Situation
I was brought into a client case involving intermittent network drops on certain Lenovo and Surface laptops. The issue had been occurring for several months and initially appeared to be Wi-Fi related, since rebooting the access points sometimes provided temporary relief and different access points had been tested without resolving the issue. During the investigation, I reviewed the affected devices, recent changes, and user reports. A key pattern emerged: devices that had recently upgraded from Windows 11 version 23H2 to 24H2 began showing the same symptoms.
Investigation & Outcome
After discovering that the issues began following the upgrade to Windows 11, version 24H2, I initially suspected a power management conflict. The power profiles in 24H2 seemed more aggressive, often causing poor performance on devices not set to the High Performance power plan.
Initial Troubleshooting Steps Power Settings: I enabled the "High Performance" power plan and disabled the ability for the Wi-Fi adapter to wake the device. While this improved stability, it did not fully resolve the connection drops.
User Feedback: The client reported that the connection dropped specifically when the signal strength weakened.
Hardware Identification: Upon reviewing the affected devices, I identified the Intel AX201 wireless adapter. This triggered a recollection of similar cases I had encountered recently, where uninstalling the DNSFilter agent proved to be the final, successful fix.
Pattern Recognition and Verification I conducted an inventory check of previously affected devices and confirmed they all utilized either the Intel AX201 or AX211 series adapters. To verify the link to DNSFilter, I compared system logs:
Affected Devices (with DNSFilter): I observed a recurring loop of Event ID 11004 ("Wireless security stopped") and Event ID 11010 ("Wireless security started"), appearing hundreds of times in the logs.
Control Devices (without DNSFilter): These logs were absent, and the connectivity remained stable.
Resolution: I decided to remove the DNSFilter agent from an affected laptop as a test. The result was immediate: the connection drops ceased entirely. Removing the agent from all remaining affected laptops permanently resolved the network connectivity issues.
Working Theory
This is my theory on why it was specifically Windows 11 24H2/25H2 and DNSFilter Agent 2.2.1.
The Wi‑Fi dropping issue happened because Windows 11 24H2 changed how networking and connectivity checks behaved, and DNSFilter’s Roaming Client sat directly in the middle of that traffic. On affected laptops, the Wi‑Fi adapter would weaken or briefly roam, and 24H2 could already be sensitive to DHCP/DNS timing and reconnect behavior; DNSFilter then amplified that instability by intercepting DNS and applying its own roaming-client logic, which made Windows think the network had lost connectivity. In practice, this showed up as Event Viewer loops in WLAN‑AutoConfig, including wireless security stopping and restarting, plus apparent internet drops even when the wireless link itself was only weakening. Removing DNSFilter stopped the loop because the laptops no longer had the extra DNS interception layer during reconnects, so the weak Wi‑Fi signal no longer turned into a full connectivity failure. So it wasn't poor Wi-Fi connection dropping altogether, it was the combination of a Windows 11 24H2 networking change and DNSFilter’s roaming client interfering with recovery. That is why devices without DNSFilter did not show the same repeated events or drops.
DNSFilter’s later 3.x Windows Roaming Client releases include fixes and stability improvements related to wake states, network transitions, DNS restoration, and modern Windows compatibility. So if you are running a later version of the agent, likely you won't experience this issue. However if you encounter Wi-Fi dropping issues or similar problems, do not overlook the DNSFilter roaming agent on the device, as it may be the culprit.