How do I disable Microsoft Diagnostic Tool (MSDT) entirely?

Question

There was a recently published exploit using URIs to open MSDT and execute arbitrary code. Microsoft's suggestion was to delete the registry key corresponding to the ms-msdt:// protocol.

Unfortunately, this still leaves MSDT active and presumably exploitable via other routes. Personally, I have never used MSDT, nor would I ever need to. Searching how to disable MSDT (results filtered to before May 1, 2022) gave me this result on how to disable MSDT from communicating with Microsoft:

Registry Hive: HKEY_LOCAL_MACHINE

Subkey: \Software\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy\

Value Name: DisableQueryRemoteServer

Type: REG_DWORD

Value: 0

However, I didn't find any further results. Is there a way to disable MSDT entirely? Would simply deleting msdt.exe actually impact the system's stability?

Answer 1

I think that in theory you could try and change the permissions to %WINDOWS%\System32\msdt.exe by removing execution rights temporarily. But this is no guarantee, that the functionality itself isn't accessable via other calls via API. But at least nobody should be able to run it from command prompt.