Skip to content

Windows 11 privacy and security policies: Activity History, Defender, and WER

On this page

Short answer

Section titled “Short answer”

The semantics of the listed policies are confirmed by Microsoft documentation, and individual readers are confirmed by system code or tracing. The policies govern data collection, diagnostics and background app activity; they do not improve performance.

What was checked

Section titled “What was checked”

We checked policy paths and types, their precedence over user settings, and which components read the values.

Scope of research

Section titled “Scope of research”

Windows 11 25H2 build 26200.9168, machine and user policies. The actual state of a feature depends on Group Policy, MDM and the Windows edition.

Methodology

Section titled “Methodology”

Verifying semantics against the official Policy CSP/ADMX documentation, analyzing readers in system code, and observing policy reads in a trace.

Canonical policies

Section titled “Canonical policies”
Path Value Type Default/policy What it controls
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet SpynetReporting REG_DWORD policy not configured Defender cloud reporting
same path SubmitSamplesConsent REG_DWORD policy not configured sample submission
HKLM\SOFTWARE\Policies\Microsoft\Windows\System EnableActivityFeed REG_DWORD policy not configured Activity Feed
same path PublishUserActivities REG_DWORD policy not configured publishing activity data
same path UploadUserActivities REG_DWORD policy not configured uploading activity data
HKCU\Software\Microsoft\Windows\CurrentVersion\ActivityDataModel ActivityHistory REG_DWORD 1 user Activity History
HKLM\SYSTEM\CurrentControlSet\Control\Remote Assistance fAllowToGetHelp REG_DWORD 1 Remote Assistance invitations
HKCU\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo Enabled REG_DWORD 1 Advertising ID
HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy LetAppsRunInBackground REG_DWORD policy not configured background app access policy
HKCU\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications GlobalUserDisabled REG_DWORD 0 user background access
HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting Disabled REG_DWORD 0 WER local policy
HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting Disabled REG_DWORD policy not configured WER group policy

Activity History and Advertising ID

Section titled “Activity History and Advertising ID”

For Activity History there are computer policies and user settings. EnableActivityFeed, PublishUserActivities and UploadUserActivities allow disabling the corresponding stages of data processing. ActivityHistory in HKCU controls activity data collection for the current user.

AdvertisingInfo\Enabled allows disabling the advertising identifier of the current user. The rest of Windows telemetry and the identifiers required by other services continue to work.

Choose these settings according to your privacy requirements: they reduce certain types of data collection or publication. They do not improve CPU work scheduling.

Section titled “Related BoosterX settings”

This group includes the “Activity Feed” settings, network telemetry opt-out, PowerShell telemetry opt-out, telemetry services, location access, sensors, inventory collection and the family of app access restrictions. They should be evaluated by the specific type of data and the scope of the app, not as a general switch for all Windows telemetry.

Practical page on background app access: “How UWP apps work in the background”.

Results

Section titled “Results”

The policies cover Activity History, the advertising identifier, Defender cloud lookup, WER, Remote Assistance and background app activity. The semantics of the values are confirmed by Microsoft documentation; for some parameters no read was observed in a short trace, so the state of the feature must be checked separately.

Defender cloud lookup and WER

Section titled “Defender cloud lookup and WER”

SpynetReporting accepts 0 to disable MAPS, 1 for basic and 2 for advanced participation. SubmitSamplesConsent accepts 0 to request consent, 1 for automatic submission of safe samples and 2 to prohibit submission. On the studied system without enforced policies, 2 and 1 were used respectively. If the policy is not set, the behavior is determined by the default Defender configuration; on another system the values may differ.

Windows Error Reporting\Disabled=1 disables the collection and submission of WER reports. The value in the policies section takes precedence over the local configuration. An exception, app termination and system event logging are still possible.

Disabling cloud reports reduces the exchange of diagnostic data, but limits cloud lookup and diagnostics. Here you have to choose between privacy and protection capabilities, rather than expect a performance gain.

Remote Assistance and Background Apps

Section titled “Remote Assistance and Background Apps”

fAllowToGetHelp=0 prohibits Remote Assistance invitations. For LetAppsRunInBackground, the value 0 leaves the choice to the user, 1 forcibly allows background activity, 2 prohibits it. GlobalUserDisabled=1 sets a general user prohibition. The computer policy takes precedence and applies primarily to packaged apps. Regular Win32 services, scheduled tasks and processes are not stopped by this switch.

What is confirmed

Section titled “What is confirmed”
  • Policy paths, types and values in the studied build.
  • The semantics of the values and the precedence of the computer policy over the user setting.
  • Individual readers in system code or a trace, including the Defender policies section.
  • The scope of LetAppsRunInBackground: primarily packaged apps, not Win32 services and scheduled tasks.

What is not confirmed

Section titled “What is not confirmed”
  • The effect of the policies on FPS, latency or overall performance.
  • The read of every parameter in a short boot trace.
  • The actual state of a feature without a separate check on a specific system.

Practical conclusion

Section titled “Practical conclusion”

Choose policies according to your data and feature requirements. First determine which type of collection or background activity needs to be limited, and make sure the apps and diagnostics you need continue to work.

Restoring the state

Section titled “Restoring the state”

Remove the enforced policy values or return them via Group Policy/MDM. After updating the policies, check the state of the affected features.

Limitations and sources

Section titled “Limitations and sources”

Policies can be applied via Group Policy, MDM and user settings. “Policy not configured” means that no enforced value is set; the actual state of the feature must be determined separately. Opening the interface does not always trigger a policy read. In the trace, Defender requested its own policies section. For a number of the other parameters, the confirmation is the official Policy CSP/ADMX documentation: the read code triggers on other events or resides in components that were not studied.

For how to reproduce the dynamic part of the observations, see How to check it yourself.

The research and the tools used belong to the BoosterX developer, so the developer has a direct interest in the results. The methodology and the limits of applicability are described above, and the conclusions can be verified against open data and the listed public sources.

Public sources checked: 2026-09-02.

Change history

Section titled “Change history”
  • 2026-09-20: added a conflict-of-interest disclaimer and a link to independent verification of dynamic observations in the methodology.
  • 2026-09-02: first publication; added the limits of applicability of the policies and a separation of confirmed readers from documented semantics.