18.10.43.10.1 Ensure 'Configure Watson events' is set to 'Disabled'

Information

This policy setting allows you to configure whether or not Watson events are sent.

The recommended state for this setting is: Disabled.

Rationale:

Watson events are the reports that get sent to Microsoft when a program or service crashes or fails, including the possibility of automatic submission. Preventing this information from being sent can help reduce privacy concerns.

Impact:

Watson events will not be sent to Microsoft automatically when a program or service crashes or fails.

Solution

To establish the recommended configuration, set the following Device Configuration Policy to Disabled:

To access the Device Configuration Policy from the Intune Home page:

Click Devices

Click Configuration profiles

Click Create profile

Select the platform (Windows 10 and later)

Select the profile (Administrative Templates)

Click Create

Enter a Name

Click Next

Configure the following Setting

Path: Computer Configuration\Windows Components\Microsoft Defender Antivirus\Reporting
Setting Name: Configure Watson events
Configuration: Disabled

Select OK

Continue through the Wizard to complete the creation of the profile (profile assignments, applicability etc.)

Note: More than one configuration setting from each of the Configuration profiles (ex: Administrative Templates, Custom etc.) can be added to each Device Configuration Policy.

Default Value:

Enabled. (Watson events will be sent to Microsoft automatically when a program or service crashes or fails.)

See Also

https://workbench.cisecurity.org/benchmarks/14664