Windows 10: [Windows Security] Automatic Sample Submission

Countless times I get this security notification




And countless times I choose "Dismiss".

How can I stop this notification, short of "Turn on" automatic sample submission?

:)

 

Windows Defender Automatic sample submission

It's not likely that your PC will need to submit entire files to Microsoft's servers very often, since in most cases the executable files that Defender would be concerned with would be digitally signed and so later copies could be verified via the file's
signature data alone. This means that only the first PC to download such a file would need to actually upload and even then only if something about it seemed suspicious to the Defender monitoring components.

For less well known executable files from marginal software developers (think less popular games or similar programs) the potential need for upload goes up, but even then if the file's size, checksum and other data matched earlier samples from others, it
still shouldn't be necessary. And remember, there still must be something questionable that Defender sensed about the file to make it of interest.

If you read the short paragraph for the Automatic sample submission setting, you'll note that it mentions you will be prompted if the file they need is likely to contain personal information. What this means is that Defender will prompt you with the file
name, path and ask for your permission before sending any files such as documents or spreadsheets for example, while executables will typically be sent silently.

So overall, your risk to privacy is very low, though
Microsoft's own Privacy Statement regarding Microsoft Security Essentials doesn't describe this in a comforting manner as you'll see in the excerpt I've copied further below. I assume there's an equivalent section to this for Defender embedded within the
Windows 10 Privacy Statement as well, but I found this document more easily.

Unless you commonly download huge installer or other files that aren't signed and may contain questionable executable files which might peak Defender's interest, I typically wouldn't expect to see much if anything uploaded from most machines. Also note
that Microsoft has paid more attention to metered Internet connections with Windows 10, though I don't know whether they've specifically tuned Defender to pay attention to this or not.

Rob

Automatic sample submission

What this feature does: The product contains functionality that may identify certain files as potentially unwanted and may request further information to make an assessment. As described below, this feature will automatically send such files
without prompting you each time such an action is recommended.

Information collected, processed, or transmitted: This feature sends specific files from your PC that the product suspects might be potentially unwanted software. The report is used for further analysis. These reports may include information
about the files or apps in question, such as file names, cryptographic hash, vendor, size, and date stamps. Reports might also include the actions that you applied when the product notified you that software was detected.

Sample submission reports may be automatically sent to Microsoft when the product detects software or changes to your PC by software that hasn’t been analyzed for risks yet when the following are enabled:

• 
  Automatic sample submission
  
• 
  MAPS
  

Microsoft uses sample submission reports to help the product operate as intended—to help protect your computer against potential threats.

To help protect your privacy, reports that are sent to Microsoft are encrypted.

Use of information: Sample submission reports are used to improve Microsoft software and services. The reports might also be used for statistical or other testing or analytical purposes, and for generating definitions. Only Microsoft employees,
contractors, partners, and vendors who have a business need to use the reports are provided access to them. Sample submission reports do not intentionally collect personal information. To the extent that sample submission reports collect any personal information,
Microsoft does not use the information to identify you or contact you.

Choice and control: When you install the program for the first time, you will be automatically enrolled in this feature by default during setup. To opt-out you can uncheck the box next to “Turn on automatic sample submission” during setup,
or you can opt-out later via the product settings. To turn this feature off, go to the "Settings" tab in the product, select “Advanced” on the left hand bar, and uncheck the box next to “Send file samples automatically when further analysis is required.” Automatic
sample submissions operates when product has been enabled on your computer and you are enrolled in MAPS at a basic or advanced level.

During an upgrade, you may be asked if you want to turn automatic sample submission on. Microsoft will honor your settings until you make a change.

 

Windows Defender Automatic sample submission

This is actually a very simple and clear policy by Microsoft.

Even if you choose to accept the Automatic Sample Submission feature remaining enabled, if the file Microsoft is requesting is a data file of any sort, then there will be a prompt to confirm. The only files that Microsoft will send without confirmation
are executable files, which for most consumer users are not personally created items.

An ISO file isn't directly executable, so it would only present a risk if that file were first decompressed and any malware it contained were written to disk as a separate file. So no, an ISO file isn't something that would normally be requested for upload.

If you are a software developer and are thus concerned about the potential that your personally created executable files might be sent without your permission, then I suggest that you consider acquiring a commercial security application from a 3rd-party
that allows for such granular control.

Microsoft provides Windows Defender free with the operating system primarily for consumers and small businesses, few of whom would have any interest in monitoring to confirm the sending of executables, so it's highly unlikely that this sort of additional
setting will be added to Defender.

If the warning you are talking about relating to automatic sample submission being turned off is the yellow exclamation point symbol displayed in the new Windows Defender Security Center, then that's being discussed in different threads, since that change
occurred when this new interface was released within the Windows 10 Creators Update back in early April. It has nothing directly to do with the specific questions originally asked or answered in this thread.

Rob

 

Windows Defender Automatic sample submission

What if it is a large file (Operating System ISO) which is mistakenly thought to contain some suspected malware, but isn't likely to contain personal information? Would it be submitted? How about media files?

I am also of the opinion that the automatic sample submission being turned off should not cause a warning to be displayed...

Perhaps offer an optional setting where if the "Automatic Sample Submission" feature is enabled, one can also choose to request confirmation for ALL files being submitted. Otherwise I see it as a privacy issue if I can't control what is being sent and what
isn't.

Cheers.