This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Here's how to Block Windows 10 "Spying"

I have gathered from different sources the sites that Windows 10 use to send informations collected from your computer.

You just need to go into: Web Protection -> Web Filtering -> Policies -> Default content filter action

Under Websites -> Block Theses Websites Import this list :

vortex.data.microsoft.com
vortex-win.data.microsoft.com
telecommand.telemetry.microsoft.com
telecommand.telemetry.microsoft.com.nsatc.net
oca.telemetry.microsoft.com
oca.telemetry.microsoft.com.nsatc.net
sqm.telemetry.microsoft.com
sqm.telemetry.microsoft.com.nsatc.net
watson.telemetry.microsoft.com
watson.telemetry.microsoft.com.nsatc.net
redir.metaservices.microsoft.com
choice.microsoft.com
choice.microsoft.com.nsatc.net
df.telemetry.microsoft.com
reports.wes.df.telemetry.microsoft.com
wes.df.telemetry.microsoft.com
services.wes.df.telemetry.microsoft.com
sqm.df.telemetry.microsoft.com
telemetry.microsoft.com
watson.ppe.telemetry.microsoft.com
telemetry.appex.bing.net
telemetry.urs.microsoft.com
telemetry.appex.bing.net:443
settings-sandbox.data.microsoft.com
vortex-sandbox.data.microsoft.com
survey.watson.microsoft.com
watson.live.com
watson.microsoft.com
statsfe2.ws.microsoft.com
corpext.msitadfs.glbdns2.microsoft.com
compatexchange.cloudapp.net
cs1.wpc.v0cdn.net
a-0001.a-msedge.net
statsfe2.update.microsoft.com.akadns.net
sls.update.microsoft.com.akadns.net
fe2.update.microsoft.com.akadns.net
diagnostics.support.microsoft.com
corp.sts.microsoft.com
statsfe1.ws.microsoft.com
pre.footprintpredict.com
i1.services.social.microsoft.com
i1.services.social.microsoft.com.nsatc.net
feedback.windows.com
feedback.microsoft-hohm.com
feedback.search.microsoft.com
rad.msn.com
preview.msn.com
ad.doubleclick.net
ads.msn.com
ads1.msads.net
ads1.msn.com
a.ads1.msn.com
a.ads2.msn.com
adnexus.net
adnxs.com
aidps.atdmt.com
apps.skype.com
az361816.vo.msecnd.net
az512334.vo.msecnd.net
a.rad.msn.com
a.ads2.msads.net
ac3.msn.com
aka-cdn-ns.adtech.de
b.rad.msn.com
b.ads2.msads.net
b.ads1.msn.com
bs.serving-sys.com
c.msn.com
cdn.atdmt.com
cds26.ams9.msecn.net
c.atdmt.com
db3aqu.atdmt.com
ec.atdmt.com
flex.msn.com
g.msn.com
h1.msn.com
live.rads.msn.com
msntest.serving-sys.com
m.adnxs.com
m.hotmail.com
pricelist.skype.com
rad.live.com
secure.flashtalking.com
static.2mdn.net
s.gateway.messenger.live.com
secure.adnxs.com
sO.2mdn.net
ui.skype.com
www.msftncsi.com
msftncsi.com
view.atdmt.com
msnbot-65-55-108-23.search.msn.com
settings-win.data.microsoft.com
schemas.microsoft.akadns.net 
a-0001.a-msedge.net
a-0002.a-msedge.net
a-0003.a-msedge.net
a-0004.a-msedge.net
a-0005.a-msedge.net
a-0006.a-msedge.net
a-0007.a-msedge.net
a-0008.a-msedge.net
a-0009.a-msedge.net
msedge.net
a-msedge.net
lb1.www.ms.akadns.net
pre.footprintpredict.com
vortex-bn2.metron.live.com.nsatc.net
vortex-cy2.metron.live.com.nsatc.net

Cheers ! [:D]

This thread was automatically locked due to age.

