[{"data":1,"prerenderedAt":1447},["ShallowReactive",2],{"post:\u002F2026\u002F06\u002F24\u002Fwindows-server-disabling-ipv6-company-wide-what-actually-broke\u002F":3},{"post":4,"newer":1396,"older":1406,"related":1417,"series":1445},{"id":5,"title":6,"body":7,"canonical":1377,"categories":1378,"date":1380,"description":1381,"extension":1382,"featured":1383,"hero":1384,"image":1384,"meta":1385,"navigation":427,"path":1386,"readingTime":272,"seo":1387,"series":1384,"seriesOrder":1384,"sites":1388,"source":1384,"stem":1389,"tags":1390,"updated":1384,"url":1394,"__hash__":1395},"blog\u002Fblog\u002F2026\u002F06\u002F24\u002Fwindows-server-disabling-ipv6-company-wide-what-actually-broke.md","Windows Server: Disabling IPv6 Company-Wide — What Actually Broke",{"type":8,"value":9,"toc":1367},"minimark",[10,14,19,22,106,119,132,136,142,165,169,176,186,190,193,196,200,209,216,1191,1198,1206,1221,1225,1244,1290,1296,1300,1306,1310,1363],[11,12,13],"p",{},"The push to disable IPv6 across a Windows estate almost always starts the same way: a vulnerability scan flags IPv6 as an unmanaged attack surface, nobody in the environment is actually routing IPv6 anywhere, and someone reasonably asks why it's enabled at all. The honest answer is in Microsoft's own guidance (KB 929852, now titled \"Configure IPv6 for advanced users\"): IPv6 \"is a mandatory part of Windows Vista and Windows Server 2008 and newer versions,\" and \"we don't recommend that you disable IPv6 or IPv6 components or unbind IPv6 from interfaces. If you do, some Windows components might not function.\" The Windows network stack was never designed to have IPv6 removed, only quieted, and the gap between those two things is where most of the pain lives.",[15,16,18],"h2",{"id":17},"the-three-things-people-mean-by-disable-ipv6","The three things people mean by \"disable IPv6\"",[11,20,21],{},"Most arguments about this go sideways because three different changes get the same name. Keeping them separate is most of the battle.",[23,24,25,41],"table",{},[26,27,28],"thead",{},[29,30,31,35,38],"tr",{},[32,33,34],"th",{},"Change",[32,36,37],{},"How",[32,39,40],{},"Microsoft's position",[42,43,44,64,92],"tbody",{},[29,45,46,50,61],{},[47,48,49],"td",{},"Prefer IPv4 over IPv6",[47,51,52,56,57,60],{},[53,54,55],"code",{},"DisabledComponents"," = ",[53,58,59],{},"0x20"," (decimal 32)",[47,62,63],{},"Recommended \"instead of disabling IPv6\"",[29,65,66,69,89],{},[47,67,68],{},"Disable IPv6 components",[47,70,71,56,73,76,77,80,81,84,85,88],{},[53,72,55],{},[53,74,75],{},"0x01"," (tunnels), ",[53,78,79],{},"0x10"," (native interfaces), ",[53,82,83],{},"0x11",", or ",[53,86,87],{},"0xFF"," (everything except loopback)",[47,90,91],{},"Supported registry setting, not recommended",[29,93,94,97,103],{},[47,95,96],{},"Unbind IPv6 from an adapter",[47,98,99,100],{},"Untick \"Internet Protocol Version 6 (TCP\u002FIPv6)\" or ",[53,101,102],{},"Disable-NetAdapterBinding -ComponentID ms_tcpip6",[47,104,105],{},"Not recommended; \"can result in an unsupported Windows configuration\"",[11,107,108,109,111,112,115,116,118],{},"All the registry options live in one DWORD, ",[53,110,55],{},", under ",[53,113,114],{},"HKLM\\SYSTEM\\CurrentControlSet\\Services\\Tcpip6\\Parameters",", and all of them need a restart. It's a bitmask: bit 0 disables tunnel interfaces, bits 1 to 3 disable 6to4, ISATAP and Teredo individually, bit 4 disables native interfaces (including PPP), and bit 5 switches the default prefix policy to prefer IPv4. ",[53,117,87],{}," sets them all.",[11,120,121,123,124,127,128,131],{},[53,122,59],{}," is the one people skip, and it's usually the one that answers the actual complaint. By default Windows follows RFC 3484 and \"favors IPv6 global unicast addresses over IPv4 addresses.\" Setting bit 5 changes the prefix table so the IPv4-mapped prefix ",[53,125,126],{},"::ffff:0:0\u002F96"," outranks ",[53,129,130],{},"::\u002F0",": name resolution that returns both an AAAA and an A record connects over IPv4, while the IPv6 stack, link-local addresses and loopback keep working for everything inside Windows that expects them.",[15,133,135],{"id":134},"the-wrong-way-in-and-why-its-tempting","The wrong way in, and why it's tempting",[11,137,138,139,141],{},"The tempting approach is unchecking the IPv6 box on every NIC, because it's visible, it's fast, and it makes the compliance scan happy on the spot. It's the option Microsoft is bluntest about: \"We don't recommend unbinding IPv6 from an Ethernet or WiFi network adapter without a justifiable need. Windows is tested with, and some products and features expect, IPv6 to be bound and functional.