[Windows Client] Applications Report No Internet Connection While Twingate Is Connected

Applicable to:

• Twingate Component: Client

• Platform: Windows

Overview

Certain applications refuse to start or report that you are offline while the Twingate Client is connected, even though internet access is working normally. Browsers, email and general web traffic are unaffected. Disconnecting the Twingate Client makes the affected applications work again.

This happens because Windows has marked the connection as local only, and those applications check that status with Windows before they will run.

Symptoms

• Microsoft Store fails with "you'll need the internet for this"

• Spotify will not connect or stays offline

• The network icon may show limited or no internet access

• Browsers, DNS resolution and access to Twingate Resources all continue to work normally

• Everything recovers as soon as the Twingate Client is disconnected

In the Windows Event Viewer, under Applications and Services Logs > Microsoft > Windows > NCSI > Operational, Event 4042 is logged:

Capability: Local  ChangeReason: SuspectDnsProbeFailed

Cause

Windows checks whether a device is online using a component called the Network Connectivity Status Indicator (NCSI). Part of that check is a DNS query, and NCSI sends it on each network adapter separately, using the DNS server configured on that adapter.

While the Twingate Client is connected, DNS sent over UDP to any server other than Twingate's own resolver is not delivered. This is intended behavior and is described in Using nslookup with Manually Defined Nameserver Fails on Windows with Twingate Client Running. The Windows connectivity check is affected by it, receives no reply, and records the connection as local only.

Most software is unaffected because ordinary name resolution still works through Twingate. The applications that break are the ones that ask Windows whether the device is online before doing anything.

Windows provides a setting that changes this. NCSI_GlobalDns allows the connectivity check to resolve on any adapter rather than only the one being tested, so it can use Twingate's resolver and succeed. Microsoft describes the policy as: "NCSI by default will restrict DNS lookups to the interface it's currently probing on. If you enable this setting, NCSI will allow the DNS lookups to happen on any interface." See Microsoft's ADMX_NCSI policy reference.

Resolution

Run the following from an elevated Command Prompt or PowerShell. Right click and choose Run as administrator.

1. Check whether the setting is already present:

reg query "HKLM\Software\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator" /v UseGlobalDns

On most devices this returns ERROR: The system was unable to find the specified registry key or value, which means it is not set.

2. Enable it:

reg add "HKLM\Software\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator" /v UseGlobalDns /t REG_DWORD /d 1 /f

3. Open the affected application again. If Windows still reports no internet, restart the device and retry.

To revert the change:

reg delete "HKLM\Software\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator" /v UseGlobalDns /f

This corrects the Windows connectivity check only. DNS queries that name a specific external DNS server will still time out while the Twingate Client is connected, which remains expected behavior.

If many devices are affected

The Windows Client installer can apply this at install time with ncsi_global_dns=true, which writes the same registry value. This is the preferred approach when deploying the Client across a fleet. It applies during installation only, so devices that already have the Client installed will need the registry change above.

→ Windows Managed Devices