How do you Disable WPAD from doing DNS queries?

@Joshua_C4T

*** UPDATE ***

It appears that if I DO NOT disable the WinHTTP Web Proxy Auto-Discovery Service but instead put the value to "3" (Manual) and add the 4 registry key listed below, I have now literally no more WPAD DNS request at all !!!! I have Wireshark my connection for 2 hours straight and no more request at all ...

Please take note that I have applied all these modifications through a GPO.

Disable the WinHTTP Web Proxy Auto-Discovery Service
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinHttpAutoProxySvc
Value Name: Start
Value Type: REG_DWORD
Value Data: 3 (Manual)

Disable WPAD (Web Proxy Auto-Discovery) (Key #1)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp

Value Name: DisableWpad

Value Type: REG_DWORD
Value Data: 1

Disable WPAD (Web Proxy Auto-Discovery) (Key #2)

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings

Value Name: AutoDetect

Value Type: REG_DWORD
Value Data: 0

Disable WPAD Auto-Discovery

Path:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad
Value Name: WpadOverride
Value Type: REG_DWORD
Value Data: 1

Disable WPAD DNS Fallback Mechanism

Path:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNSCache\Parameters
Value Name: DisableAutoProxy
Value Type: REG_DWORD
Value Data: 1

This will stop the system from performing WPAD lookups using DNS.

2 full reboot are required after you applied the GPO for the service and the reg. keys.

Hi Shawn.Z - MSFT.

What about the fact that these GPOs settings do not exist by default under Windows 11 ?

Is there any set of specific ADMX that needs to be applied in order to view these options ?

Group Policy Settings

Make sure the following Group Policy settings are properly configured:

• Path:
  Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Connection Page
• Policies:
  • “Disable changing Automatic Configuration settings”: Enabled
  • “Disable Automatic Proxy Detection”: Enabled

Additionally:

• Path:
  Computer Configuration -> Administrative Templates -> Windows Components -> Windows Network Connection Manager
• Policy:
  • “Turn off automatic proxy detection”: Enabled

The key thing is it is still happening with the Browsers closed, so it is not specifically the browser. If it only happened when the browser were opened you can for sure say the browsers is doing the communication. But with none of them being opened and still doing it, it isn't the browsers giving off the communication.

I was working on putting all those settings on a couple of other machines to make sure it wasn't just my machine that the traffic remained. I can confirm with those settings in place on multiple machines we are still seeing wpad DNS Queries.

I was working on getting to your step 5 to see if we can narrow it down to the application or process doing the communication.

Still working through all, but wanted to update:

This does not exist:
Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Connection Page

This does not exist:
Computer Configuration -> Administrative Templates -> Windows Components -> Windows Network Connection Manager

We did already enable this policy:
Policies:

“Disable changing Automatic Configuration settings”: Enabled
At this location:
Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer

I can confirm both of these registries are in place:
Disable the WinHTTP Web Proxy Auto-Discovery Service
Disable WPAD Auto-Discovery

I can confirm WinHttpAutoProxySvc is in the Stopped state and if you look at Service Manager it says Disabled