Windows 7 Network Awareness: How Windows knows it has an internet connection

May 16, 2011 by . 66 comments

Have you ever been connecting to a new wireless network and seen the following pop-up balloon?

Additional login information may be required. Click to open your browser.

no internet accessWhenever I connect to a WiFi network which requires in-browser authentication, such as university networks and hotel access points, Windows somehow magically knows. Windows also knows when your internet connection isn’t working, and can differentiate between having local LAN access, no network access at all, or full internet access. But how?

This week’s question of the week is one I myself asked about this very topic. I guessed that there must be some online Microsoft site that Windows is checking to determine the state of the connection, but I wanted proof, not just speculation.

How does Windows know whether it has internet access or if a Wi-Fi connection requires in-browser authentication?

Tobias Plutat and Jeff Atwood both replied with information about the Network Connectivity Status Indicator (NCSI) service, first introduced in Windows Vista.

When called on by Network Awareness, NCSI can add information about the following capabilities for a given network:
  • Connectivity to an intranet
  • Connectivity to the Internet (possibly including the ability to send a DNS query and obtain the correct resolution of a DNS name)
NCSI is designed to be responsive to network conditions, so it examines the connectivity of a network in a variety of ways. For example, NCSI tests connectivity by trying to connect to, a simple Web site that exists only to support the functionality of NCSI.

How does it work?

Windows does indeed check a Microsoft site for connectivity, using the Network Connectivity Status Indicator site. There are a few variations of the connection checking process:

  1. NCSI performs a DNS lookup on, then requests This file is a plain-text file and contains only the text Microsoft NCSI.
  2. NCSI sends a DNS lookup request for This DNS address should resolve to If the address does not match, then it is assumed that the internet connection is not functioning correctly.

The exact sequence of when which test is run is not documented; however, a little bit of digging around with a packet sniffing tool like Wireshark reveals some info. It appears that on any connection, the first thing NCSI does is requests the text file (step 1 above). NCSI expects a 200 OK response header with the proper text returned. If the response is never received, or if there is a redirect, then a DNS request for is made. If DNS resolves properly but the page is inaccessible, then it is assumed that there is a working internet connection, but an in-browser authentication page is blocking access to the file. This results in the pop-up balloon above. If DNS resolution fails or returns the wrong address, then it is assumed that the internet connection is completely unsuccessful, and the “no internet access” error is shown.

The order of events appears to be slightly different depending on whether the wireless network is saved, has been connected to before even if it is not in the saved connections list, and possibly depending on the encryption type. The DNS and HTTP requests and responses showing up in Wireshark were not always consistent, even connecting to the same network, so it’s not entirely clear what causes different methods of detection under different scenarios.

What about my privacy?

Some people may be concerned about Windows “phoning home” to Microsoft with their PC’s information through this service. According to Microsoft’s documentation, NCSI retains the time of access and IP addresses of requests made to

IIS logs are stored on the server at These logs contain the time of each access and the IP address recorded for that access. These IP addresses are not used to identify users, and in many cases, they are the address of a network address translation (NAT) computer or proxy server, not a specific client behind that NAT computer or proxy server.

It is possible to disable NCSI by a registry setting if you don’t want Microsoft to be able to check your internet connection.

  1. HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesNlaSvcParametersInternet
  2. Under the Internet key, double-click EnableActiveProbing, and then in Value data, type: 0.The default for this value is 1. Setting the value to 0 prevents NCSI from connecting to a site on the Internet during checks for connectivity.

When I changed this registry setting, Wireshark picked up no more communication to the NCSI site. As a result, there was no indicator that in-browser authentication was required, and the connection indicator would say “internet connection” even if there was in fact none present.

registry settingsIn the same registry key were a series of other parameters. The expected DNS response, the host to query for a DNS address, the expected content of the text file, the name of the text file, and the domain with the text file were all included. The other parameters are not quite as self explanatory. I tried adapting PassivePollPeriod, expecting it to change how frequently NCSI would poll the server. It appeared at first that the decimal value was equal to that many tenths of a minute, so a value of 5 polls every 30 seconds and a value of 10 polls every minute. However, the frequency also seemed to decrease with time. I could not figure out the use of the other two values.

Can I run my own NCSI server?

For those concerned about privacy, is it possible to run your own server to respond to these requests? Let’s find out!

I created on my web hosting, and set it up to send /ncsi.txt as a plain text file with the content nhinkle NCSI. I then changed all of the registry values to point to the values for my server, and what do you know, it worked! Looking in Wireshark, requests were being made to my server instead of to Microsoft’s server, and the system was still determining the status of the internet connection correctly. The user agent on the requests was still Microsoft NCSI, indicating that it was indeed the same service making the requests.

