diff --git a/ansible/README.md b/ansible/README.md
index dd998d1..d072d1b 100644
--- a/ansible/README.md
+++ b/ansible/README.md
@@ -81,6 +81,9 @@ Playbook:
 
 - `aw_windows_afk_enabled: false` — не запускать `aw-watcher-afk`;
 - `aw_windows_window_enabled: false` — не запускать `aw-watcher-window`;
+- `aw_windows_incident_capture_enabled: false` — отключить блок incidentCapture;
+- `aw_windows_incident_screenshot_enabled: false` — не делать скриншот при DLP-инциденте;
+- `aw_windows_incident_artifacts_root: 'C:\...\incident-artifacts'` — переопределить путь артефактов;
 - `aw_windows_skip_hardening: true` — пропустить `hardening-recovery.ps1` внутри ensemble-скрипта.
 
 ## Результат
diff --git a/ansible/deploy_aw_windows_phase2.yml b/ansible/deploy_aw_windows_phase2.yml
index 5af2043..8cf0e9f 100644
--- a/ansible/deploy_aw_windows_phase2.yml
+++ b/ansible/deploy_aw_windows_phase2.yml
@@ -22,6 +22,9 @@
     aw_windows_afk_enabled: true
     aw_windows_window_enabled: true
     aw_windows_local_agent_logs_enabled: false
+    aw_windows_incident_capture_enabled: true
+    aw_windows_incident_screenshot_enabled: true
+    aw_windows_incident_artifacts_root: "{{ aw_windows_state_root }}\\incident-artifacts"
     aw_windows_logon_marker_enabled: true
     aw_windows_skip_hardening: false
     aw_windows_rules_path: "{{ aw_windows_deploy_root }}\\windows\\web-category-rules.example.json"
@@ -90,6 +93,9 @@
             AfkEnabled = {{ '$true' if (aw_windows_afk_enabled | bool) else '$false' }}
             WindowEnabled = {{ '$true' if (aw_windows_window_enabled | bool) else '$false' }}
             LocalAgentLogsEnabled = {{ '$true' if (aw_windows_local_agent_logs_enabled | bool) else '$false' }}
+            IncidentCaptureEnabled = {{ '$true' if (aw_windows_incident_capture_enabled | bool) else '$false' }}
+            IncidentScreenshotEnabled = {{ '$true' if (aw_windows_incident_screenshot_enabled | bool) else '$false' }}
+            IncidentArtifactsRoot = "{{ aw_windows_incident_artifacts_root }}"
             LogonMarkerEnabled = {{ '$true' if (aw_windows_logon_marker_enabled | bool) else '$false' }}
             CustomRulesPath = "{{ aw_windows_rules_path }}"
             CustomPolicyPath = "{{ aw_windows_policy_path }}"
diff --git a/ansible/group_vars/windows.example.yml b/ansible/group_vars/windows.example.yml
index 8b41439..09e91d3 100644
--- a/ansible/group_vars/windows.example.yml
+++ b/ansible/group_vars/windows.example.yml
@@ -20,6 +20,9 @@ aw_windows_state_root: "C:\\ProgramData\\ActivityWatch-Phase2"
 aw_windows_afk_enabled: true
 aw_windows_window_enabled: true
 aw_windows_local_agent_logs_enabled: false
+aw_windows_incident_capture_enabled: true
+aw_windows_incident_screenshot_enabled: true
+aw_windows_incident_artifacts_root: "{{ aw_windows_state_root }}\\incident-artifacts"
 aw_windows_logon_marker_enabled: true
 aw_windows_skip_hardening: false
 
diff --git a/windows/ActivityWatch.Windows.Common.psm1 b/windows/ActivityWatch.Windows.Common.psm1
index 4180964..1d87864 100755
--- a/windows/ActivityWatch.Windows.Common.psm1
+++ b/windows/ActivityWatch.Windows.Common.psm1
@@ -320,6 +320,9 @@ function New-ActivityWatchDeploymentConfig {
         [bool]$AfkEnabled = $true,
         [bool]$WindowEnabled = $true,
         [bool]$LocalAgentLogsEnabled = $true,
+        [bool]$IncidentCaptureEnabled = $true,
+        [bool]$IncidentScreenshotEnabled = $true,
+        [string]$IncidentArtifactsRoot,
         [bool]$LogonMarkerEnabled = $true,
         [Parameter(Mandatory = $true)]
         [string]$LaunchScriptPath,
@@ -330,6 +333,8 @@ function New-ActivityWatchDeploymentConfig {
         [string]$PackageVersion = 'v0.13.2'
     )
 
