Network Shell (Netsh) Technical Reference
See Also

Network shell (netsh) is a command-line utility that allows you to configure and display the status of various network communications server roles and components after they are installed on computers running Windows Server® 2008.

Some client technologies, such as Network Access Protection (NAP) client, also provide netsh commands that allow you to configure client computers running Windows Vista®.

In most cases, netsh commands provide the same functionality that is available when using the Microsoft Management Console (MMC) snap-in for each server role or component. In addition, there are netsh commands for network functionality, such as for IPv6, network bridge, and remote procedure call (RPC), that are not available in the user interface as an MMC snap-in.

You can use netsh commands to configure and display the status of network components on the local computer and on remote computers.

In addition, netsh commands can be run manually by typing commands at the netsh prompt and they can be run in batch files and scripts.

Netsh commands are organized in a hierarchy of contexts. Each network technology with netsh command functionality has its own context. For example, the netsh context for remote access service is ras.

Network communications technologies that provide netsh functionality

Netsh functionality is provided for some server roles, role services, features, and technologies.

Server roles and role services

The following server roles provide netsh command functionality:

  • The Dynamic Host Configuration Protocol (DHCP) server role. After installing the DHCP server role, you can configure the DHCP server by using the commands at the netsh dhcp context. The context for DHCP is netsh dhcp.

  • The Network Policy and Access Services server role. This server role provides netsh functionality for the following role services after the role services are installed:

    • Health Registration Authority (HRA). The context for HRA is netsh nap hra.

    • Network Policy Server (NPS). The context for NPS is netsh nps.

    • Routing and Remote Access. The contexts for Routing and Remote Access are netsh routing and netsh ras.

Features and other network communications technologies

The following features provide netsh command functionality:

  • Windows Internet Name Service (WINS). The context for WINS is netsh wins.

The following network communications technologies provide netsh functionality:

  • DHCP client. The context for DHCP client is netsh dhcpclient.

  • Firewall. See Windows Firewall and Windows Firewall with Advanced Security.

  • Hypertext Transfer Protocol (HTTP). The context for HTTP is netsh http.

  • Internet Authentication Service. IAS is renamed to Network Policy Server (NPS), and the context for NPS is netsh nps.

  • Internet Protocol version 4 (IPv4). The context for IPv4 is netsh interface ip.

  • Internet Protocol version 6 (IPv6). The context for IPv6 is netsh interface ipv6.

  • IPv4 and IPv6 network and application proxy. The context for the IPv4 and IPv6 network and application proxy is netsh interface portproxy.

  • Internet Protocol security (IPsec). The context for IPsec is netsh ipsec.

  • Local Area Network. See Wired Local Area Network.

  • Network Access Protection (NAP). The context for NAP client is netsh nap. In addition, NPS provides netsh commands at the netsh nps context that allow you to configure NPS as a NAP policy server.

  • Network Bridge. The context for network bridge is netsh bridge.

  • Network input output (netio). The context for netio is netsh netio.

  • Remote Procedure Call (RPC). The context for RPC is netsh rpc.

  • Windows Firewall. The context for Windows Firewall is netsh firewall.

  • Windows Firewall with Advanced Security. The context for Windows Firewall with Advanced Security is netsh advfirewall.

  • Windows HTTP. The context for Windows HTTP is netsh winhttp.

  • Windows Sockets (winsock). The context for Windows Sockets is netsh winsock.

  • Wired Local Area Network (LAN). The context for wired LAN is netsh lan.

  • Wireless LAN. The context for wireless LAN is netsh wlan.

The following sections provide information about the netsh commands and their use, including a comprehensive command reference with syntax and parameters for all commands.

See Also

Concepts

Netsh Overview
Enter a Netsh Context
Formatting Legend
Netsh DHCP Example
Netsh WINS Example
Netsh Command Reference


Netsh Overview

Netsh is a command-line scripting utility that allows you to display or modify the network configuration of a computer that is currently running. Netsh commands can be run by typing commands at the netsh prompt and they can be used in batch files or scripts. Remote computers and the local computer can be configured by using netsh commands.

Netsh also provides a scripting feature that allows you to run a group of commands in batch mode against a specified computer. With netsh, you can save a configuration script in a text file for archival purposes or to help you configure other computers.

Netsh contexts

Netsh interacts with other operating system components by using dynamic-link library (DLL) files. Each netsh helper DLL provides an extensive set of features called a context, which is a group of commands specific to a networking component. These contexts extend the functionality of netsh by providing configuration and monitoring support for one or more services, utilities, or protocols. For example, Dhcpmon.dll provides netsh with the context and set of commands necessary to configure and manage DHCP servers.

Running netsh commands

To run a netsh command, you must start netsh from the command prompt by typing netsh and then pressing ENTER. Next, you can change to the context that contains the command you want to use. The contexts that are available depend on the networking components that you have installed. For example, if you type dhcp at the netsh prompt and press ENTER, netsh changes to the DHCP server context. If you do not have DHCP installed, however, the following message appears:

Copy Code
The following command was not found: dhcp.

Available contexts

For more information about Netsh contexts, see the following topics:

  • Netsh Commands for Dynamic Host Configuration Protocol client

  • Netsh Commands for Dynamic Host Configuration Protocol server

  • Netsh Commands for Health Registration Authority

  • Netsh Commands for Hypertext Transfer Protocol (HTTP)

  • Netsh Commands for Interface (IPv4 and IPv6)

  • Netsh commands for Internet Authentication Service (IAS). In Windows Server® 2008, IAS is replaced by Network Policy Server (NPS).

  • Netsh Commands for Internet Protocol Security (IPsec)

  • Netsh Commands for Network Access Protection (NAP) Client

  • Netsh Commands for Network Bridge

  • Netsh Commands for Network Input Output (NETIO)

  • Netsh Commands for Network Policy Server

  • Netsh Commands for Peer-to-Peer Networking (P2P)

  • Netsh Commands for Remote Access

  • Netsh Commands for Remote Procedure Call (RPC)

  • Netsh Commands for Routing

  • Netsh Commands for Windows Firewall

  • Netsh Commands for Windows Firewall with Advanced Security

  • Netsh Commands for Windows Hypertext Transfer Protocol (WINHTTP)

  • Netsh Commands for Windows Internet Name Service (WINS)

  • Netsh Commands for Windows Sockets (WINSOCK)

  • Netsh Commands for Wired Local Area Network (LAN)

  • Netsh Commands for Wireless Local Area Network (WLAN)

Subcontexts

Netsh contexts can contain both commands and additional contexts, called subcontexts. For example, within the Routing context, you can change to the IP and IPv6 subcontexts.

To display a list of commands and subcontexts that you can use within a context, at the netsh prompt, type the context name, and then type either /? or help. For example, to display a list of subcontexts and commands that you can use in the Routing context, at the netsh prompt (that is, netsh>), type one of the following:

routing /?

routing help

To perform tasks in another context without changing from your current context, type the context path of the command you want to use at the netsh prompt. For example, to add an interface named "Local Area Connection" in the IGMP context without first changing to the IGMP context, at the netsh prompt, type:

routing ip igmp add interface "Local Area Connection" startupqueryinterval=21

Running Netsh commands from command prompt

To start Network Shell and enter netsh at the command prompt, follow the command below.

netsh

Netsh is a command-line scripting utility that allows you to, either locally or remotely, display or modify the network configuration of a currently running computer. Used without parameters, netsh opens the Netsh.exe command prompt (that is, netsh>).

Syntax

netsh [ -a AliasFile] [ -c Context ] [-r RemoteComputer] [ -u [ DomainName\ ] UserName ] [ -p Password | *] [{NetshCommand | -f ScriptFile}]

Parameters

-a

Optional. Specifies that you are returned to the netsh prompt after running AliasFile.

AliasFile

Optional. Specifies the name of the text file that contains one or more netsh commands.

-c

Optional. Specifies that netsh enters the specified netsh context.

Context

Optional. Specifies the netsh context that you want to enter. For more information, see Enter a Netsh Context.

-r

Optional. Specifies that you want the command to run on a remote computer.

RemoteComputer

Optional. Specifies the remote computer that you want to configure.

-u

Optional. Specifies that you want to run the netsh command under a user account.

DomainName\

Optional. Specifies the domain where the user account is located. The default is the local domain if DomainName\ is not specified.

UserName

Optional. Specifies the user account name.

-p

Optional. Specifies that you want to provide a password for the user account.

Password

Optional. Specifies the password for the user account that you specified with -u UserName.

NetshCommand

Optional. Specifies the netsh command that you want to run.

-f

Optional. Exits netsh after running the script that you designate with ScriptFile.

ScriptFile

Optional. Specifies the script that you want to run.

/?

Optional. Displays help at the netsh prompt.

Remarks

  • If you specify -r followed by another command, netsh runs the command on the remote computer and then returns to the Cmd.exe command prompt. If you specify -r without another command, netsh opens in remote mode. The process is similar to using set machine at the Netsh command prompt. When you use -r, you set the target computer for the current instance of netsh only. After you exit and reenter netsh, the target computer is reset as the local computer. You can run netsh commands on a remote computer by specifying a computer name stored in WINS, a UNC name, an Internet name to be resolved by the DNS server, or an IP address.

Typing parameter string values for netsh commands

Throughout the Netsh command reference there are commands that contain parameters for which a string value is required.

In the case where a string value contains spaces between characters, such as string values that consist of more than one word, it is required that you enclose the string value in quotation marks. For example, for a parameter named interface with a string value of Wireless Network Connection, use quotation marks around the string value:

interface="Wireless Network Connection"

For information on how to interpret netsh command syntax, see Formatting Legend.


Enter a Netsh Context

You can use this procedure to start the network shell and enter a netsh context.

To enter a netsh context

  1. Open command prompt.

  2. At the command prompt, type netsh, and then press ENTER.

  3. Type one of the values from the following table, and then press ENTER.

Netsh contexts

Following are the values you can type to enter a netsh context.

To enter this context | Type
Dynamic Host Configuration Protocol (DHCP) client | dhcpclient
Dynamic Host Configuration Protocol (DHCP) server | dhcp
Health Registration Authority (HRA) | nap hra
Hypertext Transfer Protocol (HTTP) | http
Interface (IPv4 and IPv6) | interface
Internet Authentication Service (IAS). IAS is renamed to Network Policy Server. | nps
Internet Protocol security | ipsec
Network Access Protection (NAP) client | nap
Network Bridge | bridge
Network Input Output (NETIO) | netio
Network Policy Server (NPS) | nps
Remote Access | ras
Routing | routing
Remote Procedure Call (RPC) | rpc
Windows Firewall | firewall
Windows Firewall with Advanced Security | advfirewall
Windows Hypertext Transfer Protocol (WinHTTP) | winhttp
Windows Internet Name Service (WINS) | wins
Windows Sockets (WINSOCK) | winsock
Wired Local Area Network (LAN) | lan
Wireless Local Area Network (LAN) | wlan

Additional information

  • To enter a context, you can type only enough letters in the context name to allow netsh to uniquely identify the context. For example, to enter the winhttp context from the netsh prompt (that is, netsh>), you can type winh, and then press ENTER.

