WDA_EXCLUDEFROMCAPTURE Explained: How Windows Hides a Window From Screen Capture

WDA_EXCLUDEFROMCAPTURE is the flag behind every "invisible on screen share" app on Windows, including ours. We've shipped it in AuraCloak, an overlay that has to stay out of Zoom and Teams shares, and most of what's below comes from bugs we fixed along the way rather than from the four paragraphs of official documentation.

What WDA_EXCLUDEFROMCAPTURE is

SetWindowDisplayAffinity(HWND hWnd, DWORD dwAffinity) lives in User32.dll and has been there since Windows 7. It "specifies where the content of the window can be displayed" (Microsoft Learn: SetWindowDisplayAffinity). It accepts three values:

Microsoft's wording for the new value is that the window "is displayed only on a monitor. Everywhere else, the window does not appear at all", and it names the intended use: recording controls that shouldn't end up in the recording. On builds older than 2004, the docs say passing WDA_EXCLUDEFROMCAPTURE "will behave as if WDA_MONITOR is applied". In practice that means older machines show a black box instead of nothing, which is a very different experience for the person watching your share.

How it works under the hood

Since Windows 8, the Desktop Window Manager (DWM) composes every frame you see. Apps draw into their own surfaces; DWM stacks them into the final image. Screen capture APIs ask DWM for that image too:

• Windows.Graphics.Capture, used by modern meeting apps, browsers and OBS's newer capture methods.
• DXGI Desktop Duplication, used by many recorders and remote-support tools.
• GDI BitBlt from the screen DC, the decades-old screenshot path that Graphics.CopyFromScreen in .NET still uses.

When a window has WDA_EXCLUDEFROMCAPTURE, DWM composes it into the frame sent to your monitor but not into the frame handed to those capture paths. IOActive's 2026 analysis of the flag describes the same split: the pixels reach the physical display, while capture tools get a composited frame without them (IOActive: The DRM flag that isn't DRM). That's also why it fails exactly where it does. Anything that receives the monitor signal, or looks at the monitor, sees the window.

Code: SetWindowDisplayAffinity in C# and C++

C# (WPF)

This is close to what AuraCloak runs. Call it once the window has a handle, for example in SourceInitialized:

using System;
using System.Runtime.InteropServices;
using System.Windows;
using System.Windows.Interop;

static class CaptureGuard
{
    [DllImport("user32.dll", SetLastError = true)]
    static extern bool SetWindowDisplayAffinity(IntPtr hWnd, uint dwAffinity);

    const uint WDA_NONE = 0x00, WDA_MONITOR = 0x01, WDA_EXCLUDEFROMCAPTURE = 0x11;

    public static void Hide(Window window)
    {
        IntPtr hwnd = new WindowInteropHelper(window).EnsureHandle();
        // Fails (returns false) for child windows and windows of other processes.
        if (!SetWindowDisplayAffinity(hwnd, WDA_EXCLUDEFROMCAPTURE))
            SetWindowDisplayAffinity(hwnd, WDA_MONITOR); // fallback: black box in captures
    }

    public static void Show(Window window) =>
        SetWindowDisplayAffinity(new WindowInteropHelper(window).Handle, WDA_NONE);
}

C++ (Win32)

#include <windows.h>

#ifndef WDA_EXCLUDEFROMCAPTURE            // older SDKs lack the constant
#define WDA_EXCLUDEFROMCAPTURE 0x00000011
#endif

bool HideFromCapture(HWND hwnd)
{
    if (SetWindowDisplayAffinity(hwnd, WDA_EXCLUDEFROMCAPTURE))
        return true;
    // GetLastError() explains why; common cause: hwnd is not top-level.
    return SetWindowDisplayAffinity(hwnd, WDA_MONITOR) != FALSE;
}

bool IsHiddenFromCapture(HWND hwnd)
{
    DWORD affinity = WDA_NONE;
    return GetWindowDisplayAffinity(hwnd, &affinity)
        && affinity == WDA_EXCLUDEFROMCAPTURE;
}

If you prefer generated bindings in .NET, Gérald Barré shows the same call with the Microsoft.Windows.CsWin32 source generator, framed as a way to keep an app out of Windows Recall (meziantou.net). Electron wraps it as win.setContentProtection(true), which on Windows calls SetWindowDisplayAffinity with WDA_EXCLUDEFROMCAPTURE.

Gotchas we hit shipping it

The single call above handles the main window. The bugs live everywhere else. Each of these was a real "wait, why is that on the recording?" moment while building AuraCloak.

