Configure Default consent
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: Windows 8.1, Windows 8, Windows 7, and Windows Vista only
Path in the GPO console
User Configuration\Administrative Templates\Windows Components\Windows Error Reporting\Consent Description
This policy setting determines the default consent behavior of Windows Error Reporting. If you enable this policy setting, you can set the default consent handling for error reports. The following list describes the Consent level settings that are available in the pull-down menu in this policy setting: - Always ask before sending data: Windows prompts users for consent to send reports. - Send parameters: Only the minimum data that is required to check for an existing solution is sent automatically, and Windows prompts users for consent to send any additional data that is requested by Microsoft. - Send parameters and safe additional data: the minimum data that is required to check for an existing solution, along with data which Windows has determined (within a high probability) does not contain personally-identifiable information is sent automatically, and Windows prompts the user for consent to send any additional data that is requested by Microsoft. - Send all data: any error reporting data requested by Microsoft is sent automatically. If this policy setting is disabled or not configured, then the consent level defaults to the highest-privacy setting: Always ask before sending data.
Registry
SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting\Consent MDM / Intune (CSP)
./User/Vendor/MSFT/Policy/Config/ADMX_ErrorReporting/WerDefaultConsent_1 Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Configure Default consent
; State: Enabled
; Supported on: Windows 8.1, Windows 8, Windows 7, and Windows Vista only
[HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting\Consent]
"DefaultConsent"=dword:00000001More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Configure Default consent
# State: Enabled
# Supported on: Windows 8.1, Windows 8, Windows 7, and Windows Vista only
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
$path = 'HKCU:\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting\Consent'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DefaultConsent' -Value 1 -Type DWordIntune XML
OMA-URI: ./User/Vendor/MSFT/Policy/Config/ADMX_ErrorReporting/WerDefaultConsent_1
Data type: String
Value:
<enabled/>
<data id="WerConsent" value="1"/>Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Configure Default consent
# State: Enabled
# Supported on: Windows 8.1, Windows 8, Windows 7, and Windows Vista only
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKCU:\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting\Consent' -Name 'DefaultConsent' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Configure Default consent
# State: Enabled
# Supported on: Windows 8.1, Windows 8, Windows 7, and Windows Vista only
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
$path = 'HKCU:\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting\Consent'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DefaultConsent' -Value 1 -Type DWordSCCM scripts
# Exported from gporais.com
# Policy: Configure Default consent
# State: Enabled
# Supported on: Windows 8.1, Windows 8, Windows 7, and Windows Vista only
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Configure Default consent
# State: Enabled
# Supported on: Windows 8.1, Windows 8, Windows 7, and Windows Vista only
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKCU:\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting\Consent' -Name 'DefaultConsent' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Configure Default consent
# State: Enabled
# Supported on: Windows 8.1, Windows 8, Windows 7, and Windows Vista only
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
$path = 'HKCU:\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting\Consent'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DefaultConsent' -Value 1 -Type DWordBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.