1

dns.msftncsi.com

I've had 11,505 resolved checks to that domain in the last 24 hours! This is apparently Microsoft (Windows 10 version 20H2), checking to see how it should display the network icon in the system tray. Trying to see if I'm online and in the last 24 hours it has checked 11,505 times. This seems excessive. Is there any advantage to  blocking it? Any way to control it? 

21 replies

null
    • If in doubt, ask someone to help!
    • Terry_Webbs
    • 3 yrs ago
    • Reported - view

    This is typical for most routers to ping Microsoft servers for network information
    You can safely either blacklist this or simply login to your router and remove the entry from network monitoring. Mine wasn't enabled and yet it was still sending out packets - thanks to NextDNS I tracked it down to the router settings hidden inside the NVRAM.

    My router model is ASUS, so settings labels mentioned below might vary on other models.

    1. First, open your router’s web UI (default is http://192.168.1.1).
    2. On the left-hand side, click on Administration
    3. Click tab System
    4. Search for Network Monitoring option in the list
    5. Select DNS Query checkbox, two input fields are going to get displayed:
      1. Resolved Target
      2. Respond IP
    6. Clear the values of both fields above
    7. Click button Apply
    8. Make sure DNS Query checkbox is not selected

    After the change has been applied, you can observe that there are no new queries for dns.msftncsi.com

    You might have to perform this task again if the router receives an update

      • Phillip_Gaudreau
      • 2 yrs ago
      • Reported - view

      Terry Webbs I did this.. and verified the boxes ARE clear.. and its still doing it :(

      • Pro subscriber ✓
      • DynamicNotSlow
      • 2 yrs ago
      • Reported - view

      Phillip Gaudreau you can disable that feature in windows itself. No need for strange network settings. 

      • If in doubt, ask someone to help!
      • Terry_Webbs
      • 2 yrs ago
      • Reported - view

      Phillip Gaudreau 

      Putting this below text inside a .reg file and running it will causes the computer to correctly believe that it has internet access and no longer use the dns. msftncsi. com lookup query.
      You will need to reboot afterwards. 

      Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator]
@=""
"NoActiveProbe"=dword:00000000
"DisablePassivePolling"=dword:00000000

      If this still does not work, you may need to:

      • Install the newest LAN driver available for your system (If the below IPv4 Checksum offload option is absent)
      • Open device manager → select your NIC → open the Advanced tab
      • Locate and select IPv4 Checksum Offload in the Properties list
      • Set the value to Disabled
      • Select OK

      This only seems to work about 80% of the time, upgrading the computer to 20H2 Seems usually help with the remaining 20%.

      • Phillip_Gaudreau
      • 2 yrs ago
      • Reported - view

      Terry Webbs I am on 21H2 and it happens when my computer is off.. which is why I suspect the router.. unless win7 does it too? I have a plex server upstairs that runs 24/7 

      • If in doubt, ask someone to help!
      • Terry_Webbs
      • 2 yrs ago
      • Reported - view

      Phillip Gaudreau 

      Yes win7 will also do the same! All windows based software will always 'call home' to coin a phrase!

      The best way forward is to set a unique name for all your devices on the network and then check the log on NextDNS, you will surely find the culprit.

      • Phillip_Gaudreau
      • 2 yrs ago
      • Reported - view

      Terry Webbs hmm i have 3 windows devices in the house total [4 when i boot my dual boot ubuntu laptop to windows monthly for updates] - i use nextdns at the router level so unfortunately it doesnt tell me what devices are doing this. maybe ill just do the reg + nic fix and wipe hands on pants.

      • Phillip_Gaudreau
      • 2 yrs ago
      • Reported - view

      tho i just booted two of them and in asus's qos web history log that supports that its the router..because none of the computers went to this site. 

      I read on another site disabling that in the current firmware [blanking it out] causes issues :/ 

      • If in doubt, ask someone to help!
      • Terry_Webbs
      • 2 yrs ago
      • Reported - view

      Phillip Gaudreau 

      Alternatively you could always add  dns. msftncsi. com to the deny list on your nextDNS account 

      • Pro subscriber ✓
      • DynamicNotSlow
      • 2 yrs ago
      • Reported - view

      Terry Webbs this doesn’t stop the queries and will even end in more

      • If in doubt, ask someone to help!
      • Terry_Webbs
      • 2 yrs ago
      • Reported - view

      DynamicNotSlow 

      Yes your right as it's a service request, it will just continue trying and trying to resolve the query!!!!
      Apologies the deny list should only be used to block websites and not services.

    • QA/QC
    • Stephane
    • 3 yrs ago
    • Reported - view

    Terry Webbs  Steven Shank

    In my case, I had to empty the 2 fields in the Asus Router 3.0.0.4.386_42643 and click apply.

    Unmarked checkboxes was not enough... 

    • Steven_Shank
    • 3 yrs ago
    • Reported - view

    Thanks. That seems to have resolved that issue. However, now I notice that ipv6.msftconnecttest.com which apparently does the same thing, is checked about twice a minute.

    As I understand this, it is a Windows issue. Any ideas or just ignore it?

    • Techno
    • 2 yrs ago
    • Reported - view

    I was having the same problem. The culprit is my Asus router.

    The solution if you're running  Asuswrt-Merlin firmware is....

    Tools

    Other

    Wan:  use local caching dns server as system resolver (set it to yes)

      • Pro subscriber ✓
      • DynamicNotSlow
      • 2 yrs ago
      • Reported - view

      Techno no. A cache doesn’t stop queries itself. NextDNS also provide cache too. 

      • Techno
      • 2 yrs ago
      • Reported - view

      DynamicNotSlow the option in mention worked for me. I was getting hundred of queries a day from dns.msftncsi.com , even when my windows machines were turned off.

      • Pro subscriber ✓
      • DynamicNotSlow
      • 2 yrs ago
      • Reported - view

      Techno doesn’t make sense. Did you use a XBOX?

      • Phillip_Gaudreau
      • 2 yrs ago
      • Reported - view

      Techno its worth a test.. is this a toggle or a "hey, router will reboot" toggle. [that matters as im not the only person home so i try and do reboots on downtime... and theyre not predictable.. ipv4 dns no reboot.. ipv6 dns, reboot.. i never know which settings are gonna reboot it.]

      • Phillip_Gaudreau
      • 2 yrs ago
      • Reported - view

      Techno Turned it off [it didn't reboot] and it instantly eliminated 99% of these queries. [I do have 1 win10 and 2 win7 machines on the network so i expect to still see it occasionally when theyre on] [no i dont own an xbox ] 👍

    • Chris.15
    • 2 yrs ago
    • Reported - view

    Shrugs, I use a Unix clone OS but still get msftncsi probes flooding my logs. To rectify the situation on my ASUS GT-AX11000 I went to Administration ---> System Tab and selected the DNS Query checkbox. Then in the Resolve Hostname field I entered 45.90.28.0 

    Now there are no more mega capitalist microsoft connectivity check look-ups in my logs.

Login to reply

Content aside

  • 1 Likes
  • 2 yrs agoLast active
  • 21Replies
  • 2733Views
  • 6 Following