1. Only top-level windows, only your own process. The docs say hWnd must be a top-level window that belongs to the current process. Passing a child HWND returns FALSE. Passing another app's window fails too, which is why no utility can hide Chrome or Outlook without injecting code into them.
2. Owned windows don't inherit the flag. Our file picker (a standard OpenFileDialog) appeared in captures even though its owner was hidden. It's a separate native top-level window. We fixed it with a thread-local WH_CBT hook: on HCBT_ACTIVATE, if the new window's owner is the overlay, we call SetWindowDisplayAffinity on it before it's ever drawn.
3. Pop-ups from embedded browsers belong to someone else. WebView2 sign-in pop-ups (OAuth windows) are created by the Edge browser process, so our process can't flag them. We intercept NewWindowRequested, mark it handled, and host the pop-up in our own WPF window that already has the flag.
4. Menus are windows too. A WPF ContextMenu opens in its own HwndSource. We apply the flag in the menu's Opened event.
5. Remember the off switch. Users sometimes want the overlay in a recording, for a tutorial for example. WDA_NONE restores normal capture, and AuraCloak exposes it as a setting and as [Privacy] ExcludeFromCapture=false in its INI file.

Electron's own history shows a different trap: its maintainers had to set the WS_EX_LAYERED style before applying the affinity to avoid a black window after hiding and re-showing a protected BrowserWindow. If you hide and show your window a lot, test that path.

Which apps respect it

Any tool that captures through Windows' own APIs gets frames without the window. That covers nearly every screen sharing and recording app on a normal Windows PC. AuraCloak, our invisible AI overlay for Windows, is left out by all of the apps in the first group below.

For a user-friendly version of this, with what Zoom, Teams and Meet show in each share mode, see how to hide a window from screen share.

How to test it yourself

1. Run winver. You need version 2004 (OS build 19041) or later for true exclusion.
2. Open the window you've flagged and put something recognizable behind it, like a colorful web page.
3. Press Win + Shift + S and capture the full screen. Paste it into Paint. The window should be missing and the page behind it intact.
4. Start a 10-second clip with Xbox Game Bar (Win + Alt + R) and play it back.
5. In OBS, add a Display Capture source and look at the preview.
6. Join a Zoom or Teams meeting from your phone, share your entire screen from the PC and look at the phone.
7. Open every dialog, menu and pop-up your app can produce, and repeat steps 3 and 6 with each one open. This is the step that catches the owned-window bugs above.

A printable version for non-developers is on our screen share visibility test page.

Is it a security feature?

No, and Microsoft says so plainly: "unlike a security feature or an implementation of Digital Rights Management (DRM), there is no guarantee" the function will "strictly protect windowed content, for example where someone takes a photograph of the screen."

IOActive's write-up goes further. Code running inside the owning process can clear the flag. Code at the display-driver level isn't subject to the exclusion at all. And any process can call GetWindowDisplayAffinity to see whether a window is excluded, which is what makes the flag detectable by local software. Think of it as a privacy curtain against the everyday case: screen shares, recordings, accidental screenshots and Recall. Signal Desktop leaned on the same family of protections in May 2025 when it switched on Screen security by default for Windows 11 to keep chats out of Recall (Signal blog).

That's also how we describe AuraCloak. It keeps your notes, your AI chat and anything you load in browser mode out of screen shares and recordings. It doesn't make anything undetectable, and nothing built on this flag can.

FAQ

What is the value of WDA_EXCLUDEFROMCAPTURE?

WDA_EXCLUDEFROMCAPTURE is 0x00000011 (decimal 17). WDA_NONE is 0x00000000 and WDA_MONITOR is 0x00000001. Older Windows SDK headers may not define it, so many projects declare the constant themselves.

Which Windows versions support WDA_EXCLUDEFROMCAPTURE?

Windows 10 version 2004 (build 19041, May 2020 Update) and later, including Windows 11. On earlier versions, Microsoft says the value behaves like WDA_MONITOR, so the window appears as a black box in captures.

Can I use SetWindowDisplayAffinity on another app's window?

No. The window must be a top-level window belonging to the calling process. Calls on other processes' windows fail, so tools that hide third-party apps have to run code inside those apps.

Why does my window show as black in screenshots?

Either the PC runs a Windows build older than 2004, where the flag falls back to WDA_MONITOR, or your code set WDA_MONITOR. Check winver and the value you pass. Electron also documents a black-window issue after hiding and showing a protected window.

Does WDA_EXCLUDEFROMCAPTURE hide a window from Windows Recall?

Yes. Recall snapshots go through the same compositor path, and developers such as Gérald Barré recommend the flag specifically to keep sensitive app windows out of Recall.