Why would my fresh install of Win 11 Pro, with no browser running and no "apps" installed, be making DNS lookups for rum8.perf.linkedin.com and rum18.perf.linkedin.com?
Any ideas why, and how to stop it?
1 Answer
First, let me mention that LinkedIn is owned by Microsoft (purchased in 2016), so having some Windows component contacting it is not completely unexpected.
Try removing the usual suspects first -
Open the privacy settings (On the Settings app, open the left menu and click "Privacy and Security") turn off all options under Windows Permissions and App Permissions and check if that solves the issue.
Turning off security features (from the same dashboard) such as Windows Defender or Windows Update is not recommended but if you're willing to take the risk you can temporarily disable them to see if that's related. It's technically possible that the server being associated with LinkedIn is outdated (although I personally doubt it).
Open the Task Manager (Ctrl+Shift+Esc), go to the "Startup" tab and disable everything to prevent many apps from auto-starting. If that solves the issue it would be easy to then narrow it down to the offending app.
When the connection is open you can use the "netstat -on" command to display the PID of the process associated with it, then look-up the process name on Task Manager. If you find it's a service process (e.g., svchost.exe) you can use SysInternals' Process Explorer to determine exactly which service it is.
If nothing works, assuming the connection is HTTP or HTTPS-based you can you can use a program named Fiddler to log all the data being sent (it even has the option of decrypting HTTPS). Hopefully there's something user-readable there that can give you any hints.
Please mind that you cannot completely prevent Windows 10/11 from ever "calling home" as there are some features that cannot be disabled. Examples includes periodic activation checks (causing Windows to self-deactivate if you activate another computer with the same key) or Windows Update (updates can be postponed but never truly disabled and Windows will at the very least check for them to notify you).
