dasHost.exe is causing udp broadcast flood on 22222 or 10004 ports...

Anonymous
2024-10-16T07:33:40+00:00

Hi i have problem with Device Association Framework Provider Host..

I checked das host is running from right place C:\Windows\System32

Its signed by ms.

How to stop it? It is hundreds broadcast connections per miute..

System is updated, antivirus is working.

Windows for home | Windows 11 | Internet and connectivity

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

61 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2025-02-26T17:58:13+00:00

    I'm seeing it on every computer running 24H2, not on the ones running 23H2.

    It makes them pretty much useless until users restart, as they don't have permissions to kill the process.

    dasHost.exe is using 100% of the CPUs on brand new i9s and using all 64Gb of RAM.

    This really needs to be addressed!

    Was this answer helpful?

    4 people found this answer helpful.
    0 comments
  2. Anonymous
    2024-12-16T12:48:01+00:00

    I found a solution to this problem. The root cause is the new printing interface in certain applications like Chrome, Paint, as well as other major systems that use it. To fix this, you just need to switch to the older printing interface by modifying the registry:

    [HKEY_CURRENT_USER\Software\Microsoft\Print\UnifiedPrintDialog]
    Add a DWORD 32-bit named "PreferLegacyPrintDialog" and set it to 1.

    This will disable the new interface and stop the broadcast packets from being sent.

    Was this answer helpful?

    3 people found this answer helpful.
    0 comments
  3. Anonymous
    2025-03-21T15:35:24+00:00

    We're in the same, 120 computers and as they've been updated, it's become unsustainable, I have logged 4 broadcasts per second per computer, network stability is clearly in danger, It's incredible that Microsoft hasn't fixed this!

    We've disabled the device association service and the broadcasts disappear, but programs that use native Windows printing fail or take forever (Notepad, Paint, Photos...)

    We use BitDefender Firewall instead of the Windows one, and not permit drop broadcast...

    Any other suggestion?

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  4. Anonymous
    2025-01-10T10:07:28+00:00

    Hi,

    Theses port seems to be used by Windows for printer lookup.

    You could reproduce with the button "Add printer"

    Under 24H2 with WPP (Windows protected print mode) enabled, this still using broadcast on port 10004, 22222 and 3289, but not when printing.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  5. Anonymous
    2025-01-07T19:07:38+00:00

    Martin, Do you know if there will eventually be a fix for this?

    I have identified that printing from a browser does initiate this storm but so far have found no way to stop other than creating a Firewall rule on the local PC.

    I have also identified that once initiated dashost.exe tries to broadcast storm over to UDP to 3289, 10004 and 22222.

    Is there any way to put in a ticket with Microsoft regarding this or at least get their attention?

    What is this even suppose to be doing other than flooding networks with non-sense broadcast traffic?

    I tried the registry key entry outlined below but it did not have any effect.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments