windows

How to Disable Windows 11 Telemetry, and What Each Setting Actually Stops

secure-os· Updated September 5, 2026· 4 min read #windows#privacy#telemetry#hardening

An open silver laptop with a blank dark screen on a pale grey desk in front of a bright window, a red cased phone and a slim black pen lying to its left on a strip of yellow tape

Search this and you will find two kinds of answer. One is a list of five toggles in Settings. The other is a script that claims to strip telemetry out of Windows entirely.

The first understates what is collected. The second overstates what can be removed. The useful version sits between them, and it starts with knowing what the categories mean.

The two tiers, and why only one of them is optional

Windows 11 splits diagnostic data into Required and Optional.

Optional covers browsing activity in Microsoft apps, how you use features, inking and typing data, and detailed crash information. This is genuinely optional and turning it off changes what leaves the machine.

Required is the tier people argue about. It covers device configuration, installed applications, reliability and crash events. There is no supported setting on Home or Pro that turns Required diagnostic data off. Enterprise and Education editions expose a policy that reduces it further, and consumer editions do not.

Anyone telling you a toggle removes all telemetry from Windows 11 Home is describing the Optional tier and calling it everything.

The settings that do change something

Settings, Privacy and security, Diagnostics and feedback. Turn off Send optional diagnostic data. Turn off Improve inking and typing. Turn off Tailored experiences, which is the setting that lets diagnostic data feed personalised suggestions. Set Feedback frequency to Never.

Settings, Privacy and security, General. Four toggles here control the advertising ID, local content based on your language list, app launch tracking, and suggested content in Settings. Turn off all four. The advertising ID one is the most consequential, because it is the identifier that follows you across apps.

Settings, Privacy and security, Search permissions. Turn off Cloud content search for both your Microsoft account and work accounts, and turn off Search history on this device. Without these, text typed into the Start menu goes to Bing.

Settings, Privacy and security, Activity history. Turn off sending activity history to Microsoft.

Settings, Privacy and security, Find my device. Off, unless you rely on it, in which case keep it and know what you traded.

Three white outdoor security cameras mounted back to back on a single tall white pole, pointing in different directions, against a background of sunlit green shrubs and foliage

Group Policy and registry, on the editions that have them

On Windows 11 Pro, gpedit.msc under Computer Configuration, Administrative Templates, Windows Components, Data Collection and Preview Builds, has Allow Diagnostic Data. Set it to Send required diagnostic data. On Enterprise and Education the same policy offers Diagnostic data off, which Pro will accept in the interface but not honour.

The registry equivalent, for scripting the same thing:

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v AllowTelemetry /t REG_DWORD /d 0 /f

On Home and Pro this floors at Required regardless of the value. Writing 0 does not produce zero. This is the single most repeated piece of bad advice on the subject, and it is easy to check: the value is accepted, and the service keeps running.

Two components can be disabled outright, and they are the ones that actually send:

sc config DiagTrack start= disabled
sc stop DiagTrack

DiagTrack, shown as Connected User Experiences and Telemetry, is the service that transmits diagnostic data. Disabling it is supported in the sense that nothing else breaks in normal use. The scheduled tasks under Microsoft\Windows\Application Experience and Microsoft\Windows\Customer Experience Improvement Program can be disabled in Task Scheduler for the same reason.

What to be careful with

Blocking telemetry endpoints in the hosts file does not work reliably. Windows ignores hosts entries for a set of its own domains, and the endpoint list changes between builds. A firewall rule is more honest, and it will need maintenance.

Debloating scripts vary enormously in quality. Some are careful and reversible. Others disable Windows Update, break the Store, or make future feature updates fail in ways that are hard to diagnose six months later. If you run one, read what it does first and take a restore point.

Every one of these settings can come back after a feature update. Not always, not all of them, but often enough that rechecking after a major update is part of the routine rather than a sign something went wrong.

The honest summary

You can switch off the Optional tier, the advertising ID, cloud search, and activity history, and you can stop the service that transmits. That is a real reduction and it is worth doing.

You cannot reduce a consumer edition of Windows 11 to no telemetry, and the machine will still contact Microsoft for updates, activation, and time. If your threat model requires that the operating system not report to its vendor, the answer is a different operating system rather than a better configuration: see our most secure Linux distros and Linux vs Windows security. Choosing to stay on Windows with these settings applied is a perfectly reasonable decision, as long as it is made with the limit in view.