Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesThe control you need depends on what kind of AI agent is running. For Windows’ experimental Copilot Actions, turn off Settings > System > AI components > Agent tools > Experimental agentic features. For an app that appears in Windows’ file-system privacy list, use Settings > Privacy & security > File system and disable its access, or turn off the global switch. If the agent is a conventional desktop (Win32) program, those privacy controls may not apply; use the program’s own settings, remove it, or run it in Windows Sandbox instead.
There is no single Windows switch that reliably blocks every third-party AI agent from every file and application. The sections below show which boundary each control actually enforces, how to configure it, and what to do when an agent is missing from the list.
As an Amazon Associate I earn from qualifying purchases.
First identify the agent you are trying to stop
Windows uses different security boundaries for its own experimental agent features, Store-style apps, and traditional desktop programs. Selecting the wrong control can create a false sense of protection: a global file-system switch can affect many apps while leaving an unlisted desktop agent untouched.
| Agent or program type | Primary control | What it changes | Main limitation |
|---|---|---|---|
| Windows experimental Copilot Actions | Settings > System > AI components > Agent tools > Experimental agentic features | Turns the preview feature on or off | It is an experimental preview, and its implementation can change |
| App shown in File system privacy | Settings > Privacy & security > File system | Global or per-app file-system permission for the signed-in account | Not every Windows program appears in the list |
| Unlisted desktop (Win32) agent | The program’s own controls, removal, or isolation | Stops the program or limits the environment in which it runs | Windows Privacy settings generally cannot control desktop apps with broad system access |
| Untrusted Win32 software for one session | Windows Sandbox | Runs the software in an isolated desktop and discards its state when closed | It isolates a run; it is not a per-agent permission toggle in your normal desktop session |
Microsoft describes the agent security principle this way: “An agent starts with limited permissions and only obtains access to resources you explicitly provide permission to, like your local files.” The practical controls, however, vary by feature and app type. Treat preview behavior and app-list behavior as separate cases.
#1 Best Overall
- 1.1 GHz (boost up to 2.4GHz) Intel Celeron N5030 Quad-Core
Turn off Windows Copilot Actions and other experimental agentic features
If the activity comes from Windows’ own experimental Copilot Actions, disable the feature itself. Microsoft says the feature is disabled by default and is activated through the setting below. The feature is a preview, so labels, account behavior, and available controls may change between Windows releases.
- Open Settings.
- Select System.
- Open AI components.
- Select Agent tools.
- Turn off Experimental agentic features.
The setting is documented by Microsoft Support’s Experimental Agentic Features guidance. After switching it off, close any agent-controlled windows and start a new session to confirm that the feature no longer runs.
What Copilot Actions can access during the preview
During the documented preview, actions run under a separate standard agent account rather than under your signed-in user account. Microsoft describes access to a limited group of known folders, including Documents, Downloads, Desktop, and Pictures, plus resources available to all system accounts. Access outside those locations requires user authorization. This is scoped access, not a promise that every file on the computer is inaccessible.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →The preview also describes visibility into activity and the ability to monitor or take control. Sensitive actions or important decisions may prompt for additional approval. These are preview descriptions, not guarantees for third-party agents or for later Windows releases. If you grant access to a shared folder, review that grant and revoke it when the task is complete.
When the switch is missing
The experimental-agentic-features path applies to the Windows feature described by Microsoft. A third-party agent installed as a normal desktop application may not expose this switch at all. Do not infer that the agent is blocked merely because the Copilot setting is off; identify the process or app that is actually performing the work and use the corresponding control.
Block an app through Windows’ file-system privacy setting
For apps that Windows lists under file-system permissions, you can deny access globally for the signed-in account or disable a specific app. Open Start > Settings > Privacy & security > File system. Microsoft’s current instructions are available in Windows file system access and privacy.
Rank #2
- 256 GB SSD of storage.
- Multitasking is easy with 16GB of RAM
- Equipped with a blazing fast Core i5 2.00 GHz processor.
Disable access for one listed app
- Go to Settings > Privacy & security > File system.
- Leave Let apps access your file system enabled if other approved apps still need access.
- Find the agent or app in the list.
- Switch that app’s access to Off.
