30 ms·

Does anyone know if there is a tool to safely remove telemetry executables from Win10? Is it possible to remove these?

by Zarath 8y ago

ssvss 8y ago
I saw this tool being recommended in r/windows10. I have tried it, no issues so far, though haven't tested to see if it does disable telemetry. https://www.oo-software.com/en/shutup10 https://www.oo-software.com/en/shutup10
- eastendguy 8y ago
  The point of the report above is that you can NOT disable all telemetry, not even in the Enterprise version of Windows.
  - tjoff 8y ago
    ...through official means. I don't for a second doubt you can turn it off completely. But unofficial solutions come with tons of potential issues.
    - metildaa 8y ago
      Could just block all communication with Microsoft by the OS. Or, move to non-Windows OSes like the retail giants already have. Kroger and Walmart run Suse Enterprise Linux (relevant Uptime Funk reference) https://www.youtube.com/watch?v=SYRlTISvjww https://www.youtube.com/watch?v=SYRlTISvjww
      - Spooky23 8y ago
        Not in a government or business environment using Office 365. 365 requires all sorts of open connectivity to function.
        metildaa 8y ago
        If your using Office 365, telemetry in Windows is the least of your concern.
      - Dylan16807 8y ago
        > Could just block all communication with Microsoft by the OS. Easier said than done when there's a minefield of firewall-bypasses for it.
        rasz 8y ago
        Care to elaborate? Afaik and tested w10 does NOT bypass its own firewall when set to 'drop all' traffic.
        Dylan16807 8y ago
        From what I've seen "drop all" works at the moment but directly blocking the telemetry programs keeps getting undone whenever the file changes and it intentionally doesn't use the hosts file.
        rasz 8y ago
        Dont know what you mean by undone, but running firewall in drop all + whitelisting works fine and block all telemetry (one caveat : dnscache needs to be disabled to remove possibility of dns tunneling)
        Dylan16807 8y ago
        From what I remember, when you say "block all connections by this program" on the relevant files it doesn't just use the filename, it tracks the exact version of the file, and as soon as windows update touches it your firewall block stops working. So a whitelist method works, good, but I think it's fair to said that specifically blocking telemetry is extremely difficult with the way blacklisting works.
- Pica_soO 8y ago
  One has to love those little parasite riding a parasite schemes. Like a fleas flea. I provide a tool, cutting you off from revenue- now you can ride the service rodeo all you want- but if you pay well, i shall cease to update, i might even reactivate the telemetry by accident.
- forrestthewoods 8y ago
  This tool is great. Only problem is you have to regularly re-run it because Windows Update will revert changes.
  - AnIdiotOnTheNet 8y ago
    Yep, which is why you disable Windows Update too. The people who work on Windows these days should probably all be fired. Out of a cannon. Into the sun.
    - ricardonunez 8y ago
      Telling users to disable updates it's not a good recommendation.
      - Spooky23 8y ago
        Sure it is. Microsoft software deployment on client is a dumpster fire. Blindly installing Windows updates these days is very dangerous and should be avoided. Your best approach for avoiding malware is to use browsers like Firefox and Chrome. Critical task workflows should be in LTSB, iOS or ChromeOS. Microsoft’s guidance is to have around four deployment rings each for Windows and Office, and only immediately patch 10-20% of your enterprise environment and defer to avoid impacts from the quality issues that are very common as Microsoft is supporting like a half dozen Windows 10s. See: https://docs.microsoft.com/en-us/windows/deployment/update/waas-deployment-rings-windows-10-updates https://docs.microsoft.com/en-us/windows/deployment/update/w...
        wtallis 8y ago
