Configure Watson events

since 0.9.8.11

Purpose

Show registry keys (1)

HKLM\Software\Policies\Microsoft\Windows Defender\Reporting\DisableGenericRePorts

This machine-level registry value controls whether Microsoft Defender Antivirus sends Watson events to Microsoft. These are product diagnostic or error-reporting events.

The value is stored as a REG_DWORD. Because the registry value name is phrased negatively, its data has the inverse meaning of the policy state:

0: Watson events are sent. This corresponds to the policy being enabled.
1: Watson events are not sent. This corresponds to the policy being disabled.
If the value is absent, Watson events are also sent.

Notes

Security

Suppressing Watson events prevents the diagnostic-data transmission governed by this setting. However, Microsoft's documentation for the policy does not define the precise contents of these events. The setting alone therefore does not establish whether a particular report contains items such as a memory dump or user content.

This setting is not a general privacy or telemetry control. It does not disable all Windows diagnostic data or other Microsoft Defender Antivirus reporting channels, such as Microsoft MAPS, sample submission, or cloud-delivered protection.

Possible side effects

When Watson events are suppressed, Microsoft does not receive the affected error data for analysis of Microsoft Defender Antivirus problems. The value does not directly disable malware detection or remediation.

Notes

DisableGenericRePorts implements the ADMX-backed, machine-scoped “Configure Watson events” policy. It is distinct from general Windows Error Reporting policies and from settings that control Microsoft Defender Antivirus notifications.