+    $effectiveIncidentArtifactsRoot = if ($IncidentArtifactsRoot) { $IncidentArtifactsRoot } else { Join-Path $StateRoot 'incident-artifacts' }
+
     return [pscustomobject]@{
         version  = 1
         generatedAtUtc = (Get-Date).ToUniversalTime().ToString('o')
@@ -361,9 +366,9 @@ function New-ActivityWatchDeploymentConfig {
             localAgentLogsEnabled = $LocalAgentLogsEnabled
         }
         incidentCapture = [pscustomobject]@{
-            enabled           = $true
-            screenshotEnabled = $true
-            artifactsRoot     = (Join-Path $StateRoot 'incident-artifacts')
+            enabled           = $IncidentCaptureEnabled
+            screenshotEnabled = $IncidentScreenshotEnabled
+            artifactsRoot     = $effectiveIncidentArtifactsRoot
         }
         sessionEvents = [pscustomobject]@{
             logonEnabled = $LogonMarkerEnabled
diff --git a/windows/deploy-domain-users.ps1 b/windows/deploy-domain-users.ps1
index da246c6..936ce3c 100755
--- a/windows/deploy-domain-users.ps1
+++ b/windows/deploy-domain-users.ps1
@@ -19,6 +19,9 @@ param(
     [bool]$AfkEnabled = $true,
     [bool]$WindowEnabled = $true,
     [bool]$LocalAgentLogsEnabled = $false,
+    [bool]$IncidentCaptureEnabled = $true,
+    [bool]$IncidentScreenshotEnabled = $true,
+    [string]$IncidentArtifactsRoot,
     [bool]$LogonMarkerEnabled = $true,
     [string]$CustomRulesPath,
     [string]$CustomPolicyPath
@@ -81,6 +84,9 @@ $config = New-ActivityWatchDeploymentConfig `
     -AfkEnabled $AfkEnabled `
     -WindowEnabled $WindowEnabled `
     -LocalAgentLogsEnabled $LocalAgentLogsEnabled `
+    -IncidentCaptureEnabled $IncidentCaptureEnabled `
+    -IncidentScreenshotEnabled $IncidentScreenshotEnabled `
+    -IncidentArtifactsRoot $IncidentArtifactsRoot `
     -LogonMarkerEnabled $LogonMarkerEnabled `
     -LaunchScriptPath $launchScriptPath `
     -RecoveryScriptPath $recoveryScriptPath `
diff --git a/windows/deploy-ensemble.ps1 b/windows/deploy-ensemble.ps1
index 3f54a3c..129d226 100644
--- a/windows/deploy-ensemble.ps1
+++ b/windows/deploy-ensemble.ps1
@@ -19,6 +19,9 @@ param(
     [bool]$AfkEnabled = $true,
     [bool]$WindowEnabled = $true,
     [bool]$LocalAgentLogsEnabled = $false,
+    [bool]$IncidentCaptureEnabled = $true,
+    [bool]$IncidentScreenshotEnabled = $true,
+    [string]$IncidentArtifactsRoot,
     [bool]$LogonMarkerEnabled = $true,
     [string]$CustomRulesPath,
     [string]$CustomPolicyPath,
@@ -62,6 +65,9 @@ if (-not (Test-Path -LiteralPath $deployScript)) {
     -AfkEnabled $AfkEnabled `
     -WindowEnabled $WindowEnabled `
     -LocalAgentLogsEnabled $LocalAgentLogsEnabled `
+    -IncidentCaptureEnabled $IncidentCaptureEnabled `
+    -IncidentScreenshotEnabled $IncidentScreenshotEnabled `
+    -IncidentArtifactsRoot $IncidentArtifactsRoot `
     -LogonMarkerEnabled $LogonMarkerEnabled `
     -CustomRulesPath $CustomRulesPath `
     -CustomPolicyPath $CustomPolicyPath
@@ -81,6 +87,9 @@ if (-not $SkipHardening) {
         -AfkEnabled $AfkEnabled `
         -WindowEnabled $WindowEnabled `
         -LocalAgentLogsEnabled $LocalAgentLogsEnabled `
+        -IncidentCaptureEnabled $IncidentCaptureEnabled `
+        -IncidentScreenshotEnabled $IncidentScreenshotEnabled `
+        -IncidentArtifactsRoot $IncidentArtifactsRoot `
         -LogonMarkerEnabled $LogonMarkerEnabled `
         -CustomRulesPath $CustomRulesPath `
         -CustomPolicyPath $CustomPolicyPath
diff --git a/windows/deploy-single-user.ps1 b/windows/deploy-single-user.ps1
index 878eae4..d3eafef 100755
--- a/windows/deploy-single-user.ps1
+++ b/windows/deploy-single-user.ps1
@@ -18,6 +18,9 @@ param(
     [bool]$AfkEnabled = $true,
     [bool]$WindowEnabled = $true,
     [bool]$LocalAgentLogsEnabled = $false,
+    [bool]$IncidentCaptureEnabled = $true,
+    [bool]$IncidentScreenshotEnabled = $true,
+    [string]$IncidentArtifactsRoot,
     [bool]$LogonMarkerEnabled = $true,
     [string]$CustomRulesPath,
     [string]$CustomPolicyPath
@@ -79,6 +82,9 @@ $config = New-ActivityWatchDeploymentConfig `
     -AfkEnabled $AfkEnabled `
     -WindowEnabled $WindowEnabled `
     -LocalAgentLogsEnabled $LocalAgentLogsEnabled `
