Diagnostic Data and Telemetry¶
Windows sends diagnostic data, crash dumps, and usage statistics to Microsoft. Level 1 limits it to the minimum. Level 2 turns off as much as policy allows. The reasoning is the same either way: anything leaving the machine is information an attacker who intercepts it can use, and crash dumps in particular can contain passwords and file contents.
None of these break a scenario. Apply all of them.
Where¶
gpedit.msc → Computer Configuration → Administrative Templates, mostly under Windows Components → Data Collection and Preview Builds and System → Internet Communication Management → Internet Communication settings.
Level 1¶
| CIS | Setting | Path | Set to | Why |
|---|---|---|---|---|
| 18.10.16.1 | Allow Diagnostic Data | Data Collection and Preview Builds | Enabled: Send required diagnostic data (or Diagnostic data off, on Enterprise) | The minimum Windows will accept |
| 18.10.16.3 | Do not show feedback notifications | Data Collection and Preview Builds | Enabled | No "rate your experience" prompts, which are also a data channel |
| 18.10.13.3 | Turn off Microsoft consumer experiences | Windows Components → Cloud Content | Enabled | No suggested apps or tips pushed from Microsoft |
| 18.10.13.1 | Turn off cloud consumer account state content | Cloud Content | Enabled | Same, for account-based content |
| 18.1.2.2 | Allow users to enable online speech recognition services | Control Panel → Regional and Language Options | Disabled | Voice data doesn't go to the cloud |
| 18.9.19.2 | Continue experiences on this device | System → Group Policy | Disabled | Activity doesn't sync across devices through a Microsoft account |
| 18.9.20.1.2 | Turn off downloading of print drivers over HTTP | Internet Communication settings | Enabled | Drivers come from Windows Update or the administrator, not a web download |
| 18.9.20.1.6 | Turn off Internet download for Web publishing and online ordering wizards | Internet Communication settings | Enabled | |
| 18.10.79.1 | Enables or disables Windows Game Recording and Broadcasting | Windows Components → Windows Game Recording and Broadcasting | Disabled | Screen recording feature off |
Level 2¶
Every one of these is a feature that phones home. Under Internet Communication settings, set each to Enabled (they're phrased as "Turn off"):
| CIS | Setting |
|---|---|
| 18.9.20.1.3 | Turn off handwriting personalization data sharing |
| 18.9.20.1.4 | Turn off handwriting recognition error reporting |
| 18.9.20.1.5 | Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com |
| 18.9.20.1.7 | Turn off printing over HTTP |
| 18.9.20.1.8 | Turn off Registration if URL connection is referring to Microsoft.com |
| 18.9.20.1.9 | Turn off Search Companion content file updates |
| 18.9.20.1.10 | Turn off the "Order Prints" picture task |
| 18.9.20.1.11 | Turn off the "Publish to Web" task for files and folders |
| 18.9.20.1.12 | Turn off the Windows Messenger Customer Experience Improvement Program |
| 18.9.20.1.13 | Turn off Windows Customer Experience Improvement Program |
| 18.9.20.1.14 | Turn off Windows Error Reporting |
Under Data Collection and Preview Builds:
| CIS | Setting | Set to | Why |
|---|---|---|---|
| 18.10.16.2 | Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service | Enabled: Disable Authenticated Proxy usage | Telemetry can't borrow the user's proxy credentials |
| 18.10.16.4 | Enable OneSettings Auditing | Enabled | Logs which settings Windows downloads from Microsoft |
| 18.10.16.5 | Limit Diagnostic Log Collection | Enabled | No extra logs uploaded on request |
| 18.10.16.6 | Limit Dump Collection | Enabled | Crash dumps stay on the machine. Memory dumps contain whatever was in memory. |
Under System → Troubleshooting and Diagnostics:
| CIS | Setting | Set to | Why |
|---|---|---|---|
| 18.9.49.5.1 | Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider | Disabled | MSDT was the vector for the 2022 Follina exploit |
| 18.9.49.11.1 | Enable/Disable PerfTrack | Disabled | Performance telemetry |
Under Windows Components → App and Device Inventory, all Enabled: Turn off API Sampling (18.10.3.1), Turn off Application Footprint (18.10.3.2), Turn off Install Tracing (18.10.3.3). Under Windows Components → Application Compatibility → Turn off Inventory Collector: Enabled (STIG WN22-CC-000200), which stops the inventory of installed programs and files from being sent to Microsoft.
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppCompat" /v DisableInventory /t REG_DWORD /d 1 /f
Under User Configuration → Administrative Templates: System → Internet Communication Management → Turn off Help Experience Improvement Program (19.6.6.1.1): Enabled. Windows Components → Cloud Content → Do not use diagnostic data for tailored experiences (19.7.8.3): Enabled.
Services: disable WerSvc and wercplsupport (Services to Disable).
Apply the main ones¶
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v AllowTelemetry /t REG_DWORD /d 1 /f
One worked example; the rest are in the table. Type each reg add yourself (the syntax is on The Command Line) and read it back with reg query "<key>" /v <name> before moving on:
| Key | Value | Type | Data |
|---|---|---|---|
HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection |
AllowTelemetry |
REG_DWORD | 1 |
HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection |
DoNotShowFeedbackNotifications |
REG_DWORD | 1 |
HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection |
LimitDumpCollection |
REG_DWORD | 1 |
HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection |
LimitDiagnosticLogCollection |
REG_DWORD | 1 |
HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent |
DisableWindowsConsumerFeatures |
REG_DWORD | 1 |
HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting |
Disabled |
REG_DWORD | 1 |
HKLM\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy |
DisableQueryRemoteServer |
REG_DWORD | 0 |
HKLM\SOFTWARE\Policies\Microsoft\Windows\GameDVR |
AllowGameDVR |
REG_DWORD | 0 |
HKLM\SOFTWARE\Policies\Microsoft\InputPersonalization |
AllowInputPersonalization |
REG_DWORD | 0 |
Verify¶
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection"
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" /v Disabled
Try it¶
- Set the telemetry level and find it in Settings → Privacy → Diagnostics (greyed out).
- Set three of the table's values with
reg addand check them.
Build it¶
A privacy.bat for this group; the values are all reg add and all verify with reg query.