\" And it doesn't do what people think. The checkbox and the registry are independent. The KB points out that the ",[53,140,55],{}," value \"doesn't affect the state of the check box,\" so a box can be ticked while IPv6 is disabled, and unticking it on one adapter leaves the stack, the tunnel adapters and the other NICs exactly as they were.",[11,143,144,145,147,148,150,151,154,155,157,158,161,162,164],{},"The next temptation is ",[53,146,87],{},", because \"disabled\" feels more final than \"preferred.\" Two details from the KB matter here. First, the right value is ",[53,149,87],{},", not ",[53,152,153],{},"0xFFFFFFFF","; the latter is a common copy-paste error that Microsoft says delays every startup by five seconds. Second, even ",[53,156,87],{}," leaves loopback alone: \"You cannot completely disable IPv6 as IPv6 is used internally on the system for many TCPIP tasks. For example, you will still be able to run ping ",[53,159,160],{},"::1"," after configuring this setting.\" So ",[53,163,87],{}," doesn't remove the attack surface the scanner flagged. It just switches off the parts that were doing useful work.",[15,166,168],{"id":167},"what-broke-immediately","What broke immediately",[11,170,171,172,175],{},"Failover clustering was the first thing to complain, and loudly. The cluster service talks node to node through the hidden Microsoft Failover Cluster Virtual Adapter (NetFT). The adapter carries an APIPA IPv4 address and an IPv6 link-local address, and the cluster log shows the node-to-node connections established on the ",[53,173,174],{},"fe80::"," virtual endpoints, tunneled over the physical NICs. That is true even in clusters where every client-facing IP is IPv4. Microsoft's KB lists failover clusters as a known casualty of disabling IPv6 for this reason. Clusters get IPv6 left alone, full stop.",[11,177,178,179,182,183,185],{},"The KB names two more immediate failures worth planning around: on domain controllers, LDAP over UDP 389 can stop working, and Exchange Server can stop working outright (the KB's example is Exchange 2010, and the linked Microsoft material covers why). And one that isn't in most checklists: \"Values other than 0 or 32 causes the Routing and Remote Access service to fail after this change takes effect.\" Any RRAS box, whether it does VPN, routing, or DirectAccess, has to stay at ",[53,180,181],{},"0"," or ",[53,184,59],{},".",[15,187,189],{"id":188},"what-broke-weeks-later","What broke weeks later",[11,191,192],{},"The slower failures were worse to diagnose because they showed up disconnected from the change window. DirectAccess, where it was still in use on a few management workstations, quietly stopped working. DirectAccess clients reach the server over IPv6, tunneled across IPv4 networks with 6to4, Teredo or IP-HTTPS, so a disable that takes out tunnel interfaces takes DirectAccess with it. And DirectAccess failing looks like a VPN problem, not a protocol-stack problem, so it took real time to connect the dots back to a change made a month earlier.",[11,194,195],{},"The other slow burn was a trickle of tickets from devices and agents that behaved differently once IPv6 was gone, none of which said \"IPv6\" in the first report. I'm not going to pretend I can give you a clean list for your environment. The practical lesson is that the tickets arrive late, and you need the change record and the per-server state (below) to hand when they do.",[15,197,199],{"id":198},"audit-before-you-touch-anything","Audit before you touch anything",[11,201,202,203,205,206,208],{},"Before changing anything I want to know what the estate looks like today: which servers already have a ",[53,204,55],{}," value (and whether anyone typed ",[53,207,153],{},"), which have IPv6 unbound on an adapter, and which roles are present that the KB flags. This script collects that over PowerShell remoting and writes a CSV. It reads only; it changes nothing.",[11,210,211,212,215],{},"It needs Windows PowerShell 5.1 or later, WinRM reachable on the targets, and local admin rights on them (",[53,213,214],{},"Get-WindowsFeature"," is a Server Manager cmdlet, so it reports roles on Windows Server only).",[217,218,223],"pre",{"className":219,"code":220,"language":221,"meta":222,"style":222},"language-powershell shiki shiki-themes github-dark","\u003C#\n.SYNOPSIS\n    Audits IPv6 configuration across Windows servers without changing anything.\n.DESCRIPTION\n    For each server, reads the Tcpip6 DisabledComponents value, decodes it,\n    lists adapters where IPv6 (ms_tcpip6) is unbound, and flags installed roles\n    that Microsoft's KB 929852 calls out (failover clustering, AD DS, RRAS).\n    Writes one row per server to a CSV.\n.PARAMETER ComputerName\n    Servers to audit.\n.PARAMETER OutputPath\n    CSV path. Default .\\ipv6-audit.csv.\n.EXAMPLE\n    .\\Get-Ipv6Audit.ps1 -ComputerName (Get-Content -Path .