Interesting question from Susan Bradley: https://twitter.com/SBSDiva/status/1156433770750205952 Faucet drip level – or firehose? Anybody want to take
[See the full post at: How much telemetry is going out with this month’s “Security-only” Win7 patch?]
|
Patch reliability is unclear. Unless you have an immediate, pressing need to install a specific patch, don't do it. |
-
How much telemetry is going out with this month’s “Security-only” Win7 patch?
- This topic has 80 replies, 27 voices, and was last updated 3 years, 7 months ago.
AuthorViewing 25 reply threadsAuthor-
-
The telemetry (KB2952664 functionality = Compatibility Appraiser) was rolled into the Rollup Preview in Sept. 2018 and into the Monthly Rollup in Oct 2018 – has been there for a while.
The July 2019 Security-only Update (Group B) is the first time (that we know of) that the Compatibility Appraiser has been included int the (no longer) Security-only patch.
-
Thanks for the investigation, but any amount is “too much” in a SECURITY ONLY patch.
Stopped installing patches from June, and no this kinda stuff actually puts me off moving to Windows 10 even more..
Don’t care what they think and what their EULA says, my PC is my PERSONAL COMPUTER, I say what goes on it, and dodgy tricks make me even less likely to give enough trust to installing anything else.
FOr many of us, support has ended 6 months early.
-
I agree with your sentiment, but want to establish that we’re seeing more than just the ability to send telemetry and the scheduled tasks to make it happen (both of which are known to be included in the July “Security-only” patch).
How big a beast are we talking about?
5 users thanked author for this post.
-
If telemetry is there to tell Microsoft that your machine didn’t blue screen Is that too much? Seriously if a level of telemetry is there to give MS feedback on the quality of updates so that you don’t have to suffer through bad updates and even worse support experience why is that a bad thing?
As an aside I thought this wasn’t the first time telemetry updates were included in security updates but I’m trying to find that post.
You leak data on the web now. Chrome leaks it. Firefox leaks it. It helps developers know when crashes are occurring and to fix their software. Why is this evil?
Susan Bradley Patch Lady
4 users thanked author for this post.
-
Seriously if a level of telemetry is there to give MS feedback on the quality of updates so that you don’t have to suffer through bad updates and even worse support experience why is that a bad thing?
@Susan, you are dreaming when you think that 1. Microsoft cares about its users. 2. That these are Microsoft’s real intentions for Telemetry. For example : why Microsoft does scan every media file on Windows OS and sends the list vis Telemetry? what does this has to do with “better” support ?
Microsoft knows exactly how many users use Office vs LibreOffice vs Google Docs vs… How many users use none. How many users use VLC vs MPC-HC vs… How many use OneDrive vs Google Drive vs iCloud…In short, Microsoft has each user’s list of software and this is worth $Billions to Microsoft and 3rd party software vendors with whom Microsoft shares its data. -
I guess if they were little more transparent and announced that, it would be understandable somehow
btw, most added appraiser files are from Windows 10 build 18362 (1903)
why would Windows 7 need those to check current status?you probably mean KB3121461, which was a security update for the Compatibility Appraiser (aka KB2952664, KB2976978)
-
It would be nice if we had official reasons rather than guessing. My guess – some enterprise who uses security only patches needs the data in their rollout/rollup to Windows 10 for analyzing if something is compatible.
Yes I do think that Microsoft cares about “users”. Granted these days those “users” may be Enterprise users, but I know enough good people at Microsoft to understand and know that they aren’t inherently evil. They have good intentions and good reasons. Generally speaking and especially in the Security department they want to keep Microsoft customers safe. They may (are) be heavy handed about it.
Susan Bradley Patch Lady
-
I think an official announcement along the lines of “We’re starting to collect telemetry with Security-only patches because blah blah blah” would be a foregone conclusion.
Part of the problem with the debate over whether MS is benevolent or malicious is that MS isn’t a monolith. There are many, many, many good people at MS. Always have been. But some of the people who make the decisions don’t make the right decisions, some of the time.
It’s up to us cackling geese to raise the alarm.
