DNS Cache service - secret source of telemetry?

Discussion in 'Windows 10' started by DirtyAngelicaSecured, Dec 30, 2020.

  1. DirtyAngelicaSecured

    Mar 30, 2020
    101
    17
    10
    My network devices were fast enough to a point where DNS caching did not improve performance and such caching was disabled to reduce attack surface and chances of DNS cache poisoning.

    Just to test performance differences, I re-enabled DNS Cache service in Windows and noticed in my firewall log that Windows 10 OS began reaching out to random Microsoft Telemetry, Update, and other Spyware IP's I blocked a long time ago. I tested my theory by disabling DNS Cache service, rebooting, testing, then re-enabling DNS Cache service. Each time there was the same result - Windows 10 OS reaching out to all kinds of telemetry IP's when DNS Cache service was enabled. Windows OS never reached out to the same blocked IP's when DNS Cache service was disabled.

    Built-in MS Telemetry could be the reason why there wasn't even a way to disable Windows DNS Cache service in newer Windows 10 OS builds via Services.msc, even if you used Trusted Installer privileges. The only way to disable it was to use Autoruns.

    On top of that, enabling DNS Cache service made Windows 10 MS attempt to use outbound ICMP to some MS IP's and use other blocked network protocols that were never used without that service. MS integrated much more than simple DNS Caching into later Windows 10 OS DNS Caching service...
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  2. RobrPatty

    RobrPatty MDL Expert

    Jul 23, 2009
    1,286
    598
    60
    Just go to C:\Windows\System32\svchost allow permission. Reboot Then stop and disable DNS Client in services. Thx for info DirtyAngelicaSecured.