\\servers.txt)\n.NOTES\n    Author  : Thomas Lasswell (https:\u002F\u002Fwww.techcolumnist.com)\n    Version : 1.0 (2026-06-24)\n    Requires: PowerShell remoting, local admin on targets\n#>\n[CmdletBinding()]\nparam (\n    [Parameter(Mandatory = $true)]\n    [string[]]$ComputerName,\n\n    [string]$OutputPath = \".\\ipv6-audit.csv\"\n)\n\n$auditScript = {\n    $regPath = \"HKLM:\\SYSTEM\\CurrentControlSet\\Services\\Tcpip6\\Parameters\"\n    $property = Get-ItemProperty -Path $regPath -Name DisabledComponents -ErrorAction SilentlyContinue\n    $value = $null\n\n    if ($property) {\n        $value = [int64]$property.DisabledComponents\n\n        if ($value -lt 0) {\n            $value += 4294967296\n        }\n    }\n\n    $meaning = switch ($value) {\n        $null { \"Not set (default: IPv6 preferred)\" }\n        0 { \"0x00 default\" }\n        1 { \"0x01 tunnels disabled\" }\n        16 { \"0x10 native interfaces disabled\" }\n        17 { \"0x11 native and tunnels disabled\" }\n        32 { \"0x20 prefer IPv4 (recommended)\" }\n        255 { \"0xFF IPv6 disabled except loopback\" }\n        4294967295 { \"0xFFFFFFFF WRONG VALUE (5 s boot delay)\" }\n        default { \"0x{0:X} custom bitmask\" -f $value }\n    }\n\n    $unbound = Get-NetAdapterBinding -ComponentID ms_tcpip6 -ErrorAction SilentlyContinue |\n        Where-Object { -not $_.Enabled } |\n        ForEach-Object { $_.Name }\n\n    $roles = @()\n\n    if (Get-Command -Name Get-WindowsFeature -ErrorAction SilentlyContinue) {\n        $roles = Get-WindowsFeature -Name Failover-Clustering, AD-Domain-Services, RemoteAccess |\n            Where-Object { $_.Installed } |\n            ForEach-Object { $_.Name }\n    }\n\n    [PSCustomObject]@{\n        DisabledComponents = $meaning\n        UnboundAdapters    = ($unbound -join \"; \")\n        FlaggedRoles       = ($roles -join \"; \")\n    }\n}\n\n$results = Invoke-Command -ComputerName $ComputerName -ScriptBlock $auditScript -ErrorAction SilentlyContinue -ErrorVariable remoteErrors\n\n$results |\n    Select-Object -Property PSComputerName, DisabledComponents, UnboundAdapters, FlaggedRoles |\n    Sort-Object -Property PSComputerName |\n    Export-Csv -Path $OutputPath -NoTypeInformation\n\nforeach ($failure in $remoteErrors) {\n    Write-Warning \"Unreachable: $($failure.TargetObject) - $($failure.Exception.Message)\"\n}\n\nWrite-Host \"Audit written to $OutputPath\"\n","powershell","",[53,224,225,234,244,250,258,264,270,276,282,293,299,309,315,323,329,337,343,349,355,361,374,383,408,422,429,446,452,457,468,479,507,518,523,532,549,554,572,584,590,596,601,615,630,643,656,669,682,695,708,721,738,743,748,772,791,805,810,824,829,852,896,911,923,928,933,950,961,980,997,1002,1008,1013,1043,1048,1055,1083,1096,1112,1117,1132,1167,1172,1177],{"__ignoreMap":222},[226,227,230],"span",{"class":228,"line":229},"line",1,[226,231,233],{"class":232},"sAwPA","\u003C#\n",[226,235,237,240],{"class":228,"line":236},2,[226,238,185],{"class":239},"sDLfK",[226,241,243],{"class":242},"snl16","SYNOPSIS\n",[226,245,247],{"class":228,"line":246},3,[226,248,249],{"class":232},"    Audits IPv6 configuration across Windows servers without changing anything.\n",[226,251,253,255],{"class":228,"line":252},4,[226,254,185],{"class":239},[226,256,257],{"class":242},"DESCRIPTION\n",[226,259,261],{"class":228,"line":260},5,[226,262,263],{"class":232},"    For each server, reads the Tcpip6 DisabledComponents value, decodes it,\n",[226,265,267],{"class":228,"line":266},6,[226,268,269],{"class":232},"    lists adapters where IPv6 (ms_tcpip6) is unbound, and flags installed roles\n",[226,271,273],{"class":228,"line":272},7,[226,274,275],{"class":232},"    that Microsoft's KB 929852 calls out (failover clustering, AD DS, RRAS).\n",[226,277,279],{"class":228,"line":278},8,[226,280,281],{"class":232},"    Writes one row per server to a CSV.\n",[226,283,285,287,290],{"class":228,"line":284},9,[226,286,185],{"class":239},[226,288,289],{"class":242},"PARAMETER",[226,291,292],{"class":242}," ComputerName\n",[226,294,296],{"class":228,"line":295},10,[226,297,298],{"class":232},"    Servers to audit.\n",[226,300,302,304,306],{"class":228,"line":301},11,[226,303,185],{"class":239},[226,305,289],{"class":242},[226,307,308],{"class":242}," OutputPath\n",[226,310,312],{"class":228,"line":311},12,[226,313,314],{"class":232},"    CSV path. Default .\\ipv6-audit.csv.\n",[226,316,318,320],{"class":228,"line":317},13,[226,319,185],{"class":239},[226,321,322],{"class":242},"EXAMPLE\n",[226,324,326],{"class":228,"line":325},14,[226,327,328],{"class":232},"    .\\Get-Ipv6Audit.ps1 -ComputerName (Get-Content -Path .