Why Windows Shows No Internet While You Browse—and How to Fix NCSI

Windows can report “No Internet access” while web pages and apps continue to load — a confusing UI mismatch that’s usually harmless but can mask real network problems and make troubleshooting harder. A recent Guiding Tech how‑to lays out the common quick fixes and three deeper repairs — disabling IPv6, editing the NCSI registry probe values, and running SFC/DISM to repair corrupted system files — and offers practical step‑by‑step guidance for each approach.

Background / Overview​

Windows reports connectivity state using the Network Connectivity Status Indicator (NCSI), a small subsystem that performs active and passive checks to determine whether an interface has full internet access, captive‑portal access, or only local connectivity. Those checks include DNS queries and a lightweight HTTP probe to Microsoft’s connect test endpoints; when they fail (for legitimate reasons or false positives), Windows may show the yellow “no internet” icon even though apps and browsers can reach sites. This mismatch is a diagnostic nuisance: it interferes with captive‑portal popups, may confuse end users or support teams, and can cause system components that rely on NCSI to behave as if there’s no connectivity.
Most cases are transient UI glitches fixed by a reboot or a router power cycle, but there are recurring scenarios that trigger the icon reliably: proxy/VPN interference, restrictive firewall rules, misconfigured registry entries for NCSI, IPv6/DNS probe failures, and corrupted system network components. The following sections summarize verified causes, reproduceable fixes, and practical mitigation steps — with explicit warnings where system changes carry risk.

---

What triggers the “No Internet” icon while traffic works​

The NCSI probe mechanics (short)​

• Active probe (HTTP + DNS): Windows attempts a DNS lookup against a fixed probe host and then downloads a tiny text file from a Microsoft test URL. If both succeed the interface is marked as “Internet.” If either fails, NCSI may mark the interface as limited. The exact registry keys controlling these probes are under HKLM\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet. Microsoft documents the default probe hosts, probe content and the EnableActiveProbing flag there.
• Passive probe: Windows also makes passive observations of routing/hop counts and TCP success. On networks where active probing is blocked (corporate proxies, captive portals), passive detection can still mark connectivity correctly — but both systems interact and misconfiguration of either side can create inconsistent UI states.

Common real‑world causes​

• Local firewall or corporate proxy blocking the probe endpoints (or blocking HTTP port 80 to the probe hosts).
• VPNs or split‑tunnel rules that intercept or reroute probe traffic so NCSI can’t reach Microsoft endpoints.
• Registry or Group Policy disabling or changing the NCSI probe settings, intentionally or as a side‑effect of an update or security baseline.
• IPv6 vs IPv4 probing mismatch — NCSI probes both v4 and v6 by default; if IPv6 is present but not fully routed to the internet, the probe may fail and confuse the indicator.
• Corrupted system files or networking components that make Windows’ internal checks fail even though apps use their own stack successfully.
• Router/modem issues or misrouted DHCP responses that intermittently fail NCSI’s quick probes while allowing HTTP/TCP to succeed on retry.

---

Quick checklist (try these first)​

Before editing the registry or changing advanced settings, work through this short list. These steps fix the majority of UI mismatches and transient problems.

• Restart your PC and power‑cycle your router/modem.
• Disconnect VPNs and disable proxy settings temporarily (Settings > Network & Internet > Proxy).
• Reconnect to a different network (or switch Ethernet ports if using extenders) to rule out adapter/port issues.
• Temporarily disable any third‑party antivirus/firewall to verify interference.
• Run Windows Update and install any pending optional updates.
• From Settings > Network & Internet > Advanced network settings > Network reset, perform a network stack reset if other quick fixes fail.

These quick steps are sourced from common troubleshooting guidance and mirror the initial triage recommended in community and how‑to writeups.

---

Fix 1 — Disable IPv6 (when IPv6-related probes cause false negatives)​

Why: If your machine has an IPv6 address in the interface table but your ISP/router doesn’t provide usable IPv6 for outbound probes, NCSI’s IPv6 probe can fail while IPv4 traffic works fine. In mixed or poorly provisioned networks this can produce the “No Internet” icon.
Caveats:

• IPv6 is an increasingly used protocol — global metrics show IPv6 adoption varies by region and ISPs, and it is not universally “the default” everywhere. Disabling IPv6 is a troubleshooting step, not a permanent recommendation for networks that rely on IPv6. Use it only to diagnose the problem. (google.com, blog.apnic.net)

How to disable IPv6 on the adapter:

• Press Windows+R → type ncpa.cpl → Enter.
• Right‑click your active adapter → Properties.
• Uncheck “Internet Protocol Version 6 (TCP/IPv6)” → OK.
• Open an elevated Terminal/Command Prompt and run:
• ipconfig /flushdns

If this clears the icon, re‑enable IPv6 once you confirm the network path or firewall can handle IPv6 probes, or leave it disabled only for affected machines when IPv6 isn’t needed.