  • Some of these contexts are not available at the netsh prompt unless you have previously installed the server role, role service, feature, or other technology. For example, the DHCP server context netsh dhcp is not available at the netsh prompt until after you install the DHCP server role.

  • Many of the contexts listed above have one or more subcontexts. Subcontexts contain netsh commands that can be run only within the subcontext. For example, to run the add scope command, you must be within the server subcontext of the dhcp context:

    netsh dhcp server add scope parameters

    Where parameters are the properties of the scope that you can configure with the command.

  • Network Policy Server (NPS) was formerly known as Internet Authentication Service, and is the Microsoft implementation of a Remote Authentication Dial-In User Service (RADIUS) server and proxy, as well as a client health policy server for Network Access Protection (NAP).


Formatting Legend

You can use the following formatting legend to understand the meaning of the text formatting used in the netsh command references.

Formatting legend

The text formatting described below details how to interpret the text formatting of all netsh commands in this reference so that you type the command syntax correctly when you run the command at the netsh prompt or in a batch file or script.

Format | Meaning
Italic | Information that the user must supply.
Bold | Elements that the user must type exactly as shown.
Ellipsis (...) | Parameter that can be repeated several times in a command line.
Between brackets ([]) | Optional items.
Between braces ({}); choices separated by pipe (|). Example: {even|odd} | Set of choices from which the user must choose only one.
Courier font | Code or program output.


Netsh DHCP Example

You can use Netsh commands for Dynamic Host Configuration Protocol (DHCP) in batch files and other scripts to automate tasks. The following batch file example demonstrates how to use Netsh commands for DHCP to perform a variety of related tasks.

In the circumstance of this example procedure, DHCP-01 is a DHCP server with the IP address 192.168.0.2. The procedure adds a new scope to DHCP-01 with the name MyScope, IP address 192.168.10.0, subnet mask 255.255.255.0, and comment NewScope. It then configures the scope with an address range (192.168.10.1 through 192.168.10.254), an exclusion range (192.168.10.1 through 192.168.10.25), and router IP addresses (DHCP option 003). The scope is then set to an active state.

In the following procedure example, lines that contain comments are preceded by "rem," for remark. Netsh ignores comments.

Copy Code
rem one DHCP server:
rem (DHCP-01) 192.168.0.2

rem 1. Connect to (DHCP-01), and add the scope MyScope with IP address 192.168.10.0,
rem 1.1  subnet mask 255.255.255.0, and the comment NewScope.
netsh dhcp server 192.168.0.2 add scope 192.168.10.0 255.255.255.0 MyScope NewScope

rem 2. Connect to (DHCP-01 MyScope), and add IP address range 192.168.10.1 to 192.168.10.254 for distribution
rem 2.1  and the default ClientType of DHCP.
netsh dhcp server 192.168.0.2 scope 192.168.10.0 add iprange 192.168.10.1 192.168.10.254

rem 3. Connect to (DHCP-01 MyScope), and add IP exclusion range 192.168.10.1 to 192.168.10.25
rem 3.1  and the default ClientType of DHCP.
netsh dhcp server 192.168.0.2 scope 192.168.10.0 add excluderange 192.168.10.1 192.168.10.25

rem 4. Connect to (DHCP-01 MyScope), and set the value of option code 003
rem 4.1   to list two router IP addresses (10.1.1.1, 10.1.1.2).
netsh dhcp server 192.168.0.2 scope 192.168.10.0 set optionvalue 003 IPADDRESS 10.1.1.1 10.1.1.2

rem 5.  Connect to (DHCP-01 MyScope), and set the scope state to active.
netsh dhcp server 192.168.0.2 scope 192.168.10.0 set state 1

rem 6. End example batch file.

The following table lists the netsh dhcp commands that are used in this example procedure.

Command | Description
server | Shifts the current DHCP command-line context to the server that is specified by either its name or IP address.
add scope | Adds a new scope to the specified DHCP server.
scope | Switches the command context to the DHCP scope that is specified by its IP address.
add iprange | Adds a range of IP addresses to the current scope.
add excluderange | Adds a range of excluded addresses to the current scope.
set optionvalue | Sets an option value for the current scope.
set state | Sets or resets the state of the current scope to either an active or inactive state.


Netsh WINS Example

You can use Netsh commands for Windows Internet Name Service (WINS) in batch files and other scripts to automate tasks. The following batch file example demonstrates how to use Netsh commands for WINS to perform a variety of related tasks.

In this example procedure, WINS-A is a WINS server with the IP address 192.168.125.30 and WINS-B is a WINS server with the IP address 192.168.0.189. The procedure adds a dynamic name record with IP address 192.168.0.205, MY_RECORD [04h], to WINS-A, sets WINS-B as a push/pull replication partner of WINS-A, connects to WINS-B, and then sets WINS-A as a push/pull replication partner of WINS-B. Next, the procedure initiates a push replication from WINS-A to WINS-B, and then connects to WINS-B to verify that the new record, MY_RECORD, was replicated successfully.

In the following example procedure, lines that contain comments are preceded by "rem," for remark. Netsh ignores comments.

Copy Code
rem two WINS servers:
rem (WINS-A) 192.168.125.30
rem (WINS-B) 192.168.0.189

rem 1. Connect to (WINS-A), and add the dynamic name MY_RECORD [04h] to the (WINS-A) database.
netsh wins server 192.168.125.30 add name Name=MY_RECORD EndChar=04 IP={192.168.0.205}

rem 2. Connect to (WINS-A), and set (WINS-B) as a push/pull replication partner of (WINS-A).
netsh wins server 192.168.125.30 add partner Server=192.168.0.189 Type=2

rem 3. Connect to (WINS-B), and set (WINS-A) as a push/pull replication partner of (WINS-B).
netsh wins server 192.168.0.189 add partner Server=192.168.125.30 Type=2

rem 4. Connect back to (WINS-A), and initiate a push replication to (WINS-B).
netsh wins server 192.168.125.30 init push Server=192.168.0.189 PropReq=0

rem 5. Connect to (WINS-B), and check that the record MY_RECORD [04h] was replicated successfully.
netsh wins server 192.168.0.189 show name Name=MY_RECORD EndChar=04

rem 6. End example batch file.

The following table lists the netsh wins commands that are used in this example procedure.

Command | Description
server | Shifts the current WINS command-line context to the server specified by either its name or IP address.
add name | Registers a name to the server.
add partner | Adds a replication partner to the server.
init push | Initiates and sends a push trigger to a WINS server.
show name | Displays detailed information for a particular record in the WINS server database.


Netsh Command Reference

This section provides a comprehensive netsh command reference, including syntax, parameters, and examples.

  • Netsh Commands for Dynamic Host Configuration Protocol client

  • Netsh Commands for Dynamic Host Configuration Protocol server

  • Netsh Commands for Health Registration Authority

  • Netsh Commands for Hypertext Transfer Protocol (HTTP)

  • Netsh Commands for Interface (IPv4 and IPv6)

  • Netsh commands for Internet Authentication Service (IAS). In Windows Server® 2008, IAS is replaced by Network Policy Server (NPS).

  • Netsh Commands for Internet Protocol Security (IPsec)

  • Netsh Commands for Network Access Protection (NAP) Client

  • Netsh Commands for Network Bridge

  • Netsh Commands for Network Input Output (NETIO)

  • Netsh Commands for Network Policy Server

  • Netsh Commands for Peer-to-Peer Networking (P2P)

  • Netsh Commands for Remote Access

  • Netsh Commands for Remote Procedure Call (RPC)

  • Netsh Commands for Routing

  • Netsh Commands for Windows Firewall

  • Netsh Commands for Windows Firewall with Advanced Security

  • Netsh Commands for Windows Hypertext Transfer Protocol (WINHTTP)

  • Netsh Commands for Windows Internet Name Service (WINS)

  • Netsh Commands for Windows Sockets (WINSOCK)

  • Netsh Commands for Wired Local Area Network (LAN)

  • Netsh Commands for Wireless Local Area Network (WLAN)


Netsh Commands for All Contexts

Netsh uses the following standard commands in all contexts that you can run from a Netsh.exe command prompt (that is, netsh>).

Netsh standard commands

Following is the list of netsh commands that you can run in all netsh contexts. To view the command syntax, click a command:

  • ..

  • abort

  • add helper

  • alias

  • bye

  • commit

  • delete helper

  • dump

  • exec

  • exit

  • help

  • offline

  • online

  • popd

  • pushd

  • quit

  • set file

  • set machine

  • set mode

  • show

  • unalias

..

Moves to the context that is one level up.

Syntax

..

Parameters

/?

Displays help at the command prompt.

abort

Discards any changes made in offline mode. Abort has no effect in online mode.

Syntax

abort

Parameters

/?

Displays help at the command prompt.

add helper

Installs the helper dynamic-link library (DLL) in netsh.

Syntax

add helper DLLName

Parameters

DLLName

Required. Specifies the name of the helper DLL that you want to install.

/?

Displays help at the command prompt.

alias

Adds an alias that consists of a user-defined character string, which netsh treats as equivalent to another character string. Used without parameters, alias displays all available aliases.

Syntax

alias[AliasName] [String1 [String2 ...]]

Parameters

alias[ AliasName]

Displays the specified alias.

alias[ AliasName][ String1[ String2...]]

Sets AliasName to the specified strings.

/?

Displays help at the command prompt.

Examples

The following netsh sample script sets two netsh aliases, Shaddr and Shp, and then leaves the Netsh command prompt in the Interface IP context:

Copy Code
alias shaddr show interface ip addr
alias shp show helpers
interface ip

If you type shaddr at the Netsh command prompt, Netsh.exe interprets this as the command show interface ip addr. If you type shp at the Netsh command prompt, Netsh.exe interprets this as the command show helpers.

bye

Exits Netsh.exe.

Syntax

bye

Parameters

/?

Displays help at the command prompt.

commit

Commits any changes made in the offline mode to the router. Commit has no effect in online mode.

Syntax

commit

Parameters

/?

Displays help at the command prompt.

delete helper

Removes the helper DLL from netsh.

Syntax

delete helper DLLName

Parameters

DLLName

Required. Specifies the name of the helper DLL that you want to uninstall.

/?

Displays help at the command prompt.

dump

Creates a script that contains the current configuration. If you save this script to a file, you can use the file to restore configuration settings that have been changed. Used without parameters, dump displays all of the netsh context configurations.

