A little background:At our college, almost randomly, it seemed that when some computers woke up from sleep they would get assigned a default gateway on-link with a higher metric than that of the gateway listed in the DHCP options field. Double gateways are baaad. This would result in no connectivity except for the local domain controllers/things on same subnet (obviously). What it turns out was happening was:Computers were put to sleep via a power policy (idle for so long). They were asleep so long that the DHCP lease expired and that a windows update was required. When the computer woke it would see that it was time to update and start the (which was Manual and stopped) WinHTTP Web Proxy Auto-Discovery Service as a part of WSUS functionality. From what i gather it allows the Windows Update Client to easily check for a DHCP options variable or use DNS to find a supplied proxy, therefor not requiring any user intervention.I am able to reproduce this problem on three workstations using Intel(R) 82566DM Gigabit Network Connection. What i do to reproduce:Obtain an IP normally.(Here i get the right gateway)Release the IP(I have no gateway)Start WinHTTP Web Proxy Service(Still, no gateway, no DHCP because i haven't requested one)Disconnect the ethernet cable and reconnect it, simulating "Sleep".Here is where the magic happens. Once the ethernet cable is plugged back in WinHTTP (i suspect) sets a 0.0.0.0 mask 0.0.0.0 On-Link route (Default gateway), then the DHCP client asks for a new IP. The gateway from the DHCPserver optionsget set AFTER the On-Link gateway. If i do "route delete 0.0.0.0" and "ipconfig /renew" the DHCP client will renew the lease andi will get the correct gateway. Can anyone explain why this is happening?Software we use:We used to use McAffee, Now using ForeFrontWe are using VirtualPC with the VirtualPC Networking Service installed.I hope this helps anyone who has been going crazy due to double gateways on vista and i hope someone can explain why this only seems to happen to some people. Thanks in advance.

Hi, I have also tried your steps; however, I cannot reproduce the issue on my side: 1. A Windows Vista client with IP address DHCP (with right gateway). 2. Run ipconfig /release 3. Start WinHTTP Web Proxy Service (nothing happens). 4. Disconnect and reconnect the cable, the client gets a new lease of IP properly. Please let me know if these are the steps you have tried to reproduce the issue. May I know if the issue can be reproduced on other computers with different network adapter? At this time, please boot the system to Safe Mode with networking to check how it works. Meanwhile, please run route print on the problematic computer when the issue happens and post the report to this thread for our further research. Thanks. Nicholas Li - MSFT

===========================================================================Interface List11 ...00 19 d1 37 d5 18 ...... Intel(R) 82566DM Gigabit Network Connection 1 ........................... Software Loopback Interface 110 ...00 00 00 00 00 00 00 e0 6TO4 Adapter13 ...00 00 00 00 00 00 00 e0 isatap.jccmi.edu=========================================================================== IPv4 Route Table===========================================================================Active Routes:Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 On-link 172.20.26.87 20 0.0.0.0 0.0.0.0 172.20.16.1 172.20.26.87 10 127.0.0.0 255.0.0.0 On-link 127.0.0.1 306 127.0.0.1 255.255.255.255 On-link 127.0.0.1 306 127.255.255.255 255.255.255.255 On-link 127.0.0.1 306 169.254.0.0 255.255.0.0 On-link 172.20.26.87 30 169.254.255.255 255.255.255.255 On-link 172.20.26.87 266 172.20.16.0 255.255.240.0 On-link 172.20.26.87 266 172.20.26.87 255.255.255.255 On-link 172.20.26.87 266 172.20.31.255 255.255.255.255 On-link 172.20.26.87 266 224.0.0.0 240.0.0.0 On-link 127.0.0.1 306 224.0.0.0 240.0.0.0 On-link 172.20.26.87 266 255.255.255.255 255.255.255.255 On-link 127.0.0.1 306 255.255.255.255 255.255.255.255 On-link 172.20.26.87 266===========================================================================Persistent Routes: None IPv6 Route Table===========================================================================Active Routes:If Metric Network Destination Gateway 1 306 ::1/128 On-link11 266 fe80::/64 On-link11 266 fe80::19b2:ef1f:f3a0:c577/128 On-link 1 306 ff00::/8 On-link11 266 ff00::/8 On-link===========================================================================Persistent Routes: None*update*I can still recreate the problems using the steps i outline however it might be something else related to Windows Update and not it's use of the WPAD. After totally disabling WinHTTP Proxy Auto Discovery the problem still occurs when a lease is expired and windows update client tries to get updates. Here is my WindowsUpdate.loggoing the time the computer is started on the day i had the gateway issue til the end of the log. Sorry for the external link but it's pretty long. http://pastebin.com/f4136abbfIs there any way to debug what application modifies the routing table?

Hi, Since the issue reoccurs after disabling the WinHTTP Proxy Auto Discovery service, I suspect the issue is not related to this service; and Windows Update service is a service which is fordetection, download, and installation of updates for Windows and other programs, it should be not related either. At this time, please try the following to see if it works: 1. Click Start, type regedit in the Start Search box, and then press ENTER. 2. Locate the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters 3. On the Edit menu, point to New, and then click DWORD Value . 4. Type ArpRetryCount . 5. Right-click the ArpRetryCount registry entry, and then click Modify . 6. In the Value data box, type 0 , and then click OK . 7. Exit Registry Editor. Please keep me updated. Thanks.Nicholas Li - MSFT