+    -IncidentCaptureEnabled $IncidentCaptureEnabled `
+    -IncidentScreenshotEnabled $IncidentScreenshotEnabled `
+    -IncidentArtifactsRoot $IncidentArtifactsRoot `
     -LogonMarkerEnabled $LogonMarkerEnabled `
     -LaunchScriptPath $launchScriptPath `
     -RecoveryScriptPath $recoveryScriptPath `
diff --git a/windows/hardening-recovery.ps1 b/windows/hardening-recovery.ps1
index 90c6fde..c908b2f 100755
--- a/windows/hardening-recovery.ps1
+++ b/windows/hardening-recovery.ps1
@@ -16,6 +16,9 @@ param(
     [bool]$AfkEnabled,
     [bool]$WindowEnabled,
     [bool]$LocalAgentLogsEnabled,
+    [bool]$IncidentCaptureEnabled,
+    [bool]$IncidentScreenshotEnabled,
+    [string]$IncidentArtifactsRoot,
     [bool]$LogonMarkerEnabled,
     [string]$CustomRulesPath,
     [string]$CustomPolicyPath,
@@ -62,6 +65,9 @@ $effectiveRecoveryInterval = if ($PSBoundParameters.ContainsKey('RecoveryInterva
 $effectiveAfkEnabled = if ($PSBoundParameters.ContainsKey('AfkEnabled')) { [bool]$AfkEnabled } elseif ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'collectors' -and $existingConfig.collectors.PSObject.Properties.Name -contains 'afkEnabled') { [bool]$existingConfig.collectors.afkEnabled } else { $true }
 $effectiveWindowEnabled = if ($PSBoundParameters.ContainsKey('WindowEnabled')) { [bool]$WindowEnabled } elseif ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'collectors' -and $existingConfig.collectors.PSObject.Properties.Name -contains 'windowEnabled') { [bool]$existingConfig.collectors.windowEnabled } else { $true }
 $effectiveLocalAgentLogsEnabled = if ($PSBoundParameters.ContainsKey('LocalAgentLogsEnabled')) { [bool]$LocalAgentLogsEnabled } elseif ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'logging' -and $existingConfig.logging.PSObject.Properties.Name -contains 'localAgentLogsEnabled') { [bool]$existingConfig.logging.localAgentLogsEnabled } else { $false }
+$effectiveIncidentCaptureEnabled = if ($PSBoundParameters.ContainsKey('IncidentCaptureEnabled')) { [bool]$IncidentCaptureEnabled } elseif ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'incidentCapture' -and $existingConfig.incidentCapture.PSObject.Properties.Name -contains 'enabled') { [bool]$existingConfig.incidentCapture.enabled } else { $true }
+$effectiveIncidentScreenshotEnabled = if ($PSBoundParameters.ContainsKey('IncidentScreenshotEnabled')) { [bool]$IncidentScreenshotEnabled } elseif ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'incidentCapture' -and $existingConfig.incidentCapture.PSObject.Properties.Name -contains 'screenshotEnabled') { [bool]$existingConfig.incidentCapture.screenshotEnabled } else { $true }
+$effectiveIncidentArtifactsRoot = if ($PSBoundParameters.ContainsKey('IncidentArtifactsRoot') -and $IncidentArtifactsRoot) { $IncidentArtifactsRoot } elseif ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'incidentCapture' -and $existingConfig.incidentCapture.PSObject.Properties.Name -contains 'artifactsRoot') { [string]$existingConfig.incidentCapture.artifactsRoot } else { Join-Path $effectiveStateRoot 'incident-artifacts' }
 $effectiveLogonMarkerEnabled = if ($PSBoundParameters.ContainsKey('LogonMarkerEnabled')) { [bool]$LogonMarkerEnabled } elseif ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'sessionEvents' -and $existingConfig.sessionEvents.PSObject.Properties.Name -contains 'logonEnabled') { [bool]$existingConfig.sessionEvents.logonEnabled } else { $true }
 $effectiveVersion = if ($Version) { $Version } elseif ($existingConfig) { [string]$existingConfig.package.version } else { 'v0.13.2' }
 
@@ -117,6 +123,9 @@ $config = New-ActivityWatchDeploymentConfig `
     -AfkEnabled $effectiveAfkEnabled `
     -WindowEnabled $effectiveWindowEnabled `
     -LocalAgentLogsEnabled $effectiveLocalAgentLogsEnabled `
+    -IncidentCaptureEnabled $effectiveIncidentCaptureEnabled `
+    -IncidentScreenshotEnabled $effectiveIncidentScreenshotEnabled `
+    -IncidentArtifactsRoot $effectiveIncidentArtifactsRoot `
     -LogonMarkerEnabled $effectiveLogonMarkerEnabled `
     -LaunchScriptPath $effectiveLaunchScript `
     -RecoveryScriptPath $effectiveRecoveryScript `