Syntax

dump [FileName]

Parameters

[ FileName]

Specifies the name of the file to which you want to redirect output.

/?

Displays help at the command prompt.

exec

Loads a script file and runs commands from it.

Syntax

exec ScriptFile

Parameters

ScriptFile

Required. Specifies the name of the script that you want to load and run.

Remarks

  • The ScriptFile can run on one or more computers.

exit

Exits Netsh.exe.

Syntax

exit

Parameters

/?

Displays help at the command prompt.

help

Displays help.

Syntax

{/? | ? | help | h}

Parameters

none

offline

Sets the current mode to offline.

Syntax

offline

Parameters

/?

Displays help at the command prompt.

Remarks

  • Changes that you make in this mode are saved, but you must run the commit or online command to set the changes in the router.

  • When you switch from offline mode to online mode, changes that you made in offline mode are reflected in the configuration that is currently running.

  • Changes that you make in online mode are immediately reflected in the configuration that is currently running.

online

Sets the current mode to online.

Syntax

online

Parameters

/?

Displays help at the command prompt.

Remarks

  • Changes that you make in online mode are immediately reflected in the configuration that is currently running.

  • When you switch from offline mode to online mode, changes that you made in offline mode are reflected in the configuration that is currently running.

popd

Restores a context from the stack.

Syntax

popd

Parameters

/?

Displays help at the command prompt.

Remarks

  • Used in conjunction with pushd, popd enables you to change the context, run the command in the new context, and then resume the prior context.

Examples

The following sample script changes a context from the root context to the interface ip context, adds a static IP route, and then returns to the root context:

netsh> pushd

netsh> interface ip

netsh interface ip> set address local static 10.0.0.9 255.0.0.0 10.0.0.1 1

netsh interface ip> popd

netsh>

pushd

Saves the current context on a first-in-last-out (FILO) stack.

Syntax

pushd

Parameters

/?

Displays help at the command prompt.

Remarks

  • Used in conjunction with popd, pushd enables you to change the context, run the command in the new context, and then resume the prior context.

quit

Exits Netsh.exe.

Syntax

quit

Parameters

/?

Displays help at the command prompt.

set file

Copies the command prompt window output to a file.

Syntax

set file [ mode= ]{open FileName | append FileName | close}

Parameters

open FileName

Sends the command prompt window output to the specified new file.

append FileName

Appends the command prompt window output to the specified existing file.

close

Stops sending output and closes a file.

/?

Displays help at the command prompt.

Remarks

  • If the specified FileName does not currently exist, netsh creates a new file with that name. If the specified FileName does currently exist, netsh overwrites the existing data.

Examples

To create a new log file called Session.log and copy all succeeding netsh input and output to Session.log, type:

set file open c:\session.log

set machine

Specifies the computer on which to perform configuration tasks. Used without parameters, the local computer is configured.

Syntax

set machine [ name= ]ComputerName [ user= ][[ DomainName\]UserName ] [ pwd= ][Password | *]

Parameters

ComputerName

Required. Specifies the name of the computer on which to run subsequent netsh commands.

DomainName

Optional. Specifies the domain name where the user account is located. If not specified, the user account must reside in the local domain or on the local computer.

UserName

Optional. Specifies the user account name that has privileges to configure the specified computer.

Password

Optional. Specifies the password for the designated user account.

/?

Displays help at the command prompt.

Remarks

  • You can run commands on multiple computers from a single script by using set machine more than once in the script. For example, you can use set machine in a script to specify a destination computer (Computer A), and then any additional commands you add to the script will run on Computer A. You can then use set machine again in the same script to specify another destination computer (Computer B), and then any additional commands you add to the script will run on Computer B.

set mode

Sets the netsh mode to online or offline. Either offline or online must be specified.

Syntax

set mode [ mode= ] {online | offline}

Parameters

online

Sets the current mode to online. In online mode, netsh commands are run immediately after you type them and press Enter.

offline

Sets the current mode to offline. In offline mode, netsh commands are saved and can be run with the commit command.

/?

Displays help at the command prompt.

show

Displays alias, helper, and mode information.

Syntax

show {alias | helper | mode}

Parameters

alias

Lists all defined aliases.

helper

Lists all top-level helpers.

mode

Displays the current mode.

/?

Displays help at the command prompt.

unalias

Deletes the specified alias.

Syntax

unalias AliasName

Parameters

AliasName

Required. Specifies the name of the alias that you want to delete.

/?

Displays help at the command prompt.


Netsh Commands for Dynamic Host Configuration Protocol client

The Netsh commands for Dynamic Host Configuration Protocol (DHCP) client offer a command-line tool that helps with the administration of DHCP clients.

Netsh commands for DHCP client

You can run these commands from the command prompt for the Netsh DHCP context. For these commands to work at the command prompt, you must type netsh dhcp before typing commands and parameters as they appear in the syntax below.

For an example of how to use Netsh commands for DHCP in batch files and scripts, see Netsh DHCP Example.

For more information about netsh, see Netsh Overview and Enter a Netsh Context.

Netsh DHCP client

The following commands are available at the dhcpclient> prompt, which is rooted within the netsh environment.

trace

Specifies whether logging, which is also called tracing, is enabled or disabled for the DHCP client on the local computer.

Syntax

trace { enable | disable }

Parameters

Enable

Optional. Specifies that logging is enabled for the DHCP client service on the local computer. If the DHCP Network Access Protection (NAP) Enforcement Client is enabled, NAP events are also logged.

Disable

Optional. Specifies that logging is disabled for the DHCP client service on the local computer. If the DHCP NAP Enforcement Client is enabled, logging of NAP events is also disabled.

Example

The following example enables tracing for the DHCP client service and the DHCP NAP Enforcement Client:

netsh dhcpclient trace enable


Netsh Commands for Dynamic Host Configuration Protocol server

The Netsh commands for Dynamic Host Configuration Protocol (DHCP) server offer a command-line tool that helps with the administration of DHCP servers and provides an equivalent alternative to console-based management. This can be useful in the following situations:

  • When managing DHCP servers in wide area networks (WANs), commands can be used in interactive mode at the Netsh command prompt to better manage across slow-speed network links.

  • When managing a large number of DHCP servers, commands can be used in batch mode at the Netsh command prompt to help script and automate recurring administrative tasks that need to be performed for all DHCP servers.

You can run these commands from the command prompt for the Netsh DHCP context. For these commands to work at the command prompt, you must type netsh dhcp before typing commands and parameters as they appear in the syntax below.

For an example of how to use Netsh commands for DHCP in batch files and scripts, see Netsh DHCP Example.

For more information about netsh, see Netsh Overview and Enter a Netsh Context.

This section contains commands in the following contexts.

  • Netsh DHCP

  • Netsh DHCP server

  • Netsh DHCP V4

  • Netsh DHCP V6

  • Netsh DHCP server scope

  • Netsh DHCP server mscope

For information on how to interpret netsh command syntax, see Formatting Legend.

Netsh commands for DHCP

The following entries provide details for each command.

Netsh DHCP

The following commands are available at the dhcp> prompt, which is rooted within the netsh environment.

To view the command syntax, click a command:

  • add server

  • delete server

  • server

  • show server

add server

Adds a DHCP server to the list of authorized servers in Active Directory.

Syntax

add server serverDNS serverIP

Parameters

ServerDNS

Required. Specifies the DHCP server to add. Identifies the server by DNS domain name.

ServerIP

Required. Specifies the DHCP server to add. Identifies the server by IP address.

Examples

In the following example, this command adds a server with the DNS name dhcpsrv1.example.microsoft.com and IP address 10.2.2.2 to the list of authorized servers in Active Directory®.

add server dhcpsrv1.example.microsoft.com 10.2.2.2

delete server

Deletes a DHCP server from the list of authorized servers in Active Directory.

Syntax

delete server ServerDNS ServerIP

Parameters

ServerDNS

Required. Specifies the DHCP server to delete. Identifies the server by DNS domain name.

ServerIP

Required. Specifies the DHCP server to delete. Identifies the server by IP address.

Examples

In the following example, this command deletes the server with the DNS name dhcpsrv1.example.microsoft.com and IP address 10.2.2.2 from the list of authorized servers in Active Directory.

delete server dhcpsrv1.example.microsoft.com 10.2.2.2

server

Shifts the current Netsh DHCP command-line context to a different DHCP server. Used without parameters, server shifts the current command-line context to the local computer.

Syntax

server [{\\ServerNetBIOSName | \\ServerFQDN | ServerIP}]

Parameters

{ \\ServerNetBIOSName| \\ServerFQDN| ServerIP}

Specifies the DHCP server to which you want to shift the current command-line context. Identifies the server by NetBIOS name, fully qualified domain name (FQDN), or IP address.

Examples

In the first example, this command changes the Netsh DHCP command-line context to the DHCP server with the NetBIOS name \\DHCP-SRV1.

In the second example, this command changes the Netsh DHCP command-line context to the DHCP server with IP address 10.0.0.1.

In the third example, this command changes the Netsh DHCP command-line context to the DHCP server with the FQDN \\example.microsoft.com.

server \\DHCP-SRV1

server 10.0.0.1

server \\example.microsoft.com

show server

Displays a list of authorized servers in Active Directory.

Syntax

show server

Parameters

none

Netsh DHCP server

The following commands are available at the dhcp server> prompt, which is rooted within the netsh environment.

To view the command syntax, click a command:

  • add class

  • add mscope

  • add optiondef

  • add scope

  • backup

  • delete class

  • delete dnscredentials

  • delete mscope

  • delete optiondef

  • delete optionvalue

  • delete scope

  • delete superscope

  • dump

  • export

  • import

  • initiate auth

  • mscope

  • restore

  • scope

  • set auditlog

  • set bindings

  • set databasebackupinterval

  • set databasebackuppath

  • set databasecleanupinterval

  • set databaseloggingflag

  • set databasename

  • set databasepath

  • set databaserestoreflag

  • set detectconflictretry

  • set dnsconfig

  • set dnscredentials

  • set napstate

  • set napdeffail

  • set optionvalue

  • set server

  • set userclass

  • set vendorclass

  • show all

  • show auditlog

  • show bindings

  • show class

  • show detectconflictretry

  • show dnsconfig

  • show dnscredentials

  • show mibinfo

  • show mscope

  • show napstate

  • show napdeffail

  • show optiondef

  • show optionvalue

  • show scope

  • show superscope

  • show server

  • show dbproperties

  • show serverstatus

  • show userclass

  • show vendorclass

  • show version

add class

Adds a class to the specified DHCP server.

Syntax

add class ClassName [ClassComment] [Data] [[IsVendor=]{0 | 1}] [[IsBinary=]{B | b}]

Parameters

ClassName

Required. Specifies the name of the class to create.

ClassComment

Specifies the comment to associate with the class.

