[REPO] Windows 10 TELEMETRY REPOSITORY

All of the policy settings work on home/pro/enterprise
You just can't change the policy editor yourself without enterprise.

 

i have delete the 4-5 packages offline from install.wim works also i managed find how disable using services.msc and gpedit did know any how open it offline ?

 

So if I understand well, this topic is rather meant for the home & pro versions of windows 10, as one can disable telemetry with this simple tweak in Enterprise in the group policy editor?

 

So there seems no hope for the non-enterprise versions?

 

i find how disable telementry only in install.wim

 

Yep, it's all of these great stories.

 

How about using some sort of firewall set up for telemetry. For example firewall in routers, cheap pcs or some other devices. We should ponder on this option too I think.

 

You need to login to view this posts content.

 

Thanks for being that clear.
Being an Enterprise LTSB N user and doing those 2 tweaks in gpedit.msc, I don't need to run the script of s1ave77 then to be safe.

 

You can use the registry settings that are modified by the group policy editor in enterprise, but on home and pro versions. They will do the exact same thing that it does on enterprise.
You just can't set them via group policy editor in Home/Pro.

 

S-1-5-21-1714679646-3939120703-3301173095-1001 is a unique user sid
you need to replace it with HKEY_CURRENT_USER

Code:

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{48D7CCEC-0591-493E-BB13-377E329618B2}Machine\Software\Policies\Microsoft\Windows\Windows Search]

 

I do not have available device with home/pro windows installed to verify this, I hope soon.
Think, try set them via group policy editor in home/pro then open Setings -> Privacy -> Feedback & diagnostics
and if (Send your device data to Microsoft) window is disabled probably works.

 

You need to login to view this posts content.

 

I couldn't remove telemetry packages with this program, even though it told me it was successful - when I did the install_wim_tweak.exe /o /l afterwards, the package.txt shows them still there. Then I tried to manually remove with DISM /Online /Remove-Package /packagename:xxxxxx and I get "Access denied", and "Error 5". I've run cmd with admin privileges and from built-in admin account and same thing. Any ideas how to get access?

 

Copy the entire string, paste to empty txt file, save as ***.reg file and merge.

Spoiler

Windows Registry Editor Version 5.00


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]


"{6335365E-38DF-4F8C-BD0D-DCD11F79DF2D}"="v2.24|Action=Block|Active=TRUE|Dir=Out|App=C:\windows\system32\svchost.exe|Svc=dmwappushservice|Name=Windows Dmwappushservice|"


"{60E6D465-398E-4850-BE86-7EF7620A2377}"="v2.24|Action=Block|Active=TRUE|Dir=Out|App=C:\windows\system32\svchost.exe|Svc=DiagTrack|Name=Windows Telemetry|"


"{2765E0F4-2918-4A46-B9C9-43CDD8FCBA2B}"="v2.24|Action=Block|Active=TRUE|Dir=Out|App=C:\windows\systemapps\microsoft.windows.cortana_cw5n1h2txyewy\searchui.exe|Name=Search and Cortana application|AppPkgId=S-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742|"


"{2F1EB671-4A03-4BA3-8D97-8FD9F8858759}"="v2.24|Action=Block|Active=TRUE|Dir=Out|Protocol=6|App=C:\windows\system32\wermgr.exe|Name=Windows Problem Reporting|"


"{F85D77A3-D88E-4960-996F-7C2DAB9DCED6}"="v2.24|Action=Allow|Active=TRUE|Dir=Out|Protocol=6|App=C:\windows\system32\svchost.exe|Svc=Schedule|Name=Windows Services[Schedule]|"


"{882329F0-8BA4-4594-B114-BAC2DB35127B}"="v2.24|Action=Allow|Active=TRUE|Dir=Out|Protocol=6|RPort=443|App=C:\program files\windows defender\mpcmdrun.exe|Name=Microsoft Malware Protection Command Line Utility|"


"{454A996E-A17C-4D58-9C89-1E1A919B6C7C}"="v2.24|Action=Block|Active=TRUE|Dir=Out|Protocol=6|App=C:\windows\system32\rundll32.exe|Name=Windows host process (Rundll32)|"


"{A38B0F49-40F2-4AAF-8944-07A7BF116A70}"="v2.24|Action=Block|Active=TRUE|Dir=Out|Protocol=6|App=C:\windows\system32\sihclient.exe|Name=SIH Client|"


