I came across a lot of entries in my NxFilter log for dns.msftncsi.com and ip6.msftncsi.com since setting it up as a DNS filtering server.
What is Network Awareness?
NCSI stands for Network Connectivity Status Indicator. It is part of what Microsoft calls Network Awareness. Microsoft purposed Network Awareness to provide network-connectivity information to services and applications running on Windows Vista and Windows 7.
How does it Work?
At the beginning of a new network connection, NCSI performs a DNS lookup on www.msftncsi.com. It then requests http://www.msftncsi.com/ncsi.txt. This file is a plain-text file containing the phrase ‘Microsoft NCSI’. If it can’t access it, it will do a DNS lookup of dns.msftncsi.com to determine whether or not the internet connection is functioning properly.
How to Disable Network Awareness
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesNlaSvcParametersInternet
Under the Internet key, double-click EnableActiveProbing, and then in Value data, type: 0. The default for this value is 1. Setting the value to 0 prevents NCSI from connecting to a site on the Internet during checks for connectivity.