---

Fix 2 — Repair or reset NCSI probe settings in the Registry (use with care)​

What this does: NCSI probe behavior is configurable. The keys under:
HKLM\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet
hold the web probe host/path, DNS probe host, expected content, and the EnableActiveProbing DWORD. Microsoft documents these defaults and recommends keeping EnableActiveProbing = 1 for correct behavior. If policy or a misconfiguration flipped the NoActiveProbe policy under HKLM\SOFTWARE\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator, set it to 0 or remove it to restore active probing.
Recommended safe steps:

• Back up the registry (Registry Editor > File > Export) before changing anything.
• Open Run → regedit → confirm UAC.
• Paste HKLM\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet into the address bar.
• Confirm EnableActiveProbing is set to 1 (DWORD). If it’s 0, double‑click and change to 1.
• Verify that the following default probe values exist (strings, REG_SZ) — if missing, restore the defaults:
• ActiveDnsProbeContent: 131.107.255.255
• ActiveDnsProbeContentV6: fd3e:4f5a:5b81::1
• ActiveDnsProbeHost: dns.msftncsi.com
• ActiveDnsProbeHostV6: dns.msftncsi.com
• ActiveWebProbeContent: Microsoft Connect Test
• ActiveWebProbeContentV6: Microsoft Connect Test
• ActiveWebProbeHost: www.msftconnecttest.com
• ActiveWebProbeHostV6: ipv6.msftconnecttest.com
• Check HKLM\SOFTWARE\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator for a NoActiveProbe entry; if present and set to 1, set it to 0 or remove it.
• Reboot.

Alternative (safer for privacy‑focused setups): Instead of restoring Microsoft probe hosts, you may point DNS/web probe values to a known working resolver and web host you control (the Guiding Tech piece suggests using Google DNS as an alternative) — but note that deviating from Microsoft defaults changes how captive portals and some Windows components detect connectivity.
Risks and constraints:

• Disabling or altering NCSI probes can break captive‑portal detection, Windows Update behavior, Outlook/autodiscovery, and some enterprise management tools that depend on NCSI.
• Group Policy in managed environments can reapply values; coordination with IT is required for domain‑joined machines.
• Always export the registry keys before changing them so you can roll back.

---

Fix 3 — Repair corrupted system files (SFC + DISM)​

Why: If Windows’ network components are damaged or inconsistent after an update, NCSI checks can fail even when network I/O works for apps that circumvent the affected code paths. SFC (System File Checker) and DISM (Deployment Image Servicing and Management) are the standard, documented repair tools.
Verified procedure:

• Open Windows Terminal or Command Prompt as Administrator.
• Run DISM first to repair the Windows image:
• DISM /Online /Cleanup-Image /RestoreHealth
  (This step fetches replacement files from Windows Update if needed. If Windows Update itself is broken, DISM supports a /Source parameter with a matching WIM image.)
• After DISM finishes, run:
• sfc /scannow
• Reboot if fixes were applied.

Microsoft documents this exact workflow and recommends DISM before SFC so that SFC has a healthy image to copy from. If SFC reports corrupt files it can’t fix, the recommended next steps are DISM with a local source or a clean install in extreme cases. (support.microsoft.com, howtogeek.com)

---

Additional, evidence‑based troubleshooting steps​

• Reset the TCP/IP stack and Winsock:
• Open elevated Terminal.
• netsh int ip reset
• netsh winsock reset
• ipconfig /flushdns
• Reboot.
• Driver checks:
• Device Manager → Network adapters → update/uninstall and let Windows reinstall on reboot.
• If problems started after a driver update, roll back to the previous driver version.
• Router/proxy/firewall checks:
• Allow outbound HTTP/80 to .msftncsi.com and .msftconnecttest.com for NCSI probes, or ensure your proxy authenticates correctly for system probes. If your enterprise firewall uses IP rules, Microsoft recommends allowing the FQDNs rather than IP addresses because public probe endpoints have shifted to Akamai and can change IPs.
• Power management:
• In Device Manager, under adapter Properties → Power Management, uncheck “Allow the computer to turn off this device to save power.”
• Captive portals and proxies:
• If you rely on a captive portal or authenticated proxy, NCSI’s active probe may be intentionally blocked; in that case, use passive polling and ensure your network allows the redirect URL path so Windows can detect the portal. Microsoft documents captive‑portal behavior and explains when Windows opens the portal page.

