winhttp web proxy auto-discovery service – TechNet Microsoft
Remove From My Forums
Question
Anyone knows what is the recommended status for this service. We have encountered many issues due to this service. So we have frequently changes it from “Disabled, Manual, Automatic” etc. I’m trying to figure out what is recommended from Microsoft
about this service.
Edited by
Tuesday, March 5, 2019 9:29 PM
Answers
Hi,
Web Proxy Autodiscovery (WPAD) is a proposed Internet protocol that allows a client, such as a Web browser or a
streaming media application, to automatically locate and interface with cache services in a network so that information can be delivered more quickly to the user. Autoproxy makes it easier for WinHTTP applications to configure necessary proxy settings. This
feature takes away the responsibility of knowing proxy settings from the end user.
As far as I know, thisis service starts and stops as needed so there shouldn’t be any reason in particular to disable
it.
That said, if you don’t have a proxy, there’s no need for it. There are no dependencies on this service by other
services.
Regards, Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact
Proposed as answer by
Carl FanMicrosoft contingent staff
Sunday, March 10, 2019 6:02 AM
Marked as answer by
Curious to know
Tuesday, July 30, 2019 9:14 PM
Web Proxy Auto-Discovery Protocol – Wikipedia
The Web Proxy Auto-Discovery l Protocol is a method used by clients to locate the URL of a using and/or DNS discovery methods. Once detection and download of the configuration file is complete, it can be executed to determine the proxy for a specified URL.
History[edit]
The WPAD protocol only outlines the mechanism for discovering the location of this file, but the most commonly deployed configuration file format is the proxy auto-config format originally designed by Netscape in 1996 for Netscape Navigator 2. 0. [1]
The WPAD protocol was drafted by a consortium of companies including Inktomi Corporation, Microsoft Corporation, RealNetworks, Inc., and Sun Microsystems, Inc. (now Oracle Corp. ). WPAD is documented in an INTERNET-DRAFT which expired in December 1999. [2] However, WPAD is still supported by all major browsers. [3][4] WPAD was first included with Internet Explorer 5. 0.
Context[edit]
In order for all browsers in an organization to be supplied the same proxy policy, without configuring each browser manually, both the below technologies are required:
Proxy auto-config (PAC) standard: create and publish one central proxy configuration file. Details are discussed in a separate article.
Web Proxy Auto-Discovery Protocol (WPAD) standard: ensure that an organization’s browsers will find this file without manual configuration. This is the topic of this article.
The WPAD standard defines two alternative methods the system administrator can use to publish the location of the proxy configuration file, using the Dynamic Host Configuration Protocol (DHCP) or the Domain Name System (DNS):
Before fetching its first page, a web browser implementing this method sends a DHCPINFORM query to the local DHCP server, and uses the URL from the WPAD option in the server’s reply. If the DHCP server does not provide the desired information, DNS is used. If, for example, the network name of the user’s computer is, the browser will try the following URLs in turn until it finds a proxy configuration file within the domain of the client:
(in incorrect implementations, see note in Security below)
(Note: These are examples and are not “live” URLs due to them employing the reserved domain name of “”. )
Additionally on Windows if the DNS query is unsuccessful then Link-Local Multicast Name Resolution (LLMNR) and/or NetBIOS will be used. [5][6]
Notes[edit]
DHCP has a higher priority than DNS: if DHCP provides the WPAD URL, no DNS lookup is performed. This only works with DHCPv4. In DHCPv6, there is no WPAD-Option that Firefox does not support DHCP, only DNS, and the same is true for Chrome on platforms other than Windows and ChromeOS, and for versions of Chrome older than version 13. [3][4]
When constructing the query packet, DNS lookup removes the first part of the domain name (the client host name) and replaces it with wpad. Then, it “moves up” in the hierarchy by removing more parts of the domain name, until it finds a WPAD PAC file or leaves the current organisation.
The browser guesses where the organisation boundaries are. The guess is often right for domains like ” or ”, but wrong for ” (see security below).