- Close and reopen the app before testing, because a running process may retain an already-open file or session.
This is the least disruptive choice when you want to stop one listed app without changing permissions for the rest of your account.
Disable file-system access for most apps
- Open Start > Settings > Privacy & security > File system.
- Turn Let apps access your file system to Off.
- Restart or reopen the relevant apps and test the operation that previously read a file.
The global setting applies to most covered apps while you are signed in to that account. It does not automatically change another user’s setting on a shared PC. Microsoft also notes that an organization can manage the setting, so a work-managed computer may show a policy-controlled value or prevent changes.
What this setting can and cannot block
Windows’ own wording matters: “Not all apps will appear in the list where you can choose which apps can access your file system.” Some programs downloaded from the internet or installed from removable media are absent. Microsoft’s App permissions guidance further explains that desktop apps with permission to use all system resources are not listed and that most of their capabilities cannot be controlled from Privacy settings.
Therefore, a successful switch-off proves only that the covered permission was withdrawn from the covered app. It does not prove that every AI agent, helper process, command-line component, or desktop program has lost access to local files.
If the agent does not appear in the File system list
Absence from the list is expected for some desktop programs; it is not evidence that the program is harmless or that Windows has denied it access. First confirm that you are checking the correct Windows account and that the program is the agent itself rather than a launcher, service, browser component, or plug-in.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Use the program’s own privacy and workspace controls
Inspect the agent’s settings for workspace folders, connected drives, file indexing, project directories, browser or app integrations, and permissions requested during setup. Remove folders you no longer want it to use, disconnect integrations, and revoke any authorization the program exposes. These controls are app-specific, so do not represent them as equivalent to Windows’ file-system switch.
Rank #3
- 14" diagonal, 1366x768 resolution, HD BrightView LED, Glossy NON-TOUCH Display
Remove or avoid an agent whose access you do not accept
If the program provides no credible way to limit its file access, uninstall it or do not install it on the account containing sensitive data. Removing the visible interface may not remove a separate service or scheduled component, so after uninstalling, verify that the program no longer launches and that its related integrations are gone.
Separate sensitive data from an ordinary desktop session
For a desktop agent that must remain installed, keep sensitive material outside the folders you intentionally expose to it and avoid granting access to shared locations. This reduces accidental exposure but is not a substitute for a permission boundary: a desktop program with broad system access may still be able to reach other locations.
Review Copilot’s scoped folders and shared permissions
The preview agent account is separate from your interactive account, but it can still reach known folders and resources available to all system accounts. If you have deliberately authorized a location, treat that authorization as a grant that needs lifecycle management.
Free tools Windows power users keep installed
One-click scans. No signup required.
- List the folders you intentionally made available for the task.
- Check whether any of those folders are shared with other accounts or services.
- Remove sharing or access grants that are no longer necessary.
- Move especially sensitive material out of an authorized workspace before starting another agent task.
- Use the preview’s monitoring or take-control features when available, and approve sensitive actions only when you understand the consequence.
These precautions address the preview’s workspace model; they do not turn a general desktop application into a restricted agent.
Isolate an untrusted Win32 agent with Windows Sandbox
Windows Sandbox provides a lightweight, isolated desktop for untrusted Win32 applications. Microsoft says the sandbox uses hardware virtualization, keeps software and files inside the isolated environment, and permanently deletes the software, files, and state when you close the sandbox. Its application-isolation documentation is at Windows 11 Security Book – Application Isolation.
Use Sandbox for a disposable test
- Ensure Windows Sandbox is available and hardware virtualization is enabled on the PC.
- Open Windows Sandbox from the Start menu.
- Install or run the untrusted agent inside the sandbox rather than on the host desktop.
- Provide only the files needed for that test inside the sandbox environment.
- When finished, close the Sandbox window and confirm the prompt to discard the session.
Anything created inside that session is disposable. Copy out only files you have inspected and deliberately want to keep; closing the sandbox removes its software, files, and state.
