Recently, many netizens have been discussing whether Windows 11 is truly silently monitoring every personal PC in the background. Amid widespread privacy concerns, reverse engineers have finally provided concrete technical analysis conclusions. The answer differs from what people previously imagined.
Recently, renowned reverse engineer Xusheng Li conducted a complete disassembly analysis of the built-in Windows Health and Optimized Experiences background service, The conclusion drawn is: while this service indeed possesses extensive system-level permissions, all pre-installed companion scripts are currently used solely for routine performance diagnostics. No code traces were found that automatically upload user privacy data or secretly monitor screens in the background.
Microsoft engineer Scott Hanselman had previously publicly explained the positioning of this service. Its core function is to collect corresponding performance diagnostic data when Windows detects system lag or slow response. All collected tracking information is prioritized for storage on the user's local device. Users can later choose through the Feedback Hub whether to submit this diagnostic data to Microsoft for system optimization.
Xusheng Li's reverse engineering results basically fully corroborate this official statement. However, he also mentioned that the underlying implementation logic of this service is much more complex than the ordinary performance diagnostic services people usually encounter.
Disassembly analysis shows that the program size of the service named whesvc itself is not large. All core functionalities are concentrated in the accompanying windiag.dll dynamic link library. This DLL directly embeds the Lua 5.4.7 scripting language runtime environment. Microsoft also includes a resource file named whesvc_assets.dll with the system, which packages 84 pre-compiled Lua scripts, each corresponding to different system performance diagnostic scenarios.
During the analysis, Xusheng Li discovered that this built-in script engine exposes 79 native system call functions to all scripts. The scope of callable capabilities covers a wide range of scenarios. These include reading and modifying the Windows Registry, performing various file operations, creating and controlling processes, querying Windows Management Instrumentation (WMI) data, collecting system event tracing logs, checking security token status, obtaining device power and hardware temperature information, downloading debug symbol files, generating .cab format diagnostic archives, and initiating HTTP network requests.
In addition, this underlying mechanism includes a generic Foreign Function Interface (FFI), allowing scripts to interact directly with third-party native DLL files and various Windows system handles. From the perspective of callable permission capabilities alone, this underlying engine indeed possesses system permissions far beyond what ordinary performance diagnostic services require. It is no wonder that it has triggered significant user concerns about privacy leaks and loss of system control.
However, powerful functionality itself does not mean these capabilities will be used for improper purposes.This complete reverse engineering result shows that Microsoft almost exclusively uses these high-privilege capabilities for routine performance diagnostic tasks in all scripts pre-installed with the official release, with no signs of abuse.
For instance, registry-related functions exposed to scripts are primarily used to save performance counter data after an unexpected service restart. There is a driver information module that can modify Windows Driver Verifier settings, but this feature requires manual triggering via specific environment variables and serves only special processes for deep memory monitoring.
Researchers also admitted that this might be the most intrusive operation performed by the whesvc service in actual use.
The widely disputed rumor online about automatic user data uploads every 15 minutes was also clearly clarified in this analysis.
The system_summary module does generate a JSON-formatted system runtime summary lasting 900 seconds (15 minutes), but all generated data is saved by default to the user's local disk and is not actively transmitted externally.
Although the service itself has the capability to initiate network communications, researchers thoroughly examined all script logic and found no scenarios where unspecified HTTP requests would be arbitrarily initiated.
Among all 84 pre-installed scripts, the only external URL identified points to Microsoft's public debug symbol server. This download function is reportedly disabled by default in standard retail Windows installations, making it inaccessible to ordinary users.
Xusheng Li finally stated clearly that during his reverse engineering analysis, he specifically investigated all potentially suspicious behaviors. He found no evidence proving that this service secretly records user screens in the background, nor did he discover that diagnostic tracking data is automatically uploaded to Microsoft servers without active user authorization.