5

I am running Windows 10 pro. I deleted all the telemetric services and all the scheduled tasks (except defragment). With some digging I make a list of telemetric executable files and blocked them in firewall.

Is Windows firewall sufficient to block Windows telemetry fully and forever ??

7
  • 8
    no, Windows domains are allowed (hardcoded whitelist in DLLs) Commented May 10, 2017 at 15:43
  • 1
    You shouldn't assume that the list of exceptions you have created will not be wiped, in the future, because of a chance in a future Windows 10 feature update. It has happened before where a feature that exists in 1703, required Microsoft to set the option to a new default value, because the previous default value was no longer valid
    – Ramhound
    Commented May 10, 2017 at 15:45
  • 2
    It doesn't matter. Microsoft's domains are whitelisted. You would have to block the traffic on the telemetry ports, instead of blocking, specific domains. I suggest you block the domains using your networking hardware instead of doing anying within Windows. Your list also will have to be updated every single time, anyone of those applications is updated, which is several times a year because a Windows Firewall exception is file version specific.
    – Ramhound
    Commented May 10, 2017 at 15:53
  • 2
    They are telling you it is due to some behind the scenes voo doo magic so leave it alone at the Windows OS level as blocking Windows OS level related objects, etc. may be superseded with funky voo doo coming to take your guns like Trump magic!! Don't do it man, don't do it, just block at a different level such as a corporate firewall as the Windows OS and blocking Windows sites, domains, etc. may not give you the expected result. I wasn't aware of the file version specific Windows FW thing as pointed out but that is even another reason it's a poor choice to maintain such access restrictions. Commented May 11, 2017 at 0:09
  • 1
    Please edit your question and provide the list of objects you have determined related to Windows telemetry and what you have setup that is blocking this. As far as "Is Windows firewall sufficient to block Windows telemetry fully and forever ??"... well that depends on what you do with this system as far as Windows Updates, OS version build updates, what changes are made and how those relate to explicit blocking rules you have setup, what MS does behind the scenes to allow otherwise regardless (e.g. the whitelist), and I'm sure a few other things too so you'll get an educated guess only. Commented May 16, 2017 at 4:41

2 Answers 2

4
+25

The actual answer to your question is "Yes". See this widely mentioned article:
Stop Windows 10 spying on you using just Windows Firewall.

But I would like to throw some light of sanity on this question. The big hype of "Windows is spying on you" is sensational enough to make good headlines, but the truth is much less interesting.

First, telemetry data is not used for commercial purposes. Most of it is even deleted within 30 days of its transmission.

Second, Microsoft has become quite transparent about telemetry, and its latest versions have exposed most of the functions through PC Settings so they have become optional and controllable by the user.

Third, some parts of this telemetry data are even essential to the correct functioning of Windows. Without these parts, for example Windows Update may install incorrect patches with very bad results for the health of your computer. It is impossible to tell which "telemetric executable files" are essential for the correct functioning of your computer.

My best advice for you is to turn off telemetry via PC Settings. Do not give in to the hype.

As a remark: Microsoft is not the only one that is "spying" on you. For example see Disable NVIDIA Telemetry. I really think that stopping it all is Cutting off the nose to spite the face.

See also :

2
  • Care to share the source for "First, telemetry data is not used for commercial purposes"?
    – Mohnish
    Commented Sep 18, 2023 at 22:02
  • @Mohnish: The source is multiple declarations by Microsoft.
    – harrymc
    Commented Sep 19, 2023 at 7:48
1

Things to do before: Activate Windows OS before this tweak. Gather full path of every executable files that need to be connected. Make sure to have backup. Otherwise try in virtual machine. Below I mentioned my process with batch files command. Read also the pros and cons.

Procedure (with explanation):

  1. Delete predefined firewall rules: This command delete all predefined firewall rules. Backup the registry path HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess. Another way is to delete those rules in Windows Firewall (WF.msc).
for %%X in ( 
    "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Defaults\FirewallPolicy\FirewallRules"
"HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules"
"HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedInterfaces"
"HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices") do (
reg delete %%X /F
)
  1. Block all Outbound and Inbound connections: This command add registry to block all outbound (DefaultOutboundAction) and inbound (DefaultInboundAction) firewall settings with batch file.
for %%X in (
Defaults
Parameters ) do (
 for %%Y in (
 DomainProfile
 PublicProfile
 StandardProfile ) do (
 reg add HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\%%X\FirewallPolicy\%%Y /V "EnableFirewall" /T REG_DWORD /D "1" /F
 reg add HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\%%X\FirewallPolicy\%%Y /V "DisableNotifications" /T REG_DWORD /D "0" /F
 reg add HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\%%X\FirewallPolicy\%%Y /V "DefaultInboundAction" /T REG_DWORD /D "1" /F
 reg add HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\%%X\FirewallPolicy\%%Y /V "DefaultOutboundAction" /T REG_DWORD /D "1" /F
 )
)
  1. Restart PC to apply that previous registry settings. Shut down or sign out does not work.

  2. Allow apps to outbound rules: First add allow system outbound rule. Then other apps including antivirus software.

    Powershell New-NetFirewallRule -DisplayName "~System" -Name "~System" -Direction Outbound -Program "System" -Action Allow

  3. Delete DNS cache service: This command first stops and then deletes DNS caching service. As windows firewall will block svchost.exe, delete this service. Otherwise it would not be possible to enable DNS for other apps.

    sc stop "Dnscache" & sc delete "Dnscache"

  • Pros: This procedure does not require to edit hosts file. One has not configured all the telemetry IPs and URLs in hosts file. Block entirely telemetry apps. Try this with enabling full telemetry and Cortana allowed. Does not require to delete any other services. No telemetry network activity has shown with WireShark, GlassWire, tcpview, CurrPorts and SmartSniff (i.e. no Microsoft web address or IP is shown).

  • Cons: Block metro apps including Cortana, Edge, Store, Mail, Maps etc. Block any apps that want to update silently.

2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .