Care to join a Win7 snooping test? @ AskWoody

Care to join a Win7 snooping test?

Posted on November 23, 2016 at 05:42 CST by woody • Comment in the Forums

This from MrBrian:

I am conducting Windows telemetry technical tests similar to Ed Bott’s tests (https://www.askwoody.com/2016/the-inside-scoop-on-windows-snooping/), but instead I am testing Windows 7 x64, and I am using Microsoft’s Process Monitor instead of Resource Monitor.

Background information from Microsoft: “Windows 7, Windows 8 and Windows 10 Telemetry Updates (Diagnostic Tracking)” – https://blogs.technet.microsoft.com/netro/2015/09/09/windows-7-windows-8-and-windows-10-telemetry-updates-diagnostic-tracking/.

The October 2016 monthly rollup previews and November 2016 monthly rollups contain the Diagnostics Tracking Service, as did some previous Windows updates. See http://www.infoworld.com/article/3132377/microsoft-windows/microsoft-previews-telemetry-push-with-new-win781-patches-kb-3192403-3192404.html for more information.

The first question that I’d like to address is: does participation in the operating system’s Customer Experience Improvement Program change what the Diagnostics Tracking Service does? Background information about the Customer Experience Improvement Program is at https://www.microsoft.com/products/ceip/en-us/default.mspx.

How to test:

1. Set the operating system’s Customer Experience Improvement Program participation setting to the desired setting by following the instructions at http://www.infoworld.com/article/2981947/microsoft-windows/the-truth-about-windows-7-and-81-spy-patches-kb-3068708-3022345-3075249-and-3080149.html.

2. We need to know the PID (Process ID) of the instance of process svchost.exe that runs the Diagnostics Tracking Service. We’ll do so by using Resource Monitor. Start Resource Monitor by following the instructions at http://www.digitalcitizen.life/how-use-resource-monitor-windows-7. In the CPU section of the Overview tab, find the row with “svchost.exe (utcsvc)” in the Image column and note its corresponding PID in the PID column. This value changes every time you start the operating system.

3. If you don’t have Process Monitor, download it from https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx.

4. To reduce memory consumption in Process Monitor, make sure Filter->Drop Filtered Events is ticked. Then exit Process Monitor and start it again to ensure this setting has taken effect.

5. Add a filter by using Filter->Filter to add filter “PID is <number from step 2> Include”. As an example, my filter is “PID is 472 Include”. Make sure there isn’t more than one filter of type “Include”.

6. Press the Clear button to clear the output.

7. Run Process Monitor for at least 70 minutes (and preferably longer) to see patterns that may emerge in the output.

8. You can toggle capturing of events on or off by pressing the Capture button.

When Process Monitor has run for a few days on my computer, I’ll report the results here. Feel free to run your own tests and report your findings; be sure to include which operating system you are testing.

Windows Patches/Security Diagnostics Tracking Service, KB 2952664, telemetry

Plus Membership

Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.

AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.

Welcome to our unique respite from the madness.

It's easy to post questions about Windows 11, Windows 10, Win8.1, Win7, Surface, Office, or browse through our Forums. Post anonymously or register for greater privileges. Keep it civil, please: Decorous Lounge rules strictly enforced. Questions? Contact Customer Support.

Care to join a Win7 snooping test?

Plus Membership

Search Newsletters

Search Forums

View the Forum

Search for Topics

Recent Topics

Recent blog posts

Key Links

Care to join a Win7 snooping test?

Plus Membership

Search Newsletters

Search Forums

View the Forum

Search for Topics

Recent Topics

Recent blog posts

Login and Registration

Key Links