        Yep. All of the Windows machines that I actually rely on for work—the ones that I need to be able to start up and immediately use, and need to be able to trust them to keep running without interruption or regression—are completely firewalled off from the public internet, so that they are secure both from malware, and unwanted updates. The rest of my work is done on other, more obedient operating systems. Windows 95 was capable of 49.7 days of uptime. That's pretty difficult on client versions of Windows 10 unless you take extraordinary measures.
jcoffland 8y ago
There is a tool to safely remove all Windows 10 telemetry. It's called Linux.
- wolfgke 8y ago
  > It's called Linux. It's called GNU/Linux. :-)
  - judge2020 8y ago
    https://www.lurkmore.com/view/GNU/Linux_interjection https://www.lurkmore.com/view/GNU/Linux_interjection
  - deleted 8y ago
    [deleted]
  - robdachshund 8y ago
    Nah it's just Linux.
- Delmania 8y ago
  Great let me know when Linux can run the apps I need for work and I can reliably install it on any hardware and expect it to work without issue. I like Linux as anyone else around here, but to claim it can replace Win10 for the average user is a stretch.
  - Sir_Cmpwn 8y ago
    >let me know when [...] I can reliably install it on any hardware and expect it to work without issue. Consider yourself told, then. Linux works OOTB on pretty much all hardware, often better than Windows since it ships with all of the necessary drivers. >to claim it can replace Win10 for the average user is a stretch The average user can handle KDE Plasma just fine.
    - RaleyField 8y ago
      > Consider yourself told, then. Nowadays I run mostly Ubuntu but before this attitude used to be a big turn off for me. When things manifestly don't work but the partisan chorus is acting like Linux is the most perfect thing ever then it is really easy to walk back out of spite. I run Linux because it's the least bad OS _for me_, it's still pretty bad in so many ways. > often better than Windows And often not. My experience with Linux drivers has always been only "tolerable". > KDE Plasma It's functional. But its design language (if it has any) is by far my least favorite one. I'd rather use Windows than use KDE.
snaky 8y ago
You could set up the proxy for (not Microsoft) web browser on your router and disallow all the traffic forwarding other than going via that proxy.
- wolfgke 8y ago
  See chapter 3 of the linked German paper > https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Sicherheit/SiSyPHus/Analyse_Telemetriekomponente.pdf?__blob=publicationFile&v=4 https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Si... for other suggestions. The variant with an HTTP proxy is described in section 3.2.1.
  - snaky 8y ago
    As far as I can tell, what they do with proxy is 'allow all, disallow telemetry' policy. That's not what seem to work reliably, because Microsoft is free to change everything at any second, and the 'telemetry' list is moving target. What I'm talking about is 'disallow all, allow the traffic from Firefox only' basically.
    - wolfgke 8y ago
      > That's not what seem to work reliably, because Microsoft is free to change everything at any second, and the 'telemetry' list is moving target. Principally, you are right. But keep in mind that the paper refers to Windows 10 LTSB 1607. It would surprise me a lot if Microsoft changed the telemetry servers for a Long Term Servicing Branch release.
      - snaky 8y ago
        A couple of years ago, I would agree with you, considering the fact that enterprise customers with volume licenses and huge investments in Microsoft infrastructure are bread and butter for Microsoft, and the foundation of that is trust between those enterprise customers with platinum support contracts and Microsoft. But nowadays I don't know. Microsoft is moving to Azure and 'freemium' data-collecting based business so fast, and breaking so many things. Anyway, the 'disallow all, allow only Firefox' have additional benefits in that it's prevents any 3rd party software from phoning home or something worse. The obvious downside might be the inability of those 3rd party software to auto-update itself.