-
-
-
Big tech companies have a recurring habit of collecting more data than they need for their advertised reasons, and often more data than anyone would comfortably let them have (see recent topic on Apple and Siri). When caught out, they reply with an unconvincing “oops”.
-
If telemetry is there to tell Microsoft that your machine didn’t blue screen Is that too much? Seriously if a level of telemetry is there to give MS feedback on the quality of updates so that you don’t have to suffer through bad updates and even worse support experience why is that a bad thing?
As an aside I thought this wasn’t the first time telemetry updates were included in security updates but I’m trying to find that post.
You leak data on the web now. Chrome leaks it. Firefox leaks it. It helps developers know when crashes are occurring and to fix their software. Why is this evil?
You are completely missing the point. If you are naive enough to trust a soulless giant corporation with your private data (and lets be clear, you have no idea what all they’re collecting on you, only vague descriptions of some of what it may be), fine. Just give ME an option to turn it off. Why is that so difficult?
-
The question is, can you tell us for certain that only “the machine did not blue screen” data was sent or an update install is completed successfully data was sent?
Why must Microsoft add telemetry to our “personal computers” when that telemetry can be added to the installation program itself to report if the install was performed successfully or not? Why isn’t there an opt-out to this computer related telemetry? Why is Microsoft so tight lipped about what is being sent and not more transparent?
These are questions we at Woody’s have. This is *why* we are at Woodys instead of some other forum that caters to these issues, finding justification with an “it’s only smoke, there isn’t any fire, keep working” response. Even Woody said “How big a beast are we talking about?” Thank you Woody, for thinking about that and wanting to know.
The whole concept of AskWoody is the attitude of, “I am not sure about that, let’s investigate”. When it is hard to get an answer or that answer is not clear, we start to wonder what is happening here. Reagan said, “trust but verify”. Our attitude is more like, “uuuhh I don’t know about that. Let me look into this.”
It is thanks to many AskWoody MVPs (PKC, Abbodi86, Microfix, Kirsty, etc.) and people like Günter Born, Martin Brinkman and others, that look deeper into what is taking place. This is why I wait for woody to give his advice and not anyone else.
I would prefer Microsoft act like Mozilla in that if there is a crash, it asks you if you want to send a crash report. That too can be turned off in a checkbox or a config file.
And yes Google Chrome does have a lot of telemetry and makes it harder to delete browsing history, so that is why I don’t use it.
-
Susan: It’s a bad thing if don’t choose to send it. It’s also a bad thing if any system resources are used to collect it if I don’t want to allow it. And it’s definitely a very bad thing if it happens for any other purpose than a crash and includes anything other than data strictly relevant to the crash. And the compatibility appraiser seems to have nothing whatsoever to do with collecting crash data.
— Cavalary
-
I really don’t buy this argument. Microsoft doesn’t just collect information about whether or not you get a blue screen or not, they collect information about what processes that caused it, meaning they will know what programs I have open, do you want them to have this information? Because I don’t. They also collect memory dumps meaning they can even see at least fractions of what we are doing on our computers. Are you okay with this? Is it okay because “oh everyone else does it as well”? You are aware that Microsoft has shipped operating systems before Windows 10 without using telemetry that turned out very stable, right? The difference now is that they earn money from their users data, back in the XP/7 days, Microsoft relied on people buying their products, now they are literally giving it away for free, and if you use a pirated copy, nothing even happens, because they earn money from you anyway.
And it hasn’t been investigated. I don’t have a security only Windows 7 to test this on ergo my question. Everyone is up in arms that there’s telemetry patching in the July updates…but are they really sending data back?
In this era of fake news, let’s get facts.
Susan Bradley Patch Lady
5 users thanked author for this post.
-
-
Doesn’t matter. If those files and tasks appear after the update and they weren’t there before, it’s not a security-only update, because their presence is not required to plug a known security vulnerability, it’s data collection tools sneakily shoved down the throats of those specifically wanting to avoid them.
-
If that telemetry is in a Security Only update then I’m skipping that update and on to the next month where if there is more telemetry in any Security Only update that update will get skipped as well.