Data

Specifies class data in ASCII or binary format depending on the IsBinary parameter. If unspecified, it is assumed that the format of the data is ASCII.

[ IsVendor=]{0 | 1}

Indicates whether the class to add is a user class or a vendor class: 0-User class (default), 1-Vendor class.

[ IsBinary=]{B | b}

Indicates if the class data is in binary format. If unspecified, it is assumed that the format of the data is ASCII.

Examples

In the first example, this command creates a vendor class named MyClass, with the comment TestClass, and the class data TestDataForMyClass in ASCII format.

In the second example, this command creates a user class named MyUserClass with binary data of 4345335532 (ASCII-CE3U2).

The third example is an alternate command syntax for the second example.

add class MyClass TestClass TestDataForMyClass 1

add class MyUserClass TestClass1 4345335532 B

add class MyUserClass TestClass1 4345335532 0 b

add mscope

Adds a multicast scope to the specified DHCP server.

Syntax

add mscope MscopeName [MscopeComment] [TTL]

Parameters

MscopeName

Required. Specifies the name of the multicast scope to add.

MscopeComment

Specifies a description of the current multicast scope.

TTL

Specifies the Time-To-Live (TTL) value for the multicast scope. The valid range for this field is 1 to 255, with a default of 32.

Examples

In the following example, this command creates a multicast scope with the name My MultiCast Scope, a comment of MyTestMulticastScope, and a multicast TTL value of 40.

add mscope "My MultiCast Scope" MyTestMulticastScope 40

add optiondef

Adds a new option type definition to the specified DHCP server.

Syntax

add optiondef OptCode OptName{BYTE | WORD | DWORD | STRING | IPADDRESS} [[IsArray=]{0 | 1}] [vendor=VendorClass] [comment=OptComment] [DefValue]

Parameters

OptCode

Required. Specifies the option type to define. Identifies the option type with a unique option code. For the value of the code, choose a number between zero and 255.

OptName

Required. Specifies the name of the option type.

{BYTE | WORD | DWORD | STRING| IPADDRESS}

Required. Indicates the data type of the option.

[IsArray=]{0 | 1}

Indicates whether the data type is arrayed or non-arrayed: 0-Unary or non-arrayed (default), 1-Arrayed.

vendor= VendorClass

Specifies the vendor class for the option. If unspecified, the default vendor class, the DHCP standard options class, is used.

comment= OptComment

Specifies a comment to add to the new option type definition. If unspecified, the default value is NULL.

DefValue

Specifies a default value to use for this option type, if one is not specified otherwise.

Remarks

  • IsArray must be 0 for STRING type options.

Examples

In the first example, this command defines a new option type named ExtensionsPath with code 18, a STRING data type, and joins it to the DHCP standard options class, assigning it a default value of c:\Temp.

In the second and third examples, this command defines a new option type named TestOption with code 231 and an IPADDRESS data type. In the second example, the option is defined to provide only a single IP address. IsArray and DefValue are not necessary because defaults are assumed. In the third example, DefValue and IsArray are required to create an array that contains the IP address values 10.1.1.1, 10.1.1.2, and 10.1.1.3.

add optiondef 18 ExtensionsPath STRING 0 c:\Temp

add optiondef 231 TestOption IPADDRESS

add optiondef 231 TestOption IPADDRESS 1 vendor=MyVendorClass 10.1.1.1 10.1.1.2 10.1.1.3

add scope

Adds a scope to the specified DHCP server.

Syntax

add scope ScopeAddress SubnetMask ScopeName[ScopeComment]

Parameters

ScopeAddress

Required. Specifies the scope to add. Identifies the scope by IP network number.

SubnetMask

Required. Specifies the subnet mask for the scope to add.

ScopeName

Required. Specifies an identifying name for the scope.

ScopeComment

Specifies a comment for the scope.

Examples

In the following example, this command adds a scope for the DHCP server with scope address 10.2.2.0, subnet mask 255.255.255.0, a scope name of MyScope, and a scope comment of MyComment.

add scope 10.2.2.0 255.255.255.0 MyScope MyComment

backup

Performs an asynchronous backup of the DHCP database, including all scopes, reservations, leases, options, configuration settings, and registry keys. An error will be returned if the specified destination is not valid or cannot be found.

Syntax

backup [Path]

Parameters

[Path]

Specifies the path of the folder in which the backup .mdb DHCP database file will be created. If not specified, the path defaults to %systemroot%\System32\Dhcp\Backup.

Remarks

  • Note that if the default destination is chosen, the synchronous backup that the DHCP server creates every 60 minutes will overwrite the async backup.

Examples

In the following example, this command sets the path of the DHCP server database file to c:\MyBackUpFiles\DHCP.

backup "c:\MyBackUpFiles\DHCP”

delete class

Deletes a class from the specified DHCP server.

Syntax

delete class Name

Parameters

Name

Required. Specifies the user or vendor class to delete.

Examples

In the following example, this command deletes the class named MyClass.

delete class MyClass

delete dnscredentials

Deletes the credentials used for all DNS dynamic updates.

Syntax

delete dnscredentials dhcpforceflag

Parameters

none

delete mscope

Deletes a multicast scope from the specified DHCP server.

Syntax

delete mscope MscopeName

Parameters

MscopeName

Required. Specifies the multicast scope to delete. MscopeName is case-sensitive.

Examples

In the following example, this command deletes the multicast scope MyMulticastScope from the currently specified DHCP server.

delete mscope MyMulticastScope

delete optiondef

Deletes a defined option type from the specified DHCP server.

Syntax

delete optiondef OptCode [[vendor=]VendorName]

Parameters

OptCode

Required. Specifies the unique identifier for the option type to delete.

vendor= VendorName

Specifies the vendor class name with which the option type is associated. If unspecified, the option type definition is deleted from the non-vendor-specific DHCP standard options class.

Examples

In the following example, this command deletes an option type with code 18 from the DHCP standard options class.

delete optiondef 18

delete optionvalue

Deletes the current value of the specified option type for the specified DHCP server.

Syntax

delete optionvalue OptCode[[vendor=]VendorClass] [[user=]UserClass]

Parameters

OptCode

Required. Specifies the unique identifier of the global server option with a value to delete.

vendor= VendorClass

Specifies the vendor class name with which the option is associated. If the tag is not included, the global VendorName that was set by set vendorclass is assumed. If the tag is used, but no value is specified, then no vendor class is used. This parameter is available only for computers running Windows® 2000 Server.

user= UserClass

Specifies the user class name with which the option is associated. If the tag is not included, the global UserName that was set by set userclass is assumed. If the tag is used, but no value is specified, then no user class is used. This parameter is available only for computers running Windows 2000 Server.

Examples

In the following example, this command deletes the current value of the option type with code 18.

delete optionvalue 18

delete scope

Deletes a scope from the specified DHCP server.

Syntax

delete scope ScopeAddress {DHCPNOFORCE | DHCPFULLFORCE}

Parameters

ScopeAddress

Required. Specifies the address of the scope to delete.

{DHCPNOFORCE | DHCPFULLFORCE}

Required. Indicates the force with which the scope will be deleted: DHCPNOFORCE-Deletes the scope if there are no active clients in the scope, DHCPFULLFORCE-Deletes the scope even if there are active clients in the scope.

Examples

In the following example, this command forces the deletion of the scope 10.2.2.0 from the DHCP server and ignores all warnings.

delete scope 10.2.2.0 dhcpfullforce

delete superscope

Deletes a superscope from the specified DHCP server.

Syntax

delete superscope SuperscopeName

Parameters

SuperscopeName

Required. Specifies the name of the superscope to delete.

Remarks

  • You can set the superscope from the scope context with the set superscope command.

  • The superscope name is case-sensitive.

Examples

In the following example, this command deletes the superscope named My Superscope from the specified DHCP server.

delete superscope "My Superscope"

dump

Dumps the configuration of the local DHCP server to the command prompt window when run within the netsh environment.

Syntax

dump

When run at the command prompt or in a batch file, output can be saved in a text file. Used without parameters, this command dumps the configuration of the local server to the command prompt window.

Syntax

netsh dhcp server [IPAddress] dump >[PathAndFileName]

Parameters

IPAddress

Specifies the IP address of the DHCP server for which the configuration is output.

PathAndFileName

Specifies both the location where the file is saved, and the name of the destination file to which to dump DHCP server configuration. If unspecified, the DHCP server configuration is dumped to the command prompt window.

Remarks

  • This command dumps the DHCP configuration as text output within the command prompt window. You can copy or redirect this output to a file to view it in a text editor. After file output is obtained, you can use the exec command to configure another DHCP server with the same configuration.

  • Before you perform the dump command at the source server, reconcile all scopes and fix any reported inconsistencies.

  • The following command dumps the current configuration for the local DHCP server (the source) to a text file named Dhcpcfg.dmp. This file can be copied to another (destination) DHCP server and used to recreate the source configuration on it. You can recreate the configuration by typing the following command:

    dump > dhcpcfg.dmp

  • Before you use the exec command to produce a dump file at the destination server, complete the following steps:

    1. Close the DHCP console at the destination server. Do not reopen the console until after you have run the exec command.

    2. Delete all default option definitions and any user and vendor classes at the destination server.

  • These examples demonstrate how to use the delete optiondef and del class Netsh commands to delete all default option definitions and any user and vendor classes. You can run these commands at the dhcp server> prompt, from within the netsh environment.

    • delete optiondef 76

    • del class "Default BOOTP Class"

    • del class "Microsoft Windows 98 Options"

  • On the destination server, the exec command is used to load and run the saved configuration:

    netsh exec dhcpcfg.dmp

  • After you use the exec command to load the dump file, you must reconcile all scopes. Use net stop dhcpserver to stop the DHCP Server service and net start dhcpserver to restart it. Once the service is restarted, DHCP database changes take effect.

Examples

The first command, which is run within the netsh environment, dumps the configuration of the local DHCP server to the command prompt window.

The second command, which is run at the command prompt, dumps the configuration of a DHCP server with IP address 192.168.0.1 to a text file named Dhcpcfg.dmp at the location C:\Dhcp\ on the local computer.

The third command, which is run at the command prompt, dumps the configuration of a DHCP server with IP address 192.168.0.1 to a text file named Dhcpcfg.dmp on a shared network folder named \\Backup\Dhcp\.

dump

netsh dhcp server 192.168.0.1 dump > C:\Dhcp\Dhcpcfg.dmp

netsh dhcp server 192.168.0.1 dump > \\Backup\Dhcp\Dhcpcfg.dmp

export

Exports the DHCP service configuration to a file.

Syntax

export [Path]FileName {all | ScopeList}

Parameters

[Path] FileName

Required. Specifies, by name, the file where the DHCP configuration will be stored. If the path, the file name, or both contain spaces, quotation marks must be used.

