Network Connectivity Status Indicator has a Yellow Bang in Windows Server 2008 or Later

This article provides information on network connectivity status indicator shows yellow bang in the system tray in Windows Server 2008 or later.

---

The Network Connectivity Status Indicator (NCSI), introduced in Windows Vista and Windows Server 2008, is part of the Network Location Awareness (NLA) service. The NLA service is responsible for determining the type of network or networks to which a Windows machine is connected, which affects the functionality of components such as the Windows Firewall and DirectAccess.

It is the job of the NCSI to determine whether a machine has access to the internet. It does this via a simple process. When a network connection is initially established, NCSI performs the following steps:

1. Issue a DNS query for www.msftmcsi.com.
2. Issue an HTTP GET request for the contents of http://www.msftmcsi.com/ncsi.txt.
3. Issue a DNS query for dns.msftncsi.com.

This process is known as active probing. If it is successful, the NCSI indicates that the machine has internet access. Once other applications begin sending and receiving internet traffic, NCSI begins passive probing, in which it uses other applications' TCP connections to determine whether the machine has internet access. If the NCSI cannot verify internet access, it will display a warning glyph that looks similar to this:



Hovering the mouse over the indicator gives information about the network connection's status:



If you unexpectedly encounter a warning such as this, there could be many reasons for it. The first step in troubleshooting should be to determine whether or not the machine is able to access the internet. Simply try to browse to a website that hasn't recently been browsed. If the page will not open, then the NCSI is likely working properly, and the issue should be treated like any other internet-access problem.

If you are able to access the internet but the NCSI still shows a warning, something may be blocking its probes. Likely culprits are third-party antivirus and firewall/security applications. If possible, remove or disable these temporarily and observe whether the NCSI warning disappears. You may restart the Network Location Awareness service or physically disconnect and reconnect the network adapter to force NCSI to initiate a probe.

If the affected machine is connected to a VPN, this can also cause the NSCI to display a false warning.

Because there is only a single NCSI, if there are multiple networks connected to a machine, the NCSI will display an aggregate status for all of them.

More information about the NCSI, including instructions for disabling it and for hosting a local NCSI server, can be found in The Network Connection Status Icon and Network Connectivity Status Indicator and Resulting Internet Communication in Windows 7 and Windows Server 2008 R2.

-

-