quick Assist is enabled by default on both Windows 10 and Windows 11 PCs and allows a remote user to access your PC in local administrator mode. Windows Shared Experiences can be used by hackers for lateral movement once a PC has been infected with malware.

To Disable Quick Assist:
1) Create Firewall Rule to block C:\Windows\System32\quickassist.exe from internet access.
2) To disable Windows Quick Assist in Group Policy, navigate to "Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security" and then set the policy "Restrict Remote Assistance to authorized users" to "Enabled"
3) In Group Policy editor go to: Computer Configuration > Administrative Templates > System > Remote Assistance > Configure Solicited Remote Assistance (set to disabled)
4) Change the registry key: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services] "fAllowToGetHelp"=dword:00000000

For Windows Shared Experiences:
1) In Group Policy: Computer Configuration>Administrative Templates>System>Group Policy>Continue Experience On This Device (set to disabled)

2) In the registry: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System]
dword: "EnableCdp"=0

Here's a link to the Microsoft Learn article about Quick Assist: https://lnkd.in/eQ5STV86

Here's a Microsoft Support post about Shared Experiences: https://lnkd.in/ehRW-guV