Security Only updates need to be Security Only and any patches of any telemetry related code needs to be made in a different KB/patch. Folks doing the Security Only Patching for Windows 7, and 8/8.1, are doing so for the very reason that there are Security Only patching options.
And there should be no plausible deniability from MS that appears to be cheating the Security Only update system by stating that the telemetry code itself needs a security patch and then shoving a full blown telemetry update down the end users’ throats in the name of “Security”! Folks doing the security only patching should never need to patch what by the very definition of Security Only should never have been installed on their systems with MS “needing” to patch any telemetry code that should never be present if the user has been following that Security Only updating system closely since fall 2016.
Worth noting that many of these observations are addressed in
https://www.computerworld.com/article/3216425/microsoft-patch-alert-welcome-to-the-upside-down.html
-
Looking forward to the report!
If the telemetry’s just a trickle, I’m OK with the result – but not with the sneaky way it was distributed.
If it’s a full-on fire hose — full Win7 telemetry — it’s a different story.
1 user thanked author for this post.
? says:
thank you PatchLady,
who knows? microsoft collects “telemetry” from my IE “SmartScreenFilter” and MSE which i accept in return for their “protection” but baking whatever they really collect into a SECURTIY ONLY monthly patch is crossing a line (for me at least). maybe all the “data” collection is perfectly ok for millenial minded folks (don’t mean to offend) you know the ones who really don’t understand what is going on behind the curtain and\or don’t care as long as everything “works”. MrBrian (haven’t seen him for a while here) ran tests on “telemetry” a few years ago and reported it here at ask woody:
https://www.askwoody.com/forums/topic/care-to-join-a-win7-snooping-test/#post-21435
so does it really matter how much?
I do not run wireshark, but did a pre (and post) check on scheduled tasks when installing the security only July update for Windows 7. I reviewed the following scheduled tasks, those under PerfTrack, Customer Experience, and Application Experience. I had all tasks under those categories disabled. Post install I rechecked to see if any of the tasks were re-enabled. Nothing was re-enabled under PerfTrack and Customer Experience. Two items under Application Experience were re-enabled 1) Compatibility Appraiser and 2) Program Data Updater (The AitAgent under App Experience remained disabled) I re-disabled the Compatibility Appraiser and Program Data Updater tasks and they remain disabled for now. Hope is somewhat helpful.
-
I have Windows 7 and I’m not sure I’ll be able to disable the “new scheduled tasks” as recommended by Woody in his ComputerWorld DEFCON-4 posting of August 2, 2019. This is because my Task Scheduler doesn’t seem to be working properly, but I don’t know for sure, because I’ve never used Task Scheduler before. I contacted Woody by e-mail, and he responded that PKCano is his expert on this, and that I should post my problem on the website. When I opened up Task Scheduler for the first time (and all subsequent times), it says “The selected task “0” no longer exists. To see the current tasks, click refresh”. But when I click “refresh”, I get that same message all over again. Also, I’m not able to follow the instructions of AJNorth of August 3, 2019 at 10:31 PM shown in the postings in the DEFCON-4 topic at https://www.askwoody.com/forums/topic/ms-defcon-4-time-to-get-the-july-2019-patches-installed because the word “Microsoft” does not appear in the white rectangular box on the left as AJNorth says it should. The only thing that appears in that box is the Task Scheduler Library. When I expand the Library, it contains four scheduled tasks, all of which appear to be associated with updating my antivirus program, Adobe Reader, and Google Chrome browser. But I don’t see any of the things discussed by AJNorth on August 3rd. However, I haven’t installed KB4507456 yet, and so maybe they will appear once I install KB4507456. But I’m hesitant to install KB4507456 until I’m sure the Task Scheduler is working properly. So can someone please give me some advice on what I should do? I’m hoping that PKCano can respond, because Woody says he’s an expert on this.
-
Please create a topic under the “Questions Windows 7” Forum.
Title it something like “How do I use Task Scheduler in Windows 7?”
Include information how you have been patching (Group A or Group B)
And explain what you need to use Task Scheduler for.Giving you the instructions would be off topic in this thread.
