How to Completely Disable Windows 10 Telemetry

You’re staring at your Wireshark logs at 2 AM, watching a bizarre amount of encrypted traffic silently bleed out of your machine through port 443. The destination IPs trace back to Microsoft servers. You open your Windows settings, navigate to the privacy tab, and see that you’ve already toggled everything off. The diagnostic data is set to basic. The tailored experiences are disabled. You did everything the shiny user interface asked you to do.

Yet, your computer keeps talking.

It lies. Microsoft designed that entire friendly settings menu to pacify casual users with soothing toggle switches that essentially function as placebo buttons. They give you the illusion of privacy while quietly continuing to package up your keystroke metadata, application usage patterns, and hardware diagnostics in the background. If you’ve ever found yourself staring at a network monitor late at night wondering exactly how to completely disable Windows 10 telemetry, you already know the settings menu is effectively a joke.

We need to go deeper. Much deeper.

To actually stop your operating system from treating your personal bandwidth like an all-you-can-eat buffet, you have to rip out the wiring. You have to break things on purpose. You have to dive into the registry, gut the task scheduler, and block things at the network layer. It takes work.

The Day the Network Choked: A Lesson in Silent Siphoning

Let me paint a picture for you. Back in 2018, I was managing the IT infrastructure for a mid-sized regional medical billing firm. We had just rolled out fresh Windows 10 Pro images to about 400 workstations. Everything seemed fine for the first week.

Then, suddenly, our entire network started crawling. VoIP calls dropped. Database queries timed out. I pulled up our firewall traffic analyzer expecting to see a malware infection or maybe someone streaming 4K video. Nope. It was a process called CompatTelRunner.exe.

Four hundred machines had simultaneously decided it was the perfect time to run the Microsoft Compatibility Appraiser, zip up gigabytes of “telemetry” data, and upload it to Redmond. We were bleeding 14% of our total network capacity just to tell Microsoft how our computers were running. That was the day I developed what my team internally called the “Silent Wire Methodology.” We couldn’t afford to let an operating system dictate our bandwidth usage.

I spent the next three weeks reverse-engineering the exact mechanisms Windows uses to phone home. What I learned is that Microsoft doesn’t just use one method to gather data. They use redundant, overlapping services. If you kill a registry key, a scheduled task will rewrite it. If you disable a service, a Windows update will quietly turn it back on. You have to attack the problem from five different angles simultaneously.

Understanding the Target: What Are We Actually Killing?

Before you start ripping out system files, you need to understand the anatomy of the beast. Windows 10 groups its data collection primarily under a service originally called Diagnostics Tracking (DiagTrack). When tech enthusiasts realized what DiagTrack was doing and started writing scripts to disable it, Microsoft pulled a brilliant PR move. They didn’t remove the service.

They just renamed it.

Overnight, the notorious DiagTrack became the heavily sanitized “Connected User Experiences and Telemetry.” Sounds lovely, right? Like you’re joining a community. In reality, it’s the exact same executable (diagtrack.dll) running inside a generic svchost.exe wrapper. It collects crash dumps, app usage, unique device identifiers, and sometimes memory snapshots that can inadvertently contain personal data.

There are technically four levels of data collection baked into the OS:

• Security: The bare minimum. Usually only available to Enterprise and Education editions.
• Basic: The lowest level Home and Pro users can select via the GUI. Still sends hardware info and error reports.
• Enhanced: Gathers data about how you use applications.
• Full: Sucks up everything, including advanced diagnostic data and potentially user-generated content for troubleshooting.

Notice how “Off” isn’t on that list? That’s why we have to force it.

The First Strike: Group Policy Editor (Windows 10 Pro & Enterprise)

If you are running Windows 10 Pro, Enterprise, or Education, you have access to the Local Group Policy Editor. This is a powerful administrative tool that overrides standard user settings. Before diving into the registry, the Group Policy Editor is the cleanest first step when figuring out how to completely disable Windows 10 telemetry without breaking your core system functions.

Here is exactly how you lock it down.

Press the Windows key, type gpedit.msc, and hit Enter. You’ll see a clunky, old-school interface that hasn’t fundamentally changed since Windows 2000. That’s a good thing. It means it works.

Navigate through this exact path in the left-hand tree:

Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds

Look at the right-hand pane. You will see a policy named Allow Telemetry (or on newer builds, it might be called Allow Diagnostic Data). Double-click it.

