Hellbovine
Active Member
I'm pretty sure I'll eventually figure this out on my own as I make my way through the pile of registry tweaks I'm testing, but in an effort to help speed up that process I'm hoping someone knows the answer to this one so I don't have to wait, since it's quite the annoyance right now.
Anyone that uses tools such as RegShot or RegistryChangesView, etcetera, to compare registry settings after you toggle something on/off is likely to be really familiar with the following 3 keys that ALWAYS appear with everything you do to Windows. Those keys are:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Notifications\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage
I'm not quite sure what the Notifications\Data is for, I assume that it's a way for Windows to track timestamps for things like "LastUpdate" keys elsewhere.
The "UserAssist" and "FeatureUsage" constantly write to the registry anytime you do literally anything on your computer. There are several articles on the internet about these keys--forensic analysts are happy about them because it offers more ways for people to track what a user was doing on their computer and so forth. These keys don't benefit users much, they're mostly just for uploading data to Microsoft.
Does anyone know how to disable these in the registry, cleanly? I'd like to avoid policies if possible, or better yet have both the official registry key and then also the GPO key too. I know that with some tools like RegistryChangesView I can filter out these results so they stop appearing in my registry comparisons, but at the end of the day I'd still rather these features that I don't use be disabled for performance and privacy.
Anyone that uses tools such as RegShot or RegistryChangesView, etcetera, to compare registry settings after you toggle something on/off is likely to be really familiar with the following 3 keys that ALWAYS appear with everything you do to Windows. Those keys are:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Notifications\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage
I'm not quite sure what the Notifications\Data is for, I assume that it's a way for Windows to track timestamps for things like "LastUpdate" keys elsewhere.
The "UserAssist" and "FeatureUsage" constantly write to the registry anytime you do literally anything on your computer. There are several articles on the internet about these keys--forensic analysts are happy about them because it offers more ways for people to track what a user was doing on their computer and so forth. These keys don't benefit users much, they're mostly just for uploading data to Microsoft.
Does anyone know how to disable these in the registry, cleanly? I'd like to avoid policies if possible, or better yet have both the official registry key and then also the GPO key too. I know that with some tools like RegistryChangesView I can filter out these results so they stop appearing in my registry comparisons, but at the end of the day I'd still rather these features that I don't use be disabled for performance and privacy.
Last edited: