Microsoft NDIS Capture (NdisCap) Service Defaults in Windows 10

Microsoft NDIS Capture.

Default Settings

Startup type:
Windows 10 Home 1507Manual
Windows 10 Pro 1507Manual
Windows 10 Education 1507Manual
Windows 10 Enterprise 1507Manual
Windows 10 Home 1511Manual
Windows 10 Pro 1511Manual
Windows 10 Education 1511Manual
Windows 10 Enterprise 1511Manual
Windows 10 Home 1607Manual
Windows 10 Pro 1607Manual
Windows 10 Education 1607Manual
Windows 10 Enterprise 1607Manual
Windows 10 Home 1703Manual
Windows 10 Pro 1703Manual
Windows 10 Education 1703Manual
Windows 10 Enterprise 1703Manual
Windows 10 Home 1709Manual
Windows 10 Pro 1709Manual
Windows 10 Education 1709Manual
Windows 10 Enterprise 1709Manual
Windows 10 Home 1803Manual
Windows 10 Pro 1803Manual
Windows 10 Education 1803Manual
Windows 10 Enterprise 1803Manual
Windows 10 Home 1809Manual
Windows 10 Pro 1809Manual
Windows 10 Education 1809Manual
Windows 10 Enterprise 1809Manual
Windows 10 Home 1903Manual
Windows 10 Pro 1903Manual
Windows 10 Education 1903Manual
Windows 10 Enterprise 1903Manual
Windows 10 Home 2004System
Windows 10 Pro 2004System
Windows 10 Education 2004System
Windows 10 Enterprise 2004System
Display name:Microsoft NDIS Capture
Service name:NdisCap
Service type:kernel
Error control:normal
Group:NDIS
Path:%SystemRoot%\System32\drivers\ndiscap.sys
Registry key:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisCap

Default Behavior

Microsoft NDIS Capture is a kernel device driver. It is starting only if the user, an application or another service starts it in Windows 10 Home 1507, Windows 10 Pro 1507, Windows 10 Education 1507, Windows 10 Enterprise 1507, Windows 10 Home 1511, Windows 10 Pro 1511, Windows 10 Education 1511, Windows 10 Enterprise 1511, Windows 10 Home 1607, Windows 10 Pro 1607, Windows 10 Education 1607, Windows 10 Enterprise 1607, Windows 10 Home 1703, Windows 10 Pro 1703, Windows 10 Education 1703, Windows 10 Enterprise 1703, Windows 10 Home 1709, Windows 10 Pro 1709, Windows 10 Education 1709, Windows 10 Enterprise 1709, 1803 Home, 1803 Pro, 1803 Education, 1803 Enterprise, 1809 Home, 1809 Pro, 1809 Education, 1809 Enterprise, Windows 10 Home 1903, Windows 10 Pro 1903, Windows 10 Education 1903, Windows 10 Enterprise 1903. This service is starting at Kernel initialization in Windows 10 Home 2004, Windows 10 Pro 2004, Windows 10 Education 2004, Windows 10 Enterprise 2004. If Microsoft NDIS Capture fails to start, the failure details are being recorded into Event Log. Then Windows 10 will start up and notify the user that the NdisCap service has failed to start due to the error.

Restore Default Startup Configuration for Microsoft NDIS Capture

1. Run the Command Prompt as an administrator.

2. Depending on the version of your operating system, copy the commands below, paste them into the command window and press ENTER.

For Windows 10 1507 Home, Windows 10 1507 Pro, Windows 10 1507 Education, Windows 10 1507 Enterprise, Windows 10 1511 Home, Windows 10 1511 Pro, Windows 10 1511 Education, Windows 10 1511 Enterprise, Windows 10 1607 Home, Windows 10 1607 Pro, Windows 10 1607 Education, Windows 10 1607 Enterprise, Windows 10 1703 Home, Windows 10 1703 Pro, Windows 10 1703 Education, Windows 10 1703 Enterprise, Windows 10 1709 Home, Windows 10 1709 Pro, Windows 10 1709 Education, Windows 10 1709 Enterprise, Windows 10 1803 Home, Windows 10 1803 Pro, Windows 10 1803 Education, Windows 10 1803 Enterprise, Windows 10 1809 Home, Windows 10 1809 Pro, Windows 10 1809 Education, Windows 10 1809 Enterprise, Windows 10 1903 Home, Windows 10 1903 Pro, Windows 10 1903 Education, Windows 10 1903 Enterprise, Windows 10 1909 Home, Windows 10 1909 Pro, Windows 10 1909 Education, Windows 10 1909 Enterprise:
sc config NdisCap start= demand

For Windows 10 2004 Home, Windows 10 2004 Pro, Windows 10 2004 Education, Windows 10 2004 Enterprise:
sc config NdisCap start= system
sc start NdisCap

3. Close the command window and restart the computer.

The NdisCap service is using the ndiscap.sys file that is located in the %WinDir%\System32\drivers folder. If the file is changed, damaged or deleted, you can restore its original version from Windows 10 installation media.