Microsoft Flags Windows 10 Hosts File Telemetry Data Blocking As Security Threat

windows 10 hosts files
Windows 10 has come under fire recently for a who laundry list of problems with the May 2020 Update. Microsoft has been working overtime to address all of the outstanding issues, but new ones seemingly pop up every week. Now a new issue has presented itself with Windows 10 over the past few days, and it is drawing scrutiny from computer users who edit their Hosts file.

Hosts is a text file that is located at C:\Windows\system32\driver\etc\HOSTS and is used to map connections between an IP address and a domain name. Putting addresses in a hosts file typically allows your computer to resolve the address faster than going through your dynamic name server (DNS).

You can also use the hosts file to block your computer from reaching out to certain websites. For example, if a parent wanted to discretely block Facebook on their child's computer, they could enter in the following text string in the hosts files:

And this is where Microsoft's recent actions come into play. Many Windows 10 users aren't too happy about telemetry data that the company collects automatically. So, they have been manually entering certain Microsoft domains into the hosts file with the prefix to prevent telemetry data from being sent back to the mothership.

windows defender hosts detection
Modified hosts file flagged as a threat (Source: Bleeping Computer)
Microsoft apparently wasn’t too thrilled with this turn of events, and has provisioned Windows Defender to sniff out these specific modifications to hosts that include its domains. Some of the domains that Microsoft takes issues with user blocking include:


Windows Defender now flags any edits made to the hosts file that include specific Microsoft domains, and labels it as a “SettingsModifier:Win32/HostsFileHijack” threat according to Bleeping Computer. If you decide to remove this “threat”, your hosts file is reverted back to its default state. Microsoft describes this threat, writing:

The Hosts file is used by your web browser to find out where to redirect certain IP address calls. Malicious or unwanted software can modify this file to prevent users and applications from accessing certain websites. Or the malware may force you to visit other websites instead.

And for anyone that attempts to modify and save the hosts file with one of the affected Microsoft servers after the fact will see the following message: "Operation did not complete successful because the file contains a virus or potentially unwanted software". Now there is no question that certain malware can strike your hosts file, make modifications, and make your system vulnerable to threats. However, the modifications to block certain Microsoft servers made by discerning Windows 10 users seems harmless at face value. In essence it's Microsoft's way of slapping you on the wrist for "Taking sides against the family".

windows 10 hosts files 2

Microsoft’s solution to sidestep the issue if you have personally modified your hosts file is to put it on the exclusions list with your antivirus program. However, that keeps you unprotected if malware does attempt to modify it at a later date. So, if you’re paranoid about Microsoft collecting data on you, maybe your best course would be to tread lightly.