While not defending Microsoft (my first advice would be: don't use Windows), there's a free app called "ShutUp10" that allows you to fix almost everything in your list above.
Jury is not out, shutup10 turns off "official' telemetry services. Problem is MS build in telemetry into everything now, explorer, cortana, edge, crypto service or dnscache, _everything_ calls home regularly ~once per hour during ordinary use.
Only way to 99.9% block telemetry is to switch blocking all outgoing by default in firewall and whitelist what you use. This still leaves DNS exfiltration route :(
Did you read the comments where, if you do block the standard ports, the telemetry system in Win10 goes all subversive botnet-like and starts connecting on random ports to random hosts in order to get out of the firewall?
I think he talks about W10 ignoring hosts file and calling home using raw IPs if you block usual domains. This still gets blocked with firewall.
DNS is a problem tho, I dont know of any dns clients with per application whitelist functionality :( This means every program on the system can make dns queries.
afaik Windows firewall is not able to block loopback communications, can komodo?.
I dont want to give up dns caching, and since I dont know of any way to firewall localhost traffic in windows I figured only way would be in dns caching program itself.
So far only way to prevent dns tunneling I can come up with involves giving up dnscache :(. To make up lost performance you could maybe run dnsmasq on the router, or in a virtual machine? or somehow force dnscache to listen on virtual network adapter?
