Overview
- A viral X post claiming Windows 11 added a new background service that “sends data every 15 minutes” drew wide attention last Friday and prompted a Community Note and technical scrutiny.
- Scott Hanselman of Microsoft responded that the service, called whesvc, is part of Windows diagnostics and records targeted performance traces locally rather than automatically phoning home.
- The whesvc component first appeared in May 2025 Canary builds and runs Lua-driven sampling scripts that capture metrics such as CPU load, thermals, brightness, and battery percentage for diagnostics.
- Microsoft acknowledged the in-product service description is unclear and said it will be revised, while community guides and built-in options let users disable whesvc manually if they prefer.
- The episode revived long-standing user distrust of Windows telemetry and renewed calls for clearer controls or a true zero-telemetry option to give users simpler, stronger privacy choices.