The focus of our discussion in this post is how to implement the Disable Watson Events Policy Using Intune. Similar to previous posts in this series, we will utilize Intune’s Configuration Profiles to accomplish this task.
The “Configure Watson events” policy setting is part of the Windows Defender Antivirus settings in the Group Policy Editor. When this policy is enabled, it determines whether Watson events are sent from Windows Defender to IBM Watson. Watson events are data points collected by Windows Defender that are used to help improve threat intelligence and the effectiveness of security measures.
By default, the “Configure Watson events” policy setting is not configured, which means that Watson events are enabled. However, security best practices often recommend disabling this policy to protect sensitive or confidential data and reduce network traffic.
To enforce this policy setting across a group of Windows devices, you can use Group Policy Object (GPO) to configure the “Disable Watson Events” policy setting. Alternatively, you can use other automated management tools, such as Microsoft Intune, to deploy the policy setting as we are doing now.
It’s important to note that disabling Watson events can potentially reduce the effectiveness of Windows Defender’s threat intelligence, as it relies on the data collected through Watson events. However, organizations can still use other threat intelligence solutions to complement the security measures provided by Windows Defender.
- Speed Up Windows Update Detection Frequency Policy Using Intune
- Boot Start Driver Initialization Policy Using Intune
Windows CSP Details Reporting_DisablegenericrePorts
Let’s go through Windows CSP Details for this Policy setting Reporting_DisablegenericrePorts. “Ensure ‘Configure Watson events’ is set to ‘Disabled’ (Automated)” suggests that you should configure a group policy or other automated mechanism to disable the transmission of Watson events from Windows devices to IBM Watson. This recommendation is likely intended to reduce the risk of transmitting sensitive or confidential information to IBM Watson, as well as to reduce network traffic and control costs associated with transmitting data.
CSP URI – ./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Reporting_DisablegenericrePorts
Disable Watson Events Policy Using Intune
To set Disable Watson Events Policy Using Intune, follow the steps stated below:
- Sign in to the Intune Admin Center portal https://intune.microsoft.com/.
- Select Devices > Windows > Configuration profiles > Create a profile.
In Create Profile, Select Windows 10 and later in Platform, and Select Profile Type as Settings catalog. Click on Create button.
| Platform | Profile Type |
|---|---|
| Windows 10 and later | Settings Catalog |
In the Basics tab pane, enter a name for the Policy as Disable Watson Events Policy. You can enter the Description for the Policy if you want, then select Next.
Now in Configuration settings, click Add Settings to browse or search the catalog for the settings you want to configure.
In the Settings Picker windows, search by the keyword Watson, you will see only Administrative Templates\Windows Components\Microsoft Defender Antivirus\ Reporting, and select this.
When you select the option as stated above, you will see only one setting, which is Configure Watson events. After selecting your setting, click the cross mark at the right-hand corner, as shown below.
Now, in the Administrative Templates, disable Configure Watson events, as shown below in the image.
Using Scope tags, you can assign a tag to filter the profile to specific IT groups. One can add scope tags (if required) and click Next to continue. Now in Assignments, in Included Groups, you need to click on Add Groups, choose Select Groups to include one or more groups, and click Next to continue.
In the Review + Create tab, you need to review your settings. After clicking on Create, your changes are saved, and the profile is assigned.
A notification will appear automatically if you see it in the top right-hand corner. One can easily see that the “Disable Watson Events Policy” was created successfully. Also, if you check in the Configuration Profiles list, the Policy is visible there.
Your groups will receive your profile settings when the devices check in with the Intune service. The Policy applies to the device.
Intune Report for Disable Watson Events Policy
From Intune Portal, you can view the Intune settings catalog profile report, which provides an overview of device configuration policies and deployment status.
To monitor the assignment of the policy, you must choose the appropriate policy from the list of Configuration Profiles. You can check the device and user check-in status to see if the policy has been successfully applied. If you wish to view more information, you can click on “View Report” to see additional details.
Intune MDM Event Log
Intune event IDs 813 and 814 can be used to identify if the String or integer policy has been successfully applied to Windows 10 or 11 devices. By examining these event IDs, you can also determine the specific value of the policy that is being applied to those devices. In the case of this particular policy, the value is a string and is associated with event ID 814.
To confirm this, you can check the Event log path – Applications and Services Logs – Microsoft – Windows – Devicemanagement-Enterprise-Diagnostics-Provider – Admin.
MDM PolicyManager: Set policy string, Policy: (Reporting_DisablegenericrePorts), Area: (ADMX_MicrosoftDefenderAntivirus), EnrollmentID requesting merge: (4009A089-4FBA-482B-9D17-9E5A8428CB98), Current User: (Device), String: (<disabled/>), Enrollment Type: (0xD), Scope: (0x0).
You will get some important information like Area and Enrollment ID that will help you detect the registry path after you look in the event viewer to log above. Please refer to the below table for this information:
| Area | Policy | String | Scoped | Event ID |
|---|---|---|---|---|
| ADMX_MicrosoftDefenderAntivirus | Reporting_DisablegenericrePorts | Enabled | Device | 814 |
Information from the above table of Disable Watson Events Policy Using Intune can be used to REGEDIT.exe on a target computer to view the registry settings that store group policy settings. These settings are located in the registry path.
- Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\providers\4009A089-4FBA-482B-9D17-9E5A8428CB98\default\Device\ADMX_MicrosoftDefenderAntivirus
When you navigate to the above path in the Registry Editor, you will find the registry key with the name Reporting_DisablegenericrePorts. Refer to the table and image below.
| Registry Name | Value |
|---|---|
| Reporting_DisablegenericrePorts | Disabled |
Author
Abhinav Rana is working as an SCCM Admin. He loves to help the community by sharing his knowledge. He is a B.Tech graduate in Information Technology.