uto 8y ago
Pi-hole seems to block windows telemetry domains by default. I don't know how complete the blocking is but there are a lot of domains like the ones listed in this thread on my top blocked domains list.
kakarot 8y ago
Not sure, I tried doing it myself once and it was a rabbit hole of scripts and changing obscure settings in the command line. After somewhere between 12-18 hours of solid work there was still so much left open, and I came to realize it's simply impossible to have a copy of Windows 10 that doesn't spy on you in some way. For example, hardware profiling. Attach a printer to Windows 10, Microsoft will receive the hardware ID. Sell the printer on craigslist. A political party uses it to print propaganda that is considered illegal. Don't be surprised when the police are at your door in two weeks. With support for Windows 7 Professional ending in 2020, I'm not sure where to go from here. I can just hope that VR and similar recent tech is fully realized on Linux or Linux+Wine in that time.
- einr 8y ago
  With support for Windows 7 Professional ending in 2020, I'm not sure where to go from here. Maybe you'll be able to do what some folks did with Windows XP and use a registry hack to trick Windows into receiving security patches for Windows Embedded POSready 7, which is the embedded Point-Of-Sale version of Win7. This is going to be supported until 10/12/2021. Of course, this is a very fragile and hacky solution that I would be unwilling to use on boxes running important stuff. I'm in the same quandary and I think I'm going to just disconnect all my Windows 7 boxes from the Internet on the end date. Although a bit of a bother I will still be able to do my music production, games and graphics stuff without Internet access, and all the day-to-day Internet stuff I can migrate to Linux. Maybe use disposable Windows 7 VM's for random lightweight Windows-only stuff.
  - kakarot 8y ago
    As it is, I run Windows in a VM with IOMMU, firewalled incoming connections, host-level VPN, etc., passing through a Geforce 1080 for direct access, and I only use it for specific purposes. Everything else is done in other VMs that run Linux. It's a similar setup to Qubes. I also do music production and graphics and game programming in Windows, so I'm totally with you on how fucked this is going to be in a year. One of my biggest issues is that I know for a fact my fb2k visualizer doesn't work under Wine. One possible solution I've thought about for using a non-networked W7: * Set up a separate VM with allocated storage that gets broadcast as a set of read-only local network drives * Add both W7 and this VM to a private network without net access * Access the netdrive on W7 and copy any files with which you need write access to a W7-only storage partition. Seeing as how we seem to have similar use cases, I'm happy to give you some pointers on setting up something similar to what I have.
tgsovlerkhgsel 8y ago
No. Even if you succeed, the next update will likely bring back some of the stuff you removed, two additional independent monitoring tools using separate C2 domains/IPs hidden somewhere in your system (not necessarily the Windows folder either), plus three "repair" tools that try to find modifications to Windows files like the ones you made and revert them.
njharman 8y ago
Yeah, it’s called “installer for another OS”
glenneroo 8y ago
My experience testing multiple tools on VMs (mostly recommendations from reddit), eventually deciding on one that seemed to work as advertised and installing it on my primary PC, says definitely not. Initially I saw a drastic reduction in outgoing traffic to MS/akadns, but after a couple months it ramped back up again... as someone else mentioned above, a lot of telemetry tools are reactivated/reinstalled via Windows Updates. I seemed to have completely nuked SMB in the process as well. I never saw any outbound traffic to microsft.com, I wonder if it's because they are using the German version?