We can answer your questions there. -
Thanks, PKCano. I did as you suggested, and posted it in the Windows 7 Questions Forum. I will appreciate if you could respond there.
1 user thanked author for this post.
-
-
-
0patch is a great company, and everything I’ve seen from them works well, but…
(You knew there would be a “but,” right?)
Installing one-off patches from non-Microsoft sources is inherently risky. You need to decide for yourself if that risk is greater than the risk of installing the Microsoft patch (when it eventually appears) or not patching altogether.
-
If telemetry is there to tell Microsoft that your machine didn’t blue screen Is that too much? Seriously if a level of telemetry is there to give MS feedback on the quality of updates so that you don’t have to suffer through bad updates and even worse support experience why is that a bad thing?
As an aside I thought this wasn’t the first time telemetry updates were included in security updates but I’m trying to find that post.
You leak data on the web now. Chrome leaks it. Firefox leaks it. It helps developers know when crashes are occurring and to fix their software. Why is this evil?
I get what you are saying, and maybe 20 years ago it would be passable. But not in today’s world.
Just because so many entities on the web currently leak & slurp up user data doesn’t mean consumers should just relent and let it happen to them. In fact the notion of “user data rights” is enjoying growing public support, evidenced by what Facebook/Google/Apple/etc are dealing with right now. MS should be on that list too, as they seem to be flying under consumer privacy/data radar since Win 10 launched. I remain hopeful.
Regardless of operating system, I require the option to turn updates on/off whenever I wish and opt out of telemetry for as long as I want. Nothing less.
4 users thanked author for this post.
To be honest, Microsoft was possibly going to have to include some of those parts at some point. As in if they ever found any security issues in the telemetry components.
Because, the security-only patch also needs to apply to installations that already have installed one of the intermediate rollups with telemetry but not the latest rollup.
The right thing would’ve been to only update those parts IF the telemetry base component was already installed, and not change enable/disable state, but…
1 user thanked author for this post.
If telemetry is there to tell Microsoft that your machine didn’t blue screen Is that too much? Seriously if a level of telemetry is there to give MS feedback on the quality of updates so that you don’t have to suffer through bad updates and even worse support experience why is that a bad thing?
As an aside I thought this wasn’t the first time telemetry updates were included in security updates but I’m trying to find that post.
You leak data on the web now. Chrome leaks it. Firefox leaks it. It helps developers know when crashes are occurring and to fix their software. Why is this evil?
It’s evil because of the sneaky way of doing it, and MY COMPUTER, MY CHOICE. I do absolutely agree with finding out just how much though (even though any amount is “too much”), as knowledge is power.
Hypothetically, I’m sure the benevolent company Amazon would just love to “assess” my house to ensure a “smooth delivery experience” too, of course how nice and non-evil of them it would be to help me out with that, all off their own backs, if they gave me the option (and made it VERY clear what it entailed) then, no problem. (I’d say no, but still).
However, it would be another story altogether if the next time I had a delivery from them, their deliveryman forged a key to my house (unbeknown to myself), and then let themselves in while I was out or upstairs, having a good snoop round, categorising everything, taking pictures, sending it all back to Amazon HQ for them to sort through and optimise my deliveries and make sure no delivery man would ever hurt himself coming to my door etc (though how the contents of my house would affect that, no idea, but besides the point, it’s all to help me of course!).
Everyone else is doing it too! Rando’s peeping in my windows, and burglers would just break in if they wanted as well, so what’s wrong with Amazon doing the same, eh? The couple down the street don’t mind at all, too, they even installed Amazon cameras inside their house as well! So why should ‘I’ feel any different? It’s just what everyone’s doing now, so that makes it ok!
Now I’d probably just be paranoid if I thought they’d really sent all that data off to a foreign country (with potentially untrustworthy staff) to be manually examined and sorted through. The type of door and lock I have, whether I have steps or not, and everything inside my house of course. I’d likely especially be paranoid if they were found to then be selling all that information on to advertisers and who knows what dodgy company. But nahh, they couldn’t possibly only be focused on MAKING MONEY from this sort of thing could they?
…Could they?
