Flamingo Raises $4.5M Seed Round · Led by Vertex Ventures, bringing total funding to $6.7M to build the open, AI-native layer for IT and security.
"Fae" Grace Meadows
Windows telemetry has three settings, and only Enterprise, Education and Server can turn it fully off. Here is what each level sends, why the policy's Disabled option does nothing, what update reporting depends on it, and how to set it correctly across a fleet with Group Policy or Intune.
Every Windows device in a fleet reports diagnostic data to Microsoft, and the setting that controls it has four values, three names and one trap. Pick the wrong one and a device keeps sending data while the console says otherwise, or stops sending data that your update reports depend on. This guide walks through Windows telemetry from a business admin's side: what gets sent, which policy values each edition honors, what switching it off costs, and the controls that hold up across a fleet.
Windows diagnostic data is the stream of events, crash reports and logs a device sends back to Microsoft. Microsoft's own term is diagnostic data; everyone else calls it telemetry. Since Windows 11 and Windows Server 2022 there are three settings, down from four.
Diagnostic data off sends no Windows diagnostic data at all. It used to be called Security, and Microsoft's configuration guide limits it to Windows Server, Enterprise and Education editions.
Required sends the minimum Microsoft says it needs to keep a device secure and up to date: hardware and driver details, crash counts, app compatibility data, and whether the machine meets the bar for the next feature update. It used to be called Basic, and it is the default on Windows 10 1903 and later.
Optional adds app activity, browsing data from Microsoft browsers, more device health logs and fuller crash dumps. It used to be called Full. Microsoft warns that those dumps can contain fragments of whatever the user had open when the crash happened, which is the part a privacy review should care about.
The old Enhanced level only exists on Windows 10 1809 and earlier, Server 2016 and Server 2019. A device set to Enhanced that upgrades to Windows 11 is treated as Required.
The control lives in Group Policy at Computer Configuration, Administrative Templates, Windows Components, Data Collection and Preview Builds. On Windows 11 the policy is named Allow Diagnostic Data; on Windows 10 1809 and earlier, and on Server 2019, it is still Allow Telemetry. Either way it writes the same registry value, AllowTelemetry under HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection.
The values are 0 for Diagnostic data off, 1 for Required, 2 for Enhanced and 3 for Optional. Two details catch people. First, 0 only works on Enterprise, Education and Server. On Windows 10 or 11 Pro, a 0 is treated as 1, so the device keeps sending Required data. Second, the policy has to be Enabled with a value chosen. Setting the policy itself to Disabled does not turn telemetry off; it is the same as Not Configured, and the device falls back to its default.
That second point is a mistake repeated across "disable telemetry" guides. The r/WindowsLTSC thread below asks the question directly, and the top reply confirms that Enabled with 0 is the setting that works, while Disabled leaves telemetry on.
One more rule from Microsoft: when both a computer policy and a user policy are set, the more restrictive one wins. And on Windows 10 1803 and later a user can still lower the level in Settings unless you also set Configure diagnostic data opt-in settings user interface. If you are new to where these settings live, the Group Policy Editor guide covers testing a policy on one machine before it goes into a GPO.
The component that collects and uploads diagnostic events is the Connected User Experiences and Telemetry service. Its service name is DiagTrack. Crash reports travel separately, through Windows Error Reporting.
Stopping DiagTrack, deleting its scheduled tasks, or blocking Microsoft's endpoints in a hosts file is where third-party "privacy" scripts tend to start. On a managed fleet it creates a mess you then have to explain. Microsoft's endpoint list includes settings-win.data.microsoft.com, which it says not to block, because it is how diagnostic settings are configured remotely and how devices enroll in the processor configuration covered below. The same scripts often disable things you need, which is why our debloat guide keeps to built-in tools and documented switches.
The policy is the supported lever. If a device should send less, set the level; don't fight the service that implements it.
Diagnostic data is the feed for several Microsoft services that IT teams pay for. Windows Update for Business reports needs devices at Required or higher, and Microsoft's prerequisites page recommends Optional on Windows 11. Device names only appear in those reports if you also set Allow device name to be sent in Windows diagnostic data. Windows Autopatch and the Windows updates reports in Intune rely on the same data.
