Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. ProgramData
  3. Microsoft
  4. Diagnosis
FolderRisk: Caution

Diagnosis C:\ProgramData\Microsoft\Diagnosis

C:\ProgramData\Microsoft\Diagnosis: local store for Windows diagnostic data (telemetry) from the DiagTrack service, read by Diagnostic Data Viewer.

Updated on By AltF4 Formation

What it’s for

DiagTrack, the “Connected User Experiences and Telemetry” service, keeps Windows diagnostic data here before it goes to Microsoft, at the level the user or administrator has chosen. You will find ETLLogs (event traces) and EventTranscript\EventTranscript.db, the local database that the Diagnostic Data Viewer tool reads.

What it contains

Files that only the Windows diagnostic components are meant to read: .etl traces and the EventTranscript.db database. The folder is locked down. Even an administrator can be refused read access without further elevation.

To see what Windows has collected, open Diagnostic Data Viewer (Microsoft Store) rather than the folder.

Risks and best practices

  • The format is internal and changes between versions. To erase this data, use Settings > Privacy & security > Diagnostics & feedback > “Delete diagnostic data”, not File Explorer.
  • To limit collection, set the diagnostic data level (Settings, or the “Allow Telemetry” policy). Deleting files does nothing to what is collected next.
  • On a managed fleet, document the level you chose for compliance, GDPR in particular.

Useful commands

Fenêtre de terminal
# Telemetry service status
Get-Service -Name DiagTrack | Select-Object Name, Status, StartType


# Diagnostic data level enforced by policy, if any
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection' -Name AllowTelemetry -ErrorAction SilentlyContinue


# List the folder (needs elevation, sometimes denied even to administrators)
Get-ChildItem "$env:ProgramData\Microsoft\Diagnosis" -Force -ErrorAction SilentlyContinue

Report a mistake