“The Sun discovered earlier this week that an English-speaking Amazon team in Bucharest, Romania, monitors thousands of Alexa recordings — and has heard private moments including family rows, money and health discussions — and couples “making love”.”
https://www.mirror.co.uk/tech/amazon-staff-listen-users-having-18798294“Amazon reportedly employs thousands of people to listen to your Alexa conversations.”
https://edition.cnn.com/2019/04/11/tech/amazon-alexa-listening/index.html“Ring used its Ukrainian “data operators” as a crutch for its lackluster artificial intelligence efforts, manually tagging and labeling objects in a given video as part of a “training” process to teach software with the hope that it might be able to detect such things on its own in the near future.”
https://theintercept.com/2019/01/10/amazon-ring-security-camera/Erm.. Well I’m sure it’s not for evil purposes!
“At the time the Ukrainian access was provided, the video files were left unencrypted, the source said, because of Ring leadership’s “sense that encryption would make the company less valuable.”
…Oh.
Either way even if Amazon were being absolutely benevolent and ONLY using all this data to “help my experience”, it’s besides the point isn’t it, because it’s MY HOUSE! It’s not up to some random company to decide what is “ok” or “not evil” when it comes to invading my privacy, and tampering with my own personal possessions or data without my knowledge, or worse, explicitly telling me they’re NOT doing so (“Security ONLY”), but then doing it anyway.
So in conclusion the actual result matters not (though thanks for investigating anyway), it’s the principle that matters. Why do people trust corporations so much with their own personal stuff? I grew up being told to never share your personal info or real name etc online, and now everything “encourages” you to do so, as well as loads of other personal stuff, all for “benevolent” reasons, of course.
Either way, my house, my personal computer, my data. Give me a very clear and transparent OPTION, or get out.
To address this posted by Susan Bradley:
As an aside I thought this wasn’t the first time telemetry updates were included in Security updates
I have four computers running Windows 7 and have done security only updates since bundling started in October 2016. I have yet to install July 2019 and probably will not. Looking in services, there is no telemetry listed. So telemetry was never put into security only updates.
Got coffee?
-
Yep. That matches everything I’ve heard.
We also know that the July Security-only patch installs the plumbing – and we weren’t warned. (I think that’s unconscionable.)
The big question is whether the plumbing is hooked up to Microsoft, whether data’s being sent. Still don’t know yet, but I’m hoping GoneToPlaid’s test will tell us.
-
Looking in services, there is no telemetry listed.
Microsoft is not simple. Given the kinds of information which could be collected, Microsoft would not normally put all methods into a service module named Telemetry. Microsoft favors use of diverse fancy obscure terminology for the telemetry service names and programs.
In the future if a service name Telemetry does show up the result will be worth a long discussion beginning with a question, ‘Is it really legitimate software from Microsoft?’
1 user thanked author for this post.
I have had CEIP and other tasks disabled since the GWX and other telemetry info surfaced. I found it has not transmitted data, HOWEVER, it has run scans as indicated in the task manager. The way to disable the scans it to disable the triggers in the task properties. As such, my AIT and CEIP now show the last scans were in 2017 and 2016 respectively.
Way back after I removed GWX and its partners in crime, I also searched for the related files and storage locations (for Appraiser data, etc.) and deleted those locations and files.
Once I read GoneToPlaid’s report, I may try the July 2019 SO patch and see what it changes, and/or what it actually adds, since I do not have the GWX beginnings (removed) and never installed any of the following telemetry or appraiser updates and patches.
I do see Susan Bradley’s points, but whenever I have looked at a crashdump file using a text editor, I always found readable text from whatever I had open on my machine. It also included file names, dates and file locations. Due to that, and the fact that I never got any feedback from the reliabilty monitor, I turned off the crash reporting even before GWX and telemetry.
I’m not in group “B”, yet this IS troubling.
IS MSFT evil? Depends on your time frame.
Back in the day (Gates1.0, pre-Melinda) when they were paying retail outlets NOT to install Netscape, and was engaging in other anti-competitive practices, I’d have a hard time saying no.
These days, they seem less malignant, but more disregardful of the home or small biz user.
IS neglect and carelessness a form of bad behavior? Grist for the mill.
