Windows 10: Prevent Windows Overwriting Hosts File

I've been editing my Windows\system32\drivers\etc\hosts file for years to facilitate my work.

As of a couple of days ago Windows has started overwriting this file with a clean version every time I boot up.

I have tried making the file read-only and denying write permissions to "ALL APPLICATION PACKAGES", "ALL RESTRICTED APPLICATION PACKAGES" and to "SYSTEM", which was a recommended solution in older advice on this issue.

The Deny Write setting on "SYSTEM" and "ALL RESTRICTED APPLICATION PACKAGES" will not take effect.


I have not tried preventing inheritance or removing any of these groups as I don't want to break DNS for obvious reasons.

Is there any way to prevent Windows from overwriting this file? Or do we now need to set up our own DNS server in order to use Windows 10 for serious stuff like development work?

Thanks,
Geoff

:)

 

Prevent Windows Overwriting Hosts File

I've been editing my Windows\system32\drivers\etc\hosts file for years to facilitate my work.

As of a couple of days ago Windows has started overwriting this file with a clean version every time I boot up.

I have tried making the file read-only and denying write permissions to "ALL APPLICATION PACKAGES", "ALL RESTRICTED APPLICATION PACKAGES" and to "SYSTEM", which was a recommended solution in older advice on this issue.

The Deny Write setting on "SYSTEM" and "ALL RESTRICTED APPLICATION PACKAGES" will not take effect.

I have not tried preventing inheritance or removing any of these groups as I don't want to break DNS for obvious reasons.

Is there any way to prevent Windows from overwriting this file? Or do we now need to set up our own DNS server in order to use Windows 10 for serious stuff like development work?

Thanks,

Geoff

 

Prevent Windows Overwriting Hosts File

Hi and thanks for reaching out. My name is William. I'm a Windows technical expert. I'll be happy to help you out today.

This is likely being done by a 3rd party process. The only Windows processes that I know that care about the hosts file is Windows Security, but its normal operation is to only flag it as potentially suspicious, not delete it. However, if you think that may
be an issue, you can create a exception for the hosts file under Windows Security > Manage exceptions.

If you are running a 3rd party antivirus then you can do it from there. Otherwise you need to take a look at or second guess some of the programs you have installed. VPN programs come to mind, for example or network utility applications.

However, when in doubt, Process Monitor. Download from Microsoft. When you initially run, create a filter using Path is C:\Windows\system32\drivers\etc\hosts. Monitor. You should be able to see what process is touching it and then follow the crumbs. This may
take awhile, so when you run this go to Filter drop menu and select option to "Drop Filtered Events" to keep resource usage at a minimum.

 

Hosts file editing

I have to jump in and say I use, and have used the host file for years. It's an easy way to take stress off of old name servers. I don't add everything, but major shares I do add to the host file. I've used the host file for some tunneling as well. I try to optimize my network as much as possible and I have a solid network. But Easy Rhino is right as well, you'll want to have everything he suggested as well. *Toast :toast: