1

So I have been using the firewall from Symantec Endpoint Protection to analyze and block telemetry collected my Microsoft. I have recognized a trend.

  1. The standard feedback client tries to connect to: settings-win.data.microsoft.com

  2. If that fails, Feedback SUIF(unsure about the acronym) tries to connect to: settings-win.data.microsoft.com

  3. If that fails, windows tries to send the data using the Windows Problem Reporting(WerMgr) to: watson.telemetry.microsoft.com It tries this method TWICE

Upon failing all of those steps it decides to get nasty and displays the Activate Windows watermark in the lower right hand corner.

Why would it display this watermark if it simply fails to send telemetry data? Is there any way to block the data being sent without causing the watermark to show up?

Some additional info:

I am running Insider Preview Microsoft Windows Version 10.0.11102

I was originally blocking the telemetry data in the release version without the watermark occurring, things seem to have changed. The attempts to send data have become more blatant and more frequent.

  • 3
    sounds like M$ is saying that you aren't complying with their terms and conditions for the preview program (which requires you have spyware turned on, BTW) and is telling you that if you aren't going to do what they say that you have to pay for a license. – Wyatt8740 Feb 9 '16 at 17:09
  • Your question makes no sense. 1) and 2) indicate the failsafe domain is identical to the primary domain. – Ramhound Feb 9 '16 at 17:34
  • @Ramhound steps 1 and 2 are two different applications trying to send the same data to the same address, the 2nd application only tries to send when the 1st one fails. In my opinion the 3rd is just semi social engineering as it looks like WerMgr is just trying to find a solution to a "problem" when it is actually sending telemetry data. – Chad Baxter Feb 9 '16 at 17:49
  • Retracted vote to close after reviewing the Windows Insider Program Agreement. – bwDraco Feb 9 '16 at 18:24
1

Not sure why you are getting the watermark.

This is how I disable telemetry in Windows 10, Open Control Panel and select Windows Firewall, then select Advanced Settings. When that window opens select Outbound Rules. Highlight all the telemetry entries then right click and select Disable Rule.

I have done this on several W10 PC's with any adverse issues.

enter image description here

  • 1
    I don't think this does anything in the 'preview' versions - microsoft's TOS says that you are required to use telemetry, similar to home edition. But then again I almost never use windows anymore and when I do it's a version that respects my privacy (7 without the telemetry updates). – Wyatt8740 Feb 9 '16 at 17:20
  • It has been proven that the telemetry addresses are hard-coded and that windows firewall has been made to ignore connections to these hosts. This is why I am using a third party firewall. – Chad Baxter Feb 9 '16 at 17:30
  • @ChadBaxter post a link that supports that, all I have read is you cannot block telemetry ip's in the hosts file. – Moab Feb 9 '16 at 17:34
  • I missed the preview tag, I suppose preview versions may have been hard coded and you cannot opt out of telemetry. – Moab Feb 9 '16 at 17:37
  • @Moab you're good, I forget where I read it but some guy did some testing and found that some telemetry routes around the windows firewall. He used a Windows 10 VM and monitored all connections out of the VM. He set up the VM's firewall to block telemetry and he found data was still transmitted. – Chad Baxter Feb 9 '16 at 17:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.