\\servers.txt)\n",[226,330,332,334],{"class":228,"line":331},15,[226,333,185],{"class":239},[226,335,336],{"class":242},"NOTES\n",[226,338,340],{"class":228,"line":339},16,[226,341,342],{"class":232},"    Author  : Thomas Lasswell (https:\u002F\u002Fwww.techcolumnist.com)\n",[226,344,346],{"class":228,"line":345},17,[226,347,348],{"class":232},"    Version : 1.0 (2026-06-24)\n",[226,350,352],{"class":228,"line":351},18,[226,353,354],{"class":232},"    Requires: PowerShell remoting, local admin on targets\n",[226,356,358],{"class":228,"line":357},19,[226,359,360],{"class":232},"#>\n",[226,362,364,368,371],{"class":228,"line":363},20,[226,365,367],{"class":366},"s95oV","[",[226,369,370],{"class":239},"CmdletBinding",[226,372,373],{"class":366},"()]\n",[226,375,377,380],{"class":228,"line":376},21,[226,378,379],{"class":242},"param",[226,381,382],{"class":366}," (\n",[226,384,386,389,392,395,399,402,405],{"class":228,"line":385},22,[226,387,388],{"class":366},"    [",[226,390,391],{"class":239},"Parameter",[226,393,394],{"class":366},"(",[226,396,398],{"class":397},"s9osk","Mandatory",[226,400,401],{"class":242}," =",[226,403,404],{"class":239}," $true",[226,406,407],{"class":366},")]\n",[226,409,411,413,416,419],{"class":228,"line":410},23,[226,412,388],{"class":366},[226,414,415],{"class":242},"string",[226,417,418],{"class":366},"[]]$ComputerName",[226,420,421],{"class":242},",\n",[226,423,425],{"class":228,"line":424},24,[226,426,428],{"emptyLinePlaceholder":427},true,"\n",[226,430,432,434,436,439,442],{"class":228,"line":431},25,[226,433,388],{"class":366},[226,435,415],{"class":242},[226,437,438],{"class":366},"]$OutputPath ",[226,440,441],{"class":242},"=",[226,443,445],{"class":444},"sU2Wk"," \".\\ipv6-audit.csv\"\n",[226,447,449],{"class":228,"line":448},26,[226,450,451],{"class":366},")\n",[226,453,455],{"class":228,"line":454},27,[226,456,428],{"emptyLinePlaceholder":427},[226,458,460,463,465],{"class":228,"line":459},28,[226,461,462],{"class":366},"$auditScript ",[226,464,441],{"class":242},[226,466,467],{"class":366}," {\n",[226,469,471,474,476],{"class":228,"line":470},29,[226,472,473],{"class":366},"    $regPath ",[226,475,441],{"class":242},[226,477,478],{"class":444}," \"HKLM:\\SYSTEM\\CurrentControlSet\\Services\\Tcpip6\\Parameters\"\n",[226,480,482,485,487,490,493,496,499,502,504],{"class":228,"line":481},30,[226,483,484],{"class":366},"    $property ",[226,486,441],{"class":242},[226,488,489],{"class":239}," Get-ItemProperty",[226,491,492],{"class":242}," -",[226,494,495],{"class":366},"Path $regPath ",[226,497,498],{"class":242},"-",[226,500,501],{"class":366},"Name DisabledComponents ",[226,503,498],{"class":242},[226,505,506],{"class":366},"ErrorAction SilentlyContinue\n",[226,508,510,513,515],{"class":228,"line":509},31,[226,511,512],{"class":366},"    $value ",[226,514,441],{"class":242},[226,516,517],{"class":239}," $null\n",[226,519,521],{"class":228,"line":520},32,[226,522,428],{"emptyLinePlaceholder":427},[226,524,526,529],{"class":228,"line":525},33,[226,527,528],{"class":242},"    if",[226,530,531],{"class":366}," ($property) {\n",[226,533,535,538,540,543,546],{"class":228,"line":534},34,[226,536,537],{"class":366},"        $value ",[226,539,441],{"class":242},[226,541,542],{"class":366}," [",[226,544,545],{"class":242},"int64",[226,547,548],{"class":366},"]$property.DisabledComponents\n",[226,550,552],{"class":228,"line":551},35,[226,553,428],{"emptyLinePlaceholder":427},[226,555,557,560,563,566,569],{"class":228,"line":556},36,[226,558,559],{"class":242},"        if",[226,561,562],{"class":366}," ($value ",[226,564,565],{"class":242},"-lt",[226,567,568],{"class":239}," 0",[226,570,571],{"class":366},") {\n",[226,573,575,578,581],{"class":228,"line":574},37,[226,576,577],{"class":366},"            $value ",[226,579,580],{"class":242},"+=",[226,582,583],{"class":239}," 4294967296\n",[226,585,587],{"class":228,"line":586},38,[226,588,589],{"class":366},"        }\n",[226,591,593],{"class":228,"line":592},39,[226,594,595],{"class":366},"    }\n",[226,597,599],{"class":228,"line":598},40,[226,600,428],{"emptyLinePlaceholder":427},[226,602,604,607,609,612],{"class":228,"line":603},41,[226,605,606],{"class":366},"    $meaning ",[226,608,441],{"class":242},[226,610,611],{"class":242}," switch",[226,613,614],{"class":366}," ($value) {\n",[226,616,618,621,624,627],{"class":228,"line":617},42,[226,619,620],{"class":239},"        $null",[226,622,623],{"class":366}," { ",[226,625,626],{"class":444},"\"Not set (default: IPv6 preferred)\"",[226,628,629],{"class":366}," }\n",[226,631,633,636,638,641],{"class":228,"line":632},43,[226,634,635],{"class":239},"        0",[226,637,623],{"class":366},[226,639,640],{"class":444},"\"0x00 default\"",[226,642,629],{"class":366},[226,644,646,649,651,654],{"class":228,"line":645},44,[226,647,648],{"class":239},"        1",[226,650,623],{"class":366},[226,652,653],{"class":444},"\"0x01 tunnels disabled\"",[226,655,629],{"class":366},[226,657,659,662,664,667],{"class":228,"line":658},45,[226,660,661],{"class":239},"        16",[226,663,623],{"class":366},[226,665,666],{"class":444},"\"0x10 native interfaces disabled\"",[226,668,629],{"class":366},[226,670,672,675,677,680],{"class":228,"line":671},46,[226,673,674],{"class":239},"        17",[226,676,623],{"class":366},[226,678,679],{"class":444},"\"0x11 native and tunnels disabled\"",[226,681,629],{"class":366},[226,683,685,688,690,693],{"class":228,"line":684},47,[226,686,687],{"class":239},"        32",[226,689,623],{"class":366},[226,691,692],{"class":444},"\"0x20 prefer IPv4 (recommended)\"",[226,694,629],{"class":366},[226,696,698,701,703,706],{"class":228,"line":697},48,[226,699,700],{"class":239},"        255",[226,702,623],{"class":366},[226,704,705],{"class":444},"\"0xFF IPv6 disabled except loopback\"",[226,707,629],{"class":366},[226,709,711,714,716,719],{"class":228,"line":710},49,[226,712,713],{"class":239},"        4294967295",[226,715,623],{"class":366},[226,717,718],{"class":444},"\"0xFFFFFFFF WRONG VALUE (5 s boot delay)\"",[226,720,629],{"class":366},[226,722,724,727,729,732,735],{"class":228,"line":723},50,[226,725,726],{"class":242},"        default",[226,728,623],{"class":366},[226,730,731],{"class":444},"\"0x{0:X} custom bitmask\"",[226,733,734],{"class":242}," -f",[226,736,737],{"class":366}," $value }\n",[226,739,741],{"class":228,"line":740},51,[226,742,595],{"class":366},[226,744,746],{"class":228,"line":745},52,[226,747,428],{"emptyLinePlaceholder":427},[226,749,751,754,756,759,761,764,766,769],{"class":228,"line":750},53,[226,752,753],{"class":366},"    $unbound ",[226,755,441],{"class":242},[226,757,758],{"class":239}," Get-NetAdapterBinding",[226,760,492],{"class":242},[226,762,763],{"class":366},"ComponentID ms_tcpip6 ",[226,765,498],{"class":242},[226,767,768],{"class":366},"ErrorAction SilentlyContinue ",[226,770,771],{"class":242},"|\n",[226,773,775,778,780,783,786,789],{"class":228,"line":774},54,[226,776,777],{"class":239},"        Where-Object",[226,779,623],{"class":366},[226,781,782],{"class":242},"-not",[226,784,785],{"class":239}," $_",[226,787,788],{"class":366},".Enabled } ",[226,790,771],{"class":242},[226,792,794,797,799,802],{"class":228,"line":793},55,[226,795,796],{"class":239},"        ForEach-Object",[226,798,623],{"class":366},[226,800,801],{"class":239},"$_",[226,803,804],{"class":366},".Name }\n",[226,806,808],{"class":228,"line":807},56,[226,809,428],{"emptyLinePlaceholder":427},[226,811,813,816,818,821],{"class":228,"line":812},57,[226,814,815],{"class":366},"    $roles ",[226,817,441],{"class":242},[226,819,820],{"class":242}," @",[226,822,823],{"class":366},"()\n",[226,825,827],{"class":228,"line":826},58,[226,828,428],{"emptyLinePlaceholder":427},[226,830,832,834,837,840,842,845,847,849],{"class":228,"line":831},59,[226,833,528],{"class":242},[226,835,836],{"class":366}," (",[226,838,839],{"class":239},"Get-Command",[226,841,492],{"class":242},[226,843,844],{"class":366},"Name ",[226,846,214],{"class":239},[226,848,492],{"class":242},[226,850,851],{"class":366},"ErrorAction SilentlyContinue) {\n",[226,853,855,858,860,863,865,868,870,873,876,879,881,884,886,889,891,894],{"class":228,"line":854},60,[226,856,857],{"class":366},"        $roles ",[226,859,441],{"class":242},[226,861,862],{"class":239}," Get-WindowsFeature",[226,864,492],{"class":242},[226,866,867],{"class":366},"Name Failover",[226,869,498],{"class":242},[226,871,872],{"class":366},"Clustering",[226,874,875],{"class":242},",",[226,877,878],{"class":366}," AD",[226,880,498],{"class":242},[226,882,883],{"class":366},"Domain",[226,885,498],{"class":242},[226,887,888],{"class":366},"Services",[226,890,875],{"class":242},[226,892,893],{"class":366}," RemoteAccess ",[226,895,771],{"class":242},[226,897,899,902,904,906,909],{"class":228,"line":898},61,[226,900,901],{"class":239},"            Where-Object",[226,903,623],{"class":366},[226,905,801],{"class":239},[226,907,908],{"class":366},".Installed } ",[226,910,771],{"class":242},[226,912,914,917,919,921],{"class":228,"line":913},62,[226,915,916],{"class":239},"            ForEach-Object",[226,918,623],{"class":366},[226,920,801],{"class":239},[226,922,804],{"class":366},[226,924,926],{"class":228,"line":925},63,[226,927,595],{"class":366},[226,929,931],{"class":228,"line":930},64,[226,932,428],{"emptyLinePlaceholder":427},[226,934,936,938,941,944,947],{"class":228,"line":935},65,[226,937,388],{"class":366},[226,939,940],{"class":242},"PSCustomObject",[226,942,943],{"class":366},"]",[226,945,946],{"class":242},"@",[226,948,949],{"class":366},"{\n",[226,951,953,956,958],{"class":228,"line":952},66,[226,954,955],{"class":366},"        DisabledComponents ",[226,957,441],{"class":242},[226,959,960],{"class":366}," $meaning\n",[226,962,964,967,969,972,975,978],{"class":228,"line":963},67,[226,965,966],{"class":366},"        UnboundAdapters    ",[226,968,441],{"class":242},[226,970,971],{"class":366}," ($unbound ",[226,973,974],{"class":242},"-join",[226,976,977],{"class":444}," \"; \"",[226,979,451],{"class":366},[226,981,983,986,988,991,993,995],{"class":228,"line":982},68,[226,984,985],{"class":366},"        FlaggedRoles       ",[226,987,441],{"class":242},[226,989,990],{"class":366}," ($roles ",[226,992,974],{"class":242},[226,994,977],{"class":444},[226,996,451],{"class":366},[226,998,1000],{"class":228,"line":999},69,[226,1001,595],{"class":366},[226,1003,1005],{"class":228,"line":1004},70,[226,1006,1007],{"class":366},"}\n",[226,1009,1011],{"class":228,"line":1010},71,[226,1012,428],{"emptyLinePlaceholder":427},[226,1014,1016,1019,1021,1024,1026,1029,1031,1034,1036,1038,1040],{"class":228,"line":1015},72,[226,1017,1018],{"class":366},"$results ",[226,1020,441],{"class":242},[226,1022,1023],{"class":239}," Invoke-Command",[226,1025,492],{"class":242},[226,1027,1028],{"class":366},"ComputerName $ComputerName ",[226,1030,498],{"class":242},[226,1032,1033],{"class":366},"ScriptBlock $auditScript ",[226,1035,498],{"class":242},[226,1037,768],{"class":366},[226,1039,498],{"class":242},[226,1041,1042],{"class":366},"ErrorVariable remoteErrors\n",[226,1044,1046],{"class":228,"line":1045},73,[226,1047,428],{"emptyLinePlaceholder":427},[226,1049,1051,1053],{"class":228,"line":1050},74,[226,1052,1018],{"class":366},[226,1054,771],{"class":242},[226,1056,1058,1061,1063,1066,1068,1071,1073,1076,1078,1081],{"class":228,"line":1057},75,[226,1059,1060],{"class":239},"    Select-Object",[226,1062,492],{"class":242},[226,1064,1065],{"class":366},"Property PSComputerName",[226,1067,875],{"class":242},[226,1069,1070],{"class":366}," DisabledComponents",[226,1072,875],{"class":242},[226,1074,1075],{"class":366}," UnboundAdapters",[226,1077,875],{"class":242},[226,1079,1080],{"class":366}," FlaggedRoles ",[226,1082,771],{"class":242},[226,1084,1086,1089,1091,1094],{"class":228,"line":1085},76,[226,1087,1088],{"class":239},"    Sort-Object",[226,1090,492],{"class":242},[226,1092,1093],{"class":366},"Property PSComputerName ",[226,1095,771],{"class":242},[226,1097,1099,1102,1104,1107,1109],{"class":228,"line":1098},77,[226,1100,1101],{"class":239},"    Export-Csv",[226,1103,492],{"class":242},[226,1105,1106],{"class":366},"Path $OutputPath ",[226,1108,498],{"class":242},[226,1110,1111],{"class":366},"NoTypeInformation\n",[226,1113,1115],{"class":228,"line":1114},78,[226,1116,428],{"emptyLinePlaceholder":427},[226,1118,1120,1123,1126,1129],{"class":228,"line":1119},79,[226,1121,1122],{"class":242},"foreach",[226,1124,1125],{"class":366}," ($failure ",[226,1127,1128],{"class":242},"in",[226,1130,1131],{"class":366}," $remoteErrors) {\n",[226,1133,1135,1138,1141,1144,1146,1149,1152,1155,1157,1159,1162,1164],{"class":228,"line":1134},80,[226,1136,1137],{"class":239},"    Write-Warning",[226,1139,1140],{"class":444}," \"Unreachable: ",[226,1142,1143],{"class":242},"$",[226,1145,394],{"class":444},[226,1147,1148],{"class":366},"$failure.TargetObject",[226,1150,1151],{"class":444},")",[226,1153,1154],{"class":444}," - ",[226,1156,1143],{"class":242},[226,1158,394],{"class":444},[226,1160,1161],{"class":366},"$failure.Exception.Message",[226,1163,1151],{"class":444},[226,1165,1166],{"class":444},"\"\n",[226,1168,1170],{"class":228,"line":1169},81,[226,1171,1007],{"class":366},[226,1173,1175],{"class":228,"line":1174},82,[226,1176,428],{"emptyLinePlaceholder":427},[226,1178,1180,1183,1186,1189],{"class":228,"line":1179},83,[226,1181,1182],{"class":239},"Write-Host",[226,1184,1185],{"class":444}," \"Audit written to ",[226,1187,1188],{"class":366},"$OutputPath",[226,1190,1166],{"class":444},[11,1192,1193,1194,1197],{},"Sample output, opened with ",[53,1195,1196],{},"Import-Csv -Path .\\ipv6-audit.csv | Format-Table",":",[217,1199,1204],{"className":1200,"code":1202,"language":1203,"meta":222},[1201],"language-text","PSComputerName DisabledComponents                      UnboundAdapters FlaggedRoles\n-------------- ------------------                      --------------- ------------\nSRV-APP01      Not set (default: IPv6 preferred)\nSRV-CL01N1     Not set (default: IPv6 preferred)                       Failover-Clustering\nSRV-DC01       0xFFFFFFFF WRONG VALUE (5 s boot delay)                 AD-Domain-Services\nSRV-RAS01      0x20 prefer IPv4 (recommended)                          RemoteAccess\nSRV-FILE02     Not set (default: IPv6 preferred)       Ethernet 2\n","text",[53,1205,1202],{"__ignoreMap":222},[11,1207,1208,1209,1212,1213,1216,1217,1220],{},"Anything with ",[53,1210,1211],{},"FlaggedRoles"," goes to the back of the queue or out of scope entirely. Anything with ",[53,1214,1215],{},"UnboundAdapters"," gets re-bound (",[53,1218,1219],{},"Enable-NetAdapterBinding -Name \"\u003Cadapter>\" -ComponentID ms_tcpip6",") as part of the same change, because that's the configuration