What exactly is Windows 7 doing when it says "Identifying" a network connection?

When I connect my Windows 7 Pro laptop to my corporate network it recognizes the wired network connection and then shows it's connected to corp.company.com domain but still says "Identifying..." for 60-90 seconds longer. Only after it's done do I get a working network connection. With my previous Windows XP laptop I don't remember ever having to wait for a network connection on the same corporate network.

With my home wireless network the Windows 7 laptop connects and gets an active/ready network connection much faster--after only a second or two.

So what exactly is Windows doing when it says "Identifying"? What can I look into to speed this process up? Do others regularly see long delays at this step?


It's a feature of Windows 7 called "Network Awareness."

Part of that feature is something called "NCSI" - which is described here. NCSI causes your system to fetch a webpage from msftncsi.com and also verify the address returned by a DNS lookup from that domain name. That consumes some time. That same webpage describes how to turn it off.

I have disabled it on a system of mine; it displays a continuous warning triangle on the system tray network icon, but otherwise works normally.

Windows Vista/7 also have a new protocol installed by default (in addition to TCP/IP and TCP/IP v6) called "Link Layer Topology Discovery" - it's used to draw the network map in the Network Connections control panel. I'm not entirely sure but I believe Vista/7 tries to make an LLTD discovery broadcast or query and waits for a reply. You can try disabling the LLTD protocols on your network adapter and see if that increases connection speed.


Since its a corporate laptop I'm going to assume that it may be connected to a domain at your workplace. My guess is that it's trying to connect to that domain.


Radius Authentication (username and password).

ARP Resolution of network layer addresses into link layer addresses.

DHCP Requesting and getting an IP address.

Access rules Your client may be required to pass certain tests before it's allowed onto the network. For instance, a machine that can't provide proof that it has the most recent virus definitions might be given access only to the server that has all the AV updates on it.

  1. You could install Wireshark to watch the packets to see what your machine's doing during the time the message is displayed.
  2. You could just ask your network administrator what's going on. If it's a Windows bug, s/he may have a patch for you.