0 Amodin over 9 years ago

You can also import this into the default filter, Web Protection > Web Filtering > Policies
and under the Default content filter action.

Under the Websites tab, you can import this text above to basically a labeled list, so if you need to remove them quickly you can.

Good list, have you seen any impact on windows updates?

OPNSense 64-bit | Intel Xeon 4-core v3 1225 3.20Ghz
16GB Memory | 500GB SSD HDD | ATT Fiber 1GB
(Former Sophos UTM Veteran, Former XG Rookie)
Cancel
Vote Up 0 Vote Down

Cancel
0 pascalgoty over 9 years ago in reply to Amodin

No impact so far.

Outlook app on cellphone, Windows updates, everything's working fine.

I can see some random wave of blocked M$ sites, so it's doing its work..

I have edited my first post to include your method i like it better [:)]

Thanks
Cancel
Vote Up 0 Vote Down

Cancel
0 Lesmona2020 over 9 years ago

thank you!!
Cancel
Vote Up 0 Vote Down

Cancel
0 JeffreyCase over 9 years ago

After reading Windows 10 can still connect to Microsoft's servers, even if users enable privacy features | Windows Central you may want to add ssw.live.com to the list of websites to block.

"Windows 10 will periodically send data to a Microsoft server named ssw.live.com. This server seems to be used for OneDrive and some other Microsoft services. Windows 10 seems to transmit information to the server even when OneDrive is disabled and logins are using a local account that isn't connected to a Microsoft Account. The exact nature of the information being sent isn't clear—it appears to be referencing telemetry settings—and again, it's not clear why any data is being sent at all."
Cancel
Vote Up 0 Vote Down

Cancel
0 twister5800 over 9 years ago

Thnaks for a good post ! [;)]

There are also other things that can't be blocked on the UTM (And the URL list updates constantly with new sites).

For at single PC you can use this software:

Windows 10 Privacy Settings: How to stop Windows 10 from spying on you | BGR

-----

Best regards
Martin

Sophos XGS 2100 @ Home | Sophos v20 Technician
Cancel
Vote Up 0 Vote Down

Cancel
0 Emotive over 9 years ago

I have Windows 10 Pro and disabled everything in GPO, Settings, and task scheduler. I still have watson.telemetry.microsoft.com trying to connect all day. Seems to be the only one in the list trying to phone home after disabling all the spyware in Windows 10.
Cancel
Vote Up 0 Vote Down

Cancel
0 JeffreyCase over 9 years ago in reply to Emotive

Here is some more information. Seems the validity of the information is in question, but might be true.

http://www.disclose.tv/news/a_terrifying_traffic_analysis_of_windows_10/121544
Cancel
Vote Up 0 Vote Down

Cancel
0 vilic over 9 years ago
Nice info, thanks...[:)]

A little piece of advice regarding proposed UTM configuration:

Importing the URL list in a Filter Action creates invisible object that you cannot manipulate anywhere else in the UTM.

Instead, I advise creating a new Website tag labeled with something like "Windows 10 Spying" (scrshot 1).

After that you can use it as an object anywhere in Web Filtering module, for example in Filter Actions (scrshot 2) or in Exceptions (scrshot 3).
Cancel
Vote Up 0 Vote Down

Cancel
0 twister5800 over 9 years ago

Why block the Windows 10 spying feature?? - all other vendors do this, your ISP do this, Google does, Azure,Amazon....it's a never ending story [[;)]]

If you are concerned about your privacy, unplug the Internet Cable :-D

Just doing a different perspective - not aiming for flying fists [[;)]]

-----

Best regards
Martin

Sophos XGS 2100 @ Home | Sophos v20 Technician
Cancel
Vote Up 0 Vote Down

Cancel
0 vilic over 9 years ago in reply to twister5800

Why block the Windows 10 spying feature?? - all other vendors do this, your ISP do this, Google does, Azure,Amazon....it's a never ending story [[;)]]

I personally enjoy this battle, like in David vs Goliath story...[[;)]]
Cancel
Vote Up 0 Vote Down

Cancel