Does anyone know if there is a tool to safely remove telemetry executables from Win10? Is it possible to remove these?

by Zarath 8y ago

Does anyone know if there is a tool to safely remove telemetry executables from Win10? Is it possible to remove these?

I saw this tool being recommended in r/windows10. I have tried it, no issues so far, though haven't tested to see if it does disable telemetry. https://www.oo-software.com/en/shutup10 https://www.oo-software.com/en/shutup10

eastendguy 8y ago
The point of the report above is that you can NOT disable all telemetry, not even in the Enterprise version of Windows.
- tjoff 8y ago
  ...through official means. I don't for a second doubt you can turn it off completely. But unofficial solutions come with tons of potential issues.
  - metildaa 8y ago
    Could just block all communication with Microsoft by the OS. Or, move to non-Windows OSes like the retail giants already have. Kroger and Walmart run Suse Enterprise Linux (relevant Uptime Funk reference) https://www.youtube.com/watch?v=SYRlTISvjww https://www.youtube.com/watch?v=SYRlTISvjww
    - Spooky23 8y ago
      Not in a government or business environment using Office 365. 365 requires all sorts of open connectivity to function.
      - metildaa 8y ago
        If your using Office 365, telemetry in Windows is the least of your concern.
    - Dylan16807 8y ago
      > Could just block all communication with Microsoft by the OS. Easier said than done when there's a minefield of firewall-bypasses for it.
      - rasz 8y ago
        Care to elaborate? Afaik and tested w10 does NOT bypass its own firewall when set to 'drop all' traffic.
        Dylan16807 8y ago
        From what I've seen "drop all" works at the moment but directly blocking the telemetry programs keeps getting undone whenever the file changes and it intentionally doesn't use the hosts file.
        rasz 8y ago
        Dont know what you mean by undone, but running firewall in drop all + whitelisting works fine and block all telemetry (one caveat : dnscache needs to be disabled to remove possibility of dns tunneling)
        Dylan16807 8y ago
        From what I remember, when you say "block all connections by this program" on the relevant files it doesn't just use the filename, it tracks the exact version of the file, and as soon as windows update touches it your firewall block stops working. So a whitelist method works, good, but I think it's fair to said that specifically blocking telemetry is extremely difficult with the way blacklisting works.
Pica_soO 8y ago
One has to love those little parasite riding a parasite schemes. Like a fleas flea. I provide a tool, cutting you off from revenue- now you can ride the service rodeo all you want- but if you pay well, i shall cease to update, i might even reactivate the telemetry by accident.
forrestthewoods 8y ago
This tool is great. Only problem is you have to regularly re-run it because Windows Update will revert changes.
- AnIdiotOnTheNet 8y ago
  Yep, which is why you disable Windows Update too. The people who work on Windows these days should probably all be fired. Out of a cannon. Into the sun.
  - ricardonunez 8y ago
    Telling users to disable updates it's not a good recommendation.
    - Spooky23 8y ago
      Sure it is. Microsoft software deployment on client is a dumpster fire. Blindly installing Windows updates these days is very dangerous and should be avoided. Your best approach for avoiding malware is to use browsers like Firefox and Chrome. Critical task workflows should be in LTSB, iOS or ChromeOS. Microsoft’s guidance is to have around four deployment rings each for Windows and Office, and only immediately patch 10-20% of your enterprise environment and defer to avoid impacts from the quality issues that are very common as Microsoft is supporting like a half dozen Windows 10s. See: https://docs.microsoft.com/en-us/windows/deployment/update/waas-deployment-rings-windows-10-updates https://docs.microsoft.com/en-us/windows/deployment/update/w...
      - wtallis 8y ago
        Yep. All of the Windows machines that I actually rely on for work—the ones that I need to be able to start up and immediately use, and need to be able to trust them to keep running without interruption or regression—are completely firewalled off from the public internet, so that they are secure both from malware, and unwanted updates. The rest of my work is done on other, more obedient operating systems. Windows 95 was capable of 49.7 days of uptime. That's pretty difficult on client versions of Windows 10 unless you take extraordinary measures.

jcoffland 8y ago

There is a tool to safely remove all Windows 10 telemetry. It's called Linux.

wolfgke 8y ago
> It's called Linux. It's called GNU/Linux. :-)
- judge2020 8y ago
  https://www.lurkmore.com/view/GNU/Linux_interjection https://www.lurkmore.com/view/GNU/Linux_interjection
- deleted 8y ago
  [deleted]
- robdachshund 8y ago
  Nah it's just Linux.
Delmania 8y ago
Great let me know when Linux can run the apps I need for work and I can reliably install it on any hardware and expect it to work without issue. I like Linux as anyone else around here, but to claim it can replace Win10 for the average user is a stretch.
- Sir_Cmpwn 8y ago
  >let me know when [...] I can reliably install it on any hardware and expect it to work without issue. Consider yourself told, then. Linux works OOTB on pretty much all hardware, often better than Windows since it ships with all of the necessary drivers. >to claim it can replace Win10 for the average user is a stretch The average user can handle KDE Plasma just fine.
  - RaleyField 8y ago
    > Consider yourself told, then. Nowadays I run mostly Ubuntu but before this attitude used to be a big turn off for me. When things manifestly don't work but the partisan chorus is acting like Linux is the most perfect thing ever then it is really easy to walk back out of spite. I run Linux because it's the least bad OS _for me_, it's still pretty bad in so many ways. > often better than Windows And often not. My experience with Linux drivers has always been only "tolerable". > KDE Plasma It's functional. But its design language (if it has any) is by far my least favorite one. I'd rather use Windows than use KDE.

snaky 8y ago

You could set up the proxy for (not Microsoft) web browser on your router and disallow all the traffic forwarding other than going via that proxy.

