If you don't want spying, put the machine behind a http proxy with a strict white lists in and out firewall. I guess than you have to worry about the firewall

If you don't want spying, put the machine behind a http proxy with a strict white lists in and out firewall. I guess than you have to worry about the firewall machine. chain a couple of them, and they won't know which machine is the final firewall. If any of the others send unexpected chatter, you at least know you are failing. This way you can still use windows at least until they require an always on chatty encrypted connection to microsoft to function.