Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I work with Windows Client and Server systems on a private network that cannot reach the internet. Problem is, many programs (like Subversion) cause Windows to attempt connections to to download a file called "" file. The direct result is that many programs that use SSL, like Subversion, block for five or ten seconds trying to resolve this host (which it never does).

I've tried putting this host to or some other IP address in my C:\Windows\System32\Drivers\Etc\hosts file, but it still tries to look this up in DNS, and I assume it is bypassing the hosts file for security reasons.

Besides putting a dummy entry into a DNS server, which I cannot do, what other things can I try to stop or block this?

share|improve this question

Well, if you cannot touch the official DNS, perhaps you install a proxy DNS (on your workstation) that has a fake entry (pointing e.g. to for, and that redirects all the other requests to the true DNS.

share|improve this answer

To make sure the problem is really a problem of resolution, you can enable the DNS client log (the DNS client is a service on Windows).

To do so, go to:


and optionally


Then have a look at what the subversion client does in that log. To make sure it really bypasses the hosts file, compare to the result of a manual:

nslookup -d2
share|improve this answer
Alain, I don't have the registry path for DNS in the registry. Also, when I "ping" the host it does use I think there is something internal that is disallowing us to locally remap that host name. – Aegrotatio Mar 31 '11 at 14:23
You must create the Registry Path and Key. You might be right for the way the resolution is performed inside the subversion client, but I see no reason for this. The log should actually tell you how the resolution is performed. The other two solutions proposed in that thread are not bad and I would eventually resort to one of them (and actually did in the past), but I believe you first have to trace what's happening and that would involve creating/declaring and reading that log. – Alain Pannetier Apr 1 '11 at 8:40
Well, I tried those keys and even tried replacing "DNS" with "dnscache" which does exist, but I never get any information in the log file I set. Still, I don't get why it's using DNS when that hostname is in the hosts file. I suspect there is an internal security setting that never uses the local hosts file for that host name. – Aegrotatio Apr 6 '11 at 18:08

A clever solution I've used in the past is to push out a GPO or registry setting for a WSUS server that does not exist. The machines will then stop asking Microsoft for updates and instead fail to query for your missing server. Not exactly a clean solution, but it gets the job done.

You really should have a WSUS server, by the way.

share|improve this answer
+1 - I thought about this as well. I did not mention it because my understanding was that the OP had turned the windows update service off. Otherwise, yes that might be a way. But then setting a WSUS is not a common maintenance task. – Alain Pannetier Apr 1 '11 at 18:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.