How do you Disable WPAD from doing DNS queries?

What;s the correct IP address for IPv6 to fix this mess?

The frequency dropped tremendously but did not 100% stop when I had all applications closed.

It was a couple of entries every 2 to 3 hours.

Path:

Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer
Policy:
“Disable changing Automatic Configuration settings”: Enabled

Registry Verification

Disable the WinHTTP Web Proxy Auto-Discovery Service
Disable WPAD Auto-Discovery

Service Status - Disabled ****Disable WPAD Fallback Mechanism
Disable WPAD DNSCache ****I can confirm all are set and verified.

I also checked the NIC Adapter Settings and saw nothing related to Proxy in it.

Still seeing wpad queries.

Next step is checking browser settings.
One troubleshooting step I am going to try is closing all browser and applications possible and leaving machine on for a several hours with no activity on it. See if wpad queries show or not.
This queries are happening constantly throughout the hour, so if all applications are closed and no queries happen at all, then that points to your third statement and could be the browser causing the traffic.

I will update tomorrow my finding of no activity with all applications closed. ****

Exact same problem on my side !

Can it be related to Group Policy Settings from ADMX for Windows 11 24H2 ?

EDIT: It is not related to Windows 11 ADMX for Windows 11 24H2. We just updated ours and these GPOs still do not exist.

Group Policy Settings

Make sure the following Group Policy settings are properly configured:

• Path:
  Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Connection Page
• Policies:
  • “Disable changing Automatic Configuration settings”: Enabled
  • “Disable Automatic Proxy Detection”: Enabled

Dear Joshua_C4T

Thank you for posting in the Microsoft community.

The issue of observing DNS lookups for wpad.domain.name in Windows 11 despite the steps you have taken to disable WPAD (Web Proxy Auto-Discovery Protocol) may be due to the fact that some system components or services are still attempting to perform auto-proxy discovery.

The following are the steps to further troubleshoot and resolve the issue.

Verify WPAD is Completely Disabled

Although you’ve already taken steps to disable WPAD, it’s important to ensure all relevant configurations are applied. Check the following critical points:

Group Policy Settings

Make sure the following Group Policy settings are properly configured:

• Path:
  Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Connection Page
• Policies:
  • “Disable changing Automatic Configuration settings”: Enabled
  • “Disable Automatic Proxy Detection”: Enabled

Additionally:

• Path:
  Computer Configuration -> Administrative Templates -> Windows Components -> Windows Network Connection Manager
• Policy:
  • “Turn off automatic proxy detection”: Enabled

Registry Verification

Double-check that these registry keys are correctly configured:

Disable the WinHTTP Web Proxy Auto-Discovery Service
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinHttpAutoProxySvc
Value Name: Start
Value Type: REG_DWORD
Value Data: 4 (Disabled)

Disable WPAD Auto-Discovery

Path:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad
Value Name: WpadOverride
Value Type: REG_DWORD
Value Data: 1

Service Status

Run the following command to ensure WinHTTP Web Proxy Auto-Discovery Service is stopped and disabled:

sc query WinHttpAutoProxySvc

If the service isn’t disabled, use this command to disable it:

sc config WinHttpAutoProxySvc start= disabled

2. Disable WPAD Fallback Mechanism

Even if WinHTTP Auto Proxy service is disabled, certain Windows components may still attempt WPAD queries through other mechanisms like DNS or DHCP. Take the following additional steps:

Disable WPAD DNS and DHCP Queries

Adjust Registry

Path:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNSCache\Parameters
Value Name: DisableAutoProxy
Value Type: REG_DWORD
Value Data: 1

This will stop the system from performing WPAD lookups using DNS.

Disable WPAD via DHCP

Path:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
Value Name: EnableDHCP
Value Type: REG_DWORD
Value Data: 0

Note: Disabling DHCP may impact network connectivity if your environment relies heavily on DHCP for IP assignments. Proceed with caution.

Disclaimer: Modifying the registry or workgroups is usually geared towards advanced users, administrators, and IT professionals, and it can help fix some problems, however, improper registry modifications can cause serious problems. Therefore, please make sure to strictly follow the steps below. For further protection, make a backup of the registry before modifying it. For more information on how to backup and restore the registry ref:

How to back up and restore the registry in Windows - Microsoft Support

3. Check Browser and Application Settings

Certain browsers (e.g., Microsoft Edge, Google Chrome) and applications may independently attempt proxy auto-discovery. Ensure the following settings are disabled:

Microsoft Edge/Internet Explorer

• Open Internet Options (inetcpl.cpl), go to Connections -> LAN Settings.
• Make sure “Automatically detect settings” is unchecked.

Google Chrome

Chrome depends on the system proxy settings but may still trigger WPAD queries. To disable it, launch Chrome with the following command-line flag:

chrome.exe --no-proxy-server

4. Check Network Adapters and Other Services

Certain network adapters or third-party software may trigger WPAD queries:

Disable Auto Proxy Detection on Network Adapters

1. Open Device Manager.
2. Locate your network adapter.
3. Check if there are advanced settings related to auto-proxy detection (varies by adapter model and drivers).

Review Third-Party Software

Some security software (e.g., firewalls, VPN clients) may trigger WPAD queries. Temporarily disable or review their configurations to ensure they’re not causing the issue.

5. Use Network Monitoring Tools for Further Troubleshooting

If WPAD queries persist despite these changes, network monitoring tools can help identify the source. Recommended tools include:

• Wireshark: Use it to capture network traffic and filter for wpad DNS traffic to identify the process or service triggering the queries.
  Filter:
  dns && frame contains "wpad"
• Sysinternals Process Monitor (ProcMon): Monitor registry and network activity to trace operations related to wpad.

6. Forcefully Block WPAD Queries

If disabling WPAD by configuration still doesn’t resolve the issue, consider blocking it at the network or system level:

Modify Local Hosts File

Point wpad to localhost to prevent resolving via DNS:
Path: C:\Windows\System32\drivers\etc\hosts
Add the following line:

127.0.0.1 wpad 

Block WPAD on DNS Server

If you manage the DNS server, create a DNS record for wpad and point it to an invalid IP address (e.g., 0.0.0.0).

Conclusion

By following these steps, you should be able to completely disable WPAD-related DNS queries. If the problem persists, it’s essential to use tools like Wireshark or ProcMon to identify which process or service is responsible for the queries and take targeted action.

Best Wish

Shawn.Z-MSFT | Microsoft Community Support Specialist