Update quality depends on it too. Microsoft's guidance states that if your organization relies on Windows Update, the minimum recommended setting is Required, because with diagnostic data off no information about update failures is sent. A reply in the r/Windows11 thread below puts the practical version plainly: the commenter keeps telemetry on so Microsoft knows their hardware and applies an update safeguard hold if a known issue affects it.
So for a business fleet the useful question is rarely "on or off". It is "Required or Optional", and "do we want the crash dumps and logs that come with Optional".
Windows 11 and Server 2022 added two policies that trim what Optional sends. Limit Dump Collection restricts Windows Error Reporting to kernel mini dumps and user mode triage dumps, which cuts the chance of user content riding along in a crash dump. Limit Diagnostic Log Collection stops diagnostic logs from being sent at all. Both sit in the same Data Collection and Preview Builds folder, and both have MDM equivalents.
These are the settings a privacy review usually wants: Optional for the data that helps update quality, minus the parts most likely to contain something sensitive.
Every IT team has seen the result of the other approach.
For a European business, the legal question is who controls the diagnostic data. Microsoft's answer is the Windows diagnostic data processor configuration, which makes your organization the controller under GDPR and Microsoft the processor.
How you get there depends on your Microsoft Entra tenant's billing address. Since the January 2023 preview cumulative update, devices joined to a tenant billed in the EU or EFTA are enrolled automatically, and their data is processed in Europe. Tenants billed elsewhere enroll by signing up for Windows Update for Business reports, Windows Autopatch or Intune's Windows updates reports.
Three conditions apply. Devices must be Entra joined or hybrid joined, running Enterprise, Pro or Education, with diagnostic data at Required or higher. Microsoft also notes that data collected before enrollment is deleted when the configuration is enabled. And once you are the controller, responding to users' data subject requests is your job.
Before arguing about telemetry in a meeting, look at it. The Diagnostic Data Viewer is a free Microsoft Store app that shows every event a device sends. Turn on data viewing under Settings, Privacy and security, Diagnostics and feedback, then open the viewer and use the device as normal for a day.
Microsoft warns that data viewing can use up to 1 GB of disk by default, and recommends turning it off when you are done, which also clears the stored history. On Windows Server, where the Store is missing, there is a PowerShell version. Ten minutes in the viewer settles more debates than any blog post, including this one.
For a domain, set Allow Diagnostic Data in a GPO linked to the computers, choose the level, and add Configure diagnostic data opt-in settings user interface so users cannot change it. For Intune, the same settings are in the settings catalog and the Policy CSP: System/AllowTelemetry, System/LimitDumpCollection, System/LimitDiagnosticLogCollection and System/AllowDeviceNameInDiagnosticData. The MDM comparison covers which other tools can push the same CSPs.
The walkthrough below shows the Intune side end to end, including where the device name and diagnostic level settings live.
Then check the result rather than trusting the policy. The AllowTelemetry value under the DataCollection policy key and the DiagTrack service state tell you what a device is doing. If you run OpenFrame, reading both is one script run across a client's devices with the output collected in one place, which turns "is every machine on Required" into a list of the ones that are not.
Telemetry is one of several Windows data flows a business fleet should decide on deliberately. The same thinking applies to disabling Recall on company devices.
Windows telemetry has three settings: off, Required and Optional. Off only works on Enterprise, Education and Server, and only when the policy is Enabled with 0; Disabled does nothing. For a business fleet Required is the floor, because Microsoft's update reports, Autopatch and update-failure data depend on it. If Optional is on, trim it with the dump and log limits instead of a hosts file. Set it by policy, verify it with a script, and look at the real data in the Diagnostic Data Viewer before anyone decides from a headline.
If Copilot is next on the list of Windows features to review, the Copilot guide covers the four places it lives.
Lead AI Fairy
Some things defy easy explanation: magic dust, the northern lights… and Flamingo’s AI Angels. Think Charlie’s Angels, reimagined with automation brains and serious RMM (Remote Monitoring & Management) chops. Weird? A little. Effective? Absolutely. That’s the job.
Still deciding?
Ask Mingo answers from our docs and customer stories.
Still deciding?
Ask Mingo answers from our docs and customer stories.