The Windows Genuine Advantage Notifications application in Windows XP has been the cause of much user discontent since Microsoft introduced it last year. Now,Heise Security reports that Microsoft may be quietly keeping track of users who opt out of installing the software via Windows Update. Heise says that, unbeknownst to end users, Windows Update sends data to a server at http://genuine.microsoft.com when a user refuses to install the software. The data transmitted includes encrypted strings as well as information about the user's version of Windows, the version of the WGA notification tool, and the language of the operating system. According to Heise, Microsoft might even be able to identify individual computers with some of this information.

In addition to some confusing, apparently encrypted data, the WGA Update Installer also uses the XML tag UGD to transmit the value stored in the registry as a string for SusClientID under the Windows Update branch. In addition, the data transmitted contain information about the version of the WGA Notification Tool, Windows, and the language of the operating system. Furthermore, a cookie containing a GUID is also used to contact the server. It may be possible to identify individual computers by these means.

When asked by heise Security, Microsoft merely stated that it collected data to improve the quality of the WGA for users. Part of that process, the vendor said, was knowing where the user cancelled setup. To count reliably, the GUID is used, though Microsoft says the user is not identified. Microsoft says that the other data transmitted to Redmond contain information about the version of Windows used and the language and whether the machine is registered in a domain.

Heh. Time to block genuine.microsoft.com in the hosts file.