I've read the NCIS docs but I can't seem to get Windows 10 (1903) to auto launch a browser when in a captive portal. When I manually surf to a page (including the NCIS test page), the redirect happens fine. the system tray icon recognizes it doesn’t have inet access. I took a pcap and can see windows tried for the NCIS page and got the page moved redirect back. No other automatic http is tried by the OS. Active probing in the registry is enabled (otherwise it wouldn't even try this).
I can't find any other similar cases (usually people are trying to disable NCIS because it's popping too often for them). this is a wired etherrnet port but can't find why/if that makes any difference in how windows works.
I included a screen shot of the pcap that shows the redirect happening. You can even see the GET is made using a User Agent string 'Microsoft NCSI'
