Need some help to understand Windows Defender telemetry.

Pulcinella · 05 Sep 2017

This topic it may have been discussed somewhere in tenforums, if so please redirect me.

I decided to use Windows Defender (WD) and SmartScreen (SS) as AV. I would like to tweak its settings to avoid telemetry as far as it does not reduce the effectiveness of its protections.
Do I need to send cloud telemetry?
I understand that Disabling SS will lower the protection but I read that SS send a lot of things and it is of a privacy concern for many.
Does SS have access to the browsing history and surfing habit of the user? Does it send details of apps, files, TV series and the like the user watch or download?
With the upcoming W10 fall upgrade WD will be greatly enhanced with a number of new features. I suspect more telemetry too.

I'll much appreciate any thought, suggestion and insight how to find a balance between security and privacy.

TairikuOkami · 06 Sep 2017

Pulcinella said:

Does SS have access to the browsing history and surfing habit of the user? Does it send details of apps, files, TV series and the like the user watch or download?

Only MS can tell you that and they will not, but this says something:

Privacy: URLs that are collected may unintentionally contain personal information (depending on the design of the website that is visited). Like the other information that is sent to Microsoft, this information is not used to identify, contact, or target advertising to users. In addition, Microsoft filters address strings to remove personal information where possible.

Manage Privacy: SmartScreen Filter and Resulting Internet Communication

Pulcinella said:

Do I need to send cloud telemetry?

No. I disable all cloud features, I prefer AVs with heuristics. The tradeoff is, that the computer is mostly unprotected against new threats, but that is usually fixed within 24-48 hours by signatures updates.

Pulcinella said:

I would like to tweak its settings to avoid telemetry as far as it does not reduce the effectiveness of its protections.

As for cloud protection, you can customize those settings.

Code:

Block at First Sight / 0 - Enable / 1 - Disable
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "0" /f

Cloud-based Protection / 0 - Disable / 1 - Basic / 2 - Advanced
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "1" /f

Send file samples when further analysis is required / 0 - Always prompt / 1 - Send safe samples automatically / 2 - Never send / 3 - Send all samples automatically
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "1" /f

Configuring SpyNet reporting

Enable Block at First Sight to detect malware in seconds | Microsoft Docs

Enable cloud-delivered protection in Windows Defender Antivirus | Microsoft Docs

Pulcinella · 06 Sep 2017

TairikuOkami said:

Only MS can tell you that and they will not, but this says something:

Thanks for the information. Really appreciate your time and effort.

In regard the below statement:

Privacy: URLs that are collected may unintentionally contain personal information (depending on the design of the website that is visited). Like the other information that is sent to Microsoft, this information is not used to identify, contact, or target advertising to users. In addition, Microsoft filters address strings to remove personal information where possible.

Does SS collect the same even if I don't use Edge or IE?

Pulcinella · 06 Sep 2017

@TairikuOkami

Would you recommend disabling this settings?Attachment 152123

TairikuOkami · 06 Sep 2017

Pulcinella said:

Would you recommend disabling this settings?

I would not say recommend, but if you are concerned about privacy, then you should keep it disabled.

Pulcinella said:

Does SS collect the same even if I don't use Edge or IE?

No, but if it detects an unknown file, it might upload it online for the analysis.

Pulcinella · 06 Sep 2017

TairikuOkami said:

No, but if it detects an unknown file, it might upload it online for the analysis.

So in a way SS monitor other browsers activity too. Or you mean that once a file is downloaded SS may access the computer folders and upload a newly downloaded file. Or that SS or WD have access to files and folders to monitor for old or new files?

BTW I use O&O ShutUp to disable Spynet and others unwanted Telemetry.

TairikuOkami · 06 Sep 2017

SS is like a realtime AV, it monitors all files, which are being accessed, they do not have to be from the internet.

Windows Defender SmartScreen Filter Frequently Asked Questions

Pulcinella · 06 Sep 2017

Edit to post #6

@TairukiOkami
I can see the answers on the link you sent me.

Manage Privacy: SmartScreen Filter and Resulting Internet Communication

Thanks again, I guess does not make much sense using WD without SS. If I stick with it I have to accept some compromise.