Does Windows 10 leak information about your IP address?

Question

There are various reports of Windows 10 automatically sending out data when the user opens the start menu. Can that information or other information that Windows 10 automatically sends out to the internet be used to link an individual PC to an IP address? Does it communicate IDs or other information with its requests that can be used to link IP addresses to specific PCs?

If I'm at an internet café with my notebook and go online, does Windows 10 send out information that can be used to link my notebook to the IP I'm using when I open the start menu?

If a systemwide proxy is set, does Windows 10 use that proxy to do its automatic requests?

Answer 1

Is Windows 10 Leaking my IP Address?

Almost everything is leaking your IP address.

I'm going to avoid telling you your IP address isn't secret. You seem to already know that. Instead, I'm going to tell you what you're looking for: Yes, Windows 10 leaks information about your IP address ten over a hundred times until Sunday, even if you're behind a proxy!

Can that information or other information that Windows 10 automatically sends out to the internet be used to link an individual PC to an IP address?

Yes, see below

----------


## Web Search Group Policy ##

Registry Keys: 

1. HKEY_LOCAL_MACHINE\SOFTWARE\Polices\Microsoft\Windows\Windows Search\DisableWebSearch
2. HKEY_LOCAL_MACHINE\SOFTWARE\Polices\Microsoft\Windows\Windows Search\ConnectedSearchUseWeb\
3. HKEY_LOCAL_MACHINE\SOFTWARE\Polices\Microsoft\Windows\Windows Search\ConnectedSearchUseWebOverMeteredConnections

-----

## Cortana Group Policy ##

Registry keys:

1. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Experience\AllowCortana\value
2. HKEY_LOCAL_MACHINE\SOFTWARE\Polices\Microsoft\Windows\Windows Search\Allow Cortana

-----------

## OneDrive Service ##

Windows Services:

1. Sync Host (OneSyncSvc)
2. Sync Host_Session1 (OneSyncScv_Session1)

------------


## OneDrive Group Policy ##

Registry key: 

- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\OneDrive\DisableFileSyncNGSC

----------

## Remote Registry Service ##

Service: (RemoteRegistry)

-------------------

## Built-In Bing Search ##

Contacts Bing for things such as web searching. If a patch is made that circumvents the above fixing, you'll need to block Bing.

----------------

## Office 15 (2015) Telemetry Group Policy ##

Registry keys:

1. HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\15.0\osm\enablelogging
2. HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\15.0\osm\enablefileobfuscation
3. HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\15.0\osm\enableupload

-----------

## Office 15 (2013) Telemetry Scheduled Tasks ##

Tasks: 

1. Microsoft\Office\OfficeTelemetryAgentFallBack
2. Microsoft\Office\OfficeTelemetryAgentLogOn

---------

## Office 16 (2016) Telemetry Group Policy ##

Registry keys:

1. HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\osm\enablelogging
2. HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\osm\enablefileobfuscation
3. HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\osm\enableupload


--------


## Office 16 (2016) Telemetry Scheduled Tasks ##

Tasks: 

1. Microsoft\Office\OfficeTelemetryAgentFallBack2016
2. Microsoft\Office\OfficeTelemetryAgentLogOn2016

---------


## Telemetry Services ##

Services:

1. Connected User Experience and Telemetry (DiagTrack)
2. dmwappushscv (dmwappushservice)

---------

## Telemetry Group Policy ##

- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection\AllowTelemetry


-------

## Consumer Experience Improvement Program Group Policy ##

- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SQMClient\Windows\CEIPEnable


---------

## Customer Experience Improvement Program Scheduled Tasks ##

Tasks:

1. Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser
2. Microsoft\Windows\Application Experience\ProgramDataUpdater
3. Microsoft\Windows\Autochk\Proxy
4. Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector
5. Microsoft\Windows\Customer Experience Improvement Program\Consolidator

----------


## Application Impact Telemetry Group Policy ##

- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AppCompat\AITEnable

-----

## Steps Recorder Group Policy ##

- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AppCompat\DisableUAR

------

## WiFi Sense (HotSpot Sharing) Group Policy ##

Registry keys:

1. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\WiFi\AllowWiFiHotSpotReporting\value
2. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\WiFi\AllowAutoConnectToWiFiSenseHotSpots\value

-------

## P2P Windows Update outside local network ##

Registry keys:

1. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode
2. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\SystemSettingsDownloadMode

-----

TLDR: Registry Keys, Tasks, Hosts, and Services

I could go on and on. But download Spybot Anti-Beacon, and it will block most of these, and more. You don't want to block Windows Update because software updates help maintain the security and integrity of your machine.

Note that blocking all of these telemetry options isn't going to prevent information gathering, so don't trust in them. This program is simply there to help you opt out of Windows 10 telemetry stuff.

They can still find out what accounts were connected to what IP address at each time, even if the proxy is system-wide. If you wanted to hide your information from Microsoft, you would literally have to blacklist all connections, and whitelist only the ones you want.

---

Communicating Other IDs

Does it communicate IDs or other information with its requests that can be used to link IP addresses to specific PCs?

If I'm at an internet café with my notebook and go online, does Windows 10 send out information that can be used to link my notebook to the IP I'm using when I open the start menu?

If a systemwide proxy is set, does Windows 10 use that proxy to do its automatic requests?

Yes. Yes. Yes, and yes. Look at Application User ID Tracking:

Registry key:

• HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion AdvertisingInfo\Enabled

---

Answers to your main questions

Now that we've demonstrated a small fraction of IP-leaking processes behind Windows 10, let's talk about what can be done with this data.

If I'm at an internet café with my notebook and go online, does Windows 10 send out information that can be used to link my notebook to the IP I'm using when I open the start menu?

Yes, application advertising IDs, connecting to Windows Update with your Windows 10 account, etc. In fact, connecting to any of these services, of which there are many, during your Internet Cafe visit, can easily tell Microsoft where you've been.

It doesn't matter if you were behind a proxy or 40: all connections to Microsoft services are recorded. Every single IP address for every single instance of your advertising ID / windows key / windows account, is recorded.

Answer 2

Since your IP address is essentially the internet equivalent of your postal address and since it is required for routing your request (and especially the response) over the internet, any website that you connect to will have access to it. Any email server you connect to will have access to it, etc. Every time you connect to another computer, that computer can see your IP address.

The Windows 10 Start Menu has a variety of features designed to make it more useful. This includes a search functionality when you start typing which by default will send your typed text to Bing to perform a web search. The Windows 10 Start Menu also has live tiles, which will periodically connect to their service provider(s) to fetch updates.

Answer 3

This is a question you should answer for yourself. The most accurate way to know what you're sending is to download and install Wireshark, and set it to capture from your WiFi network interface. Connect to the cafe's wireless hotspot, and observe the start menu for a minute or so. Terminate the capture.

You'll see literally hundreds or thousands of IP packets representing dozens of TCP sockets and other communications that your computer is initiating. You'll likely be dismayed to see your machine advertising its own name, and attempting to communicate to other Windows machines by name on your home network as it searches for things like printers. You'll also find network traffic to Microsoft requesting updates for news items, weather reports, advertisements, software updates, etc. And there are all manner of traffic to various hosts and ports, including twitter, facebook, etc., all depending on the software packages you've installed. Every Windows 10 machine is different; but they're all sharing way too much information.

Any packets that go out over the network can certainly be sniffed by the cafe's access point or ISP. This means if one of your live tiles doesn't use TLS 1.2, it's possible the cafe could see the cookies in your requests, cookies that may contain more specific ID information.

You can mitigate a little bit of this easily: turn off live tiles that you don't need to see, and shut off services you're not interested in, such as twitter. You can also block much of this traffic with Windows Firewall, but be aware that some features will be impacted or even disabled. Make sure that the services you do intend to connect to, like IMAP, are encrypted. In general, though, be prepared for bitter disappointment at all the private information you scatter about your neighborhood as you connect to public access points.

Answer 4

The start menu only fires web requests if either Cortana or the search bar is enabled. If both are turned off, you're not leaking your IP to Microsoft.

Answer 5

This is something a LOT of people asked a LOT of times, and honestly the information is outlined pretty easily in your Terms of Service and how the internet works as a WHOLE.

However more specifically in the start menu there is the smart panels, which have web based content, which will send your IP address out to the web servers(same with the search pane). This is also sent to their advertising group if you opted in to receive focused ads.

This IP address however is just that. Microsoft leeks no identity information from your computer more so than a cookie or a session identifier. It does not send out your computer unique identifier. However it does send out something that let's it know it is the same user for tailoring purposes. This user can use multiple computers with windows 10, and as long as they use a Microsoft account, then a profile for them is beings built. If they use a local account only, that information stays on that computer alone and stays only on that computer.

This is no more dangerous, insidious, or less secure than you using your web browser. Their TOS outline exactly what the data is for and where it goes and none of it raises a red flag unless you are the type of person who doesn't want anything to be leaked(in which case why are you even using the internet?).

Answer 6

To be more simple, lets assume, you have set internet time sync on your windows. By default it contacts time.windows.com to fetch the time. When a client connects to a server, the IP is disclosed, because IP is the metadata of the established connection.

Let that be any kind of connection on any OS irrespective of Windows 10, the answer is so so so simple.

When a client connects with a server, the IP is disclosed, unless you are in a VPN or ProxyServer.

If you want to hide your IP address while opening a website, to stay Anonymous, use any VPN services. There are tons of free VPN services available out there. My personal favourite is ToR and Hotspot Shield.

You cannot simply prevent your windows to hide your IP address unless your connection is in a relay.

And yea, you are correct. If a system wide proxy is set, it upto some extent for known schema and ports, will hide the IP address.

Answer 7

Windows "leaks" your IP Address to Microsoft since there's Internet Support.

The Network Connectivity Status requests a file from Microsofts servers to check if your connection works.

This can not be connected with your computer, tho.

If I'm at an internet café with my notebook and go online, does Windows 10 send out information that can be used to link my notebook to the IP I'm using when I open the start menu?

If you connected a Microsoft Account to your Notebook, Microsoft will know that your account used the Internet Connection of the Café.

If a systemwide proxy is set, does Windows 10 use that proxy to do its automatic requests?

It'll use the proxy for almost all requests (I'm not excactly sure if there are features that bypass the Proxy, by design there shouldn't), however that's limited depending of the protocol. DNS Requests for example aren't proxied, nor is any third party application forced to use the proxy.