Ever wonder where this little guy gets its information from, be it happy or sad?
Essentially, a task runs whenever a network configuration change event takes place. This calls a service which first tries to NSLookup www.msftncsi.com, the Microsoft Network Connection Status Indicator site. If this is successful, it then performs an HTTP GET on a simple text file stored on this site.
If these two steps work, it proves that DNS, Routing, and HTTP traffic are all allowed and working.
Now, if you’re on a system that can access certain sites explicitly, like Updates.Microsoft.com then you may still a see a status icon of disconnected, even if your system can get out to the general web. This might be because msftncsi.com remains blocked.
So, the icon is a great indicator of whether or not you have web access for most cases, but not necessarily in high security environments.