Disable data logging in Windows 10
Please excuse the below screen captures are in German, But the menu entries are just the same in English, so it should be easy for you to find the right one.
By the way, a very good howto is available from reddit as well, so check it out.
Simply follow my settings in below screnn copys.
Get rid of some services
sc delete DiagTrack
sc delete dmwappushservice
echo "" > C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger\AutoLogger-Diagtrack-Listener.etl
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection /v AllowTelemetry /t REG_DWORD /d 0 /f"
Change owner and rights of C:\Windows\System32\CompatTelRunner.exe
del C:\Windows\System32\CompatTelRunner.exe
And deactivate the telemetry data collection
Gpedit
Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > Telemetry
I personally doubt that with above setting you're now save from Microsoft's data sucking, but at least you shut the main doors.
For the NON-WSUS machines, keep MS-Updates available.
This will be tougher one.
Deeper investigation is still in progress from what my DNS- and IP-monitoring will show.
Anyway, a good entry point seems this post talking about the URLs need to be available fror WSUS to pull the updates.
The below list was mentioned here, but firsts tests showed that whitelisting windowsupdate.microsoft.com already enabled the 1809 to fetch the list of updates and whitelisting windowsupdate.com installed them.
But this needs deeper analysis how far these domains are used for telemetry actions as well. My sysmon-Splunk-Dashboard will show soon. :-)
As per post of August 2018:
-
http://*.windowsupdate.microsoft.com
-
https://*.windowsupdate.microsoft.com
-
http://*.update.microsoft.com
-
https://*.update.microsoft.com
-
http://*.windowsupdate.com
-
http://*.download.windowsupdate.com
Win10 Telemetry tweaks
https://www.mpauli.de/disable-data-logging-in-windows-10.html
# Win 10 / Server 2016 / Server 2019 Initial Setup Script - Tweak library
# Author: Disassembler <disassembler@dasm.cz>
# Version: v3.6, 2019-01-28
# Source: Disassembler0/Win10-Initial-Setup-Script
Description
This is a PowerShell script for automation of routine tasks done after fresh installations of Windows 10 and Windows Server 2016 / 2019. This is by no means any complete set of all existing Windows tweaks and neither is it another "antispying" type of script. It's simply a setting which I like to use and which in my opinion make the system less obtrusive.
Usage
If you just want to run the script with the default preset, download and unpack the latest release and then simply double-click on the Default.cmd file and confirm User Account Control prompt. Make sure your account is a member of Administrators group as the script attempts to run with elevated privileges.
The script supports command line options and parameters which can help you customize the tweak selection or even add your own custom tweaks, however these features require some basic knowledge of command line usage and PowerShell scripting. Refer to Advanced usage section for more details.
powershell.exe -NoProfile -ExecutionPolicy Bypass -File Win10.ps1 [-include filename] [-preset filename] [[!]tweakname]
-include filename load module with user-defined tweaks
-preset filename load preset with tweak names to apply tweakname apply tweak with this particular name
!tweakname remove tweak with this particular name from selection
My output while installing the defaulting script:
C:\Users\xxxx\Downloads\Win10-Initial-Setup-Script-master\Win10-Initial-Setup-Script-master>.\Default.cmd
Disabling Telemetry...
Disabling Wi-Fi Sense...
Disabling Bing Search in Start Menu...
Disabling Application suggestions...
Disabling Activity History...
Disabling Background application access...
Disabling Location Tracking...
Disabling automatic Maps updates...
Disabling Feedback...
Disabling Tailored Experiences...
Disabling Advertising ID...
Disabling Website Access to Language List...
Disabling Cortana...
Disabling Error reporting...
Stopping and disabling Diagnostics Tracking Service...
Stopping and disabling WAP Push Service...
Disabling implicit administrative shares...
Setting current network profile to private...
Hiding Account Protection warning...
Disabling Windows Script Host...
Enabling .NET strong cryptography...
Enabling F8 boot menu options...
Setting Data Execution Prevention (DEP) policy to OptOut...
Disabling Windows Update automatic restart...
Disabling Shared Experiences...
Disabling Remote Assistance...
Enabling Remote Desktop w/o Network Level Authentication...
Disabling Autoplay...
Disabling Autorun for all drives...
Disabling Action Center (Notification Center)...
Disabling Lock screen...
Hiding network options from Lock Screen...
Hiding shutdown options from Lock Screen...
Disabling Sticky keys prompt...
Showing task manager details...
Showing file operations details...
Hiding Taskbar Search icon / box...
Hiding Task View button…
Hiding Pictures icon from This PC...
Hiding Videos icon from This PC...
Hiding 3D Objects icon from This PC...
Disabling creation of thumbnail cache files...
Disabling creation of Thumbs.db on network folders...
Disabling OneDrive...
Uninstalling OneDrive...
Uninstalling default Microsoft applications...
Uninstalling default third party applications...
Disabling Xbox features...
Disabling built-in Adobe Flash in IE and Edge...
Disabling Edge preload...
Disabling Edge shortcut creation...
Disabling Internet Explorer first run wizard...
Setting Photo Viewer association for bmp, gif, jpg, png and tif...
Adding Photo Viewer to 'Open with...'
Uninstalling Microsoft XPS Document Writer...
Removing Default Fax Printer...
Press any key to continue...