[REPO] Windows 10 TELEMETRY REPOSITORY

Discussion in 'Windows 10' started by Yen, Aug 4, 2015.

  1. Nyrewes

    Nyrewes MDL Novice

    Dec 25, 2018
    9
    8
    0
  2. ceo54

    ceo54 MDL Addicted

    Aug 13, 2015
    978
    486
    30
    Here's a simple How To I followed.


    1. Get rid of 8 telemetry binaries
    2. Disable related services
    3. Strip Diagnostic related scheduled tasks
    4. Disable Diagtrack autologger
    5. Strip Defender

    These alone will get you 90% there. Rest 10% could be controlled with registry, typing, handwriting, contacts, speech etc, can all be turned off from registry. I'm sure there are many packs that have all the needed tweaks for this. Just do 5 steps and it will rip the telemetry infrastructure out.

    Code:
    :: Telemetry Executables (8 files)
    1.  C:\Windows\System32\CompatTelRunner.exe
    2.  C:\Windows\System32\DeviceCensus.exe
    3.  C:\Windows\System32\ProgramDataUpdater.exe
    4.  C:\Windows\System32\AggregatorHost.exe
    5.  C:\Windows\System32\aitstatic.exe
    6.  C:\Windows\System32\wsqmcons.exe
    7.  C:\Windows\System32\SIHClient.exe         
    8.  C:\Windows\System32\oobe\tflupdate.exe
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. pm67310

    pm67310 MDL Guru

    Sep 6, 2011
    3,915
    3,178
    120
    Use ifeo to block this executable and stay safe from sfc /scannow or revert change
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  4. qwesta

    qwesta MDL Senior Member

    Jul 22, 2011
    404
    214
    10
    Is there a command line to do this?
    Regards
     
  5. migascalp

    migascalp MDL Addicted

    Sep 18, 2009
    561
    945
    30
    Examples

    Edit
    Code:
    Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "DisallowRun" /t REG_DWORD /d "1" /f
    Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "1" /t REG_SZ /d "Smartscreen.exe" /f
    Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "2" /t REG_SZ /d "WindowsBackupClient.exe" /f
    Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WindowsBackupClient.exe" /v "Debugger" /t REG_SZ /d "blocked" /f
    Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smartscreen.exe" /v "Debugger" /t REG_SZ /d "Blocked" /f
    
     
  6. pm67310

    pm67310 MDL Guru

    Sep 6, 2011
    3,915
    3,178
    120
    @qwesta
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  7. ceo54

    ceo54 MDL Addicted

    Aug 13, 2015
    978
    486
    30
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  8. qwesta

    qwesta MDL Senior Member

    Jul 22, 2011
    404
    214
    10
    How does one run this please?
    Regards
     
  9. migascalp

    migascalp MDL Addicted

    Sep 18, 2009
    561
    945
    30
    Run as admin FAM2.80.cmd
     
  10. freddie-o

    freddie-o MDL Expert

    Jul 29, 2009
    1,745
    3,091
    60
    Facts About Telemetry: Why You Can Never Fully Verify It

    This applies to any telemetry check, on any system — not just Windows, not just one script. The same limits show up whether you're auditing Windows, a phone, a smart TV, or an app.

    The core fact: a clean scan means "nothing failed the checks I ran" — not "nothing is being sent." Those are different claims, and it's easy to blur them.

    Why no on-device check can ever be a guarantee
    Encryption hides the contents.
    Modern traffic is encrypted. You can see that a connection happened, and often where it went — but not what was inside it. You're always trusting the vendor's word for what a given server actually does with what it receives.
    Addresses aren't fixed. Big companies route traffic through content delivery networks, so the same service can use different internet addresses over time. Blocking by name holds up; watching for specific numbers can miss traffic the moment the address shifts.
    Not all traffic looks the same. Older tools were built to watch one kind of connection (TCP). Newer, faster protocols (like QUIC/HTTP-3, which rides over UDP) are much harder to inspect the same way — a real blind spot for most home-user tools, not just a missing checkbox.
    "Known" endpoint lists are never official or complete. They're built by outside researchers watching behavior over time, not published in full by the vendor. The list you're checking against is always a snapshot, not the whole picture.
    Closed-source software can't be fully audited. If you can't read the code, you only know what's been caught doing something — not everything it's capable of doing.
    The vendor can quietly undo your changes. Companies have reset user-modified settings via updates before, or flagged blocking attempts as a security risk.

    The general pattern behind all of this
    Every device-level check — hosts file, firewall rules, registry/settings toggles, scheduled tasks, live connection snapshots — controls or observes known, named things. None of them can prove the absence of something unknown. That's true of any checklist, on any system: you can verify what you thought to look for, never what you didn't.

    How to actually raise your confidence (not device-level checks)
    The only way to get a real answer instead of a hopeful one is to watch traffic from outside the device being audited, so nothing running on it can hide, and so IP rotation doesn't matter because you're watching everything, not just a list:

    Packet capture on the same device (e.g. Wireshark) — easiest, but you're still trusting the device you're suspicious of.
    A separate machine bridging the network connection — watches from outside, much harder to blind.
    A managed switch with a mirror/SPAN port — same outside vantage point, no bridge hardware needed.
    A dedicated DNS blocker on your network (e.g. Pi-hole) — fixes the address-rotation problem specifically, since it blocks by name.
    A full router-level firewall/capture setup — most complete, applies automatically to every device on the network.

    The honest bottom line
    A clean device-level scan is genuinely useful — it closes every door that kind of check can close, and that's real progress. But it's a ceiling, not a guarantee, for any system, on any check, by any tool. If actual certainty matters to you, the meaningful next step is always the same: watch from outside the device, not add more checks inside it.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  11. freddie-o

    freddie-o MDL Expert

    Jul 29, 2009
    1,745
    3,091
    60
    Update:
    disable_telemetry_08.17.2026

    Added offline verification scan (in disable_telemetry scripts) to check component store for file corruption
    Added more entries to the "Disable Windows telemetry, diagnostics, and feedback" list
    Added more tasks to be deleted in "Scheduled tasks that collect telemetry" list -- Autochk, DiskDiagnostic and InstallService
    Added AggregatorHost.exe, sdiagnhost.exe, SecurityHealthSystray.exe, MRT.exe, WerFault.exe and WerFaultSecure.exe to "IFEO redirect" list
    Added "diagsvc" to the list of windows diagnostics services to be deleted
    Removed "BITS" from the list of windows update services to be deleted -- it not only affects Windows Update and Microsoft Defender - it also affects third-party apps and network lagging
    Added "Null-route_hosts.cmd" script that blocks known Microsoft telemetry/diagnostic endpoints in the local hosts file. (In the ZIP package. Run this after a clean install of Windows).

    https://forums.mydigitallife.net/th...lemetry-repository.63874/page-66#post-1686849
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...