Detections
Analytics

18.10.3.2 Ensure 'Turn off Application Footprint' is set to 'Enabled'

Information

This policy setting determines if Application Footprint data is sent to Microsoft. Application Footprint monitors a sampled collection of registry and file activity to help diagnose compatibility problems.

The recommended state for this setting is: Enabled.

In high-security environments, data must never be shared with third-parties without explicit consent, as it may contain sensitive information.

Solution

To establish the recommended configuration via GP, set the following UI path to Enabled :

Computer Configuration\Policies\Administrative Templates\Windows Components\App and Device Inventory\Turn off Application Footprint

Note: This Group Policy path is provided by the Group Policy template AppDeviceInventory.admx/adml that is included with the Microsoft Windows 11 version 24H2 Administrative Templates (or newer).

Impact:

Data from Application Footprint sampling will not be sent to Microsoft.

See Also

https://workbench.cisecurity.org/benchmarks/27452

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7b.

Plugin: Windows

Control ID: 17c9c0d2a8dde47dd9129dbb1047ab4fd01c27477cd81917075717034ac87b6e