Endpoint Network, Wi-Fi and Internet Connectivity Failure — Layered Triage (Physical → IP/DHCP → DNS → App)

Indicators

• System tray network icon shows 'No internet access' (yellow triangle) or globe icon
• Wi-Fi status shows 'Connected, no internet' or fails to associate with SSID
• ipconfig /all reports 169.254.x.x APIPA address (DHCP lease failure)
• nslookup returns 'DNS request timed out' or 'server can't find <name>'
• ping to default gateway succeeds but ping 8.8.8.8 fails (upstream/routing issue)
• ping to IP succeeds but ping to hostname fails (DNS-only failure)
• tracert shows packet loss or timeouts at a specific hop
• Get-NetAdapter reports MediaConnectionState = Disconnected despite cable plugged

Likely causes

• Physical layer: unplugged/damaged cable, disabled NIC, hardware Wi-Fi radio switch off, faulty switch port
• Driver issues: outdated, corrupt, or incompatible NIC/Wi-Fi driver (frequently post-Windows-Update regression)
• DHCP failure: no lease obtained (APIPA 169.254.x.x), scope exhaustion, or relay/helper misconfiguration
• DNS misconfiguration: wrong resolver, poisoned cache, unreachable internal DNS server, or split-horizon mismatch
• Wi-Fi authentication: wrong PSK, expired 802.1X user/computer cert, WPA2/WPA3 mode mismatch
• IP conflict, incorrect static IP, wrong subnet mask, or wrong default gateway
• Third-party firewall, VPN client, or endpoint AV/EDR blocking traffic or hijacking DNS
• Upstream ISP outage, modem/router failure, or WAN link down
• Winsock catalog or TCP/IP stack corruption

Diagnostic steps

1. Verify layer 1: confirm Ethernet cable seated at both ends, NIC and switch port link LEDs lit; for Wi-Fi confirm hardware radio switch / Fn key is on and Windows Wi-Fi toggle enabled. Compare against a second device on the same port/SSID.
   Eliminate cabling, port, and radio issues before spending time on software layers
2. Run `ipconfig /all` and inspect: adapter status, IPv4 address (must not be 169.254.x.x), subnet mask, default gateway, DHCP server, and DNS servers.
   Confirm valid IP configuration; APIPA indicates DHCP failure, missing gateway indicates layer 2/DHCP issue
3. Test layer 3 reachability in sequence: `ping <default-gateway>`, then `ping 8.8.8.8`, then `ping www.microsoft.com`.
   Isolate the failure boundary — gateway fail = LAN; 8.8.8.8 fail = WAN/routing; hostname-only fail = DNS
4. Test DNS explicitly against configured and external resolvers: `nslookup www.microsoft.com` then `nslookup www.microsoft.com 8.8.8.8`.
   Determine whether the configured resolver is unreachable, poisoned, or misconfigured
5. Trace the path to a public target: `tracert 8.8.8.8` and `tracert -d www.microsoft.com`.
   Identify the hop at which packets are dropped (LAN edge, ISP edge, or beyond)
6. Check adapter and driver health via PowerShell: `Get-NetAdapter | Format-Table Name,Status,LinkSpeed,MediaConnectionState` and inspect Device Manager for yellow-bang or error codes on network devices.
   Detect disabled adapters, driver faults, or Media Disconnected states not visible in the UI
7. Test a specific application-layer port: `Test-NetConnection <host> -Port 443` (and 80, 53 as required).
   Confirm whether TCP handshake completes to the target service, isolating firewall/proxy blocks from routing failures
8. If Wi-Fi specific, review supplicant state: `netsh wlan show interfaces` and `netsh wlan show wlanreport` (generates HTML report of association/auth history).
   Diagnose association failures, roaming events, and 802.1X authentication errors

Resolution path

• Release and renew DHCP lease: `ipconfig /release` then `ipconfig /renew` (per-adapter with `/release <adapter>` if multiple)
• Flush DNS resolver cache: `ipconfig /flushdns` (or `Clear-DnsClientCache`)
• Reset Winsock catalog and TCP/IP stack: `netsh winsock reset` and `netsh int ip reset`, then reboot
• Rebuild Wi-Fi profile if association or auth fails: `netsh wlan delete profile name="<SSID>"` then reconnect with correct credentials/certificate
• Update or roll back the NIC/Wi-Fi driver via Device Manager or the OEM package (roll back if regression correlates with a recent Windows Update)
• Temporarily disable third-party firewall / VPN client / endpoint AV to isolate software interference; re-enable immediately after test
• If DHCP scope is exhausted or DHCP server is down, apply a static IP within the correct subnet (with valid gateway and DNS) as a temporary workaround while server team investigates
• Power-cycle local modem/router; if WAN link is confirmed down, escalate to ISP with circuit ID and observed symptoms
• As a last resort, use Windows Network Reset (Settings → Network & Internet → Advanced network settings → Network reset) to rebuild all adapters and stack configuration — note this removes VPN clients and saved Wi-Fi profiles

Prevention

• Standardise NIC/Wi-Fi driver versions via WSUS/Intune driver rings to avoid post-update driver regressions
• Monitor DHCP scope utilisation and DNS server health with alerting thresholds (e.g. alert when <10% free leases)
• Configure a secondary DNS resolver on all endpoints (via DHCP option 6 or GPO) so single-server failure does not break resolution
• Document expected SSIDs, VLANs, DHCP scope ranges, and DNS/gateway addresses per site so field techs can compare against a known-good baseline
• Enable 802.11k/v/r roaming assistance on enterprise WLAN and tune Wi-Fi roaming aggressiveness to reduce association failures on mobile clients
• Deploy Windows Network Connectivity Status Indicator (NCSI) probe overrides via GPO in restricted networks so 'No internet' state reflects reality

Tools

• ipconfig (view/reset IP configuration)
• ping (ICMP reachability)
• tracert (path analysis)
• nslookup (DNS query testing)
• netsh (TCP/IP stack, Winsock, Wi-Fi profile management)
• Test-NetConnection (PowerShell TCP/port probe)
• Get-NetAdapter / Get-NetIPConfiguration (PowerShell adapter state)
• Device Manager (driver management and rollback)
• Wireshark (packet capture for deep analysis)
• netsh wlan show wlanreport (Wi-Fi association/auth diagnostics)

References

• Microsoft — Fix network connection issues in Windows
• Microsoft Learn — netsh int ip reset / netsh winsock reset
• Microsoft Learn — Get-NetAdapter cmdlet