How to Inspect Telemetry Events in Windows 11 Using Diagnostic Data Viewer

Windows 11 continuously monitors system stability, application crashes, hardware driver faults, and security vulnerabilities to maintain operating system reliability. To help diagnose defects and dispatch corrective security patches, Windows transmits diagnostic telemetry events to Microsoft based on your configured diagnostic data collection level.

For system administrators, security auditors, and privacy-conscious users, Microsoft provides the Diagnostic Data Viewer. This tool provides complete transparency into the raw JSON diagnostic payloads collected by the Windows diagnostic engine, allowing you to inspect exactly what information your PC transmits to Microsoft.

Enabling Diagnostic Data Viewing in Windows 11 Settings

Before the Diagnostic Data Viewer application can read real-time diagnostic payloads, you must enable local diagnostic caching within Windows Settings:

1. Press Win + I to open the Settings app.
2. Select Privacy & security from the left navigation panel.
3. Under the Windows permissions section, click Diagnostics & feedback.
4. Click the expander arrow next to Diagnostic data to confirm your telemetry tier (Required diagnostic data or Optional diagnostic data).
5. Scroll down to the section labelled View diagnostic data.
6. Toggle the switch to On to enable local caching of diagnostic events.
7. Click the Open Diagnostic Data Viewer button. If the app is not currently installed, Windows will redirect you to the Microsoft Store to download the official Diagnostic Data Viewer package for free.

When enabled, Windows allocates up to 1 GB of local disk space to store recent diagnostic events for review.

Navigating and Filtering Telemetry Events

Once Diagnostic Data Viewer launches, the main interface presents a chronological feed of collected events in the left pane and detailed structured data in the right pane:

1. Review the left-hand column to view incoming diagnostic records, classified by event provider and timestamp.
2. Click any event in the list to inspect its contents. The right pane displays the complete structured payload in readable JSON format.
3. Click the Filter icon (funnel) at the top of the event list to narrow your inspection by category:
   • Device Connectivity and Configuration: Hardware attributes, network adapters, and connected peripherals.
   • Product and Service Performance: Application crash dumps, latency metrics, and background service execution times.
   • Software Setup and Inventory: Installed packages, security updates, and driver versions.
   • Browsing History: Diagnostic events relating to system navigation and Microsoft Edge performance (when optional data is consented).

Searching for Specific Error Codes and Crash Dumps

When troubleshooting persistent application crashes or hardware driver instability, the Diagnostic Data Viewer serves as an effective diagnostic companion:

1. Click the Search box located in the top-right corner of the window.
2. Enter an application executable name (such as explorer.exe or dwm.exe) or a specific Windows error code (such as 0xC0000005).
3. Press Enter to isolate events containing matching parameters.
4. Inspect the payload section in the JSON viewer to review stack traces, faulting modules, and hardware registers recorded during the failure.

Exporting Diagnostic Logs for Auditing

Security compliance policies and corporate change management often require offline archival of telemetry records:

1. Click the Export data button in the top navigation bar.
2. Select your preferred storage location and enter a file name.
3. Click Save. Diagnostic Data Viewer exports all cached events into a structured .csv file, suitable for ingestion into SIEM tools or spreadsheet analysis.

Disabling Diagnostic Caching and Clearing Local Storage

If you no longer need to audit diagnostic events and wish to reclaim local storage space:

1. Return to Settings > Privacy & security > Diagnostics & feedback.
2. Under View diagnostic data, toggle the switch to Off.
3. Scroll down to the Delete diagnostic data section and click the Delete button to remove all locally cached diagnostic records from your machine.