{all | ScopeList}

Required. Specifies which scopes you want to export. The parameter all exports all scopes. The parameter ScopeList exports the scopes that correspond to the IP addresses you list. Each IP address in the list must be separated by spaces.

Remarks

  • This command works only on the local server.

  • While the export command runs, the DHCP service is stopped and does not respond to DHCP clients seeking new leases or lease renewals.

  • If the DHCP service has a large number of scopes or a large number of client address leases, this command can take a long time to run.

Examples

In the first example, this command exports the complete DHCP service configuration to the file c:\Temp\Dhcpdb.

In the second example, this command exports the DHCP configuration for scopes 10.0.0.0 and 192.168.0.0 to the file c:\Temp\Dhcpdb.

In the third example, this command exports the complete DHCP service configuration to the file c:\My Folder\Dhcp Configuration. Note that both the path and file name contain spaces, so quotation marks are used.

export c:\Temp\Dhcpdb all

export c:\Temp\Dhcpdb 10.0.0.0 192.168.0.0

export "c:\My Folder\Dhcp Configuration" all

import

Imports a DHCP service configuration from a file to the local service.

Syntax

import [Path]FileName {all | ScopeList]

Parameters

[Path] FileName

Required. Specifies, by name, the file from which the DHCP configuration will be imported. If the path, the file name, or both contain spaces, quotation marks must be used.

{all | ScopeList}

Required. Specifies which scopes you want to import. The parameter all imports all scopes represented in the file you specify. The parameter ScopeList imports the scopes that correspond to the IP addresses you list. Each IP address in the list must be separated by spaces.

Remarks

  • This command works only on the local server.

  • While the import command runs, the DHCP service is stopped and does not respond to DHCP clients seeking new leases or lease renewals.

  • If the DHCP service has a large number of scopes or a large number of client address leases, this command can take a long time to run.

Examples

In the first example, this command imports the complete DHCP service configuration from the file c:\Temp\Dhcpdb.

In the second example, this command imports the DHCP configuration for scopes 10.0.0.0 and 192.168.0.0 from the file c:\Temp\Dhcpdb

In the third example, this command imports the complete DHCP service configuration from the file c:\My Folder\Dhcp Configuration. Note that both the path and file name contain spaces, so quotation marks are used.

import c:\Temp\Dhcpdb all

import c:\Temp\Dhcpdb 10.0.0.0 192.168.0.0

import "c:\My Folder\Dhcp Configuration" all

initiate auth

Initiates authorization of the specified DHCP server in Active Directory.

Syntax

initiate auth

Parameters

none

mscope

Switches the command context to a DHCP multicast scope.

Syntax

mscope MscopeName

Parameters

MscopeName

Required. Specifies the name of the multicast scope to which to switch the command context.

Remarks

  • This command enables you to use any of the available DHCP multicast scope-level commands on the specified DHCP multicast scope. Subsequent operations will be performed on this multicast scope at the specified server.

  • The name of the multicast scope is case-sensitive.

Examples

In the following example, this command switches the command context to a multicast scope named My Multicast Scope.

mscope "My Multicast Scope"

restore

Restores DHCP server data, including all scopes, reservations, leases, options, configuration settings, and registry keys. The DHCP service is temporarily stopped during the restore and clients cannot contact the DHCP server to obtain IP addresses.

Syntax

restore [Path]

Parameters

[Path]

Specifies the path of the .mdb DHCP database file to be restored. If not specified, the path will default to %systemroot%\System32\Dhcp\Backup

Remarks

  • An error is returned when the specified database cannot be found, or the database was created with a different language version of the server.

Examples

In the following example, this command sets the restore path of the DHCP server database file to c:\MyBackUpFiles\DHCP.

restore "c:\MyBackUpFiles\DHCP”

scope

Switches the command context to a DHCP scope.

Syntax

scope ScopeIPAddress

Parameters

ScopeIPAddress

Required. Specifies the scope to which to switch the command context. Identifies the scope by network or subnet IP address.

Remarks

  • This command enables you to use any of the available DHCP scope-level commands on the specified DHCP scope. Subsequent operations will be performed on this scope at the specified server.

Examples

In the following example, this command switches the command context to the scope with IP address 10.0.0.0.

scope 10.0.0.0

set auditlog

Configures audit logging data for the specified DHCP server.

Syntax

set auditlog NewAuditPath Maxsize Minsize Interval

Parameters

NewAuditPath

Optional. Specifies a local folder for the DHCP server to use when storing audit log files. If a path is not specified, the location will default to %windir%\System32\Dhcp.

Maxsize

Optional. This value is a DWORD and is written to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCPServer\Parameters\DhcpLogFileMaxSize. This attribute sets the maximum size restriction (in megabytes) for the total amount of disk space available for all audit log files created and stored by the DHCP service. The default is seven.

Minsize

Optional. This value is a DWORD and is written to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCPServer\Parameters\DhcpLogMinSpaceOnDisk. This attribute sets the minimum free space (in megabytes) available on the local disk before audit logging stops. The default is 20.

Interval

Optional. This value is a DWORD and is written to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCPServer\Parameters\DhcpLogDiskSpaceCheckInterval. This attributes sets the number of times the log is written to before checking free disk space. The default is 50.

Remarks

  • Only the path can be configured in the DHCP GUI. The other attributes are configured through the registry.

  • In order for this change to take effect, you must stop and restart the DHCP service after you run this command.

Examples

In the following example, this command sets the DHCP server to store audit log files in the directory %windir%\System32\Dhcp with a maximum size of seven megabytes, minimum free space of 20 megabytes, and an interval of 120.

netsh dhcp> set auditlog interval 120

set bindings

Sets interface bindings for the server.

Syntax

set bindings Interface [Enable | Disable]

Parameters

Interface

Optional. Specifies the friendly name of the interface. The default is all local interfaces.

Mode

Optional. Specifies the binding mode.

ENABLE - Enables interface binding (default).

DISABLE - Disables the interface binding.

Remarks

  • Use the “Show Bindings” command to verify the value of the “Bound to Server” attribute. “TRUE” value indicates the interface binding is enabled. “FALSE” value indicates that the interface binding is disabled.

set databasebackupinterval

Sets the backup interval for the specified DHCP server.

Syntax

set databasebackupinterval NewInterval

Parameters

NewInterval

Required. Specifies the backup interval in minutes.

Examples

In the following example, this command sets the database backup interval for the specified DHCP server to 1,440 minutes (24 hours).

set databasebackupinterval 1440

set databasebackuppath

Sets the database backup path for the specified DHCP server.

Syntax

set databasebackuppath NewBackupPath

Parameters

NewBackupPath

Required. Specifies a local folder for the DHCP server to use when storing audit log files. A valid folder path is required, and the folder must be local to the DHCP server where the path is defined.

Examples

In the following example, this command sets the database backup path to c:\windows\dhcp\backup.

set databasebackuppath c:\windows\dhcp\backup

set databasecleanupinterval

Sets the database cleanup interval of the specified DHCP server.

Syntax

set databasecleanupinterval NewInterval

Parameters

NewInterval

Required. Specifies the database cleanup interval, in minutes.

Examples

In the following example, this command sets the database cleanup interval to 10,080 minutes (every seven days).

set databasecleanupinterval 10080

set databaseloggingflag

Sets or resets the database logging flag for the specified DHCP server. Used without parameters, this command resets the database logging flag.

Syntax

set databaseloggingflag [{0 | 1}]

Parameters

{0 | 1}

Indicates the database logging flag setting: 0-Resets the flag (default), 1-Sets the flag.

Examples

In the following example, this command resets the database logging flag for the currently specified DHCP server.

set databaseloggingflag 0

set databasename

Sets the name of the DHCP server database file for the specified DHCP server.

Syntax

set databasename NewFileName

Parameters

NewFileName

Required. Specifies a new name for the DHCP server database file.

Remarks

  • In order for this change to take effect, you must stop and restart the DHCP Server service.

Examples

In the following example, this command sets the DHCP server database file name to newdatabase.mdb.

set databasename newdatabase.mdb

set databasepath

Sets the path of the DHCP server database file for the specified DHCP server.

Syntax

set databasepath NewPath

Parameters

NewPath

Required. Specifies the path of the DHCP database file.

Remarks

  • In order for this change to take effect, you must stop and restart the DHCP Server service.

Examples

In the following example, this command sets the path of the DHCP server database file to c:\windows\dhcp.

set databasepath c:\windows\dhcp

set databaserestoreflag

Sets or resets the database restore flag for the specified DHCP server. Used without parameters, this command resets the database restore flag.

Syntax

set databaserestoreflag [{0 | 1}]

Parameters

{0 | 1}

Indicates the setting of the database restore flag: 0-Resets the flag (default), 1-Sets the flag.

Examples

In the following example, this command sets the database restore flag for the currently specified DHCP server.

set databaserestoreflag 1

set detectconflictretry

Sets the number of conflict detection attempts for the specified DHCP server.

Syntax

set detectconflictretry RetryNumber

Parameters

RetryNumber

Required. Specifies the number of conflict detection attempts that the DHCP server will make before it leases a scope IP address to a client.

Remarks

  • The maximum value for RetryNumber is five. All values greater than five will default down to five.

Examples

In the following example, this command sets the DHCP server to make four attempts to detect if a there is a conflict for a scope IP address before the DHCP server uses this scope IP address in a new address lease.

set detectconflictretry 4

set dnsconfig

Sets the Domain Name System (DNS) dynamic update configuration for the specified DHCP server.

Syntax

set dnsconfig [Enable=]{0 | 1} [[Update=]{0 | 1}] [[Lookup=]{0 | 1}] [[NonDyn=]{0 | 1}]

Parameters

[Enable=]{0 | 1}

Required. Indicates whether to enable or disable the dynamic updates of DNS client information: 0-Disables dynamic updates of DNS client information, 1-Enables dynamic updates of DNS client information.

[Update=]{0 | 1}

Indicates the type of update lookups: 0-Updates according to client request, 1-Updates forward and reverse name lookups.

[Lookup=]{0 | 1}

Indicates whether to enable or disable forward lookups for clients when leases expire: 0-Disables forward lookups, 1-Enables forward lookups.

[NonDyn=]{0 | 1}

Indicates whether to update DNS information for clients that do not support dynamic updates: 0-Disables updates for clients that do not support dynamic updates, 1-Enables these updates.

Remarks

  • This command is only supported for DHCP servers running Windows 2000 Server and members of the Windows Server 2003 family.

  • The configured Preferred DNS server, in the TCP/IP properties of the DHCP server, will be updated with DHCP client records when dynamic updates are enabled. If the Preferred DNS server is not available on the network, the Alternate DNS server will be updated.