So, if you want your computer to be able to check its connectivity to the internet while not sending your every move to Microsoft, this is a way to do it. As an added benefit, this could be used as a tracking mechanism to see where your computer goes, particularly should it get lost or stolen, since any connection attempt will result in your server being requested.

As operating systems become increasingly complex, features like this can make your life much easier, but it’s always good to know what’s happening behind the scenes.


Subscribe to comments with RSS.

  • says:

    Great post! I always wondered how they did this! Awesome that you tried setting up your own server.

    And as the CAPTCHA says: “Quality ofechana!”

    P.S. What’s that small green timer in your taskbar that says “3:21” at the top screen shot?

  • nhinkle says:

    Bloodphilia, that’s BatteryBar. It was actually suggested to me in a Super User question!

  • I came for an interesting article and I was shocked to see my BatteryBar application in your screenshot! As the author I love running into people running my app.

  • Ian says:

    This must be how the Zune detects internet access as well. It’s the most annoying thing because a Zune won’t allow you to connect to a network that doesn’t have network access and therefore I can’t connect to my university’s network since I have to authenticate before the Zune can detect internet.

  • Jason says:

    If the service was ddos’d, would millions of windows users get a pop-up stating limited connectivity or connected but further log in details required? Sound like a prank 4chan might play…

  • Sigjuice says:

    “How does it work?” should say and not

  • Mike says:

    Is the most recent result stored somewhere (so I could look somewhere in memory for it instead of having to run another DNS lookup/HTTP request myself?)

  • S says:

    Very interesting read, especially the bit about using this as a tracking mechanism application.

    Small error: should say “tenths of a minute” not “tenths of a second”

  • RENi says:

    Maybe this is worth adding, the ncsi.txt file hosted on seems to have no end of line.

    $ file ncsi.txt ncsi.txt: ASCII text, with no line terminators

    If you want to host your own, make sure it doesn’t have an eol either or else the ballon “Additional log on information may be required” will popup.

  • Ted Sbardella says:

    Very interesting – thanks so much!

  • nhinkle says:

    Thanks “S” for pointing out that error, I have fixed it in the article.

  • Dinos says:

    Minor correction, “NCSI performs a DNS lookup on, then requests “

    DNS lookup is performed on the name not on the URI. Proper sentence will be “NCSI performs a DNS lookup on then requests … “

    Almost the same method is performed by Apple on iphone/ipod etc devices.

  • socceroos says:

    Well, seems that its not quite telling the truth. If it can do a DNS lookup then it has internet access.

    Tunneling traffic through DNS queries is a sinch these days with all the ready-made tools.

  • dinos_correction says:

    if you’re being picky lookup does not use schema either – “NCSI performs a DNS lookup on then requests …”

  • Jason says:

    “Proper sentence will be “NCSI performs a DNS lookup on then requests … “”

    Actually, its “NCSI performs a DNS lookup on then requests … “

  • chefybuck says:

    Can disabling the NCSI lookup be used a work-around for the infamous “unknown network” in Vista and sometimes Win7?

  • Ansuz says:

    …brilliant write up. A good idea for higher education & corporate admin’s to implement via Domain Policy. I’m sure it will assist in reducing the number of calls for technical support…

  • g0dkar says:

    You just got into Slashdot. Watch out!! 🙂 – great article, btw (Yes, I RTFA, heh)

  • RO says:

    Interesting displayed by lynx text-mode browser (from Linux PC):

    Linkname: Entry into main screen URL: Charset: iso-8859-1 Server: Microsoft-IIS/7.0 Date: Wed, 18 May 2011 01:46:07 GMT Last Mod: Tue, 13 Jan 2009 00:37:56 GMT Cache-Control: max-age=30,must-revalidate Content-Length: 14 bytes Owner(s): None size: 0 lines mode: normal

    No Links on the current page

    The text would indeed seem to have no terminating CR/NL since 14 bytes is the length of the text string exactly.


  • In a corporate setting, this can be configured with Group Policy. See “Network Connectivity Status Indicator” in Network in the Computer Configuration node.

  • samwyse says:

    “As an added benefit, this could be used as a tracking mechanism to see where your computer goes, particularly should it get lost or stolen, since any connection attempt will result in your server being requested.” Personally, I’d want to track several computers with one server. Looks like I just need to set up my server to return the same file for many different requests, then imbed my host name in the request. For example, I could set ActiveWebProbePath to “nsci-NAME.txt” or set ActiveWebProbeHost to “” where my DNS is configed to resolve * to the same IP address.

  • Vicks says:

    What about NCSI for ipv6? How does that work?

  • WhizzMan says:

    DNS lookups don’t lookup http:// or /nsci-something.txt They only look up the hostname part

  • Ron says:

    “If it can do a DNS lookup then it has internet access.”

    Unless there’s a DNS server on the LAN which has access to the world even though you might be blocked.

  • Jarmund says:

    Another alternative for lazy people: server, using it myself.

    By the way, i’ve been told “this probably works for Windows Vista as well…” can someone confirm this?

  • WizADSL says:

    I found this info from MS about how NCSI works ; you may want to take a look

  • nhinkle says:

    Thanks for the info, WizADSL. That looks to be an identical duplicate of the information in the article I linked to, just updated with “Windows 7” in the title instead of “Windows Vista”, but good to know!

  • Arno Nym says:

    “NCSI performs a DNS lookup on, then requests” is bullshit.

    “NSCI performs a DNS lookup on, then requests …” is correct.

  • killasmurf86 says:

    @Jarmund << yes works on Vista as well

  • Marijn says:

    Great article! I always assumed it had to make some call to check internet connectivity, now it’s good to know exactly how it works and even better so how to change the behaviour.

    One thing that might be noteworthy is that Microsoft isn’t the only one who can track your internet connectivity. The DNS servers you use, so probably your ISP, can track you just as easily. All they have to do is log any lookups of ‘’ and ‘’.

  • samwyse says:

    OK, anyone can now use as an NCSI server. will return a file consisting of “example NCSI” (no newline!), while will return a Windows registry file to use this for the Active Web Probe; the Active DNS Probe is currently unchanged. Note that you can replace the word “example” with any text that you wish. Note that all access is logged via App Engine’s server log, so Google and I will know what you’re doing. I’ll try later to add an internal log to allow users to view just accesses to “their” strings.

  • sirmuzz says:

    LOL arguing about the DNS lookup. You both have it wrong.

    …”DNS lookup is performed on the name not on the URI. Proper sentence will be “NCSI performs a DNS lookup on then requests … “

    Well your closer but still not there….

    It is “DNS lookup is performed on the name not on the URI. Proper sentence will be “NCSI performs a DNS lookup on then requests … “

    DNS = Networking 101….

    • GrandpaGotRoot says:

      Most of us instinctively knew what the author meant and simply passed over the typo. But if “your” going to play Internet grammar Nazi, then you probably should know the difference between “your” and “you’re,” especially when offering unsolicited grammatical advice.

      your vs. you’re = English 101 🙂

      In other words, judge not, lest ye be judged…

  • sirmuzz says:

    Ok so you were right…damn website auto adds http://… bad webmaster bad!

  • DigiP says:

    Funny, because I had wrote about this in 2009 when troubleshooting connection issues in Windows 7 after a new install. I’ve disabled this service because of the whole connectivity issue, if 7 can’t see that site because its down or for whatever reason, it causes all sorts of issues trying to get online, even when you manually set an IP configuration for the NIC.

    See for rant. You can also change priority for IPv4 over IPv6, since IPv6 connections wil be tried first over IPv4, if your router only does IPv4, its just one less step your machine has to perform to check for first.

  • Doug M. says:

    all your network connection belong to us.

  • Kurt Shubert says:

    Very interesting article. Thanks for the “enlightenment” on this.

    This is one of those things I have wanted to know for some time but have never cared enough about to do the research. Thanks for having taken the time to do it for me!

  • Jason O. says:

    We had a different problem. It was the winhttp machine proxy settings. Info here.

  • doofus says:

    No need to insert the verb “are”.

    It already does belong.

  • doofus says:

    It should be “belongs” anyway.

  • Michele says:

    “It should be “belongs” anyway.”

    I believe Doug M. was parodying the famous 1991 Sega video game message “All your base are belong to us” (as translated direct from Japanese).

  • iam8up says:

    GREAT article. I was curious myself for some time.

  • loco says:

    can this be set to an intranet adress of the router and internal dns?

    ActiveDnsProbeContent ActiveDnsProbeHost dns.localdomain.local ActiveWebProbeHost

  • No. You are not XKCD and you are not even half as funny as you think you are ksplice.

  • robsku says:

    Hi, thanks, bumped here from slashdot article comments, found this interesting enough to bookmark in “microsoft software” bookmark folder for any later possible needs even though I myself never run Windows on my own machines as “real OS” – but I might someday run one or more of versions of Win for software testing and I don’t want it to “phone home” 🙂

  • Gary says:

    Hi nhinkle,

    Great post. I have a question for you. Some users in my office uses windows 7 and whenever they login to the domain, they get “Access Denied (policy denied)” error from time to time when they try to access the internet.