For DNS lookups, the path of the configuration file is always For the DHCP protocol, any URL is usable. For traditional reasons, PAC files are often called (of course, files with this name will be ignored by the WPAD DNS search).
The MIME type of the configuration file must be “application/x-ns-proxy-autoconfig”. See Proxy auto-config for more details.
Internet Explorer and Konqueror are currently the only browsers offering support for both the DHCP and DNS methods; the DNS method is supported by most major browsers. [7]
Requirements[edit]
In order for WPAD to work, a few requirements have to be met:
In order to use DHCP, the server must be configured to serve up the “site-local” option 252 (“auto-proxy-config”) with a string value of e. g. where “” is the address of a Web server.
In order to use the DNS only method, a DNS entry is needed for a host named WPAD.
The host at the WPAD address must be able to serve a Web page.
In both cases, the Web server must be configured to serve the WPAD file with a MIME type of application/x-ns-proxy-autoconfig.
If the DNS method is used, a file named must be located in the WPAD Web site’s root directory.
The PAC files are discussed in the Proxy auto-config article.
Use caution when configuring a WPAD server in a virtual hosting environment. When automatic proxy detection is used, WinHTTP and WinINET in Internet Explorer 6 and earlier send a “Host:
Internet Explorer version 6. 2900. 2180. xpsp_sp2_rtm requests “” instead of “” from the Web server.
If you are using Windows Server 2003 (or later) as your DNS server, you might have to disable the DNS Server Global Query Block List, or even modify the registry to edit the list of blocked queries. [8][9]
Security[edit]
While greatly simplifying configuration of one organisation’s web browsers, the WPAD protocol has to be used with care: simple mistakes can open doors for attackers to change what appears on a user’s browser:
An attacker inside a network can set up a DHCP server that hands out the URL of a malicious PAC script.
If the network is ” and the file isn’t served, the browsers will go on to request. Before the introduction of the Public Suffix List in the 2010s, some browsers could not determine that was no longer inside the organization. See for an example.
The same method has been used with. This used to serve a file that would redirect all of the user’s traffic to an internet auction site.
ISPs that have implemented DNS hijacking can break the DNS lookup of the WPAD protocol by directing users to a host that is not a proxy server.
Leaked WPAD queries could result in domain name collisions with internal network naming schemes. If an attacker registers a domain to answer leaked WPAD queries and configures a valid proxy, there is potential to conduct man-in-the-middle (MitM) attacks across the Internet. [10]
Through the WPAD file, the attacker can point users’ browsers to their own proxies and intercept and modify all of WWW traffic. Although a simplistic fix for Windows WPAD handling was applied in 2005, it only fixed the problem for the domain. A presentation at Kiwicon showed that the rest of the world was still critically vulnerable to this security hole, with a sample domain registered in New Zealand for testing purposes receiving proxy requests from all over the country at the rate of several a second. Several of the domain names (including COM, NET, ORG, and US) now point to the client loopback address to help protect against this vulnerability, though some names are still registered ().
Thus, an administrator should make sure that a user can trust all the DHCP servers in an organisation and that all possible wpad domains for the organisation are under control. Furthermore, if there’s no wpad domain configured for an organisation, a user will go to whatever external location has the next wpad site in the domain hierarchy and use that for its configuration. This allows whoever registers the wpad subdomain in a particular country to perform a man-in-the-middle attack on large portions of that country’s internet traffic by setting themselves as a proxy for all traffic or sites of interest.
On top of these traps, the WPAD method fetches a JavaScript file and executes it on all users browsers, even when they have disabled JavaScript for viewing web pages.
References[edit]
^ “Navigator Proxy Auto-Config File Format”. Netscape Navigator Documentation. March 1996. Archived from the original on 2007-03-07. Retrieved 2015-02-10.
^ Gauthier, Paul; Josh Cohen; Martin Dunsmuir; Charles Perkins (1999-07-28). “Web Proxy Auto-Discovery Protocol (INTERNET-DRAFT)”. IETF. Retrieved 2015-02-10.