By default, it’s set to “Not Configured.” Change the radio button to Enabled. Yes, I know that sounds completely backwards. You have to “Enable” the policy to force a specific configuration. Once you click Enabled, a drop-down menu will activate in the options pane below.

Click that drop-down and select 0 – Security (Enterprise Only). Click Apply, then OK.

Now, a massive caveat here. If you are running Windows 10 Pro, setting this to 0 actually defaults to “Basic” in the background. Microsoft intentionally hobbled the Pro edition so you can’t completely shut off the spigot using just Group Policy. Only Enterprise and Education editions actually respect the “0” value. If you’re on Pro (or Home, which doesn’t even have gpedit), you have to get your hands dirty in the Registry.

Deep Surgery: The Registry Editor

Editing the registry is where the real magic happens for anyone seriously researching how to completely disable Windows 10 telemetry at the bare-metal level. The registry is the central nervous system of Windows. When you change a value here, you are rewriting the genetic code of the operating system.

Hit the Windows key, type regedit, and hit Enter. Accept the UAC prompt. You are now holding the scalpel.

We are going to manually create the exact same restrictions that the Group Policy attempts to enforce, but we are going to make them absolute.

Navigate to this key:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection

Right-click anywhere in the empty white space on the right pane. Select New > DWORD (32-bit) Value. Name this new value exactly AllowTelemetry.

Double-click your newly created AllowTelemetry value. Ensure the “Value data” box is set to 0. Click OK.

But we aren’t done. Microsoft is sneaky. Sometimes, local policies are overridden by user-level configurations. So, we need to enforce this globally across the machine.

Navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection

Look for the AllowTelemetry DWORD here as well. If it exists, change it to 0. If it doesn’t exist, create it just like you did in the previous step and set it to 0.

Now, let’s kill the UI toggles completely so no other user (or rogue update) can casually turn them back on. Navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CloudContent

Create a new DWORD (32-bit) Value here. Name it DisableWindowsConsumerFeatures. Set the value to 1. This stops Windows from automatically downloading promoted apps like Candy Crush and quietly sending data about your interactions with the Start Menu.

Starving the Zombies: Disabling the Core Services

I get asked constantly about how to completely disable Windows 10 telemetry permanently, and I always point them straight to the services console because that’s where the zombie processes live. You can edit the registry all day, but if the executable that gathers the data is still running in the background, it will eventually find a way to phone home.

Press the Windows key, type services.msc, and hit Enter.

Scroll down the alphabetical list until you find Connected User Experiences and Telemetry. Double-click it.

Click the “Stop” button to kill the process immediately. Then, change the “Startup type” drop-down to Disabled. Click Apply. You just severed the main artery.

Next, look for dmwappushsvc (Device Management Wireless Application Protocol Push message Routing Service). Despite the incredibly confusing name, this service is heavily involved in routing telemetry data. Double-click it. Stop it. Disable it. Apply.

Some purists like to go a step further. Disabling a service through the GUI leaves the service installed on the machine. A major Windows feature update (like the old 21H2 or 22H2 rollouts) will often scan your services, notice that DiagTrack is disabled, assume it was an “accident,” and helpfully turn it back on for you.

If you want to absolutely obliterate the service so an update can’t easily restart it, you can delete it from the command line. Open Command Prompt as an Administrator and run:

sc delete DiagTrack

sc delete dmwappushservice

Poof. Gone. If Windows wants to restart them, it has to completely reinstall the service wrappers, which is much harder to do quietly in the background.

The Hidden Triggers: Gutting the Task Scheduler

This is the step almost everyone misses. You’ve killed the registry keys. You’ve deleted the services. You think you’re safe. Then, you leave your computer idle for twenty minutes, and suddenly your hard drive starts thrashing.

What’s happening?

Windows relies heavily on Scheduled Tasks to trigger maintenance, updates, and—you guessed it—data collection. If you don’t kill the scheduled tasks, Windows will eventually run a script that realizes the telemetry services are down, and it will attempt to repair them.

Open the Start menu, type Task Scheduler, and hit Enter.