Rank #4
- 【Efficient Performance】 Powered by Intel Core i3 processor (2 cores, 4 threads, up to 3.4GHz) with 12GB RAM and 256GB SSD. Handles multitasking, office software, online classes, and HD video streaming smoothly. Integrated Intel UHD Graphics 620
- Backlit Keyboard & Complete Package】Comes with a cool backlit keyboard. Comes with awebcam, dual stereo speakers (8Ω/1.0W each), DC charger, and user manual – ready for late-night studying, online classes, video conferencing, and daily productivity
- 【Vibrant Display】 15.6-inch Full HD (1920x1080) anti-glare screen with 16:9 aspect ratio delivers crisp images and vivid colors – perfect for studying, watching lectures, or entertainment. Thin-bezel design maximizes viewing area
- 【Fast Connectivity & Expansion】 Equipped with WiFi 6 (802.11ax) and Bluetooth 5.2 for stable, high-speed wireless. Features 3 x USB 3.0, HDMI 2.1, Type-C (supports PD3.0 fast charging), and a TF card slot expandable up to 2TB – easily connect external monitors, mice, drives, or expand storage for all your files
- 【Long Battery Life & Portable】 Built-in 11.55V 5000mAh/57.75Wh high-capacity battery delivers approximately 7 hours of mixed-use battery life – enough for a full day of classes and assignments. Lightweight at just 1.63kg (3.6 lbs) and 19.5mm thin, plus a compact packing size – easily slips into a backpack for campus, library, or coffee shop
Understand Sandbox’s boundary
Sandbox isolates one run. It does not retroactively restrict an agent installed in your ordinary Windows session, and it is not a universal per-agent permission switch. If an agent already has access to your host files, moving a later test into Sandbox does not revoke that earlier access. Stop or remove the host installation separately, then use Sandbox for future untrusted runs.
Recommended Free Tools
Choose the control that matches your situation
| Your situation | Do this first | Why |
|---|---|---|
| You enabled Windows’ experimental agent feature | Turn off Experimental agentic features | Disables the Windows preview feature that created the agent activity |
| The agent is listed under File system | Turn off that app’s entry, or the global switch for most covered apps | Withdraws the documented file-system permission for the account |
| The agent is a desktop program and is absent from the list | Use its own controls, uninstall it, or avoid running it on sensitive data | Desktop programs may not be controlled by Privacy settings |
| You need to inspect unknown Win32 software safely | Run it in Windows Sandbox | Its files and state are deleted when the isolated session closes |
| You authorized a Copilot workspace folder | Review and revoke the folder’s sharing or access grant after the task | The preview uses scoped access rather than universal file visibility |
Troubleshoot when an agent still reads a file
The app remains visible after its toggle is off
Close the app completely, including any tray process, and reopen it. If it still reads files, check whether a different helper or desktop component is performing the operation. The privacy toggle applies to the listed app permission, not necessarily to every process associated with a product.
The agent is not listed at all
Assume the desktop-app exception may apply. Read the app’s own permission and workspace settings, remove the program, or move the work into Windows Sandbox. Do not treat an empty or incomplete list as a block-all result.
A work PC changes the setting back
Your organization may manage file-system privacy. Contact the administrator rather than repeatedly changing a policy-controlled value. Other user accounts on the same computer can also have different settings.
The agent can still see a shared folder
Check the folder’s sharing and access grants, including any authorization you gave during an agent task. Revoke grants that are no longer needed, then restart the agent and test with a non-sensitive file. A folder available to all system accounts may remain reachable even when your interactive account is not the one running the agent.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
You need a guaranteed block for every third-party agent
The documented Windows controls do not establish such a universal switch. You must identify each agent, remove or constrain desktop programs individually, and use an isolation environment for software you do not trust.
Verification checklist
- Identify whether the activity comes from Copilot Actions, a listed app, an unlisted desktop program, or software running in Sandbox.
- For Copilot Actions, confirm that Experimental agentic features is off.
- For a listed app, confirm its File system entry or the global switch is off for the correct Windows account.
- For an unlisted program, verify its own workspace permissions or uninstall it; do not rely on the Privacy list.
- Review and revoke shared-folder permissions after authorized agent work.
- For untrusted Win32 software, run a fresh Sandbox session and close it to destroy its state.
- Test with a harmless sample file and observe whether the agent can still open it before returning to sensitive data.
These checks distinguish a real permission change from a setting that simply does not cover the agent involved.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
