0
In Windows, there is a service named DNS Client service (dnscache) caches DNS names and registers the full computer name. When it is running only svchost.exe connects to DNS server. Then I stop and delete that service with the following process::
Set dependency of Network Store Interface Service (NSI) to only Remote Procedure Call (RPCSS)::
reg add "HKLM\SYSTEM\CurrentControlSet\Services\nsi" /V "DependOnService" /T REG_MULTI_SZ /D "RPCSS" /F
Set dependency of Network Connectivity Assistant Service (NcaSvc) to only Base Filtering Engine (BFE)::
reg add "HKLM\SYSTEM\CurrentControlSet\Services\NcaSvc" /V "DependOnService" /T REG_MULTI_SZ /D "BFE" /F
- Stop & Delete DNScache service::
sc stop "Dnscache" & sc delete "Dnscache"
After deleteing DNScache service, every executable file which is connected to internet (including every browser) send & receive DNS packets (with netstat). With this process, it is obvious that Windows does not save dnscache. you can see that with ipconfig /displaydns
.
Question: Why every executable sends DNS request after deleting DNScache service?
Your question title, and the question don't match - consider what you really are trying to ask here. As for why does it do look ups after deleting the service - consider it was doing look ups prior to deleting it too. – djsmiley2k TMW – 2017-06-28T16:23:40.430
2From what you say, it seems normal that if you remove a dns caching service then programs will send out dns queries: they can no longer interrogate the dns cache. – simlev – 2017-08-01T14:14:04.477
@simlev: Better put it up as an answer. There is no other answer. To the poster: I suggest that you undo the above changes. – harrymc – 2017-08-01T14:33:45.773
Based on this comment by the OP, this appears to be an XY problem, namely in that the OP is deleting the DNSCache service in order to be able to monitor DNS queries made by programs. There's a better way...
– I say Reinstate Monica – 2017-08-02T15:12:30.137I (and I'm sure others) would be happy to have a look but you'll need to ask a new question. – I say Reinstate Monica – 2017-08-02T15:29:34.023