This article provides information regarding the presence of a yellow bang on the network connectivity status indicator in the system tray in Windows Server 2008 or later.
The Network Connectivity Status Indicator (NCSI), introduced in Windows Vista and Windows Server 2008, is part of the Network Location Awareness (NLA) service. The NLA service is responsible for determining the type of network or networks to which a Windows machine is connected, which affects the functionality of components such as the Windows Firewall and DirectAccess.
It is the job of the NCSI to determine whether a machine has access to the internet. It does this via a simple process. When a network connection is initially established, NCSI performs the following steps:
- Issue a DNS query for www.msftmcsi.com.
- Issue an HTTP GET request for the contents of http://www.msftmcsi.com/ncsi.txt.
- Issue a DNS query for dns.msftncsi.com.
This process is known as active probing
. If it is successful, the NCSI indicates that the machine has internet access. Once other applications begin sending and receiving internet traffic, NCSI begins passive probing
, in which it uses other applications' TCP connections to determine whether the machine has internet access. If the NCSI cannot verify internet access, it will display a warning glyph that looks similar to this:
Hovering the mouse over the indicator gives information about the network connection's status:
If you unexpectedly encounter a warning such as this, there could be many reasons for it. The first step in troubleshooting should be to determine whether or not the machine is able to access the internet. Simply try to browse to a website that hasn't recently been browsed. If the page will not open, then the NCSI is likely working properly, and the issue should be treated like any other internet-access problem.
If you are able to access the internet but the NCSI still shows a warning, something may be blocking its probes. Likely culprits are third-party antivirus and firewall/security applications. If possible, remove or disable these temporarily and observe whether the NCSI warning disappears. You may restart the Network Location Awareness service or physically disconnect and reconnect the network adapter to force NCSI to initiate a probe.
If the affected machine is connected to a VPN, this can also cause the NSCI to display a false warning.
Because there is only a single NCSI, if there are multiple networks connected to a machine, the NCSI will display an aggregate status for all of them. This can cause false indications, as explained in Microsoft Knowledgebase article KB947041
More information about the NCSI, including instructions for disabling it and for hosting a local NCSI server, can be found in The Network Connection Status Icon
and Network Connectivity Status Indicator and Resulting Internet Communication in Windows 7 and Windows Server 2008 R2
Quick Tips content is self-published by the Dell Support Professionals who resolve issues daily. In order to achieve a speedy publication, Quick Tips may represent only partial solutions or work-arounds that are still in development or pending further proof of successfully resolving an issue. As such Quick Tips have not been reviewed, validated or approved by Dell and should be used with appropriate caution. Dell shall not be liable for any loss, including but not limited to loss of data, loss of profit or loss of revenue, which customers may incur by following any procedure or advice set out in the Quick Tips.