Inspect Windows default routes and proxy settings
Compare active adapters, gateways, route metrics, DNS, DHCP and WinINET or WinHTTP proxy state without changing the Windows network stack.
Run the network diagnostic
pwsh -NoProfile -File .\Invoke-WindowsDiagnostics.ps1 `
-Network -PrivacyMode -ExportMarkdownThe report places default routes first, then includes adapter, address, DNS, DHCP, gateway, route, proxy and basic reachability context. Privacy Mode replaces common identifiers in the combined report.
When this guide is useful
- Internet access works through the wrong adapter or stops after installing VPN or virtualization software.
- A browser and command-line tool behave differently because WinINET and WinHTTP proxy settings do not match.
- DNS resolution works intermittently or an unexpected DNS suffix appears.
- Several default routes compete and you need to see which route has the lower effective metric.
What the network report checks
Adapters and addresses
Active adapters, IPv4 and IPv6 addresses, DHCP state, DHCP server and DNS suffix or search-list context.
Gateways and routes
Default routes appear first with next hop, interface and effective metric, followed by a bounded list of active routes.
DNS and reachability
Configured DNS servers plus simple gateway, DNS-resolution and internet-reachability checks.
Proxy context
Current-user WinINET state and read-only WinHTTP proxy output. Proxy credentials and sensitive URL query values are removed.
How to interpret routes and proxy settings
Compare effective route metrics
For competing default routes, the path with the lower effective metric is usually preferred. The metric must still be considered together with interface state and the actual software using the network.
Expect virtual adapters to add routes
Hypervisors, containers, VPN clients and security products may create virtual interfaces and route entries. Their presence is not automatically a fault; compare the result with installed and currently running software.
Distinguish WinINET from WinHTTP
Applications may use different Windows networking APIs. A browser can use current-user WinINET settings while a service or command-line component uses WinHTTP, so one proxy can be configured while the other is direct.
Use reachability checks as clues
A successful gateway test with failed DNS resolution points in a different direction than a failed gateway test. These checks are deliberately simple and should be combined with the rest of the report.
What the toolkit does not do
- It does not add, delete or reorder routes.
- It does not enable, disable or reset adapters.
- It does not change DNS, DHCP, proxy or VPN configuration.
- It does not capture packets or inspect application traffic.
Reasonable next steps
- Identify the active adapter and the preferred default route in the report.
- Compare WinINET and WinHTTP proxy state with the affected application.
- Check whether unexpected routes belong to known VPN, hypervisor or security software.
- Preserve the redacted report before changing network configuration so the original state is not lost.