23

I installed a fresh Windows Server 2012 R2 Standard with GUI instance on a VMware VM. The first time I logged in as Administrator, I noticed an Internet Explorer window automatically opened to http://go.microsoft.com/fwlink/p/?LinkId=255141 and redirected to http://www.msn.com/?ocid=wispr. This seems to be the default Internet Explorer Start Page.

This has continued - every time I log in as Administrator or any other user, this page opens.

Later I installed Firefox, and now Firefox opens to this same page on login (which is the default Internet Explorer Start Page, not the Firefox homepage!).

I've checked the Programs Menu Startup folders for Administrator and all users, and used Sysinternals Autoruns to look for something, all to no avail. There doesn't seem to be anything that should be launching IE on logon.

This was a default install of Windows Server with GUI on a network with very limited (whitelisted) outbound Internet access. In fact, msn.com isn't on the whitelist so I never see the page, only the message from my firewall that it's blocked.

I cloned this VM to a couple of other VMs and they exhibit the same behaviour.

The only hits I can find for this sort of problem involve spyware on desktop machines or shortcuts in the Startup folder. It's a mystery to me.

I've even gone through the registry and removed all four references to LinkId=255141:

  • HKLM\Software\Microsoft\Internet Explorer\Main: Start Page and Default_Page_URL (changed both to about:blank)
  • HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main: Start Page and Default_Page_URL (changed both to about:blank)
MZS
  • 333
  • 1
  • 2
  • 6
  • It it joined to a domain, have you checked GP Mgmt Console or run GPResult on the local machine? – Ed Fries Jun 01 '15 at 18:37
  • I would open 'msconfig' and check the 'startup' tab to see if it's being launched there. –  Jun 01 '15 at 19:51
  • @EdFries It is not yet joined to a domain. – MZS Jun 01 '15 at 23:47
  • @mike Nothing in msconfig. Could the Metro start screen be hiding something? – MZS Jun 01 '15 at 23:47
  • 1
    I'm fairly certain this is the default behavior for all Windows Server OS with a fresh install. I've been seeing this happen since Windows Server 2003. If it's not in `MSCONFIG`, it might be in the `Start Menu > All Programs > Startup` or in the registry somewhere. – CIA Jun 02 '15 at 17:09
  • MZS, have you tried SysInternals Procmon or Process Explorer to see if you can track the command line and process tree that IExplore.exe was launched from? @CIA The default behaviour is that every time a user logs in, IE opens? I haven't seen that. – TessellatingHeckler Jun 02 '15 at 17:11
  • Could this be as simple as you using an RDP client which launches a program on login? Does this happen even in the VMware console? – TessellatingHeckler Jun 02 '15 at 17:14
  • 1
    @TessellatingHeckler I've seen it since the Windows XP days on desktop OSes and Windows Server 2003/2008/2012 on server OSes (includes STD, SBS, DC, etc); sometimes, it depends on the installation media source (if you bought it retail vs OEM vs MSDN) or if the media was slipstreamed or packaged in a particular way for post config. It's supposed to act as a "first run" kind of thing where it links you to a MS KB article or website congratulating you on installing Windows or informing you about Windows Updates. – CIA Jun 02 '15 at 17:25
  • @CIA I've seen it as a one-off occasionally, I didn't know that was media source dependent. I thought you were claiming "*every time I log in as Administrator or any other user, this page opens"* is default behaviour. – TessellatingHeckler Jun 02 '15 at 18:03

1 Answers1

33

I had the same issue with a Windows 8 installation. The solution described in a microsoft.com forum is:

You can disable it via setting following registry entry from 1 to 0:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet\EnableActiveProbing

Jorge Palacio
  • 446
  • 4
  • 4
  • 1
    This fixed it for me, and I believe allowing access to msftncsi.com would also have solved it. It comes down to the Network Connection Status Indicator (NCSI); I'm guessing if it can't hit msftncsi.com it pops up a browser window in case you need to log into a hotspot. Thanks so much! – MZS Aug 19 '15 at 19:37
  • 6
    I started seeing this behaviour after installing a Pi-Hole on my home network - I guess it was blocking msftncsi.com. This registry fix solved it for me +1 – MattDavey Mar 08 '16 at 11:58
  • Pi-hole gets everywhere :) this also fixed it for me on a new win 10 install. – Mike Redrobe May 07 '16 at 12:04
  • This registry key doesn't exist on my computer, but I'm getting this issue. I have `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters`, and that's as far as it go. Is there something else that might cause msn.com to open in my default browser whenever I sign in to Windows? – Michael Hoffmann Nov 03 '17 at 22:43
  • For anyone else that can't find the registry key, run regedit as Administrator, and/or create the key manually and set its value to 0. – Michael Hoffmann Nov 15 '17 at 00:20
  • Is there a GPO setting for this or the registry is the only solution? – Tobia Oct 04 '18 at 06:25