Thanks BrowserUk I ran filemon.exe and regmon.exe from Sysinternals which showed up this location (after I had posted) - the protocol file is still there on the broken box and looks just like the above. Regmon does not show the issue either when you diff the results of a working and broken system and filter for Winsock2.