18.9.76.9.1 Ensure 'Configure Watson events' is set to 'Disabled'

Information

This policy setting allows you to configure whether or not Watson events are sent.

The recommended state for this setting is: 'Disabled'.

Rationale:
Watson events are the reports that get sent to Microsoft when a program or service crashes or fails, including the possibility of automatic submission. Preventing this information from being sent can help reduce privacy concerns.

Solution

To establish the recommended configuration via GP, set the following UI path to 'Disabled':


Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Defender Antivirus\Reporting\Configure Watson events


Note: This Group Policy path may not exist by default. It is provided by the Group Policy template 'WindowsDefender.admx/adml' that is included with the Microsoft Windows 8.1 & Server 2012 R2 Administrative Templates (or newer).

Impact:
Watson events will not be sent to Microsoft automatically when a program or service crashes or fails.

See Also

https://workbench.cisecurity.org/files/1949

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6

Plugin: Windows

Control ID: ec0dac6e84feee55df4996d4d517c003128710c336cc063824f8623d9a04681e