Windows has a component internally that identifies any change in the connectivity of the network. It is called as “Network Connectivity Status Indicator” or NCSI as many would know it. NCSI is mainly responsible for detecting the Internet connectivity status and is part of NlaSvc (Network Location Awareness service). One of its tasks is to perform a background testing to determine if the machine has Internet connectivity or not. Here, Network location awareness or NLA works in coordination with NCSI. NLA determines if the network connection is in a domain or public network to define a proper firewall profile. The NCSI constantly reverts to the changes in the network conditions. It also examines the status of a network connection in many ways. To understand why pop-ups are happening the article below is structured into below three parts, it is imperative that you go through all of them-

How NCSI functions

The first thing NCSI does whenever a network configuration event or any changes in network configuration occur is that it performs several tests to identify the network’s connectivity status. It tries to reach http://www.msftncsi.com, a simple Web site that exists only to support the functionality of NCSI.NCSI performs DNS query for www.msftncsi.com. Next, HTTP contacts the website http://www.msftncsi.com/ncsi.txt. The request is sent via a plain text file with only content as “Microsoft NCSI”, thus safeguarding the privacy of user’s information. Then, NCSI performs a DNS query for dns.msftncsi.com.This entire process runs in an active mode. However, when other programs create Internet traffic, NCSI turns to the passive monitoring process and continue to identify any change in the network status. While performing these tasks, NCSI downloads a text file from the Windows site. Like for Windows 8.1 and earlier versions, it is http://www.msftncsi.com/ncsi.txt website. And for Windows 10 it is http://www.msftconnecttest.com/connecttest.txt

NCSI and Internet Explorer and Edge popup

You may be wondering how NCSI affects the pop-up window process in Internet Explorer or Edge. The reason for this pop-up is that the NCSI sometimes cannot contact the website due to some infrastructure limitations. Therefore, NCSI performs some passive probe processes. It determines if the system has internet access due to the network usage. The Internet Explorer or Edge pop-up mostly occurs in Windows version of 8 and higher. For understanding below is a simple example,

Internet Explorer and Edge popup with internet change

Consider you have a good local network for your internet connection and it has neither proxy nor Firewall limitation. As a result, NCSI will perform all its tasks smoothly and will show your proper connection. Now, when you go out and try to connect to a public Wi-Fi hotspot of that place. It may have the limitation of some sort of easy login. When you switch “ON” your machine, there will be a Yellow Bang mark in your NIC and a “No internet” connectivity message when you check your NIC.

For Windows 7 and below users

Windows with version 7 will display a message for a very short time stating that you need further actions to connect fully. So, there will be no internet until the browser is opened and the requirements are matches from the Wi-Fi hotspot to log in. After that, a normal connection will be displayed on your machine. Eventually, even the yellow bang mark will go off.

For Windows 8 and above users

Now, in recent Windows versions, to make the user experience more comfortable for the normal user, when the machine detects some login, it will immediately open the browser, so you can easily see the login requirements without opening the browser manually.

Why a popup at the corporate place with no Wi-Fi hotspot

The next query that may come to your mind is that why there is an Internet Explorer or Edge popup at a company or corporate network where there are no Wi-Fi hotspots in place. The reason for this is the proxy connection at the office, and Windows not being able to contact the NCSI website directly. In such cases, the proxy will be contacted in the background and, usually, the proxy will require authentication, and after it is authenticated, it will send you to http://www.msftconnecttest.com/redirect. This URI will redirect you to the MSN Portal. It’s a hotspot-like behavior. Hence, this is why you get a pop-up.

How to stop the pop-ups

It has been observed that Antivirus and third-party firewalls may even block the URL– http://www.msftncsi.com/ncsi.txt leading to limited access status in the taskbar in spite of Internet connection may even have issues. These issues can be resolved by just adding “*.msftncsi.com” to the list of trusted URLs. Still, if you feel that Internet Explorer and Edge pop-up is irritating, below are the steps to prevent the proxy from coming into action in the NCSI process and to avoid the passive probe process – Simply whitelist the below addresses directly on your firewall over port 80 only:

 .msftncsi.com.msftconnecttest.com

With these simple steps, you can avoid that pop-up behavior of Internet Explorer and Edge completely. However, you should also remember that this behavior aids you in saving a lot of time of troubleshooting! Source: Technet.