Microsoft Windows will always check the local Windows\System32\drivers\etc\HOSTS file by default before consulting the DNS cache. The DNS cache simply stores previously resolved domain names and their corresponding IP addresses for faster access, but if a matching entry is found in the hosts file, the cache is ignored.
It is possible via GPO to change the DNS lookup order, or DISABLE the local Windows hosts file DNS resolver function: Group Policy, Computer Configuration > Administrative Templates > Network > DNS Client and enable the policy "Turn off Multicast Name Resolution" which effectively prevents the computer from using the local hosts file for name resolution. This also disables LLMNR (Link-Local Multicast Name Resolution), which is a Microsoft endpoint security recommendation.
For those not familiar with editing the hosts file, PhoenixNAP has a nice write-up here:
https://phoenixnap.com/kb/windows-hosts-file
It is possible via GPO to change the DNS lookup order, or DISABLE the local Windows hosts file DNS resolver function: Group Policy, Computer Configuration > Administrative Templates > Network > DNS Client and enable the policy "Turn off Multicast Name Resolution" which effectively prevents the computer from using the local hosts file for name resolution. This also disables LLMNR (Link-Local Multicast Name Resolution), which is a Microsoft endpoint security recommendation.
For those not familiar with editing the hosts file, PhoenixNAP has a nice write-up here:
https://phoenixnap.com/kb/windows-hosts-file
RSS Feed