How to Disable WPAD on Windows 10 and Actually Stop the DNS Queries

ByPriya Nair

The Settings toggle helps. It isn’t enough.

If Windows 10 is flooding your Pi-hole with queries for wpad and isatap, you’ve probably already found Settings > Network & Internet > Proxy > Automatically detect settings and switched it off. The query count drops a little. Then it keeps going. That’s not a bug in your Pi-hole — it’s a second WPAD detection path that the toggle doesn’t touch.

WPAD stands for Web Proxy Auto-Discovery Protocol. Windows uses it to find a proxy configuration file on your network without manual setup. The mechanism works by sending DNS queries for a host named wpad before any outbound connection is made. Turning off the Settings toggle controls what Internet Explorer-era code and most browsers see. It does nothing about WinHTTP, the lower-level Windows HTTP library used by system services like Windows Update and various RPC components — and WinHTTP has its own WPAD detection path.

Don’t disable the service

A common suggestion is to stop the WinHTTP Web Proxy Auto-Discovery Windows service entirely. Don’t. Several Windows components — KDC proxy, Remote Desktop Gateway, DirectAccess — check at runtime whether the service is running and silently break when it isn’t, even if they don’t actually need WPAD. The service needs to stay up; what needs to change is the behaviour.

The registry key that actually stops WinHTTP-level queries

Microsoft added a dedicated registry DWORD for this starting in Windows 10 version 1809. Set it and leave the service alone:

Path:  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp
Name:  DisableWpad
Type:  DWORD (32-bit)
Value: 1

From an elevated PowerShell prompt:

Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp' -Name 'DisableWpad' -Value 1 -Type DWord

No reboot required. The WinHTTP service picks up the change as existing sessions cycle out.

One important caveat from the Microsoft documentation: even with this key set, applications can still resolve wpad by calling DNS directly rather than going through the WinHTTP API. The key kills the automatic proxy detection calls; a determined app can still do an explicit DNS lookup. For the overwhelming majority of Windows 10 systems on a home or small-office network, setting this key is what makes the Pi-hole logs go quiet.

Cover the legacy Internet Settings path too

The Settings proxy toggle writes to the current user’s registry hive. To cover all user accounts on the machine and apply it as a policy, set it in the machine-wide Policies location as well:

Path:  HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Name:  AutoDetect
Type:  DWORD (32-bit)
Value: 0

PowerShell version:

$p = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings'
if (!(Test-Path $p)) { New-Item -Path $p -Force | Out-Null }
Set-ItemProperty -Path $p -Name 'AutoDetect' -Value 0 -Type DWord

Killing the ISATAP queries separately

ISATAP is an IPv6 transition tunnelling mechanism. Windows probes for it by name through DNS, which is why you see isatap queries alongside wpad in the logs. They’re different protocols; you disable ISATAP via netsh, not the registry. From an elevated Command Prompt:

netsh interface isatap set state disabled

Confirm it took:

netsh interface isatap show state

If you want to silence Teredo and 6to4 as well — two other IPv6 transition technologies that generate their own DNS noise — add:

netsh interface teredo set state disabled
netsh interface 6to4 set state disabled

These changes are persistent across reboots.

Why disabling WPAD is good security practice, not just housekeeping

The DNS noise is the immediate annoyance. The real risk is bigger. WPAD is a legitimate attack vector on any network you don’t fully control. On an open Wi-Fi network, a rogue device can answer WPAD DNS queries with a malicious PAC file. That file redirects your traffic through an attacker-controlled proxy — silently, before you load a single page. HTTPS doesn’t fully protect you: the PAC file sees the destination URL of every request, including encrypted ones. SentinelOne documented multi-year in-the-wild abuse campaigns built entirely on this. Researchers at Google Project Zero also chained WPAD flaws to achieve full machine compromise by attacking the Windows JScript engine used to interpret PAC files. Turning WPAD off is worthwhile on its own merits, not just to clean up a busy DNS log.

Rolling this out across multiple machines with GPO

If you manage more than a couple of Windows boxes, Group Policy is cleaner than touching the registry by hand. The DisableWpad WinHTTP key can be deployed as a GPO Preferences registry entry under Computer Configuration > Preferences > Windows Settings > Registry. The legacy auto-detect setting lives under Computer Configuration > Administrative Templates > Windows Components > Internet Explorer. Combining both in one GPO gives you coverage at both the WinHTTP layer and the Internet Settings layer across the whole fleet in one push.

Verifying the fix

After applying the registry changes and disabling ISATAP, let Pi-hole run for a few minutes and watch the query log. The wpad and isatap entries should stop appearing. You can also check from PowerShell that Windows itself is no longer resolving the name automatically:

Resolve-DnsName wpad -ErrorAction SilentlyContinue

If the Pi-hole log goes quiet and that command returns nothing, you’re done.

Sources


Similar Posts