4 mins read

Disable Heartbeat Telemetry from Microsoft Windows Malicious Software Removal Tool

If you have the Microsoft Windows Malicious Software Removal Tool installed on your computer, either because it was installed manually or because it shipped with Windows, you may have already noticed that it is sending so-called heartbeat reports after certain analysis.

These reports are not linked to any of the major telemetry services or tasks that you may or may not have disabled on your machine.

In Windows 10, the Heartbeat report is sent to Microsoft even if you have disabled the Customer Experience Program and most other telemetry-related services or tasks, and have made sure to set all related settings to maximum privacy with privacy.

How to turn off heartbeat telemetry

The first thing you should do is check if the installed copy of Windows Malicious Software Removal Toll (MRT) sends heartbeat telemetry reports.

The easiest way to check this is to load the MRT log. Open File Explorer or Windows Explorer on your Windows computer and load the following by pasting it into the address bar and pressing the Enter key: C:Windowsdebugmrt.log

The MRT log opens. Scroll down to the last entries and check if there is heartbeat telemetry there. You can also press F3 to open the search and jump to the first heartbeat entry in the log.

Heartbeat telemetry data is not sent every day according to the record, but only every five or six days. You can verify that in the registry as you will find “Heartbeats will be sent in x days” entries there.

Microsoft notes in its privacy statement that the Malicious Software Removal Tool will send a report to Microsoft with “specific data about detected malware, errors, and other data about your device,” but it doesn’t go into details.

We don’t know what is sent to Microsoft as part of Heartbeat other than the information Microsoft disclosed in its privacy statement.

Option 1: Registration Key

KB891716, Deploying the Microsoft Windows Malicious Software Removal Tool in an Enterprise Environment, includes a registry key to block MRT reports from being sent to Microsoft.

An administrator can choose to disable the infection reporting component of the tool by adding the following registry key value to the computers. If this registry key value is set, the tool will not send infection information to Microsoft.

Subtitle: HKEY_LOCAL_MACHINESOFTWARENPoliciesMicrosoftMRT

Entry name: DontReportInfectionInformation
Type: REG_DWORD
Value data: 1

Note : Since heartbeat is only activated when running automatic scans, it is too early to say whether the key settings disable reporting completely. I will monitor the situation and update the article with my findings later.

  1. Press on the Windows key, type regedit.exe and press the Enter key.
  2. Navigate to the key: HKEY_LOCAL_MACHINESOFTWARENPoliciesMicrosoftMRT
  3. Right click on MRT and select New> Dword (32-bit) Value from the context menu.
  4. Name Dword name DontReportInfectionInformation
  5. Double click on the new word Dword and set its value to 1 .

Option 2: Disable the MRT task or disable heartbeat telemetry

Since MRT runs automatically, it has to be launched somewhere. If you check Task Scheduler for MRT related tasks, finally f

Staging Tool: Microsoft’s tool to enable hidden features in Windows 11

View the telemetry data that Microsoft collects in Windows 10

Microsoft gives third parties access to Windows 10 telemetry data

Microsoft Software Repair Tool for Windows 10

Microsoft resurrects telemetry updates KB2952664 and KB2976978

Microsoft offers a tool to hide or block unwanted updates in Windows 10

Microsoft confirms the depreciation of the Disk Cleanup tool in Windows 10

Windows File Recovery: Microsoft’s new tool to recover deleted files

How to disable or block Microsoft accounts in Windows 10

Microsoft broke “disable web search” in Windows 10 version 1803