Is Microsoft Taking Stealth Screenshots For 'Feedback' Purposes?

You said:

Yes, that's probably from the feedback app or possibly a program on your computer. Having a visible folder would be a dumb thing to do if you were trying to stealthily spy on someone by taking screenshots, and so would taking them at seemingly random times which will most likely be the victim arranging files or something like that, leaving it on the hard drive after taking it and uploading it,or even having the folder in the actual Pictures folder. Some programs have crash reporters that will take a screenshot if you allow them to. Maybe a program crashed and you dismissed the crash message without unchecking a box or something. It would be way to hard to accidentally leave feedback w/out a Microsoft acct, that's for sure. Are you sure that the screenshot was of you doing stuff? Perhaps someone else on your computer has a Microsoft account and they took a screenshot using the feedback app.

Please read all the posts thoroughly before responding with irrelevant, unhelpful, generic comments.

Boozad said:

Mine were taken by me using the Feedback app.

That's interesting, so we can strongly assume that these screenshots are part of the feedback system.

As I already stated: I have never run the feedback app on the machine in question and have only used a local account -- the feedback app requires an MS account to start. So, the mechanism for taking the screenshot must exist outside of the feedback app and was initiated, without consent, by another process.

Nus said:

So, in the absence of any other plausible explanation, I'm holding to the suspicion that stealth screenshots are being taken and uploaded to MS without the users knowledge. The stealth process failed on my machine, due to all the privacy hacks I have made, and dumped the screenshot to disk.

I'm prepared to change my position if anyone has a precise answer.

Otherwise, you have been warned!

Just curious...........what's your feelings on the moon landing?

Nus said:

I've just discovered a folder, in the pictures folder, called 'Feedback' which contained a sub-folder with a GUID for a name. This sub-folder contained a screenshot called Capture001.png.

Something like:

C:\Users\Nus\Pictures\Feedback\{B2367SDG-3AF8-84KN-NBUJ-K89W37Y844HJK}\Capture001.png

It was created a week ago and I know exactly what I was doing at the time the folders and screenshot were created: organising files in File Explorer.

I can only find one other occurrence of this in Google search, here. The MS tech gives a generic response about scanning for viruses.

I have all the known MS feedback, spy and telemetry stuff disabled. Which is what makes me think that this is happening on other systems in a stealthy fashion, as part of the 'feedback' programme -- the stealth obviously failed here, perhaps because of my hacks.

No other applications, besides File Explorer, were running at the time; no background apps, no 3rd-party services. System has been scanned with MBAM since and was clean. Pressing WINKEY + PrtScr takes a screenshot that goes in a Pictures\Screenshot folder.

Has this happened to anyone else?

Do you know how this scenario can be recreated?

Any other explanations, theories, thoughts?

I assume you're not an insider and with/using RTM build 10240? What exactly is this screenshot you have? Can it be opened?

I have no such folder. Insider Preview build 10532.

Nus said:

OK, just opened the Windows Feedback app for the first time. You have to login with a Microsoft account. The machine has only ever had a local account. So, direct interaction with the Windows Feedback app can be discounted.

I'm sure I have logged in to the feedback app with a Microsoft Account, even though I was logged into the machine itself with a local account, which I do most of the time.

That is, you (or anyone else who may have logged in) can login to the feedback app separately from the method you use to login to the machine, using any email address that is setup as an Insider account. You don't need to have a MS Account setup on the machine itself.