Microsoft won't support.",[15,1222,1224],{"id":1223},"rolling-it-out","Rolling it out",[11,1226,1227,1228,1230,1231,1236,1237,1239,1240,1243],{},"For the change itself I use a Group Policy computer startup script that writes ",[53,1229,55],{},", logs what it did, and warns about unbound adapters. It's published separately with parameters, sample logs and rollback as ",[1232,1233,1235],"a",{"href":1234},"\u002F2025\u002F04\u002F03\u002Fpowershell-windows-disable-ipv6-fleet-wide-via-group-policy-startup-script\u002F","PowerShell: Windows – Disable IPv6 Fleet-Wide via GPO Startup Script",". Its default is ",[53,1238,59],{},". If you don't need the logging, a GPO registry setting does the same with one line from the ",[53,1241,1242],{},"GroupPolicy"," module:",[217,1245,1247],{"className":219,"code":1246,"language":221,"meta":222,"style":222},"Set-GPRegistryValue -Name \"IPv6 - Prefer IPv4\" -Key \"HKLM\\SYSTEM\\CurrentControlSet\\Services\\Tcpip6\\Parameters\" -ValueName \"DisabledComponents\" -Type DWord -Value 32\n",[53,1248,1249],{"__ignoreMap":222},[226,1250,1251,1254,1256,1258,1261,1263,1266,1269,1271,1274,1277,1279,1282,1284,1287],{"class":228,"line":229},[226,1252,1253],{"class":239},"Set-GPRegistryValue",[226,1255,492],{"class":242},[226,1257,844],{"class":366},[226,1259,1260],{"class":444},"\"IPv6 - Prefer IPv4\"",[226,1262,492],{"class":242},[226,1264,1265],{"class":366},"Key ",[226,1267,1268],{"class":444},"\"HKLM\\SYSTEM\\CurrentControlSet\\Services\\Tcpip6\\Parameters\"",[226,1270,492],{"class":242},[226,1272,1273],{"class":366},"ValueName ",[226,1275,1276],{"class":444},"\"DisabledComponents\"",[226,1278,492],{"class":242},[226,1280,1281],{"class":366},"Type DWord ",[226,1283,498],{"class":242},[226,1285,1286],{"class":366},"Value ",[226,1288,1289],{"class":239},"32\n",[11,1291,1292,1293,1295],{},"If the actual problem is stray tunnel addresses, fix that problem instead. Windows turns on 6to4 when an interface gets a public IPv4 address and registers the resulting IPv6 addresses in DNS. Either ",[53,1294,75],{}," or the policies under Computer Configuration > Administrative Templates > Network > TCPIP Settings > IPv6 Transition Technologies (6to4 State, ISATAP State and Teredo State all set to Disabled) turn the tunnels off without touching native IPv6. ISATAP and Teredo are already off by default.",[15,1297,1299],{"id":1298},"what-id-do-differently","What I'd do differently",[11,1301,1302,1303,1305],{},"Prefer IPv4 first (",[53,1304,59],{},"), and only go further for a specific, written-down reason. Never unbind at the adapter unless a driver or vendor genuinely requires it. Stage by server role, not by blast-radius convenience: standalone application servers first, because that's where a mistake is cheapest to find, then everything else, with cluster nodes, domain controllers, Exchange and RRAS\u002FDirectAccess last or excluded with a security-group filter on the GPO. Keep the audit CSV from before and after so the late tickets can be checked against a known state. And budget for those late tickets: the DirectAccess failure took longer to attribute to the change than the change itself took to roll out. Disabling IPv6 the right way isn't really a technical challenge, since the registry value is one line. It's a change-management challenge, and the technical shortcuts are exactly where the cost hides.",[15,1307,1309],{"id":1308},"references","References",[1311,1312,1313,1322,1329,1336,1343,1350,1356],"ul",{},[1314,1315,1316],"li",{},[1232,1317,1321],{"href":1318,"rel":1319},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Ftroubleshoot\u002Fwindows-server\u002Fnetworking\u002Fconfigure-ipv6-in-windows",[1320],"nofollow","Configure IPv6 for advanced users in Windows (KB 929852)",[1314,1323,1324],{},[1232,1325,1328],{"href":1326,"rel":1327},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Farchive\u002Fblogs\u002Fnetro\u002Farguments-against-disabling-ipv6",[1320],"Arguments against disabling IPv6 (Microsoft networking blog archive)",[1314,1330,1331],{},[1232,1332,1335],{"href":1333,"rel":1334},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Farchive\u002Fblogs\u002Faskcore\u002Fwhat-is-a-microsoft-failover-cluster-virtual-adapter-anyway",[1320],"What is a Microsoft Failover Cluster Virtual Adapter anyway? (Ask the Core Team archive)",[1314,1337,1338],{},[1232,1339,1342],{"href":1340,"rel":1341},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows-server\u002Fremote\u002Fremote-access\u002Fdirectaccess\u002Fsingle-server-wizard\u002Fda-basic-plan-s1-infrastructure",[1320],"Plan the basic DirectAccess