"{2B930A7C-4B6B-49ED-92EE-7966287150AD}"="v2.24|Action=Block|Active=TRUE|Dir=Out|Protocol=6|App=C:\windows\system32\searchindexer.exe|Name=Microsoft Windows Search Indexer|"


"{14EA9999-E20B-4894-AF9C-A2DECF661549}"="v2.24|Action=Block|Active=TRUE|Dir=Out|Protocol=6|App=%ProgramFiles%\Windows Defender\MsMpEng.exe|Svc=WinDefend|Name=Block All Out traffic from WinDefend|"


"{DD68A878-61B0-421E-A029-AEDB0CFBCD78}"="v2.24|Action=Allow|Active=TRUE|Dir=Out|Protocol=6|RPort=80|RPort=443|App=C:\program files\windows defender\msascui.exe|Name=Windows Defender User Interface|"


"{4B5FB038-7A91-46CB-9FD2-A8C9A5375E3B}"="v2.24|Action=Block|Active=TRUE|Dir=Out|Protocol=6|App=C:\windows\systemapps\microsoft.windows.cortana_cw5n1h2txyewy\searchui.exe|Name=Search Application|"


"{46319005-5AA7-4404-93BD-9F5BA8742D5A}"="v2.24|Action=Block|Active=TRUE|Dir=Out|App=%SystemRoot%\explorer.exe|Name=Block All Out traffic from Explorer|"


"{C6F71C19-BD3A-41D6-93D3-3CE207457037}"="v2.24|Action=Allow|Active=TRUE|Dir=Out|Protocol=6|RPort=80|RPort=443|App=C:\windows\system32\svchost.exe|Svc=IKEEXT|Name=Process for Windows Services [IKEEXT]|"

 

@ ALL

Thanks, so far. Please someone give the new things to adopt in OP and in the script.

I do not need more scripts, since most of their content is already integrated here and therefor redundant.

Anything interesting found?

How about the long REG list from that malware like tool ?

 

REG ADD HKCU\SOFTWARE\Microsoft\Siuf\Rules /v NumberOfSIUFInPeriod /t REG_DWORD /d 0 /f
REG ADD HKCU\SOFTWARE\Microsoft\Personalization\Settings /v AcceptedPrivacyPolicy /t REG_DWORD /d 0 /f
REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\ /v BingSearchEnabled /t REG_DWORD /d 0 /f

to

REG ADD HKLM\SOFTWARE\Microsoft\Siuf\Rules /v NumberOfSIUFInPeriod /t REG_DWORD /d 0 /f
REG ADD HKLM\SOFTWARE\Microsoft\Personalization\Settings /v AcceptedPrivacyPolicy /t REG_DWORD /d 0 /f
REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\ /v BingSearchEnabled /t REG_DWORD /d 0 /f

All these should be changed to HKLM, then it applies to every other account that logs in to PC. Never use HKCU when it's not needed for these settings.

These are also good:

REG ADD HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AutoLogger-Diagtrack-Listener /v Start /t REG_DWORD /d 0 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AutoLogger-Diagtrack-Listener\{22FB2CD6-0E7B-422B-A0C7-2FAD1FD0E716} /v Enabled /t REG_DWORD /d 0 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AutoLogger-Diagtrack-Listener\{331C3B3A-2005-44C2-AC5E-77220C37D6B4} /v Enabled /t REG_DWORD /d 0 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AutoLogger-Diagtrack-Listener\{44345799-E748-4607-9ACF-35306808422C} /v Enabled /t REG_DWORD /d 0 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AutoLogger-Diagtrack-Listener\{96F4A050-7E31-453C-88BE-9634F4E02139} /v Enabled /t REG_DWORD /d 0 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AutoLogger-Diagtrack-Listener\{DBE9B383-7CF3-4331-91CC-A3CB16A3B538} /v Enabled /t REG_DWORD /d 0 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\DiagTrack /v Start /t REG_DWORD /d 4 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\dmwappushservice /v Start /t REG_DWORD /d 4 /f

 

At least the red ones are redundant when doing sc delete.

 

You need to login to view this posts content.

 

They should be removed, these packages?

Microsoft-Windows-DiagTrack-Internal-Package~31bf3856ad364e35~amd64~en-EN~10.0.10240.16384
Microsoft-Windows-DiagTrack-Internal-Package~31bf3856ad364e35~amd64~~10.0.10240.16384