How to stop Claude from reaching every file on a work PC

Acutis Gate · guides for IT directors · updated November 2026

Short answer: push a policy that closes Claude's side doors to the PC's files, then give company data back through one door. Claude Desktop has machine policies that turn off local MCP servers, the extension directory, Cowork and the Claude Code tab, and an empty folder list that stops chat from opening folders on the PC. Claude Code has managed settings that keep it inside the project folder and allow only the MCP servers you name. Point that one allowed server at a gateway that signs in as the person, and the HR folder, the finance share and the CRM open for exactly the people who could already open them.

Where Claude reaches local files

On a work PC, Claude runs as the person signed in, so it can reach whatever they can: their documents, every mapped drive, and every share they can edit. It gets there three ways:

• Local connectors in Claude Desktop: MCP servers added in Developer settings, and desktop extensions such as a filesystem extension.
• Claude Code: the terminal app, and the Code tab inside Claude Desktop, read and edit files and run shell commands.
• Chat and Cowork: a person can add a folder to a chat, and Claude then reads and edits the files in it, even with Cowork turned off.

Each one is useful in the right folder and a risk across the whole PC. The goal is not to block Claude, it is to put every company file behind a door that knows who is asking.

Step 1: close the side doors with policy

With Acutis Gate, the console builds the whole policy for you:

1. In the Gate console, open Lock down PCs.
2. Pick the apps (Claude is one of six) and choose what stays open: the Claude Code tab (off, or on and held to the project folder), Cowork (off, one shared folder, or on), and whether people sign in with Windows.
3. Download AcutisGate-AI-Lockdown.ps1 for Windows, or AcutisGate-AI.mobileconfig and AcutisGate-AI-Mac.sh for Mac.
4. In Intune, go to Devices, Scripts and remediations, Platform scripts, Add, Windows 10 and later. Upload the script, set Run this script using the logged on credentials to No and Run script in 64 bit PowerShell Host to Yes, and assign it to your PC group. With Group Policy, add it as a computer startup script instead.
5. People quit and reopen Claude once, and the policy is in force.

The script is safe to run again. Any file it replaces is kept next to itself, and -Undo puts everything back. The same pack covers ChatGPT, GitHub Copilot, Gemini and Cursor: see the guide for those apps. What it sets for Claude, if you would rather write it yourself:

Command line

# Claude Desktop machine policy (string values)
reg add HKLM\SOFTWARE\Policies\Claude /v isLocalDevMcpEnabled /t REG_SZ /d false /f
reg add HKLM\SOFTWARE\Policies\Claude /v isDesktopExtensionDirectoryEnabled /t REG_SZ /d false /f
reg add HKLM\SOFTWARE\Policies\Claude /v isClaudeCodeForDesktopEnabled /t REG_SZ /d false /f
reg add HKLM\SOFTWARE\Policies\Claude /v secureVmFeaturesEnabled /t REG_SZ /d false /f
reg add HKLM\SOFTWARE\Policies\Claude /v allowedWorkspaceFolders /t REG_SZ /d "[]" /f

# Claude Code: C:\Program Files\ClaudeCode\managed-settings.json
{
  "permissions": {
    "blockReadsOutsideWorkingDirectories": true,
    "blockWritesOutsideWorkingDirectories": true,
    "disableBypassPermissionsMode": "disable"
  },
  "sandbox": { "enabled": true, "allowUnsandboxedCommands": false },
  "allowManagedMcpServersOnly": true,
  "allowedMcpServers": [ { "serverUrl": "https://gate.corp.example/api/v1/gate/mcp" } ],
  "disableClaudeAiConnectors": true
}

One thing to know: Claude Code's shell sandbox runs on macOS, Linux and WSL2, not on plain Windows. The file settings above still hold Claude's own file tools to the project folder on Windows, but a shell command can read what the person can. For developers on Windows, run Claude Code inside WSL2 with the sandbox required.

Step 2: give company data back through one door

Closing the side doors only works if people still get their work done. The same pack makes Gate Claude's only connector:

• Claude Code: a managed-mcp.json lists Gate as the only MCP server, so claude mcp add refuses anything else.
• Claude Desktop: upload the Gate extension (acutis-gate.mcpb) to your Claude allowlist under Admin settings, Connectors, Desktop, and it is the one extension people get.
• Signed in as the person: on domain PCs a small helper signs Claude in with the person's Windows sign-in, so nobody pastes a token. Without Windows sign-in, each person saves a personal token once.

From then on, when Claude opens a file on a share, Windows checks it with that person's own rights. Finance opens the invoices, HR opens the layoff plans, and the help desk opens neither. Every call lands in the audit trail under their name.

Step 3: check every PC

A policy you cannot see is a policy you hope for. Acutis Go looks for AI apps and local model runners on each PC every 6 hours: Claude Desktop, Claude Code, ChatGPT, Copilot, Cursor, VS Code with Copilot, Ollama, LM Studio and more. For each one it shows whether it can still reach local files directly, and it flags a local model that is listening on the network. Gate's Lock down PCs page totals it: how many PCs are closed, and which ones still need the policy.

Command line

reg query HKLM\SOFTWARE\Policies\Claude
claude mcp list
claude mcp add --transport http test https://example.com/mcp     # refused by enterprise policy

Frequently asked questions