In the left pane, expand the folder tree exactly like this:

Task Scheduler Library > Microsoft > Windows > Application Experience

In the middle pane, you are going to see a list of tasks that sound deceptively important. Don’t be fooled. Right-click and Disable every single one of these:

• Microsoft Compatibility Appraiser: This is the monster that choked my medical clinic’s network. It scans all your files to see if they are “compatible” with Windows updates and sends the data to Microsoft. Kill it.
• ProgramDataUpdater: Collects data about program installations and uninstalls. Disable.
• StartupAppTask: Scans what programs boot with your computer. Disable.

Next, move down the folder tree to:

Task Scheduler Library > Microsoft > Windows > Customer Experience Improvement Program

If you see tasks in here like Consolidator, KernelCeipTask, or UsbCeip, disable all of them. They exist solely to package your daily usage habits into neat little compressed files for upload.

Finally, check:

Task Scheduler Library > Microsoft > Windows > Autochk

Disable the Proxy task. It collects data regarding disk checks and system errors.

By disabling these triggers, you stop the operating system from actively waking up to spy on itself. You’ve effectively induced a coma in the diagnostic subsystems.

The Nuclear Option: Network Level Blocking

At this point, your Windows 10 machine is mostly lobotomized when it comes to reporting back to Redmond. But “mostly” isn’t good enough. If you truly want absolute certainty, you cannot trust the operating system to police itself. You have to block the communication at the network level.

This means dropping a concrete wall between your computer and Microsoft’s telemetry collection servers. Even if a rogue Windows update somehow manages to resurrect the DiagTrack service, the data packets will just crash into a firewall and die.

There are two ways to do this: locally via the Windows HOSTS file, or network-wide using a DNS sinkhole like a Pi-hole. I highly recommend the Pi-hole method because it protects every device on your network, but let’s cover the local HOSTS file method since it doesn’t require extra hardware.

Open Notepad as an Administrator. (You must run it as Admin, or you won’t be able to save the file).

Click File > Open, and navigate to:

C:\Windows\System32\drivers\etc

Change the file type drop-down in the bottom right from “Text Documents (*.txt)” to “All Files”. Open the file named hosts.

This file acts as a local address book for your computer. When Windows tries to talk to vortex.data.microsoft.com, it checks the HOSTS file first before asking your ISP for directions. We are going to intentionally give it the wrong directions by routing all known telemetry domains to 0.0.0.0 (a non-existent black hole).

Below is a critical hit-list of Microsoft’s most aggressive data collection endpoints. You need to copy and paste these into the bottom of your HOSTS file.

Save the file and close Notepad. Open Command Prompt and type ipconfig /flushdns to clear your local cache. Your computer is now deaf and blind to Microsoft’s collection servers.

A quick warning about this method. Microsoft changes their telemetry domain names occasionally. They use massive Content Delivery Networks (CDNs) and dynamic routing. The HOSTS file is a static defense against a highly adaptable adversary. It works brilliantly for the domains listed, but you have to update it periodically. That’s why running a network-wide DNS sinkhole that automatically updates its blocklists weekly is the superior long-term play.

What About Third-Party Privacy Tools?

If reading through all those manual registry edits and task scheduler modifications made your eyes glaze over, you aren’t alone. The sheer complexity of manually locking down Windows has spawned an entire cottage industry of privacy tools. Applications like O&O ShutUp10++, WPD (Windows Privacy Dashboard), and the Sophia Script are incredibly popular.

Are they worth using?

Yes, but with extreme caution. These tools are essentially massive, automated scripts that execute all the manual steps I just outlined (and hundreds more) with a single click. They parse through the registry, rip out Cortana’s background processes, disable OneDrive telemetry, and block the firewall ports automatically.

The problem is that they are blunt instruments. When you use a third-party tool to nuke everything at once, you run a very high risk of breaking intended functionality. I’ve seen users click “Apply Recommended Settings” in one of these apps, only to find out a week later that their Xbox Game Bar voice chat is permanently broken, their Bluetooth headset won’t pair, and Windows Update is throwing generic 0x80070422 errors.

When you do it manually, you know exactly what you touched. If something breaks, you know exactly which registry key to revert. When a third-party app changes 400 keys in three seconds, troubleshooting becomes a nightmare.

If you absolutely must use a tool, I lean toward O&O ShutUp10++. It creates a system restore point before it does anything, and it clearly color-codes which settings are safe to disable (green) and which ones might break your system (red). But even then, I strongly advise reading line by line before you hit apply. Never blindly trust a script with your operating system’s stability.

