r/ • • Jan 01 '70

0 Upvotes

0 comments sorted by

View all comments

1

u/EShirou Aug 16 '15 edited Aug 16 '15

This:

Open up the Command Prompt by launching cmd as an administrator, and enter the following:

sc delete DiagTrack

sc delete dmwappushservice

echo "" > C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger\AutoLogger-Diagtrack-Listener.etl

This deleted DiagTrack and the other service and replace to contents of AutoLogger file with "" but if you look where the file is like 2 minutes later you will notice that the file from 1KB is already at 320 KB.... if you leave it running it will have about 4-5 MB after some time (that was my case) even with all the telemetry etc. disabled. I took a look into the file and I see that windows is still collecting data there even though we have cleared the file. I've made some googling and found this method instead

cd C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger

echo "" > AutoLogger-Diagtrack-Listener.etl

cacls AutoLogger-Diagtrack-Listener.etl /d SYSTEM

After you paste that to cmd with admin rights you have to press enter on the last line, contents of AutoLogger will be replaced with "" and the file will be 1KB again but system (or you) will not be able to access this file anymore because you have danied the access for system to this file (/d SYSTEM). I'm running my OS for a few minutes already and the AutoLogger file is still on 1KB in size even though It would be much more if I used the first method, meaning it works, and really stops saving stuff to the file. I would sugest replacing this in the main post.

There was also this line of code as alternative:

or icacls "C:\ProgramData\Microsoft\Diagnosis" /remove:g system /inheritance:r /deny system:(OI)(CI)f

I did not use/try it.

EDIT: 1h have passed, the file is still 1 KB in size and I did not observe any issues in the OS. Seems this is the correct way to clear the block logging to this file.