In the meantime, I’m waiting to see what tattletale stuff is in the July Rollups…(puts on helmet, dives into trench)
Win7 Pro SP1 64-bit, Dell Latitude E6330, Intel CORE i5 "Ivy Bridge", 12GB RAM, Group "0Patch", Multiple Air-Gapped backup drives in different locations. Linux Mint Greenhorn
--
"...all the people, all the time..."Peter Ustinov ad-lib in "Logan's Run"It looks like Microsoft is also introducing new telemetry in the July Windows 7 Rollup (KB4507449). I installed the update on 7/31/2019, and the day after I noticed CompatTelRunner.exe running on my PC for the first time ever.
I see that I now have a version of CompatTelRunner.exe dated 06/12/2019. There were two new scheduled tasks in the Microsoft Windows Application Experience folder called Microsoft Compatibility Appraiser and ProgramDataUpdater. I disabled both tasks.
-
The telemetry has been in the Monthly Rollups since Oct. 2018. That is when MS added the KB2952664 functionality to the Rollups. If you have been patching Group A, maybe you just haven’t noticed it before.
I took steps to disable telemetry on 10/07/2018 when I installed the rollup you’re referring to. My most recent .etl file is from that date.
I also remember either disabling or deleting the scheduled tasks at that time. Apparently the 2019-07 rollup (KB4507449) reinstated them.
Believe me, if CompatTelRunner.exe had been running since October 2018, I would have noticed it long before now.
-
-
Scenario tested
– Windows 7 Professional x86, VMware Workstation
– Installed updates: KB4507456 (July security only), KB4474419 (SHA-2 signing support)
– Monitoring program: Telerik Fiddler (Wireshark is too noisy and cannot decrypt SSL/TLS traffic anyway)
– Result
https://m.put.re/VyY91zNs.zipregistry files represent the changed/added values after running the schedule tasks (Amcache.reg contain most info about installed devices, programs, drivers…)
AppCompat folder is deducted copy of C:\Windows\AppCompat to show the gathered binary files
SessionsFiddler.saz is the traffic capture file
you can load it in Fiddler program for easy reading and analysis
or just rename it as .zip file and extract it, open _index.htm, then press on the C, M, S links on the left (C for client request, S for server response)the first 5 sessions “settings-win.data.microsoft.com” are the requested telemetry settings
the other sessions “vortex-win.data.microsoft.com” contain the data sent to Microsoft (the most interested part of the test)
a quick read of the sent data reveal that at least 95% are ment to measure the OS compatibility to upgrade to Windows 10
but i didn’t see any too “personal” data includedso, to answer the topic question, the amount of sent data with KB4507456 telemetry components is not different from the rollup or the standalone superseded KB2952664
-
? says:
great work, thank you abbodi86! i see the AppCompat folder is 4.1 MB, do you know how big the whole program is? system resources used by the program, also if not “upgrading,” to windowsX how this program enhances a windows 7 installation and if this program has any “security” value?
again, thank you for doing the work1 user thanked author for this post.
-
You can add about 4 MB for Amcache.hve and AlternativeAppraiser data cab file
the size will be a little different per system, depending on installed drivers and programs
CompatTelRunner.exe consume notable amount of resources the first time it runs, but the follow up runs almost not notable
i don’t know what would be the security value, but the collected data cover the CPU vulnerabilities (for spectre and meltdown)
and maybe other things, it’s hard to decode or understand all the data meanings
-
I forgot to mention that the test was made with default CEIP enabled
i now redid the test from clean status with CEIP disabled
the data is still collected, but i can confirm that nothing is reported or sent to vortex-win.data.microsoft.comthat’s a good thing, at least
From @abbodi86 post above
“so, to answer the topic question, the amount of sent data with KB4507456 telemetry components is not different from the rollup or the standalone superseded KB2952664”
And, those in Group B avoided KB2952664 at the time (and since).
Maybe, Susan Bradley’s original question could be turned on its head. Is there anything in KB4507456 other than the telemetry that is of security value for GroupB?