The War of Attrition: Surviving Windows Updates

Here is the hardest truth you have to accept. Ultimately, mastering how to completely disable Windows 10 telemetry isn’t a one-and-done chore; it’s an ongoing war of attrition against an operating system that desperately wants to phone home.

Microsoft treats Windows 10 as a “Service.” That means they don’t just patch security holes; they actively push feature updates that rewrite core system files. Every time “Patch Tuesday” rolls around, or you install a major feature update (like moving from 21H2 to 22H2), Windows runs a quiet little audit on itself.

It checks the registry. It checks the services. If it finds that AllowTelemetry is set to 0, or that the DiagTrack service is missing, it will often “repair” those files. Microsoft claims this is to ensure the operating system functions correctly. We know it’s to get the data flowing again.

You will patch the holes. Windows will quietly drill new ones.

So, how do you maintain your privacy over the long haul?

First, you have to verify your work. Don’t just assume your settings stuck. Every few months, open up services.msc and check if “Connected User Experiences and Telemetry” has mysteriously returned from the grave. If it has, kill it again.

Second, learn to use the Windows Resource Monitor. Press the Windows key, type resmon, and hit Enter. Click on the Network tab. This gives you a live look at exactly which processes are communicating over the internet. If your machine is sitting perfectly idle with no web browsers open, that network graph should be flat. If you see svchost.exe spiking and sending data to remote IP addresses, you know an update snuck a telemetry process past your defenses.

Third, control your updates. While you should never completely disable security patches—running an unpatched machine on the modern internet is suicidal—you can delay feature updates. By deferring feature updates for 30 to 60 days, you let other people act as the beta testers. You give the privacy community time to figure out exactly which new telemetry services Microsoft snuck into the patch, and you can update your HOSTS file or registry scripts accordingly before you install it.

A Word on Cortana and Web Search

You can’t have a serious conversation about stopping Windows 10 from leaking data without addressing the search bar at the bottom of your screen. Originally, the Windows Start menu search was strictly local. You typed a file name, and it searched your hard drive.

In Windows 10, Microsoft integrated Cortana and Bing directly into the local search. That means every single time you hit the Windows key and start typing—even if you’re just looking for a local PDF or the calculator app—your keystrokes are being sent to Microsoft’s servers in real-time to generate web suggestions.

It’s essentially a system-level keylogger disguised as a convenience feature.

To kill this, we go back to the Registry Editor. Open regedit and navigate to:

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\Explorer

If the Explorer key doesn’t exist under Windows, right-click the Windows folder, select New > Key, and name it Explorer.

Inside the Explorer key, create a new DWORD (32-bit) Value. Name it exactly DisableSearchBoxSuggestions. Double-click it and set the value to 1.

Restart your computer, or open Task Manager and restart the Windows Explorer process. The next time you type in the Start menu, it will only search your local hard drive. No Bing integration. No keystrokes sent to the cloud. It’s faster, cleaner, and vastly more private.

The Reality of Modern Operating Systems

We’ve ripped out the services, locked down the registry, blocked the network endpoints, and disabled the scheduled tasks. Your Windows 10 machine is now about as quiet as a ghost. It runs faster, consumes less background bandwidth, and respects your local hardware.

But you have to stay vigilant.

We are living in an era where data is the primary currency of the tech industry. Hardware sales and software licenses are secondary revenue streams compared to the massive, hidden economy of user analytics, behavioral profiling, and targeted advertising. Microsoft didn’t build this massive telemetry infrastructure because they are evil; they built it because it’s incredibly profitable.

They want to know which apps crash so they can fix bugs, sure. But they also want to know which third-party browsers you use so they can aggressively prompt you to switch to Edge. They want to know what you search for so they can feed that data into their ad networks. Your operating system is no longer just a neutral platform for running applications. It is an active participant in your daily routine, constantly taking notes.

Taking back control requires a fundamental shift in how you view your computer. You can’t just accept the default settings out of the box. You have to treat the operating system with a healthy dose of suspicion. You have to assume that every new feature, every convenience toggle, and every major update is designed to extract a little bit more information from your daily workflow.

You don’t need a computer science degree to protect yourself. You just need patience, a willingness to dig into the guts of the system, and the understanding that true privacy requires active maintenance. Keep an eye on your network traffic. Check your services after every major update. Keep your HOSTS file fresh.

It’s your hardware. It’s your bandwidth. Make sure it answers to you.