If you are concerned with privacy and use any Microsoft products (you're already making a mistake by doing so in the first place but) I would recommend, by defa

If you are concerned with privacy and use any Microsoft products (you're already making a mistake by doing so in the first place but) I would recommend, by default, blocking all Internet access to/from the host (edit: by default; make exceptions as needed, obviously). I've got one Windows machine here, just so I can run one specific client that I have to use for an internally-hosted application. That machine doesn't have a default route, just a single static route that lets it communicate with the (internal) things it needs to and, just for good measure, there are firewall rules (on the router connected to my upstream) that block any traffic to/from this machine and the Internet. (Sadly, I would not be surprised to learn that it can "fallback" to using DNS queries or some such to report back to the mothership.) I think we'll eventually get to the point where, in general, devices won't have a default route. It might take a while, though -- currently, way too many people are still completely okay with every device and application they use spying on them and reporting back on what they do. So-called "default deny" firewall policies for incoming traffic are pretty common nowadays. I can't wait for "default deny" policies for outbound traffic to become standard as well.