Windows 10 User Tracking

[Hellbovine]

I'm pretty sure I'll eventually figure this out on my own as I make my way through the pile of registry tweaks I'm testing, but in an effort to help speed up that process I'm hoping someone knows the answer to this one so I don't have to wait, since it's quite the annoyance right now.

Anyone that uses tools such as RegShot or RegistryChangesView, etcetera, to compare registry settings after you toggle something on/off is likely to be really familiar with the following 3 keys that ALWAYS appear with everything you do to Windows. Those keys are:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Notifications\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage

I'm not quite sure what the Notifications\Data is for, I assume that it's a way for Windows to track timestamps for things like "LastUpdate" keys elsewhere.

The "UserAssist" and "FeatureUsage" constantly write to the registry anytime you do literally anything on your computer. There are several articles on the internet about these keys--forensic analysts are happy about them because it offers more ways for people to track what a user was doing on their computer and so forth. These keys don't benefit users much, they're mostly just for uploading data to Microsoft.

Does anyone know how to disable these in the registry, cleanly? I'd like to avoid policies if possible, or better yet have both the official registry key and then also the GPO key too. I know that with some tools like RegistryChangesView I can filter out these results so they stop appearing in my registry comparisons, but at the end of the day I'd still rather these features that I don't use be disabled for performance and privacy.

 

[garlin]

Windows tracks your recent desktop activity, apps or files usage, so it can service Recent Files or desktop search suggestions.

This is baked in, whether you've disabled the user facing view or not. If you changed NTLite's Privacy/Allow Telemetry -> Security/Disabled, then no diagnostic data is forwarded.

Notifications\Data is updated when you make changes to WNF (Windows Notification Facility) or after processing notification events. Not all events are directed to the user, apps may use the API to alert other apps.

Explorer\UserAssist is the most recent apps/file list.
Explorer\FeatureUsage is your recent desktop actions.

I don't understand bickering about "performance". This data logging has minimal impact, what you're confused with is the background data aggregation (reporting) which kills performance. Unless you're spamming rapid-fire actions, this ain't it.

 

[garlin]

NTFS tweak?

Sorry, he's talking reg keys not disk files.

 

[Hellbovine]

Re: "performance"

Sure, I realize the performance cost is miniscule for some features, but when there's literally hundreds of these kinds of features it adds up. This is the kind of stuff responsible for why Windows resource usage is out of control. A little feature here, another there, 500 features later and you've gained 20,000 handles.

So far in my tweaking I've only done simple registry changes, all of which are easily reversible, without deleting any Windows files, and I've cut the threads down by 37%, handles down by 22%, and memory usage by 300 MB. It's all thanks to disabling all these loggers and features that in many cases are out of sight and out of mind of most users.

Also if you're a gamer or a power user in the audio/video fields then you have to realize too that all these features come with other, much more hidden performance costs that you cannot always put a value on. Things like network latency (game pings), hitching/stuttering, framerates/frametimes, and DPC latency are all affected by stuff that's running in the background and accessing the cpu/disk/ram, and it all adds up. More stuff running in the background is also more chances for bugs and compatibility issues to appear too.

 

[Clanger]

I'm pretty sure I'll eventually figure this out on my own as I make my way through the pile of registry tweaks I'm testing

care to share what you got so far?
i know how far i have gotten with 1809(as per my screen grabs), processes and threads are similar to my heavily tweaked w7 but handles are still double and that plays on my mind, maybe i can go further. there are a few things broken when i go that low, i always get a systemsettings.exe memory error

 

[Hellbovine]

Re: Clanger

Yeah I hope to be able to post my version 1.0 of my tweaks by the end of this month, if all goes well. I'm in the final testing phases now for this version as we speak, I keep adding my reg files into my NTLite and reinstalling, then manually verifying every single new tweak to make sure they not only "stick", but that they are working correctly too. I also only work in a non-virtual environment because I've come to find out that this matters sometimes.

I'm going to make 2 guides, a beginner's guide to NTLite, and then also this sort of "preset" if you will, with my reg keys, like Txmmy did (https://www.ntlite.com/community/index.php?threads/gameros-windows-10-11-diy-preset.2350/). I'll get them posted up for feedback as soon as I'm done with this final testing. I'm very, very big on testing/polish, I even went so far as to spellcheck my reg files to make sure the comments on each key were good, lol.

 

[Hellbovine]

If you changed NTLite's Privacy/Allow Telemetry -> Security/Disabled, then no diagnostic data is forwarded.

I meant to actually make a new thread regarding this kind of stuff last week, but I got distracted with my mobo dying

Instead of replying about that here, I'll make that new thread in a min, I think it is something that will interest a fair amount of people. I'll title the thread "NTLite Registry Changes Notification" and put it into the Questions and Reports forum.