Information
WinHTTP implements the client HTTP stack and provides developers with a Win32 API and COM Automation component for sending HTTP requests and receiving responses.
In addition, WinHTTP provides support for auto-discovering a proxy configuration via its implementation of the Web Proxy Auto-Discovery (WPAD) protocol.
The recommended state for this setting is: 'Disabled'.
Rationale:
This service is primarily needed to support Web Proxy Auto-Discovery (WPAD), which is an auto-proxy discovery mechanism that is poorly designed, as it causes an excessive amount of unnecessary DNS traffic on the network, and exposes the computer to Man-In-The-Middle (MITM) risks.
If an organization depends on HTTP proxy configuration, it is recommended that other client configuration mechanisms be used instead, such as Group Policy.
Solution
To establish the recommended configuration via GP, set the following UI path to: 'Disabled'.
Computer Configuration\Policies\Windows Settings\Security Settings\System Services\WinHTTP Web Proxy Auto-Discovery Service
Impact:
WPAD will cease to function for automatic HTTP proxy routing, which may prevent Internet connectivity for workstations in organizations that currently use WPAD.
Microsoft also cautions that some software that uses the network stack may have a functional dependency on this service, so it is advised that you test disabling this service on a representation of user workstations and applications before disabling it across the entire organization.