Skip to content
Setup FoundrySetup Foundry

Documentation

Disable infection reporting by the Windows Malicious Software Removal Tool

The `DontReportInfectionInformation` value is a `REG_DWORD`.

since 0.9.8.11

Purpose

Show registry keys (1)
  • HKLM\SOFTWARE\Policies\Microsoft\MRT\DontReportInfectionInformation

The DontReportInfectionInformation value is a REG_DWORD. When its value data is 1, it disables the infection-reporting component of the Windows Malicious Software Removal Tool (MSRT). The tool consequently does not report infection information to Microsoft.

This setting affects reporting only. It does not prevent MSRT from running or change its local malware detection and removal functions.

Notes

Security

Without this setting, a report generated after a detection can include the detected malware name, removal result, operating system version and locale, processor architecture, tool version, the channel from which the tool was obtained, an anonymous GUID, and cryptographic hashes derived from the paths and names of removed malware files.

Suppressing these reports reduces the transmission of security-related diagnostic data. It also means that Microsoft does not receive the affected data for measuring malware prevalence. The registry value does not add to or replace the local protection provided by MSRT.

Notes

This is a computer-wide registry value under HKEY_LOCAL_MACHINE. Microsoft documents no corresponding Group Policy setting.

MSRT is not a full antivirus product. It detects and removes specific prevalent malware that is active on the system; this registry value does not alter that functional scope.

Microsoft documentation

Microsoft Support: Deploy Windows Malicious Software Removal Tool in an enterprise environment (KB891716)

Microsoft Learn: Manage connections from Windows operating system components to Microsoft services

Microsoft Support: Remove specific prevalent malware with Windows Malicious Software Removal Tool (KB890830)

See also