infrastructure",[1314,1344,1345],{},[1232,1346,1349],{"href":1347,"rel":1348},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fpowershell\u002Fmodule\u002Fnetadapter\u002Fget-netadapterbinding",[1320],"Get-NetAdapterBinding",[1314,1351,1352],{},[1232,1353,1253],{"href":1354,"rel":1355},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fpowershell\u002Fmodule\u002Fgrouppolicy\u002Fset-gpregistryvalue",[1320],[1314,1357,1358],{},[1232,1359,1362],{"href":1360,"rel":1361},"https:\u002F\u002Fdatatracker.ietf.org\u002Fdoc\u002Fhtml\u002Frfc3484",[1320],"RFC 3484: Default Address Selection for IPv6",[1364,1365,1366],"style",{},"html pre.shiki code .sAwPA, html code.shiki .sAwPA{--shiki-default:#6A737D}html pre.shiki code .sDLfK, html code.shiki .sDLfK{--shiki-default:#79B8FF}html pre.shiki code .snl16, html code.shiki .snl16{--shiki-default:#F97583}html pre.shiki code .s95oV, html code.shiki .s95oV{--shiki-default:#E1E4E8}html pre.shiki code .s9osk, html code.shiki .s9osk{--shiki-default:#FFAB70}html pre.shiki code .sU2Wk, html code.shiki .sU2Wk{--shiki-default:#9ECBFF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":222,"searchDepth":236,"depth":236,"links":1368},[1369,1370,1371,1372,1373,1374,1375,1376],{"id":17,"depth":236,"text":18},{"id":134,"depth":236,"text":135},{"id":167,"depth":236,"text":168},{"id":188,"depth":236,"text":189},{"id":198,"depth":236,"text":199},{"id":1223,"depth":236,"text":1224},{"id":1298,"depth":236,"text":1299},{"id":1308,"depth":236,"text":1309},"techcolumnist",[1379],"engineering","2026-06-24T14:00:00Z","Field notes on disabling IPv6 across a Windows Server estate: what Microsoft says, what breaks, why prefer-IPv4 (0x20) beats 0xFF, and an audit script.","md",false,null,{},"\u002Fblog\u002F2026\u002F06\u002F24\u002Fwindows-server-disabling-ipv6-company-wide-what-actually-broke",{"title":6,"description":1381},[1377],"blog\u002F2026\u002F06\u002F24\u002Fwindows-server-disabling-ipv6-company-wide-what-actually-broke",[1391,1392,1393],"windows","ipv6","gpo","\u002F2026\u002F06\u002F24\u002Fwindows-server-disabling-ipv6-company-wide-what-actually-broke\u002F","Clnw5Lx_h_qm_cLMPykM0A_va11k2Xp08xvEJpPHFKs",{"title":1397,"description":1398,"date":1399,"url":1400,"categories":1401,"tags":1402,"image":1384,"readingTime":272,"canonical":1377,"sites":1405,"series":1384,"seriesOrder":1384},"Windows Server: TCP Stack Tuning for a 10GbE Storage Network","Field notes on getting 10GbE-class throughput from Windows Server storage links: RSS, SMB Multichannel, autotuning, offloads, jumbo frames, and a baseline script.","2026-07-01T14:00:00Z","\u002F2026\u002F07\u002F01\u002Fwindows-server-tcp-stack-tuning-for-a-10gbe-storage-network\u002F",[1379],[1391,1403,1404],"tcp","network",[1377],{"title":1407,"description":1408,"date":1409,"url":1410,"categories":1411,"tags":1412,"image":1384,"readingTime":278,"canonical":1377,"sites":1416,"series":1384,"seriesOrder":1384},"Windows 11: A Debloat and Hardening Baseline for New Deployments","A repeatable Windows 11 baseline: policy-based app removal, Microsoft security baselines, BitLocker, Defender and ASR settings, plus a fleet audit script.","2026-06-17T14:00:00Z","\u002F2026\u002F06\u002F17\u002Fwindows-11-a-debloat-and-hardening-baseline-for-new-deployments\u002F",[1379],[1413,1414,1393,1415],"windows-11","debloat","intune",[1377],[1418,1428,1436],{"title":1419,"description":1420,"date":1421,"url":1422,"categories":1423,"tags":1425,"image":1384,"readingTime":272,"canonical":1377,"sites":1427,"series":1384,"seriesOrder":1384},"Intune: Migrating From Group Policy to Cloud-Native Management","Moving a Windows estate from Group Policy to Intune: GPO inventory script, Group Policy analytics, Settings catalog migration, MDMWinsOverGP and conflict checks.","2026-04-01T14:00:00Z","\u002F2026\u002F04\u002F01\u002Fintune-migrating-from-group-policy-to-cloud-native-endpoint-management\u002F",[1379,1424],"strategy",[1415,1393,1391,1426],"active-directory",[1377],{"title":1235,"description":1429,"date":1430,"url":1234,"categories":1431,"tags":1434,"image":1384,"readingTime":260,"canonical":1377,"sites":1435,"series":1384,"seriesOrder":1384},"A Group Policy startup script that sets the Tcpip6 DisabledComponents value (prefer IPv4 by default, full disable on request) with logging, binding checks and rollback.","2025-04-03T14:00:00Z",[1432,1433],"ps","scripts",[221,1391,1392,1393],[1377],{"title":1437,"description":1438,"date":1439,"url":1440,"categories":1441,"tags":1442,"image":1384,"readingTime":260,"canonical":1377,"sites":1444,"series":1384,"seriesOrder":1384},"Windows Management: A Discovery Inventory Nobody Maintains by Hand","Why a self-refreshing Windows inventory built from AD and CIM discovery outlasts a spreadsheet, with the sweep script, staleness report and schedule.","2026-09-02T14:00:00Z","\u002F2026\u002F09\u002F02\u002Fwindows-management-building-a-discovery-inventory-nobody-has-to-maintain-by-hand\u002F",[1379,1424],[1443,1391,1426],"discovery",[1377],{"doc":1384,"posts":1446},[],1790052514051]