Why does explorer.exe has an established connection to a microsoft server?

This seems a bit odd. Using netstat -a -b -n I've found the following:

TCP 192.168.1.X:1150   157.56.124.76:443 ESTABLISHED [Explorer.EXE]

It turns out that the ip 157.56.124.76 which resolves to db3wns2011017.wns.windows.com is a static ip from Microsoft.

Moreover, using tcpView from sysinternals I can see that it's a TCP connection over https.

I tried closing the connection and after a second it was back on. Initially a kb of data was sent and nothing after that..

What is this all about and why is it Established?

I have windows 8.1 enterprise. I don't have OneDrive or any other microsoft cloud stuff installed. This is persistent, and is there after booting.

update

After finding out that this is related to Windows Push Notifications, I followed the steps here to disable such notifications, but the connection remains.


Solution 1:

Windows connects to MS servers for many purposes, like syncing time, checking for updates, and even tiny things like displaying whether your PC has access to the internet when you mouse over the notification icon for the network (windows downloads a file from one of their servers to test connectivity).

As for why its established, that is related to how the TCP protocol works. a client wants to create a connection between an open port on the client, and a listening port on the server. once this process is complete, the connection between the two points is "Established". Often server processes fork, or remap their local ports, so that after you connect to the listening port, an connection is established between a dynamically choosen server port, and the client port.