^ a b “Chromium #18575: Non-Windows platforms: WPAD (proxy autodetect discovery) does not test DHCP”. 2009-08-05. Retrieved 2015-02-10.
^ a b “Firefox #356831 – Proxy autodiscovery doesn’t check DHCP (option 252)”. 2006-10-16. Retrieved 2015-02-10.
^ “Troubleshooting Web Proxy Auto Discovery (WPAD) issues”. GFI Software. Retrieved 2015-02-10.
^ Hjelmvik, Erik (2012-07-17). “WPAD Man in the Middle”. Retrieved 2015-02-10.
^ “Konqueror: Automatic Proxy Discovery”. KDE. 2013-05-20. Retrieved 2015-02-10.
^ King, Michael (2010-02-17). “WPAD does not resolve in DNS”. Retrieved 2015-02-10.
^ “Removing WPAD from DNS block list”. Microsoft TechNet. Retrieved 2015-02-10.
^
“Alert (TA16-144A) WPAD Name Collision Vulnerability”. US-CERT. 2016-10-06. Retrieved 2017-05-02.
Further reading[edit]
de Boyne Pollard, Jonathan (2004). “Automatic proxy HTTP server configuration in web browsers”. Frequently Given Answers.
Jim Groves (November 2007). “DNS Server Global Query Block List”.
“PAC File & WPAD Examples”. 2015-09-18.
How to Disable LLMNR, Netbios, WPAD, & LM Hash – Blumira
NOTE: All below settings should be completely tested in specific environments prior to changing. Many legacy products unfortunately rely on these outdated methods of name resolution, performing these actions can be damaging to your environment. If you have a healthy DNS infrastructure and you are sure that lookups go through your DNS and not through local lookup, you should be generally OK.
Disable LLMNR
Open
Goto Computer Configuration -> Administrative Templates -> Network -> DNS Client
Click on “Turn Off Multicast Name Resolution” and set it to “Enabled”
Disable NetBios
You can’t disable netbios directly within group policy, but there are a few different ways that you can..
Via PowerShell
Via registry settings
set-ItemProperty HKLM:SYSTEMCurrentControlSetservicesNetBTParametersInterfacestcpip* -Name NetbiosOptions -Value 2
Disable/Configure WPAD
To disable WPAD you must turn off the automatic proxy configuration settings option in Internet Explorer
In group policy, expend User Configuration>Administrative Templates>Windows Components>Internet Explorer>Disable changing Automatic Configuration settings
Another option is to configure WPAD, as this will make poisoning the entry impossible.
Disable LM Hash
If you are running an older forest functional level the LMhash is an older hash that is easily cracked that stores AD credentials which you can turn off using group policy.
In Group Policy, expand Computer Configuration>Windows Settings>Security Settings>Local Policies>Security Options>Network security: Do not store LAN Manager hash value on next password change.
Note: After forest functional level 2008, this is set to enabled by default
Additional Resources:
MITRE: Man-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay
Beyond LLMNR/NBNS Spoofing – Exploiting Active Directory-Integrated DNS
How To Disable LLMNR & Why You Want To
Contact Us
Have questions or want to learn more about Blumira? We’re happy to help.
Frequently Asked Questions about the winhttp web proxy auto discovery
What is proxy auto-discovery?
The Web Proxy Auto-Discovery (WPAD) Protocol is a method used by clients to locate the URL of a configuration file using DHCP and/or DNS discovery methods. Once detection and download of the configuration file is complete, it can be executed to determine the proxy for a specified URL.
How do I turn off auto proxy on Discovery?
Disable LLMNROpen gpedit.msc.Goto Computer Configuration -> Administrative Templates -> Network -> DNS Client.Click on “Turn Off Multicast Name Resolution” and set it to “Enabled”
How do I stop WinHTTP?
Go to the “General” tab, and under “Service Status,” click on the “Stop” button. Click on “Apply.” This stops the service within the current Windows session.