-
KB4507456 contain the security fixes for July 2019, of course it’s valuable and should be installed
it’s enough to turn off CEIP and disable the schedule tasks to avoid the telemetry thing included
12 users thanked author for this post.
-
-
“It’s enough to turn off CEIP and disable the schedule tasks to avoid the telemetry thing included.”
Abbod, Thank You 1000 times, may you live forever!!
It’s nice to know the whole thing can be killed by two simple actions, (one of which I had thrown long ago), instead of port blocking, registry hacking, script running, a four-day fasting quest, Geomantic Incantations and running around the PC clockwise three times while holding a branch from a sacred oak tree while chanting, “Redmond, Washington, ooga-codswallop, rama-lama-ding dong”!
I think we should all get SOME kind of medal after all this, don’t you? (TWO medals with Galactic Clusters for Abbod.)
Win7 Pro SP1 64-bit, Dell Latitude E6330, Intel CORE i5 "Ivy Bridge", 12GB RAM, Group "0Patch", Multiple Air-Gapped backup drives in different locations. Linux Mint Greenhorn
--
"...all the people, all the time..."Peter Ustinov ad-lib in "Logan's Run"1 user thanked author for this post.
-
-
-
W10Tel.cmd already do that and it’s enough
but for who want the manual limited way, these are the schedule tasks added/changed by Telemetry Appraiser:
“Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser”
“Microsoft\Windows\Application Experience\ProgramDataUpdater”
-
-
-
-
You cannot remove OS components (whether inbox or added with updates) without breaking SFC integrity
however, you can simply turn OFF the Appraiser:
reg add HKLM\SOFTWARE\Microsoft\SQMClient\Windows /v CEIPEnable /t REG_DWORD /d 0 /fschtasks /Change /DISABLE /TN "Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser"schtasks /Change /DISABLE /TN "Microsoft\Windows\Application Experience\ProgramDataUpdater".
-
-
I have two, clean, Group B Win 7 Ult machines available for testing. Both have CEIP disabled and all telemetry related stuff disabled or removed. All unnecessary OS/application services and tasks are disabled (e.g. Remote registry, Adobe LM).
In addition to disabling OS telemetry, I always disable telemetry for the following:
1) Firefox (portable)
2) Adobe (Reader, Flash)
3) nVidia (drivers)
4) Samsung Magician (really ticks me off)
5) MS Office (2010)
6) Intel (services, utils, etc.)
7) Norton Security (watching this closely)I use an application firewall to block egress from specific applications/services (i.e. Windows gadgets, Media Player).
Since abbodi86 has already conducted some excellent research, I’m not going to duplicate his findings. I have completed a thorough machine state assessment and will do the same after installing KB4507456 and disabling any nasties I discover.
There are two, free, stand-alone tools that even the less experienced here can try for themselves:
1) Nirsoft TaskSchedulerView
http://www.nirsoft.net/utils/task_scheduler_view.htmlThis tool lists all scheduled tasks (including hidden) and allows one to save lists in both text and html table format. Run the tool as Admin or switch to Admin inside the app (click Help on menu bar). Generate pre-patch and post-patch lists. Use a diff tool to compare before and after for additions/changes.
2) Nirsoft RegistryChangesView
http://www.nirsoft.net/utils/registry_changes_view.htmlWith this tool, you can take snapshots of the registry pre and post patch and compare for changes.
Note:
Nir Sofer (Nirsoft) has been around for many years. He’s accessible and I can vouch for the integrity of his tools. Since his tools are low level, it’s possible that your anti-virus heuristics may trigger false positives (especially password tools and ProduKey) even though the apps are digitally signed. Quite a few tools require running as Admin.Best of luck fellow Group B diehards.
– Carl –
5 users thanked author for this post.
I’ve put the Win7 telemetry issue into the wastebasket. For now. I recently installed Norton360, which has a great firewall. I set the firewall to alert me when anything tries to access the internet and my computer. After installing all the July updates, I got pop-ups from Norton throughout the process. There must have been six or seven windows files that wanted access. One was ‘NETBios and file sharing.’ ZAP! Blocked that one. Another was a program that clearly said ‘Telemetry’ within the name. ZAP! Blocked that one too. And a half dozen others that I didn’t feel were necessary to have internet access. The only thing I did allow was the MSRT, which I may still end up blocking since Norton can probably take care of that.
