Latest / The Windows Podcast with Fexingo: Microsoft, PC, and Enterprise Windows Conversations / Windows 11 Privacy Settings That Actually Matter in Enterprise
Transcript
- Lucas: So you've got a hundred Windows 11 machines in your office. Do you know exactly what data each one is sending back to Microsoft every day? Luna: Honestly? Most IT admins I talk to say they set it to 'Required diagnostic data' and call it a day. They assume that's basically nothing. Lucas: Right, and that assumption is where the trouble starts. Because 'Required' doesn't mean 'nothing.' It means a fairly detailed stream of system health info — device identifiers, crash logs, reliability metrics — plus, critically, crash dumps that can contain snippets of whatever the user was doing when the crash happened. Luna: Wait — so a crash dump from Word could include part of a contract or a patient record? Lucas: Exactly. Microsoft says they strip personal data from those dumps before they're analyzed, but the raw dump goes over the wire first. And for a regulated industry — healthcare, finance, legal — that's a potential data-exposure vector you didn't even know you had. Luna: Okay, so what's the actual difference between Required and Optional? I think a lot of people assume Optional is just like, 'hey, send us your browsing history.' Lucas: It's more granular than that. Required covers what Microsoft calls 'device health and configuration' — things like OS version, driver health, hardware IDs. It also includes basic error reporting. Optional adds browsing history, inking and typing data, app usage, and richer crash dumps. But here's the kicker: even on Required, some telemetry is baked into the OS at a kernel level. You can't turn it all off without using the LTSC version or a specialized configuration. Luna: And LTSC — Long-Term Servicing Channel — that's what we covered in episode nine. It strips out the Microsoft Store, Edge, Cortana, and a lot of the telemetry hooks. Lucas: Right. LTSC is the nuclear option for privacy. But most enterprises aren't on LTSC. They're on the regular Pro or Enterprise build, and they've maybe set one Group Policy — 'AllowTelemetry' — to a value of 1 or 2 and moved on. That's a really common oversight. Luna: So what should they be setting it to? I've heard there's a value of 0, which was 'Security' in Windows 10 — does that still exist? Lucas: It does, but Microsoft changed the labeling in Windows 11. The settings are: 0 — Security, which sends only essential telemetry like Malicious Software Removal Tool data. 1 — Required, which adds basic system health. 2 — Enhanced, which adds more detail on app reliability. 3 — Optional, which is the firehose. Most organizations land at 1 or 2 because 0 actually breaks some Windows Update features and can prevent certain security patches from deploying correctly. Luna: So you can't choose the most private option without potentially breaking your patching pipeline. That's a hell of a trade-off. Lucas: It is. And it's intentional. Microsoft's argument is that telemetry helps them detect and fix issues faster — and they're not wrong. But the compliance reality is that if you're subject to GDPR or HIPAA, you need to know exactly what's leaving your network. The European Data Protection Supervisor's 2024 guidance on Microsoft 365 was pretty clear: organizations need to conduct a data protection impact assessment on telemetry flows, and they need to minimize what's collected to what's strictly necessary. Luna: And I bet most haven't done that assessment. It's easy to just set a policy and forget it. Lucas: Exactly. So here's a concrete example. I spoke with an IT director at a mid-sized manufacturing firm in Germany — about 400 endpoints. They assumed they were on 'Security' level 0. When they actually audited their Group Policy, they discovered a stale domain policy was overriding their local config, pushing them to level 2 — Enhanced. They'd been sending app usage data and additional crash dumps for over a year without realizing it. Luna: Ouch. So how did they fix it? Lucas: They cleaned up their Group Policies, set a specific registry key to enforce level 0 on all devices, and then used Microsoft's Diagnostic Data Viewer — that's a free tool in the Microsoft Store — to sample what was actually being sent. They found that even at level 0, some crash dumps still included memory fragments with proprietary part numbers. So they ended up configuring a local proxy to intercept and filter crash dumps before they left the network. Luna: That's a pretty advanced workaround. Is that feasible for most IT teams? Lucas: It depends on the team's sophistication. But the simpler lesson is: don't trust the default. Audit your policies, use the Diagnostic Data Viewer periodically, and understand that 'Required' is not 'Minimal.' Also, consider whether you really need the Windows Update optimization that level 0 breaks. For many organizations, the security patch risk is lower than the data-exposure risk. Luna: So what's the single most