---

Security, privacy and enterprise considerations​

• Privacy: NCSI active probes contact Microsoft‑hosted endpoints by design. For privacy‑sensitive environments, admins sometimes disable active probes — but this is a trade‑off: disabling them can make Windows think the device is offline and break dependent features. There are documented privacy and functional implications; weigh them before disabling NCSI probes permanently.
• Enterprise proxies and firewalls: Do not whitelist probe IPs in static firewall rules; Microsoft recommends permitting FQDNs and ensuring proxy authentication works for machine‑level probes. Microsoft moved public probe hosting to Akamai in mid‑2023, which changed how IP whitelists behave; relying on IPs is brittle.
• Group Policy and endpoint management: If the machine is domain‑joined or managed, GPOs can override local registry fixes and reintroduce a NoActiveProbe policy or disable passive polling. Coordinate changes with the security/compliance team.

---

On the claim “IPv6 became standard way back in 2025” — a fact check​

A Guiding Tech line suggests that “IPv6 became standard way back in 2025,” implying universal use. That phrasing overstates reality. IPv6 adoption has grown substantially, and regionally it is dominant in many networks, but the Internet remains dual‑stack for the foreseeable future. Public statistics show global IPv6 capability in the 40–50% range for user‑facing traffic to major platforms, with significant variance by country and operator. Disabling IPv6 can be useful for troubleshooting on networks where IPv6 is present but not fully functional, but it’s incorrect to assert IPv6 is already the universal standard everywhere. Treat IPv6 changes as network‑specific decisions rather than a universal fix. (google.com, blog.apnic.net)

---

When to escalate or seek professional help​

• If multiple devices on the same LAN show the same UI mismatch, the problem is likely the router/firewall or ISP and should be escalated to network support.
• If a registry or policy change is suspected in a domain environment, involve IT admins to avoid policy drift and compliance violations.
• If SFC/DISM consistently reports unrepairable system file corruption, plan for a clean install or image‑based repair after backing up data.
• If the machine is used for sensitive work and registry edits are not permitted, use the network reset and contact support rather than changing probe hosts.

---

Practical troubleshooting procedure (one‑page action plan)​

• Quick triage:
• Reboot PC and router, disconnect VPN, disable third‑party security temporarily.
• Short fixes:
• Network reset (Settings → Network & Internet → Advanced network settings → Network reset).
• Adapter and driver checks:
• Update/rollback driver in Device Manager.
• Diagnostic commands (run as admin), in sequence:
• ipconfig /flushdns
• netsh winsock reset
• netsh int ip reset
• ipconfig /release && ipconfig /renew
• If issue persists, run:
• DISM /Online /Cleanup-Image /RestoreHealth
• sfc /scannow
• If NCSI still shows “No Internet,” inspect and restore NCSI registry keys (backup first). Ensure EnableActiveProbing = 1 and NoActiveProbe policy = 0.
• As a last resort for temporary relief, disable IPv6 on the local adapter to see if the indicator changes; don’t make this permanent without understanding network requirements.

This sequence follows best practice repair order — reset network stack, repair image, then address NCSI specifics — and reflects Microsoft’s recommendations for SFC/DISM usage. (support.microsoft.com, howtogeek.com)

---

Final analysis — strengths, tradeoffs and risks​

Strengths of the documented fixes:

• They address the problem on three layers: connection (adapter/router), system integrity (SFC/DISM), and logic of detection (NCSI registry). That layered approach is robust and reproducible.
• Microsoft’s NCSI design and the registry knobs give administrators clear levers to troubleshoot without blind guessing. The official registry defaults are documented and restorable.

Notable tradeoffs and risks:

• Registry edits and policy changes: Changing NCSI probe hosts or disabling active probing hurts captive‑portal detection and can break other Windows services; always back up and test thoroughly in a controlled environment.
• Disabling IPv6: Temporarily useful for troubleshooting, but it may prevent access to IPv6‑only services and is not a long‑term “fix” on networks that are moving to IPv6.
• Over‑whitelisting probe IPs: Firewall rules that hardcode probe IPs are brittle; Microsoft’s probe host delivery moved to a CDN (Akamai) and IPs can change, so allow FQDNs or proxy‑aware rules instead.

When correctly followed, the combined approach — quick triage, image repair, and cautious registry repair — resolves the majority of “Windows shows no internet access but internet works” reports while minimizing collateral damage to network behavior and system services.

---

Windows’ “No Internet” indicator is a symptom, not a diagnosis: use the steps above to determine whether the problem is a flaky probe, a misrouted protocol (IPv6), a corrupted system image, or a network appliance blocking NCSI. Back up the registry before edits, coordinate with IT in managed environments, and prefer non‑invasive fixes (reboot, driver checks, DISM/SFC) before changing probe behavior. When in doubt, restore defaults and escalate to your ISP or network support — the indicator is useful, but the real goal is reliable, predictable connectivity for users and services.

---

Source: Guiding Tech Windows 11 Shows No Internet Access but Is Connected