Where Is Triangle System Computer Repair Located?

Table of Contents

The big flick
Network Connection Status Indicator (NCSI)
How does it work?
NCSI passive mode
How to disable NCSI
- Disable the Active Probes
- Ready an internal NCSI server

Hands upwardly if you've seen the dreadful "yellow triangle" on your systray network icon at least once. The meaning of that is as simple as the popup label appearing on mouse hover: the system is continued to a network, but at that place's no internet access. That'south not e'er truthful tho: sometimes, despite the xanthous triangle and the message, your PC is indeed connected and you lot can surf the web without problems.

yellow-triangle-network-windows

What's the reason behind this odd behaviour past Windows? In this post nosotros'll try to respond to this question, looking at how our (not always) beloved operating system checks our connection status and how to solve the virtually common issues.

The big pic

When a Windows PC connects to a network - be information technology publicorindividual- ii services will be used to analyze its status: theNetwork Location Awareness (NLA) and theNetwork Connection Condition Indicator (NCSI). Their purpose respectively is:

to automatically identify the network and fetch its basic informations.
to check if the network features internet access or non.

What we need, like y'all might estimate, is mostly the latter: if you experience similar y'all need more information regarding the former, yous tin find some detailed information on theNetwork Location Sensation (NLA) service looking at this great Technet.com post.

Network Connectedness Status Indicator (NCSI)

TheNetwork Connection Status Indicator (NCSI) is role ofNlaSvc (Network Location Awareness Service) and it basically serves the purpose of checking if nosotros can reach Internet or not: the bank check is performed using the NLM_CONNECTIVITY Network List Manager native APIs (read here for more info). The applications and services installed on our organisation can fetch the result of these checks from the APIsNCSI/NlaSvc to make up one's mind the well-nigh suited / stable network among the available ones according to our needs.

The Internet Connexion bank check is actually fabricated past using a standard DNS call: the outcome, if less than ok, will exist displayed by using an overlay icon - the yellow triangle, the red cross, then on - over the network icon in the systray: it'due south worth to notice that this is an overall result for all the available networks - that's because the network icon is the same - focusing on the most troubled one. This basically means that, if you get the xanthous triangle but the web seems to be working just fine, the first thing you should exercise would be to disable all the other network interfaces using the Control Panel and see if y'all manage to place the 1 causing the effect.

How does it work?

Since Windows 7, the connectivity exam performed past NCSI is part of Windows DirectAccess (read here if you never heard about it) and it features the frequent activeness of someagile probes sending an almost-realtime notification whenever any network connexion's status changes: on each connection, NCSI checks if the computer is connected to the Net by issuing a standardDNS query to www.msftncsi.com, followed by a HTTP get asking to the http://world wide web.msftncsi.com/ncsi.txt file (a plain text file) and, finally, another DNS query to dns.msftncsi.com.

These checks can exist easily identified and monitored with anetwork tracing software such as Network Monitor o Wireshark. If you don't feel similar installing new software on your organization you tin also perform the examination using thenetsh console command (available since Windows 7): to do that, just open anelevated command prompt and run the following code:

netsh trace starting time persistent=no capture=yes tracefile=c: \temp\neths-trace.etl

If yous demand to trace the network activity during the organisation boot sequence, change the above control setting the persistent parameter to yeah: this way te trace volition proceed - even afterwards a shutdown orreboot - until yous'll manually stop that issuing the following control:

The network action log will exist put into thenetsh-trace.etl file: the extension isn't required, but creating an.etl file will allow you to easily open it with Network Monitor.

For additional info on thenetsh trace command and hints on how to finer utilise it I also propose y'all to read this post.

NCSI passive mode

Whenever there are other applications generating network traffing, the NCSI service will silently switch to passive mode, checking the completion of the TCP connections estabilished by the other software instead of using its own probes, and act appropriately.

How to disable NCSI

Disable the NCSI feature is not encouraged byMicrosoft because it will make the Bone unable to detect their network connections status. If y'all're ok with that, you can either reconfigure some of its features or shutdown it entirely without affecting the stability of your organization as it's considered a not-disquisitional service.

A useful thing for most users would be to reconfigure the active probes sent to the default Internet accost www.msftncsi.com and dns.msftncsi.com, which could be blocked or unreachable due to a Proxy, Firewall or VPN presence. You tin either:

Disable them usinggroup policy settings: doing this will heighten the "yellowish triangle" on your systray icon.
Install your very ain "NCSI server" (internal or external to your network) and tell the agile probes to employ it instead to cheque your Internet status.

Disable the Active Probes

In order to disable the probes you need to change the post-obit registry key:

HKLM \SOFTWARE\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator

Setting the EnableActiveProbing DWORD value to 0 instead of 1 (which is the default value).

For boosted info regarding the active and passive probes and how they really work, we strongly suggest you to read this excellent Microsoft KB commodity.

Set an internal NCSI server

A NCSI server is nothing more than than a web application hosting a text file. To fix it up you need to have (or configure) an HTTP web server reachable by your PC and brand it publish a elementary .txt file containing a simple string of your selection (the 1 used by MS is "Microsoft NCSI"). Once yous did that, go to theregedit and navigate thru the following primal:

HKLM \System\CurrentControlSet\Services\NlaSvc\Parameters\Cyberspace

These are the settings you need to change to re-route the probes to your webserver's .txt file:

ActiveWebProbeHost (REG_SZ). Default value:www.msftncsi.com
ActiveWebProbePath (REG_SZ). Default value:ncsi.txt
ActiveWebProbeContent (REG_SZ). Default value: Microsoft NCSI

Depending on your network configuration settings, information technology could exist also required to create a dedicatedDNS zone for the webserver's domain proper noun in lodge to make it available to your internal network.

That's it for at present: happy networking!