Examples

In the following example, this command enables the dynamic update of DNS information by the DHCP server and configures updates to always be made for both forward and reverse lookups. This example also disables the option to perform forward lookups when leases expire and enables updates for non-dynamic clients.

set dnsconfig 1 1 0 1

set dnscredentials

Sets DNS dynamic update credentials for the specified DHCP server.

Syntax

set dnscredentials UserName Domain Password

Parameters

UserName

Required. The user name associated with a valid domain account.

Domain

Required. The domain in which the user account is located.

Password

Required. The password for the user account.

Examples

In the first example, this command sets the DNS dynamic update credentials to the values specified.

In the second example, this command sets the value of UserName to User1 and the value of Domain to Domain1, but the password is not specified. Instead, an asterisk (*) is used. When an asterisk (*) is used in place of a valid password, the user is prompted for a password. Without the correct password for the specified UserName, the credentials cannot be changed.

set dnscredentials User1 Domain1 Password1

set dnscredentials User1 Domain1 *

set napstate

Turns NAP functionality on or off.

Syntax

set napstate option [On | Off]

set napdeffail

Sets the NAP default failure state.

Syntax

set napdeffail state { fullaccess | drop | quarantine }

set optionvalue

Sets a DHCP server option value that will be applied for all scopes defined at the specified DHCP server.

Syntax

set optionvalue OptCode {BYTE | WORD | DWORD | STRING | IPADDRESS} [[user=]UserName] [[vendor=]VendorName] [OptionValue]

Parameters

OptCode

Required. Specifies the unique identifier for the option type with the value to set.

{BYTE | WORD | DWORD | STRING | IPADDRESS}

Required. Specifies the data type for the option type with the value to set.

[user=]UserName

Sets the applicable user class name to which this command will apply. If unspecified, the default user class is assumed.

[vendor=]VendorName

Sets the applicable vendor class name to which this command will apply. If unspecified, the DHCP standard options class is assumed.

[OptionValue]

Specifies the new server default value for the option type identified by OptCode. The value must be of the associated data type.

Remarks

  • Vendor and user classes are supported only for DHCP servers running Windows 2000 Server.

  • To modify the current defaults for an unspecified class, use either the set userclass or set vendorclass commands.

Examples

In the first example, this command sets the value of option code 003 to list two router IP addresses, 10.1.1.1 and 10.1.1.2.

In the second example, this command further qualifies the first example and sets the specified value to apply only for those scope clients that identify themselves as members of the vendor class Vendor1. In order for this example to work, this class must already be defined at the server, with the specified option type defined for its use.

set optionvalue 003 IPADDRESS 10.1.1.1 10.1.1.2

set optionvalue 003 IPADDRESS vendor=Vendor1 10.1.1.1 10.1.1.2

set server

Changes the Netsh command-line context to the specified server. Used without parameters, the local server is assumed.

Syntax

set server[{ServerIP | \\ServerDNS}]

Parameters

{ServerIP | \\ServerDNS}

Specifies the IP address or the DNS name of the specified DHCP server.

Remarks

  • When this command is used, and the Netsh command-line context is changed to another server, all subsequent command operations are performed on the specified server. To perform command operations on another server, this command must be run again, with the IP address or DNS name of the new server provided as the parameter.

Examples

In the following example, this command switches the DHCP server command-line context to the server at IP address 10.1.1.1

set server 10.1.1.1

set userclass

Sets the name for the current user class. Used without parameters, the current user class is reset to the default user class

Syntax

set userclass [UserClass]

Parameters

UserClass

Specifies the name of the user class for the currently specified DHCP server.

Remarks

  • This command is available only for use with DHCP servers running Windows 2000 Server.

Examples

In the first example, this command sets the user class name to MyUserClass.

In the second example, this command resets the current user class to the default user class.

set userclass MyUserClass

set userclass

set vendorclass

Sets the name for the current vendor class. Used without parameters, the current vendor class is reset to the default class, DHCP standard options.

Syntax

set vendorclass [VendorClass]

Parameters

VendorClass

Specifies the name of the vendor class for the current server.

Remarks

  • This command is available only for use with DHCP servers running Windows 2000 Server.

Examples

In the first example, this command sets the vendor class name to MyVendorClass.

In the second example, this command resets the current vendor class to the default class, DHCP standard options.

set vendorclass MyVendorClass

set vendorclass

show all

Displays all status and configuration information for the specified DHCP server.

Syntax

show all

Parameters

none

Remarks

  • This command lists all current server status and configuration details, including the stored management information base (MIB) information, for the currently specified DHCP server.

show auditlog

Displays all audit log information for the specified DHCP server.

Syntax

show auditlog

Parameters

none

show bindings

Displays bindings information for the specified DHCP server.

Syntax

show bindings

Parameters

none

Remarks

  • This command displays bindings information for the current DHCP server, indicating which active network connections that are configured with static IP addresses are enabled or disabled for use in servicing DHCP clients on your network.

  • The DHCP service automatically disables network connections that obtain their IP address configuration dynamically from service bindings. This happens by default.

show class

Enumerates and displays all class information for the specified DHCP server. This includes both user and vendor class information.

Syntax

show class

Parameters

none

show detectconflictretry

Displays the configured number of conflict detection attempts for the specified DHCP server.

Syntax

show detectconflictretry

Parameters

none

Remarks

  • This command displays the current number of ping retries that are used to attempt the detection of address conflicts for the scope IP addresses that are distributed by the server.

show dnsconfig

Displays the DNS dynamic update configuration for the specified DHCP server.

Syntax

show dnsconfig

Parameters

none

Remarks

  • If DNS configuration has not been enabled or set, you can use the DNS console or the set dnsconfig command to configure these settings.

show dnscredentials

Displays the current DNS dynamic update credentials.

Syntax

show dnscredentials

Parameters

none

show mibinfo

Displays management information base (MIB) information for the specified DHCP server.

Syntax

show mibinfo

Parameters

none

show mscope

Displays all information about multicast scopes for the specified DHCP server.

Syntax

show mscope

Parameters

none

show napstate

Displays whether NAP functionality is turned on or off.

Syntax

show napstate

show napdeffail

Displays the NAP default failure state.

Syntax

show napdeffail

show optiondef

Displays all defined and available options types for use at the specified DHCP server. Used without parameters, all options are displayed.

Syntax

show optiondef [vendor=VendorName]

Parameters

vendor= VendorName

Indicates which defined and available option types to display. If unspecified, the default for VendorName is the default vendor class that is currently set for the DHCP server.

Remarks

  • The default vendor class can be reset with the set vendorclass command.

  • VendorName is applicable only for DHCP servers running Windows 2000 Server.

Examples

In the first example, this command displays all defined option types for the current vendor class.

In the second example, this command displays the defined option types that are available for use with the specified class Vendor1.

show optiondef

show optiondef vendor=Vendor1

show optionvalue

Displays all of the available option values that are currently set for the specified DHCP server. Used without parameters, all option values are displayed, including those that are used for both user and vendor classes.

Syntax

show optionvalue[{user=UserName | vendor=VendorName}]

Parameters

user= UserName

Specifies the default values that are set for the option types that are available for use with the currently set user class.

vendor= VendorName

Specifies the default values that are set for the option types that are available for use with the currently set vendor class.

Remarks

  • User= UserName and vendor=VendorName are only available for use with DHCP servers running Windows 2000 Server.

  • If you provide values for UserName or VendorName, the respective tags (user= or vendor=) are required. If the tags are not included, the default that is assumed is the current user class, previously set with the set userclass command.

Examples

In the following example, this command displays all of the available option types that have values set at the currently specified DHCP server.

show optionvalue

show scope

Displays information about the scopes for the specified DHCP server.

Syntax

show scope

Parameters

none

show superscope

Displays information about the superscopes for the specified DHCP server.

Syntax

show superscope

Parameters

none

show server

Displays information about the specified DHCP server, including the fully qualified domain name and IP address of the server.

Syntax

show server

Parameters

none

show dbproperties

Displays information about server database configuration for the specified DHCP server.

Syntax

show dbproperties

Parameters

none

Remarks

  • This command displays the following database configuration information:

    • DatabaseName

    • DatabasePath

    • DatabaseBackupPath

    • DatabaseBackupInterval

    • DatabaseLoggingFlag

    • DatabaseRestoreFlag

    • DatabaseCleanupInterval

show serverstatus

Displays status information for the specified DHCP server.

Syntax

show serverstatus

Parameters

none

Remarks

  • This is an example of the type of status information that this command displays:

    Server Attrib - Server Servicing Clients :TRUE

    Server Attrib - Dynamic BootP Support Enabled :TRUE

    Server Attrib - DHCP server Part Of DS :TRUE

    Server Attrib - DHCP server Bindings Aware :TRUE

    Server Attrib - Administrative Rights :TRUE

show userclass

Displays the current user class setting at the specified DHCP server.

Syntax

show userclass

Parameters

none

Remarks

  • This is an example of the type of setting information that this command displays:

    Current Class Name set for the Server dhcpsrv1.example.microsoft.com is None.

show vendorclass

Displays the current vendor class setting at the specified DHCP server.

Syntax

show vendorclass

Parameters

none

Remarks

  • This is an example of the type of setting information that this command displays:

    Current Vendor Name set for the Server dhcpsrv1.example.microsoft.com is None.

show version

Displays current version information for the specified DHCP server.

Syntax

show version

Parameters

none

Remarks

  • This is an example of the type of version information that this command displays:

    The version of the DHCP server 192.168.0.100 is 5.6.

Netsh DHCP server V4

The following commands are available at the dhcp server scope> prompt, which is rooted within the netsh environment.

To view the command syntax, click a command:

  • add optiondef

  • add scope

  • add class

  • delete optiondef

  • delete optionvalue

  • delete scope

  • delete class

  • set bindings

  • set optionvalue

  • set userclass

  • set vendorclass

  • show bindings

  • show mibinfo

  • show optiondef

  • show optionvalue

  • show scope

  • show userclass

  • show vendorclass

  • show class

  • export

  • import

Netsh DHCP server V6

The following commands can run from the dhcp server mscope> prompt, which is rooted within the netsh environment.

To view the command syntax, click a command:

  • add optiondef

  • add scope

  • add class

  • delete optiondef

  • delete optionvalue

  • delete scope

  • delete class

  • set bindings

  • set optionvalue

  • set unicastflag

  • set rapidcommitflag

  • set preferredlifetime

  • set vaildlifetime

  • set t1

  • set t2

  • set userclass

  • set vendorclass

  • show bindings

  • show mibinfo

  • show optiondef

  • show optionvalue

  • show rapidcommitflag

  • show unicastflag

  • show preferredlifetime

  • show validlifetime

  • show t1

  • show t2

  • show scope

  • show userclass

  • show vendorclass

  • show class

  • export

  • import

set unicastflag

Sets the global unicast flag for the server.