wolfgke 8y ago
See chapter 3 of the linked German paper > https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Sicherheit/SiSyPHus/Analyse_Telemetriekomponente.pdf?__blob=publicationFile&v=4 https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Si... for other suggestions. The variant with an HTTP proxy is described in section 3.2.1.
- snaky 8y ago
  As far as I can tell, what they do with proxy is 'allow all, disallow telemetry' policy. That's not what seem to work reliably, because Microsoft is free to change everything at any second, and the 'telemetry' list is moving target. What I'm talking about is 'disallow all, allow the traffic from Firefox only' basically.
  - wolfgke 8y ago
    > That's not what seem to work reliably, because Microsoft is free to change everything at any second, and the 'telemetry' list is moving target. Principally, you are right. But keep in mind that the paper refers to Windows 10 LTSB 1607. It would surprise me a lot if Microsoft changed the telemetry servers for a Long Term Servicing Branch release.
    - snaky 8y ago
      A couple of years ago, I would agree with you, considering the fact that enterprise customers with volume licenses and huge investments in Microsoft infrastructure are bread and butter for Microsoft, and the foundation of that is trust between those enterprise customers with platinum support contracts and Microsoft. But nowadays I don't know. Microsoft is moving to Azure and 'freemium' data-collecting based business so fast, and breaking so many things. Anyway, the 'disallow all, allow only Firefox' have additional benefits in that it's prevents any 3rd party software from phoning home or something worse. The obvious downside might be the inability of those 3rd party software to auto-update itself.

uto 8y ago

Pi-hole seems to block windows telemetry domains by default. I don't know how complete the blocking is but there are a lot of domains like the ones listed in this thread on my top blocked domains list.

kakarot 8y ago

Not sure, I tried doing it myself once and it was a rabbit hole of scripts and changing obscure settings in the command line. After somewhere between 12-18 hours of solid work there was still so much left open, and I came to realize it's simply impossible to have a copy of Windows 10 that doesn't spy on you in some way. For example, hardware profiling. Attach a printer to Windows 10, Microsoft will receive the hardware ID. Sell the printer on craigslist. A political party uses it to print propaganda that is considered illegal. Don't be surprised when the police are at your door in two weeks. With support for Windows 7 Professional ending in 2020, I'm not sure where to go from here. I can just hope that VR and similar recent tech is fully realized on Linux or Linux+Wine in that time.

einr 8y ago
With support for Windows 7 Professional ending in 2020, I'm not sure where to go from here. Maybe you'll be able to do what some folks did with Windows XP and use a registry hack to trick Windows into receiving security patches for Windows Embedded POSready 7, which is the embedded Point-Of-Sale version of Win7. This is going to be supported until 10/12/2021. Of course, this is a very fragile and hacky solution that I would be unwilling to use on boxes running important stuff. I'm in the same quandary and I think I'm going to just disconnect all my Windows 7 boxes from the Internet on the end date. Although a bit of a bother I will still be able to do my music production, games and graphics stuff without Internet access, and all the day-to-day Internet stuff I can migrate to Linux. Maybe use disposable Windows 7 VM's for random lightweight Windows-only stuff.
- kakarot 8y ago
  As it is, I run Windows in a VM with IOMMU, firewalled incoming connections, host-level VPN, etc., passing through a Geforce 1080 for direct access, and I only use it for specific purposes. Everything else is done in other VMs that run Linux. It's a similar setup to Qubes. I also do music production and graphics and game programming in Windows, so I'm totally with you on how fucked this is going to be in a year. One of my biggest issues is that I know for a fact my fb2k visualizer doesn't work under Wine. One possible solution I've thought about for using a non-networked W7: * Set up a separate VM with allocated storage that gets broadcast as a set of read-only local network drives * Add both W7 and this VM to a private network without net access * Access the netdrive on W7 and copy any files with which you need write access to a W7-only storage partition. Seeing as how we seem to have similar use cases, I'm happy to give you some pointers on setting up something similar to what I have.

tgsovlerkhgsel 8y ago

No. Even if you succeed, the next update will likely bring back some of the stuff you removed, two additional independent monitoring tools using separate C2 domains/IPs hidden somewhere in your system (not necessarily the Windows folder either), plus three "repair" tools that try to find modifications to Windows files like the ones you made and revert them.

njharman 8y ago

Yeah, it’s called “installer for another OS”

glenneroo 8y ago

My experience testing multiple tools on VMs (mostly recommendations from reddit), eventually deciding on one that seemed to work as advertised and installing it on my primary PC, says definitely not. Initially I saw a drastic reduction in outgoing traffic to MS/akadns, but after a couple months it ramped back up again... as someone else mentioned above, a lot of telemetry tools are reactivated/reinstalled via Windows Updates. I seemed to have completely nuked SMB in the process as well. I never saw any outbound traffic to microsft.com, I wonder if it's because they are using the German version?