important thing an IT admin should do this week? Lucas: Run the 'Get-WindowsDiagnosticData' PowerShell cmdlet on a sample of machines. It'll show you the exact diagnostic level and what data types are included. If you're at level 2 or 3, drop it to 1 at minimum, and then evaluate whether you can go to 0. And document your rationale for whichever level you choose — that's your GDPR paper trail. Luna: That's actionable. I like it. Lucas: If today was actually useful to you, the way these stay ad-free is listener support. You can find us at buy me a coffee dot com slash fexingo. Luna: Yeah, it's a small way to keep the conversation going without any corporate interruptions. Lucas: Exactly. So back to those crash dumps — the other thing that surprised me was how much data can leak through seemingly benign features like Windows Error Reporting. Even at the most restrictive setting, WER still sends minidumps to Microsoft. Minidumps include the call stack and a subset of memory. If the crash happened while someone was editing a document, that memory might contain text fragments. Luna: So the only way to fully control that is to block the WER endpoints at the firewall level? Lucas: You can, but Microsoft warns that blocking telemetry endpoints can degrade the Windows experience — features like Windows Update reliability may suffer. Some organizations set up a local WER server to capture dumps internally instead of sending them to Microsoft. That way they still get the diagnostic data for troubleshooting, but it never leaves their network. Luna: That seems like the best of both worlds. How hard is that to set up? Lucas: It's not trivial, but it's well-documented. You need Windows Server with the Windows Error Reporting role, plus some Group Policy configuration to redirect client machines. For a small shop with a hundred endpoints, you could probably set it up in a couple of afternoons. The bigger cost is ongoing maintenance — someone has to actually look at those dumps. Luna: Right, because the whole reason telemetry exists is so Microsoft does that analysis for you. Lucas: Exactly. So you're trading convenience for control. And that's the core tension in enterprise Windows privacy: Microsoft wants the data to improve the product; regulators want you to minimize data flow; and IT admins are stuck in the middle trying to patch, update, and stay compliant. Luna: One thing I've noticed is that a lot of smaller organizations don't even know about these settings. They just click through the OOBE — out-of-box experience — and accept whatever defaults Windows 11 gives them. Lucas: That's a big problem. The out-of-box experience for Windows 11 Enterprise actually defaults to the same telemetry level as Pro — which is Required. But there's also a checkbox during setup that says 'Send optional diagnostic data' that's pre-checked in some builds. I've seen auditors miss that. Luna: So one recommendation: build a custom answer file for deployments that explicitly sets the diagnostic level to 0 or 1 and unchecks that optional data box. Lucas: Exactly. Use the Windows System Image Manager to create an unattended XML file. Set the 'TelemetryLevel' to 0 or 1. Then every new machine you deploy starts at that level, no matter what the user clicks during setup. Luna: That's a great best practice. And I imagine it also helps with audit readiness — you can prove that all machines were configured consistently from day one. Lucas: Right. And consistency is key. Because the moment you have one machine at a different level, your data map gets complicated. The European Data Protection Supervisor's guidance emphasizes data minimization across the entire fleet, not just on individual devices. Luna: So what about third-party tools that claim to block all Windows telemetry? Are those reliable? Lucas: There are tools like O&O ShutUp10 or WPD — Windows Privacy Dashboard — that block a bunch of telemetry endpoints and services. They can be effective, but they're not officially supported. Microsoft could break them with an update, and they might also interfere with legitimate functionality. For enterprise, I'd stick with documented Group Policies and registry settings. You know exactly what they do, and they're Microsoft-supported. Luna: Makes sense. So if I'm an IT admin listening, what's the one takeaway for today? Lucas: Audit your current telemetry level on a sample of machines. Use the PowerShell cmdlet. If you're at level 2 or 3, decide whether you really need that data. If not, drop to level 1 — and consider whether level 0 is feasible for your update setup. Document everything. And if you're really concerned, explore a local WER server. That's the single most impactful change you can make this quarter. Luna: And next episode, maybe we can talk about how Windows 11's new default encryption settings interact with data loss prevention policies. Lucas: That's a good one. Device encryption is on by default now on many new PCs, and it has privacy implications too. We'll dig into that next time.