Syntax

set unicastflag [ on | off ]

set rapidcommitflag

Sets the global unicast flag for the server.

Syntax

set rapidcommitflag [ on | off ]

set preferredlifetime

Sets the preferred lifetime of an issued lease on the DHCP server.

Syntax

set preferredlifetime [lifetime=seconds]

Parameters

Lifetime

The preferred lifetime in seconds.

Example

  • The following command sets the preferred lifetime on the DHCP server to 1 hour:

  • set preferredlifetime 3600

set validlifetime

Sets the valid lifetime of a lease on the DHCP server.

Syntax

set validlifetime [lifetime=seconds]

Parameters

Lifetime

The preferred lifetime in seconds.

Example

  • The following command sets the valid lifetime on the DHCP server to 1 hour:

  • set validlifetime 3600

set t1

Sets the value of T1 of an issued lease on the DHCP server.

Syntax

set t1 [lifetime=seconds]

Parameters

Lifetime

The preferred lifetime in seconds.

Example

  • The following command sets T1 on the DHCP server to 1 hour:

  • set t1 3600

set t2

Sets the value of T2 of an issued lease on the DHCP server.

Syntax

set t2 [lifetime=seconds]

Parameters

Lifetime

The preferred lifetime in seconds.

Example

  • The following command sets T2 on the DHCP server to 1 hour:

  • set t2 3600

show rapidcommitflag

Displays the rapidcommitflag.

Syntax

show rapidcommitflag

Parameters

none

show unicastflag

Displays the unicastflag.

Syntax

show unicastflag

Parameters

none

show preferredlifetime

Displays the preferred lifetime of an issued lease on the DHCP server.

Syntax

show preferredlifetime

Parameters

none

show validlifetime

Displays the valid lifetime of a lease on the DHCP server.

Syntax

show validlifetime

Parameters

none

show t1

Displays the value of T1 of an issued lease on the DHCP server.

Syntax

show t1

Parameters

none

show t2

Displays the value of T2 of an issued lease on the DHCP server.

Syntax

show t2

Parameters

none

Netsh DHCP server scope

The following commands are available at the dhcp server scope> prompt, which is rooted within the netsh environment.

To view the command syntax, click a command:

  • add excluderange

  • add iprange

  • add reservedip

  • delete excluderange

  • delete iprange

  • delete lease

  • delete optionvalue

  • delete reservedip

  • delete reservedoptionvalue

  • dump

  • initiate reconcile

  • set comment

  • set name

  • set optionvalue

  • set reservedoptionvalue

  • set scope

  • set state

  • set superscope

  • show clients

  • show clientsv5

  • show excluderange

  • show iprange

  • show optionvalue

  • show reservedip

  • show reservedoptionvalue

  • show scope

  • show state

add excluderange

Adds a range of addresses to exclude from distribution in the current scope.

Syntax

add excluderange StartIP EndIP

Parameters

StartIP

Required. Specifies the IP address that starts the exclusion range.

EndIP

Required. Specifies the IP address that ends the exclusion range.

Examples

In the following example, this command excludes the IP addresses in the range 10.2.2.10 to 10.2.2.20 from distribution in the scope.

add excluderange 10.2.2.10 10.2.2.20

add iprange

Adds a range of IP addresses to the current scope.

Syntax

add iprange StartIP EndIP [{DHCP | BOOTP | BOTH}] [MaxBootP]

Parameters

StartIP

Required. Specifies the IP address that starts the range.

EndIP

Required. Specifies the IP address that ends the range.

{DHCP | BOOTP | BOTH}

Specifies the type of client to be serviced by this scope and IP range. DHCP is the default.

MaxBootP

Specifies the maximum number of BOOTP clients.

Remarks

  • MaxBootP is useful only if ClientType is set to support BOOTP-type clients for the scope. If an optional command-line option is used, all command-line options (mandatory, as well as optional) that come before the optional command that is used are required and must appear in proper sequence.

Examples

In the following example, this command adds DHCP clients that are in the IP address range 10.2.2.10 to 10.2.2.20 to the distribution range in the scope.

add iprange 10.2.2.10 10.2.2.20

add reservedip

Reserves an IP address for use by a specified media access control (MAC) address in the current scope.

Syntax

add reservedip ReservedIP MACAddress [ClientName] [ClientComment] [{DHCP | BOOTP | BOTH}]

Parameters

ReservedIP

Required. Specifies the IP address to reserve.

MACAddress

Required. Specifies the physical hardware or MAC address to associate with the reserved IP address.

ClientName

Specifies a client name to associate with this reserved client entry. If unspecified, a client name is not associated with this reserved client entry.

ClientComment

Specifies a client comment to associate with this reserved client entry. If unspecified, a client comment is not associated with this reserved client entry.

{DHCP | BOOTP | BOTH}

Specifies the type of clients to associate with this reserved client entry. DHCP is the default.

Remarks

  • If an optional command-line option is used, all command-line options (mandatory as well as optional) that come before the optional command-line option that is used are required and must appear in proper sequence.

Examples

In the following example, this command reserves the IP address 10.2.2.32 for use by the DHCP client that identifies its MAC address as 08-00-2b-30-36-9b when it obtains a lease in the current scope.

add reservedip 10.2.2.32 08002b30369B

delete excluderange

Deletes a range of previously excluded IP addresses from the current scope.

Syntax

delete excluderange StartIP EndIP

Parameters

StartIP

Required. Specifies the IP address that starts the exclusion range.

EndIP

Required. Specifies the IP address that ends the exclusion range.

Examples

In the following example, this command deletes the exclusion range that starts with an IP address of 10.2.1.5 and ends with an IP address of 10.2.1.10 from the current scope.

delete excluderange 10.2.1.5 10.2.1.10

delete iprange

Deletes a range of IP addresses from the current scope.

Syntax

delete iprange StartIP EndIP

Parameters

StartIP

Required. Specifies the IP address that starts the range to delete.

EndIP

Required. Specifies the IP address that ends the range to delete.

Examples

In the following example, this command deletes IP addresses in the range 10.2.1.5 to 10.2.1.10 from the current scope.

delete iprange 10.2.1.5 10.2.1.10

delete lease

Deletes an IP address lease from the current scope.

Syntax

delete lease [{LeaseIP | \\HostName | AllBadAddresses | AllRasServerAddresses}]

Parameters

{LeaseIP | \\HostName | AllBadAddresses | AllRasServerAddresses}

Required. Specifies the IP address or the host name associated with the leased address. If AllBadAddresses is specified, all records marked as BAD_ADDRESS are removed. If AllRasServerAddresses is specified, all leases obtained by all Routing and Remote Access Service servers are removed.

Examples

In the first example, this command deletes the IP address lease 10.2.1.32 from the current scope.

In the second example, this command deletes all IP address leases marked as BAD_ADDRESS from the current scope.

delete lease 10.2.1.32

delete lease AllBadAddresses

delete optionvalue

Removes or clears the currently set scope option value from the current scope.

Syntax

delete optionvalue OptCode[user=UserName] [vendor=VendorName]

Parameters

OptCode

Required. Specifies the unique identifier of the option whose value is to delete.

user= UserName

Specifies the user class from which to delete the currently set option value. If the tag is provided, but the value unspecified, the current default user class is assumed.

vendor= VendorName

Specifies the vendor class from which to delete the currently set option value. If the tag is provided, but the value unspecified, the current default vendor class is assumed.

Remarks

  • Vendor and user classes are only supported for DHCP servers running Windows 2000 Server.

  • If you specify a user class, a vendor class, or both, this command deletes the set option value from only the scope clients that are identified as members of the specified class or classes.

  • To modify the current defaults for an unspecified class that is used with this command, use either the set userclass or set vendorclass commands.

Examples

In the first example, this command deletes the currently set option value for option code 18 from the current scope.

In the second example, this command deletes the currently set option value for option code 18 from the vendor class MyVendorClass.

delete optionvalue 18

delete optionvalue 18 vendor="MyVendorClass"

delete reservedip

Deletes a reservation for an IP address in the current scope.

Syntax

delete reservedip ReservedIP MACAddress

Parameters

ReservedIP

Required. Specifies the IP address reservation to delete from the current scope.

MACAddress

Required. Specifies the media access control (MAC) or physical hardware address string for which the IP address was reserved.

Examples

In the following example, this command removes the IP address reservation 10.2.1.32 for the MAC address 08002B30369B from the current scope.

delete reservedip 10.2.1.32 08002B30369B

delete reservedoptionvalue

Deletes an option value that is currently assigned to a reserved client in the current scope.

Syntax

delete reservedoptionvalue ReservedIP OptCode [User=UserName] [vendor=VendorName]

Parameters

ReservedIP

Required. Specifies the IP address of the reserved client.

OptCode

Required. Specifies the unique code for the option type that is currently assigned to the reserved client.

User=UserName

Specifies the user class from which to delete the option value. If the tag is provided, but no value is specified, the current default user class is assumed.

vendor=VendorName

Specifies the vendor class from which to delete the option value. If the tag is provided, but no value is specified, the current vendor class is assumed.

Remarks

  • Vendor and user classes are only supported for DHCP servers running Windows 2000 Server.

  • To modify the current defaults for an unspecified class used with this command, use either set userclass or set vendorclass.

Examples

In the following example, this command deletes the currently set option value for the option identified by code 18 for reserved IP address of 10.2.2.32 in the current scope.

delete reservedoptionvalue 10.2.2.32 18

dump

Dumps the configuration of the current scope to the command prompt window when run within the netsh environment.

Syntax

dump

When run at the command prompt or in a batch file, output can be saved in a text file. Used without parameters, this command dumps the configuration of the current scope to the command prompt window.

Syntax

netsh dhcp server { ServerName | IPAddress } scope ScopeID dump >[PathAndFileName]

Parameters

ServerName | IPAddress

Specifies the server name or IP address of the DHCP server for which the scope configuration is output.

ScopeID

Required. Specifies the IP address of the scope for which the configuration is output.

PathAndFileName

Specifies both the location where the file is saved, and the name of the destination file to which to dump the scope configuration. If unspecified, the scope configuration is dumped to the command prompt window.

Examples

The first command, which is run within the netsh environment, dumps the configuration of the current scope to the command prompt window.

The second command, which is run from the command prompt, dumps the configuration of the local server scope 192.168.1.0 to a file named Scopecfg.dmp on the shared network folder \\Backup\Dhcp\.

dump

netsh dhcp server scope 192.168.1.0 dump > \\Backup\Dhcp\Scopecfg.dmp

initiate reconcile

Checks and reconciles the current scope. Used without parameters, this command verifies the scopes and checks for inconsistencies but does not fix any inconsistencies that it finds in the database.

Syntax

initiate reconcile [fix]

Parameters

[fix]

Indicates that the command will fix, if possible, any inconsistencies that it finds in the database.

