How to Completely Disable ‘Automated Troubleshooting’ (Diagnostics) via Group Policy in Windows 11

Windows 11 includes a robust “Automated Troubleshooting” infrastructure (often referred to as Scripted Diagnostics or the Troubleshooting Control Panel) designed to automatically detect, diagnose, and resolve common OS issues, ranging from network adapter failures to Windows Update corruption. While beneficial for consumer endpoint management, automated background diagnostics are a severe operational liability in strict enterprise, military, or zero-trust deployment environments. The execution of unprompted, Microsoft-authored diagnostic scripts can inadvertently alter specialized network configurations, reset required registry keys, or transmit telemetry data regarding the failure state to external servers. In secure environments, all system configuration changes and diagnostic procedures MUST be explicitly executed by authorized IT personnel using audited tools.

This guide explains how to completely disable ‘Automated Troubleshooting’ (Diagnostics) via Group Policy in Windows 11, enforcing a strict zero-trust model where the OS is cryptographically prevented from executing automated remediation scripts.

Disable Automated Troubleshooting via Group Policy

To enforce a strict block that permanently neutralizes the Scripted Diagnostics infrastructure globally across the OS, we must deploy an administrative template. Note that this requires Windows 11 Pro, Enterprise, or Education editions.

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, strictly follow this exact path:

   Computer Configuration > Administrative Templates > System > Troubleshooting and Diagnostics > Scripted Diagnostics

5. In the right-hand pane, locate the policy named Troubleshooting: Allow users to access and run Troubleshooting Wizards.
6. Double-click the policy to open its configuration window.
7. Select the radio button next to Disabled. (By explicitly disabling this policy, we instruct the Windows kernel and the diagnostic engine (sdiagnhost.exe) to permanently block the execution of all local and online troubleshooting scripts, completely neutralizing the automated remediation feature).
8. Optional but recommended: Locate the policy Troubleshooting: Allow users to access online troubleshooting content on Microsoft servers in the same directory and set it to Disabled to prevent the OS from downloading new diagnostic scripts.
9. Click Apply, then click OK.

Verify the Configuration Lockdown

Group Policy changes affecting core system services require the system to refresh its configuration.

To force the policy update immediately across the OS, open Command Prompt as Administrator and run gpupdate /force. To verify the restriction is active, navigate to the Windows 11 Settings app > System > Troubleshoot > Other troubleshooters. Attempt to click “Run” next to any available troubleshooter (such as the Network Adapter or Windows Update troubleshooter). The system will return an error stating, “An error occurred while troubleshooting,” or “This troubleshooter has been disabled by Group Policy.” The Windows 11 workstation is now cryptographically bound to a strict, non-automated state, ensuring all diagnostics are manually controlled by authorized administrators.