How to Disable Windows Telemetry (DiagTrack) using PowerShell

The Diagnostic Tracking Service

Starting with Windows 10 and continuing heavily into Windows 11 and modern Server environments, Microsoft introduced the Connected User Experiences and Telemetry service (originally and still internally known as DiagTrack). This service continuously monitors operating system health, application usage patterns, and crash data, automatically transmitting this diagnostic telemetry back to Microsoft’s servers.

While Microsoft argues this data is anonymized and used strictly to improve the operating system, many enterprise organizations (particularly those in the defense, healthcare, or financial sectors) consider this a massive data privacy violation. They require absolute, verifiable control over every byte of data leaving their network.

Simply turning the “Diagnostic Data” toggle to “Basic” in the Windows Settings GUI is insufficient for strict compliance. To guarantee that telemetry is completely severed, you must disable the underlying DiagTrack service at the kernel level using PowerShell.

Step 1: Stopping the Active Service

Because DiagTrack is a core system service, you must run PowerShell with elevated Administrator privileges.

First, you must aggressively halt the active service. If it is currently midway through transmitting a telemetry payload to Microsoft, this command will immediately sever the network connection.

Stop-Service -Name "DiagTrack" -Force

Step 2: Disabling the Startup Type

Stopping the service only fixes the problem for the current session. If you reboot the computer, the Windows bootloader will automatically start the service again.

You must change the service’s startup configuration from “Automatic” to “Disabled.”

Set-Service -Name "DiagTrack" -StartupType Disabled

Step 3: Disabling the WAP Push Routing Service

DiagTrack is actually supported by a secondary service called dmwappushservice (WAP Push Message Routing Service). This service handles the routing of specific telemetry payloads and device management data.

To ensure a complete block, you must disable this secondary service as well.

Stop-Service -Name "dmwappushservice" -Force
Set-Service -Name "dmwappushservice" -StartupType Disabled

Step 4: The Registry Lockdown (The Nuclear Option)

Sometimes, massive Windows Cumulative Updates will stealthily re-enable the DiagTrack service, assuming its disabled state was an error. To prevent Windows Update from overriding your configuration, you must hardcode the restriction into the Windows Registry.

Execute the following script to force the telemetry level to absolute zero (Security Level, which is normally only available to Windows Enterprise editions):

# Create the DataCollection key if it doesn't exist
$Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection"
If (!(Test-Path $Path)) { New-Item -Path $Path -Force }

# Set the AllowTelemetry value to 0
New-ItemProperty -Path $Path -Name "AllowTelemetry" -Value 0 -PropertyType DWord -Force

With the services permanently disabled and the Group Policy registry key locked to zero, the Windows workstation is completely blocked from transmitting diagnostic telemetry data to Microsoft’s servers, ensuring full compliance with your organization’s strict data privacy policies.