How to Completely Disable ‘Diagnostic Data’ via Group Policy in Windows 11

Windows 11 features a deeply integrated, kernel-level telemetry engine that continuously harvests system diagnostic data, usage statistics, and error logs, subsequently transmitting this raw data back to Microsoft’s analytical servers. While this telemetry assists Microsoft in identifying bugs and improving software stability, it represents a colossal data exfiltration vulnerability in high-security, legal, or zero-trust enterprise environments. The “Diagnostic Data” pipeline can inadvertently capture memory dumps, partial document fragments, installed software inventories, and precise hardware configurations. In strict compliance environments (such as DoD, HIPAA, or GDPR-compliant networks), permitting the operating system to arbitrarily exfiltrate system data to external corporate servers is entirely unacceptable.

This guide explains how to completely disable ‘Diagnostic Data’ telemetry via Group Policy in Windows 11, enforcing a strict zero-trust model where all unauthorized OS-level data exfiltration is cryptographically blocked.

Disable Diagnostic Data via Group Policy

To enforce a strict block that disables the telemetry engine globally across the OS, we must deploy an administrative template. Note that this requires Windows 11 Pro, Enterprise, or Education editions.

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, strictly follow this exact path:

   Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds

5. In the right-hand pane, locate the policy named Allow Diagnostic Data (or on older builds, Allow Telemetry).
6. Double-click the policy to open its configuration window.
7. Select the radio button next to Enabled. (Note: We must enable the policy to manually enforce the restriction level).
8. Under the “Options” section, click the drop-down menu and select Diagnostic data off (or 0 – Security on older enterprise builds). (By explicitly enforcing a zero-level data policy, we instruct the Windows kernel to permanently sever the connection to Microsoft’s telemetry servers, blocking all non-essential data transmissions).
9. Click Apply, then click OK.

Verify the Configuration Lockdown

Group Policy changes affecting the kernel’s telemetry services require the system to refresh its configuration.

To force the policy update immediately across the OS, open Command Prompt as Administrator and run gpupdate /force. To verify the restriction is active, open the main Settings app and navigate to Privacy & security > Diagnostics & feedback. The option to configure diagnostic data will be greyed out, and a banner will state, “Some of these settings are hidden or managed by your organization.” The Windows 11 kernel is now cryptographically bound to operate as a sterile, non-reporting environment, completely mitigating the risk of system-level data exfiltration.