Documentation Index
Fetch the complete documentation index at: https://mintlify.com/flick9000/winscript/llms.txt
Use this file to discover all available pages before exploring further.
Windows exposes a permission consent system for UWP and modern apps through the CapabilityAccessManager registry hive. Each capability has a corresponding ConsentStore key where the Value string can be set to Deny to block all apps from accessing that resource. The base path for most of these permissions is:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\<permission>
Value entry to Deny at this path revokes system-wide access for every app using that capability. Some permissions — such as Phone, Voice Activation, and Trusted Devices — use separate policy keys outside CapabilityAccessManager and are noted below.
These registry keys govern UWP (Universal Windows Platform) and modern packaged apps. Traditional Win32 desktop applications do not consult CapabilityAccessManager and are unaffected by these settings.
Permission Reference
| Permission | ConsentStore Key / Registry Path | Registry Value |
|---|
| Location | ConsentStore\location | Value = Deny |
| Camera | ConsentStore\webcam | Value = Deny |
| Microphone | ConsentStore\microphone | Value = Deny |
| Documents Library | ConsentStore\documentsLibrary | Value = Deny |
| Pictures Library | ConsentStore\picturesLibrary | Value = Deny |
| Videos Library | ConsentStore\videosLibrary | Value = Deny |
| Broad File System | ConsentStore\broadFileSystemAccess | Value = Deny |
| Account Information | ConsentStore\userAccountInformation | Value = Deny |
| Contacts | ConsentStore\contacts | Value = Deny |
| Call History | ConsentStore\phoneCallHistory | Value = Deny |
| Messaging | ConsentStore\chat | Value = Deny |
| Notifications | ConsentStore\userNotificationListener | Value = Deny |
| Email | ConsentStore\email | Value = Deny |
| Tasks | ConsentStore\userDataTasks | Value = Deny |
| Diagnostics | ConsentStore\appDiagnostics | Value = Deny |
| Calendar | ConsentStore\appointments | Value = Deny |
| Motion | ConsentStore\activity | Value = Deny |
| Radios | ConsentStore\radios | Value = Deny |
| Recordings | ConsentStore\graphicsCaptureProgrammatic | Value = Deny |
| Screenshot Borders | ConsentStore\graphicsCaptureWithoutBorder | Value = Deny |
| AI Generation | ConsentStore\systemAIModels | Value = Deny |
| Voice Activation | HKCU\Software\Microsoft\Speech_OneCore\Settings\VoiceActivation\UserPreferenceForAllApps | AgentActivationEnabled = 0 |
| Phone | HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy | LetAppsAccessPhone = 2 |
| Trusted Devices | HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{C1D23ACC-752B-43E5-8448-8D0E519CD6D6} | Value = Deny |
PowerShell Commands
Location
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location" /v "Value" /d "Deny" /f
Camera
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam" /v "Value" /d "Deny" /t REG_SZ /f
Microphone
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone" /v "Value" /d "Deny" /t REG_SZ /f
File System
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\documentsLibrary" /v "Value" /d "Deny" /t REG_SZ /f
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\picturesLibrary" /v "Value" /d "Deny" /t REG_SZ /f
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\videosLibrary" /v "Value" /d "Deny" /t REG_SZ /f
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\broadFileSystemAccess" /v "Value" /d "Deny" /t REG_SZ /f
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\userAccountInformation" /v "Value" /d "Deny" /f
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\contacts" /v "Value" /d "Deny" /t REG_SZ /f
Call History
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\phoneCallHistory" /v "Value" /d "Deny" /t REG_SZ /f
Messaging
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\chat" /v "Value" /d "Deny" /t REG_SZ /f
Notifications
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\userNotificationListener" /v "Value" /d "Deny" /t REG_SZ /f
Email
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\email" /v "Value" /d "Deny" /t REG_SZ /f
Tasks
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\userDataTasks" /v "Value" /d "Deny" /t REG_SZ /f
Diagnostics
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\appDiagnostics" /v "Value" /d "Deny" /t REG_SZ /f
Calendar
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\appointments" /v "Value" /d "Deny" /t REG_SZ /f
Motion
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\activity" /v "Value" /d "Deny" /f
Radios
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\radios" /v "Value" /d "Deny" /t REG_SZ /f
Recordings
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\graphicsCaptureProgrammatic" /v "Value" /d "Deny" /t REG_SZ /f
Screenshot Borders
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\graphicsCaptureWithoutBorder" /v "Value" /d "Deny" /t REG_SZ /f
AI Generation
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\systemAIModels" /v "Value" /d "Deny" /t REG_SZ /f
Voice Activation
Voice activation uses a per-user key under HKCU rather than the CapabilityAccessManager path.
reg add "HKCU\Software\Microsoft\Speech_OneCore\Settings\VoiceActivation\UserPreferenceForAllApps" /v "AgentActivationEnabled" /t REG_DWORD /d 0 /f
Phone
Phone access is controlled by the AppPrivacy policy hive. Setting LetAppsAccessPhone to 2 forces denial for all apps, with the per-app override lists cleared.
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessPhone" /t REG_DWORD /d 2 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessPhone_UserInControlOfTheseApps" /t REG_MULTI_SZ /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessPhone_ForceAllowTheseApps" /t REG_MULTI_SZ /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessPhone_ForceDenyTheseApps" /t REG_MULTI_SZ /f
Trusted Devices
Trusted Devices access is stored under DeviceAccess using a GUID-based key.
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{C1D23ACC-752B-43E5-8448-8D0E519CD6D6}" /t REG_SZ /v "Value" /d "Deny" /f