Cutting telemetry without breaking Windows Update

The safe way to block telemetry on Windows comes in two parts. For Windows itself, use the diagnostic data and privacy settings Microsoft provides; they reduce what's collected without touching the services Windows needs. For third-party apps, cut telemetry one app at a time: the app's own opt-out first, then a firewall block on the app or its helper program. What breaks Windows is blocking broadly, whether that's the svchost.exe process or a long list of Microsoft domains.

What Windows telemetry is

Windows sends diagnostic data to Microsoft. There are two levels. Required diagnostic data covers the device, its configuration, whether updates installed, and errors. Optional diagnostic data adds more detailed information about how you use Windows and apps. On a PC, most of it is sent by a Windows service called Connected User Experiences and Telemetry (its short name is DiagTrack), which runs inside svchost.exe alongside dozens of other services.

That last detail is why this topic goes wrong so often. The process that carries telemetry also carries the services that keep Windows working.

Start with Windows' own settings

On Windows 11:

1. Open Settings ▸ Privacy & security ▸ Diagnostics & feedback.
2. Turn off Send optional diagnostic data. Windows then sends required diagnostic data only.
3. Turn off Tailored experiences, so your diagnostic data isn't used to personalize tips and offers.
4. Use Delete diagnostic data to ask Microsoft to delete what it has collected from this device.
5. Open Settings ▸ Privacy & security ▸ General and turn off the advertising ID and any suggestions you don't want.
6. Check Settings ▸ Privacy & security ▸ Activity history and turn off storing your activity history if you don't use it.

If you want to see what's being sent, View diagnostic data on the Diagnostics & feedback page turns on the Diagnostic Data Viewer.

Why blocking svchost.exe backfires

svchost.exe is a container. Windows runs many services inside copies of it, and from the outside they all look like the same program. Block svchost.exe in a firewall and you block all of them at once, including:

• Windows Update, and with it security fixes.
• Time synchronization, so the clock slowly drifts. A clock that is far enough off breaks secure connections.
• Activation and license checks for Windows and for Store apps.
• Network connectivity checks, so Windows starts reporting "No internet" when you have it.

Community blocklists of Microsoft domains cause a slower version of the same problem. Microsoft serves many things from shared domains and shared cloud infrastructure, so a name on a telemetry list can also serve something you need. The breakage often shows up weeks later as an update that fails with an unhelpful error code, long after you've forgotten the list was there.

What svchost.exe is doing on your network explains how to tell its services apart.

Block telemetry one app at a time

Third-party apps are a different story. Most don't share a process with anything important, so a block affects only that app. A conservative order:

1. Use the app's own setting. Look for "send usage statistics", "help improve" or "crash reports" in its options.
2. Find out what it contacts. The list of domains an app looks up usually makes its analytics and crash-reporting services obvious.
3. Block the helper, not the app. Many apps ship their updater or crash reporter as a separate .exe in the program folder. Blocking just that one leaves the app working.
4. Block the whole app if it doesn't need the internet at all.
5. Block tracking domains for everyone if you want a blanket filter on third-party analytics.

How NetSecWall helps you block telemetry safely

Tell services apart before you touch anything

In the Live tab, svchost.exe connections come with a Service column that names the Windows service behind each one. Telemetry, Windows Update and time sync stop looking identical. The DNS tab shows which domains each app looks up; see the DNS log.

Block a program, and test with a timer first

Right-click a program in the Live tab and choose Block this app (firewall) ▸ Block for 1 hour. Use the app normally. If nothing you care about breaks, come back and choose Block (permanent). Blocks are keyed to the executable's path, so you can block SomeAppCrashReporter.exe and leave the app itself online.

Filter tracking domains across all apps

Open Protection ▸ Content categories… and tick Block for Tracking (and Ads, if you like). Connections from any app to domains on those lists are then blocked. What it catches depends entirely on the list; it isn't a Windows telemetry switch. See blocking website categories.

Blocking is part of the Family and Pro plans, and of the 7-day trial.

One thing NetSecWall doesn't do

NetSecWall shows a single Windows service's traffic, but its app blocks work on whole programs, and that means all of svchost.exe. If you decide to block one Windows service anyway, Windows Defender Firewall with Advanced Security can scope a rule to a single service: in the rule's properties, Programs and Services ▸ Services ▸ Settings… ▸ Apply to this service. Do it with care, test it, and write down what you changed.

If something already broke

If Windows Update fails or an app stops connecting after a round of blocking, look at your rules before anything else. In NetSecWall, the Rules tab lists every block it made; remove the recent ones and try again. No internet after blocking something? walks through the checks in order.

The short version

Settings for Windows, narrow blocks for apps, timers before permanent rules, and never svchost.exe wholesale. If you'd like to see exactly which services and apps are sending what before you change anything, download NetSecWall and try every feature free for 7 days.