    The network team from global office says disabling ncsi from the registry will fix the problem but it didnt and after months the problem is still there and they couldn’t come back with a different solution. We are using blue coat.

  • Lurka says:

    Interesting info, thank you. Strange enough, I had set EnableActiveProbing to 0 months ago, but sometimes I still found event viewer warning “Name resolution for the name timed out after none of the configured DNS servers responded”. Possibly because my PC is registered to a domain? Now I turned it off through internet communication settings policy and will see what happens.

  • vtdone says:

    Great tracing work. I just hope that MS doesn’t release a Windows Update that overwrites this new registry set up.

  • DougE says:

    There must be something more to it. I took a Win 7 Pro PC and removed the default gateway. I then added these routes to use the router gateway. mask mask I can ping the url and and the ip resolves but I still get the icon no internet access. If I add a defualt gateway of it shows interent access. Is there more to it then this?

  • tommis says:

    Nice article! I have Win7 firewall restricted with outbound rules. Obviously NCSI is now blocked because I get “not connected” icons for internet and lan server but both are connected. So it is just the connection test that is blocked, but I can’t figure out what rule I need to allow NCSI to do the testing. NCSI is a service I understand but which program is running and needs to be allowed access? Anyone any info?? Thanks

  • zhou says:

    I use wireshark,but i cann’t catch any packages? why?

    • Tom Wijsman says:

      Try asking on Super User if you can’t get it working. Please first try to run Wireshark as an administrator, follow a tutorial/guide on how to capture packets as you might get it working on a second try…

  • You should probably edit the post and fix this:


    Very useful info by the way 🙂

  • Ari says:

    Put ncsi.txt file to C:\inetpub\wwwroot directory. Make sure IIS is up and running and you can access the file with localhost/ncsi.txt

    Modify the registry values: ActiveDnsProbeContent = ActiveDnsProbeHost = localhost ActiveWebProbeHost =

  • R2D3 says:

    Good article! Just two additions: First, I don’t really understand why they separate DNS lookups for the domain name are done, since the DNS request for already did tell the device that DNS is working, isn’t it? But wait: that’s Microsoft. Ok.

    Second, the device requesting the indeed honors redirecting replies from the server. We have lots of such requests in our web server’s logfile on a WiFi Captive Portal. It would be better to just leave the redirect reply unanswered. But as I said, this is Microsoft. So we will need to answer those URLs locally in our routers to not get flooded with useless requests.

    • Dave says:

      It needs a separate lookup for because it’s distributed through a CDN and the query response will be different depending on your location. The response for has only one answer. They’re not checking to see if DNS is working, they’re checking to see if they get the correct answer. Some captive portals will redirect HTTP traffic but will pass DNS requests to the Internet.

  • Michael says:

    You guys were great. Thanks for this.

  • zerox says:

    Android can detect that “wifi needs authorization” when you connect to a public wifi, how does it do this?

  • Tom Hudson says:

    I’m running Windows 7/64. I’m trying to troubleshoot the Internet dropping out on me every 12 hours — I’m on Time Warner Roadrunner service and it literally stops working for 3 minutes every 12 hours, like clockwork. When the Internet drops, I see the little yellow (!) symbol over the network icon indicating I have no Internet connection, as you’d expect. Tonight I tried to log into my cable modem when this happened, to see if the signal strength was bad or whatever — couldn’t connect to it. Tried getting into the Vonage router, which is connected directly to the modem — couldn’t get in there either, until the Internet came back up. Is this a known behavior — that if Windows sees you have no Internet, trying to get to a LAN address like doesn’t work either? I’ve seen this happen before on one of my other computers as well (Time Warner’s Internet drops out a lot for us occasionally).

  • Iraj says:

    My network is not connect to internet but in taskbar it shows the internet access. is any idea?

  • test says:

    Android does the same thing – it checks “”

    Just put “” as an extra line in your /system/etc/hosts file to kill it.

  • Dan Roberts says:

    Things have changed since this article was published. Not sure if this is peculiar to domain member machines or not, but on our Win 7 x64 machines, Windows tests connectivity by making an http connection to, then doing a DNS lookup to, then using an HTTP connection to the IP address returned, which is an address in the block. The lookups and connection are no longer done. I have a few machines that are blocked from the Internet, so I had to allow http access to and to the entire block to clear the connectivity test so the yellow caution would not show.

  • Comments have been closed for this post