Seems to me that MS telemetry (read; data collection) practices can be (partially?) circumvented by simply using your firewall properly and configuring it to alert you. But if I’m overlooking anything, well …. that’s why we’re all here.
Edit to remove HTML. Please use the “Text” tab in the entry box when you copy/paste.
"War is the remedy our enemies have chosen. And I say let us give them all they want" ----- William T. Sherman
1 user thanked author for this post.
-
It’s not an update, Appraiser is completely different component that hijack the inbox Program Compatibilty Experience
this is the first time it’s added to security-only updateKB2952664 was changed to important update back in February 2018 with the Spectre/Meltdown mess
the schedule tasks do “collect” the data and appraise the installed programs, drivers
but the data is not sent unless CEIP is opted-in1 user thanked author for this post.
Hi everyone,
In Task Manager, I now see two instances of Taskeng.exe. I don’t see them on my other Win7 computer. See the attached 01 image.
I see the same as @Sueska in Task Scheduler, yet I do see one additional item which I do not recall seeing before. See the attached 02 image.
I am going to leave these new things enabled to see what happens. So far, no telemetry is going out. Its not like KB2952664 which was sending stuff as I typed or every time I opened a program. It will be interesting to see what gets sent tonight after 3 AM.
Best regards,
–GTP
Viewing 25 reply threads
Plus Membership
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
Get Plus!
Recent Topics
-
Allow defenderbootstrapper.exe to phone home?
by 36 minutes ago
-
KB 5022836 will not install
by 10 hours, 4 minutes ago
-
Windows 11 desktop for Windows 10 user
by 12 hours, 10 minutes ago
-
GNOME 44 ‘Kuala Lumpur’ released
by 14 hours, 49 minutes ago
-
Emotet adopts Microsoft OneNote attachments
by 14 hours, 58 minutes ago
-
US : The Spy Law That Big Tech Wants to Limit
by 4 minutes ago
-
Ferrari confirms customer data breached following ransomware attack
by 15 hours, 46 minutes ago
-
Outlook bookmarks redirects to a different location, Help!
by 17 hours, 22 minutes ago
-
Should I go to win11?
by 6 hours, 5 minutes ago
-
The Framework Laptop – Fully Modular
by 23 hours, 4 minutes ago
-
Windows Snipping Tool is vulnerable to Acropalypse too.
by 16 hours, 57 minutes ago
-
Pale Moon updates
by 1 day, 2 hours ago
-
“Local Security Authority protection is off.” with persistent restart
by 15 hours, 28 minutes ago
-
Self-encrypting drive setup on Linux
by 1 day, 3 hours ago
-
Windows 11 Moments and local account setup
by 20 hours, 47 minutes ago
-
Older versions of Roboform
by 1 day, 10 hours ago
-
Long string filenames
by 1 day, 8 hours ago
-
Windows 11 Build 22621.1483 released to Release Preview
by 1 day, 11 hours ago
-
Will adding RAM to re-purposed PCs trigger activation again?
by 14 hours, 2 minutes ago
-
Digital Photography Review to close
by 23 hours, 5 minutes ago
-
Dish Network Hacked
by 14 hours, 52 minutes ago
-
NewQ 16-in-1 USB C/TB4 Docking Station
by 1 day, 15 hours ago
-
Is Office 2007 compromised by Windows 10?
by 23 hours, 55 minutes ago
-
ZippyShare to shut down at end of month
by 1 day, 20 hours ago
-
Odd monitor issue since last update…
by 2 days, 11 hours ago
-
Powershell
by 1 day, 11 hours ago
-
M1 Pro MacBook Pro running Parallels and Windows 11 on ARM
by 1 day, 22 hours ago
-
Make Google Maps Android full screen (without overlays)
by 20 hours, 20 minutes ago
-
How do I most easily see replies made to posts rather than to the topic?
by 13 hours, 4 minutes ago
-
Searching for documents on an additional drive
by 2 days, 11 hours ago
