nvidia-telemetry-block

Block NVIDIA App / GeForce Experience telemetry on Windows — the easy way.

The NVIDIA App and graphics driver phone home with usage and diagnostic telemetry. This repo gives you a curated, categorized list of the endpoints plus a one-click script that blocks them and a one-click undo. No command-line knowledge required.

⚠️ Use at your own risk. This edits your hosts file, adds Windows Firewall rules, and disables NVIDIA scheduled tasks. Everything is reversible (see Undo), but blocking is inherently a "your mileage may vary" activity — NVIDIA changes endpoints over time. Nothing here is affiliated with or endorsed by NVIDIA.

---

Quick start (non-technical users)

1. Click the green Code button → Download ZIP, and unzip it.
2. Open the scripts folder.
3. Right-click Run-Blocker.bat → Run as administrator.
4. Pick 1) Block SAFE.
5. Done. Telemetry is blocked and the NVIDIA App still works.

To undo later: run Run-Blocker.bat again and choose 3) Undo everything.

---

What gets blocked (tiers)

Tier	What it blocks	Effect
Safe (default)	Telemetry & analytics endpoints only	NVIDIA App keeps working normally
Aggressive	Above plus login, activation, OTA updates, and image/asset CDNs	Maximum privacy, but breaks sign-in, auto-updates, and some images

The full categorized list lives in data/domains.csv (the single source of truth) and is rendered for humans in docs/domains.md.

---

How it blocks (three layers)

A hosts file alone is not enough — apps can bypass it with DNS-over-HTTPS or hard-coded IPs, and driver updates can reset it. This isn't hypothetical: a live capture on a real NVIDIA App install (see docs/findings.md) showed NVIDIA App.exe connecting straight to NVIDIA-owned IPs (72.25.64.x) with no matching DNS lookup — i.e. over DoH, invisible to the hosts file. So this tool layers defenses:

1. Hosts file — sinkholes telemetry domains to 0.0.0.0. Simple and effective for the common case (plain DNS).
2. Windows Firewall — outbound block rules that catch what DNS blocking misses:
   • Block-by-executable on NVIDIA telemetry processes. Safe tier blocks NvTelemetryContainer.exe if present; aggressive tier also blocks nvcontainer.exe and NVDisplay.Container.exe (they host the telemetry plugin on the modern App but carry legit functions too — hence aggressive-only).
   • Block-by-IP-range (-BlockNvidiaIpRange) on NVIDIA's own block 72.25.64.0/18. This is what defeats DoH — it blocks the connection by destination address regardless of how it was resolved. Opt-in, because the range may also serve login/downloads.
3. Disable-at-source — disables NVIDIA-owned telemetry scheduled tasks (and, in aggressive mode, the auto-update task) so the telemetry isn't even generated. It never touches Windows' own tasks.

You can choose which layers to apply via the -Methods parameter (see below). For the strongest privacy:

.\Block-NvidiaTelemetry.ps1 -Tier aggressive -BlockNvidiaIpRange

---

Advanced / scripted usage

From an elevated PowerShell, in the scripts folder:

# Safe tier, all layers (default)
.\Block-NvidiaTelemetry.ps1 -Tier safe

# Aggressive tier
.\Block-NvidiaTelemetry.ps1 -Tier aggressive

# Only the hosts layer
.\Block-NvidiaTelemetry.ps1 -Tier safe -Methods Hosts

# Preview without changing anything
.\Block-NvidiaTelemetry.ps1 -Tier aggressive -DryRun

# See what's currently applied
.\Block-NvidiaTelemetry.ps1 -Status

# Survive driver updates (heavier hammer; off by default)
.\Block-NvidiaTelemetry.ps1 -Tier safe -EnableIFEO

Undo

.\Unblock-NvidiaTelemetry.ps1            # or: .\Block-NvidiaTelemetry.ps1 -Unblock

Undo removes only the marked hosts block, removes only the NvTelemetryBlock_* firewall rules, re-enables NVIDIA tasks, and removes the IFEO key. Your hosts file is also backed up to hosts.bak.<timestamp> before every change.

---

Using the lists with other tools

Don't want the scripts? The ready-made artifacts in block/ work anywhere:

• Manual hosts file: copy from block/hosts-safe.txt or block/hosts-aggressive.txt.
• Pi-hole / AdGuard Home / NextDNS: import block/pihole-safe.txt or block/pihole-aggressive.txt as a blocklist (network-wide, covers all devices).

---

Verifying / extending the list

Endpoints change. Two ready-to-run capture tools confirm what your machine actually contacts and flag any hostname not already in the list:

• No admin, no install — tools/Watch-NvidiaDns.ps1 polls the Windows DNS cache and live NVIDIA connections for a few minutes:

  pwsh tools/Watch-NvidiaDns.ps1 -Seconds 240

• Thorough (Process Monitor) — tools/Capture-NvidiaTraffic.ps1 runs a headless Procmon capture and extracts the domains. Double-click tools/Run-Capture.bat (self-elevates) or:

  .\tools\Capture-NvidiaTraffic.ps1 -Seconds 180   # from an elevated shell

While either runs, open and click around the NVIDIA App to provoke telemetry. docs/capture-methodology.md explains the manual Wireshark/Fiddler approaches too. New domains go into data/domains.csv; then run tools/Generate-Artifacts.ps1 to regenerate everything. See CONTRIBUTING.md.

---

License

MIT. Community blocklists that informed this list are credited in CONTRIBUTING.md.