Examples

In the first example, this command verifies the scopes and checks for inconsistencies.

In the second example, this command verifies the scopes, checks for inconsistencies, and fixes any inconsistencies that are found.

initiate reconcile

initiate reconcile fix

set comment

Sets the comment for the current scope. Used without parameters, set comment deletes the current comment.

Syntax

set comment [NewComment]

Parameters

[NewComment]

Specifies a new or modified comment string for the scope.

Examples

In the first example, this command sets a comment string that has no spaces.

In the second example, this command sets a comment string that includes spaces.

set comment NewCommentNoSpaces

set comment "New Comment With Spaces"

set name

Sets the name of the current scope.

Syntax

set name NewName

Parameters

NewName

Required. Specifies the new name of the scope.

Examples

In the first example, this command sets a name that has no spaces.

In the second example, this command sets a name that includes spaces.

set name NewNameNoSpaces

set name "New Name With Spaces"

set optionvalue

Sets an option value for the current scope.

Syntax

set optionvalue OptCode{BYTE | WORD | DWORD | STRING | IPADDRESS} [user=UserName] [vendor=VendorName] OptionValue

Parameters

OptCode

Required. Specifies the code for the option type whose value is to be set.

{BYTE | WORD | DWORD | STRING | IPADDRESS}

Required. Specifies the data type for the option type whose value is to be set.

user=UserName

Specifies the user class. If the tag is provided, but the value is unspecified, the current default user class is assumed.

vendor=VendorName

Specifies the vendor class. If the tag is provided, but the value is unspecified, the current default vendor class is assumed.

OptionValue

Required. Specifies the assigned value for the option type that is specified in OptCode. If the option type supports an array that contains more than a single numeric or IP address value, provide the additional values, in the order that you prefer them, at the end of the command, with each value separated by a space.

Remarks

  • Vendor and user classes are only supported for DHCP servers running Windows 2000 Server.

  • To modify the current defaults for an unspecified class used with this command, use either set userclass or set vendorclass.

Examples

In the first example, this command sets the value of option code 003 to list two router IP addresses (10.1.1.1, 10.1.1.2).

In the second example, this command sets the value that is specified in the first example to apply only to those scope clients that identify themselves as members of the vendor class Vendor1, a class that was previously defined at the server with this specified option type defined for its use.

set optionvalue 003 IPADDRESS 10.1.1.1 10.1.1.2

set optionvalue 003 IPADDRESS vendor=Vendor1 10.1.1.1 10.1.1.2

set reservedoptionvalue

Sets the value of an option for a reservation IP address in the current scope.

Syntax

set reservedoptionvalue ReservedIP OptCode {BYTE | WORD | DWORD | STRING | IPADDRESS} [user=UserName] [vendor=VendorName] OptValue

Parameters

ReservedIP

Required. Specifies the reserved IP address for which the option value is to be set.

OptCode

Required. Specifies the code for the option type whose value is to be set.

{BYTE | WORD | DWORD | STRING | IPADDRESS}

Required. Specifies the data type for the option type whose value is to be set.

user=UserName

Specifies either the current default user class or the class specified as UserName. If the tag is provided, but no value is specified, the current default user class is assumed.

vendor=VendorName

Specifies either the current default vendor class or the class specified as VendorName. If the tag is provided, but no value is specified, the current default vendor class is assumed.

OptValue

Required. Specifies the assigned value for the option type specified in OptCode. If the option type supports an array that contains more than a single numeric or IP address value, provide the additional values, in the order that you prefer them, at the end of the command with each value separated by a space.

Remarks

  • Vendor and user classes are only supported for DHCP servers running Windows 2000 Server.

  • To modify the current defaults for an unspecified class used with this command, use either set userclass or set vendorclass.

Examples

In the following example, this command sets the value of the router option (code 003) for the reserved client IP address of 10.1.1.50 in the current scope to set IP addresses of 10.1.1.1 and 10.1.1.2 for its configured routers (default gateways).

set reservedoptionvalue 10.1.1.50 003 IPADDRESS 10.1.1.1 10.1.1.2

set scope

Sets the scope for use in subsequent operations.

Syntax

set scope ScopeAddress

Parameters

ScopeAddress

Required. Specifies the IP address of the scope to use in subsequent command operations.

Examples

In the following example, this command sets the current scope to 10.2.2.0 for subsequent operations.

set scope 10.2.2.0

set state

Sets or resets the state of the current scope to either the active or inactive state. Used without parameters, this command activates the scope.

Syntax

set state [{0 | 1 | 2 | 3}]

Parameters

{0 | 1 | 2 | 3}

Indicates the state of the scope: 0-Deactivates the scope, 1-Activates the scope (default), 2-Deactivates the scope and marks the scope as "Switched,"

3-Activates the scope and marks the scope as "Switched."

Remarks

  • 2 and 3 are typically used for switched networks or networks where multiple logical networks are hosted on a single physical network.

Examples

In the first example, this command activates a scope.

In the second example, this command deactivates a scope.

set state 1

set state 0

set superscope

Sets the superscope to use in subsequent operations.

Syntax

set superscope SuperscopeName {0 | 1}

Parameters

SuperscopeName

Required. Specifies the name of the superscope to include the current scope. The SuperscopeName is case-sensitive.

{0 | 1}

Required. Indicates whether to set the state of the superscope to active or inactive: 0-Deactivates the superscope, 1-Activates the superscope.

Examples

In the following example, this command adds the current scope to the superscope MySuperScope and activates the superscope.

set superscope MySuperScope 1

show clients

Displays all of the available version 4 clients for the current scope. Used without parameters, this command displays the following information for each client: IP address, subnet mask, unique ID, lease expiration, and type.

Syntax

show clients[{0 | 1}]

Parameters

{0 | 1}

Indicates the detail level of the output: 0-Shows the following information for each client: IP address, subnet mask, unique ID, lease expiration, and data type (default), 1-Shows all of the information that 0 provides and also displays the fully qualified domain name of each client.

Remarks

  • To view the output of this command effectively, increase the width of the command prompt window to at least 95 characters.

show clientsv5

Displays all of the available version 5 clients for the current scope. Used without parameters, this command displays the following information for each client: IP address, subnet mask, unique ID, lease expiration, and type.

Syntax

show clientsv5[{0 | 1}]

Parameters

{0 | 1}

Indicates the detail level of the output: 0-Shows the following information for each client: IP address, subnet mask, unique ID, lease expires, type (default), 1-Shows all of the information that 0 provides and also displays the fully qualified domain name of each client.

Remarks

  • To view the output of this command effectively, increase the width of the command prompt window to at least 95 characters.

show excluderange

Displays all of the currently set exclusion ranges of IP addresses for the current scope.

Syntax

show excluderange

Parameters

none

Remarks

  • Use other scope-level commands to add and delete exclusion ranges.

show iprange

Displays all of the address ranges that are available for the current scope.

Syntax

show iprange

Parameters

none

show optionvalue

Displays all of the option values that are set for the current scope. Used without parameters, this command assumes the current default user and vendor classes.

Syntax

show optionvalue[user=UserName] [vendor=VendorName]

Parameters

user=UserName

Specifies that the options that are set for the specified user class will display. If the tag is provided, but no value is specified, the current default user class is assumed.

vendor=VendorName

Specifies that the options that are set for the specified vendor class will display. If the tag is provided, but no value is specified, the current default vendor class is assumed.

Remarks

  • Vendor and user classes are only supported for DHCP servers running Windows 2000 Server.

  • To modify the current defaults for an unspecified class used with this command, use either set userclass or set vendorclass.

Examples

In the following example, this command displays all options and values set for the current scope for the user defined class My User Class.

show optionvalue user="My User Class"

show reservedip

Displays all of the IP addresses that are currently reserved for the current scope.

Syntax

show reservedip

Parameters

none

show reservedoptionvalue

Displays all currently set option values for a reserved client IP address in the current scope.

Syntax

show reservedoptionvalue ReservedIP[user=UserName] [vendor=VendorName]

Parameters

ReservedIP

Required. Specifies the IP address reservation for which currently assigned options are to display.

user=UserName

Specifies that the options that are set for the specified user class will display. If the tag is provided, but no value is specified, the current default user class is assumed.

vendor=VendorName

Specifies that the options that are set for the specified vendor class will display. If the tag is provided, but no value is specified, the current default vendor class is assumed.

Remarks

  • Vendor and user classes are only supported for DHCP servers running Windows 2000 Server.

  • To modify the current defaults for an unspecified class used with this command, use either set userclass or set vendorclass.

Examples

In the following example, this command displays the option values set for the reserved IP address 10.2.2.100 in the current scope.

show reservedoptionvalue 10.2.2.100

show scope

Displays information for the current scope.

Syntax

show scope

Parameters

none

show state

Displays the state of the current scope, indicating whether it is active or inactive.

Syntax

show state

Parameters

none

Netsh DHCP server mscope

The following commands can run from the dhcp server mscope> prompt, which is rooted within the netsh environment.

To view the command syntax, click a command:

  • add excluderange

  • add iprange

  • delete excluderange

  • delete iprange

  • dump

  • initiate reconcile

  • set comment

  • set lease

  • set mscope

  • set name

  • set state

  • set ttl

  • show clients

  • show excluderange

  • show iprange

  • show lease

  • show mibinfo

  • show mscope

  • show state

  • show ttl

add excluderange

Adds a range of excluded addresses to the current multicast scope.

Syntax

add excluderange StartIP EndIP

Parameters

StartIP

Required. Specifies the IP address that starts the exclusion range.

EndIP

Required. Specifies the IP address that ends the exclusion range.

Remarks

  • The exclusion range must be a subset of the overall scope address range.

Examples

In the following example, this command adds an exclusion range that starts with 224.2.2.10 and ends with 224.2.2.20 to the distribution range of the current multicast scope.

add excluderange 224.2.2.10 224.2.2.20

add iprange

Adds a range of IP addresses to the current multicast scope.

Syntax

add iprange StartIP EndIP

Parameters

StartIP

Required. Specifies the IP address that starts the range.

EndIP

Required. Specifies the IP address that ends the range.

Remarks

  • The range must be within the valid range of multicast IP addresses (from 224.0.0.0 to 239.255.255.255).

Examples

In the following example, this command adds the IP address range 224.2.2.10 to 224.2.2.20 to the distribution range in the multicast scope.

add iprange 224.2.2.10 224.2.2.20

delete excluderange

Deletes an exclusion range of previously excluded IP addresses in the current multicast scope.

Syntax

delete excluderange StartIP EndIP

Parameters

StartIP

Required. Specifies the IP address that starts the exclusion range.

EndIP

Required. Specifies the IP address that ends the exclusion range.

Examples

In the following example, this command removes a multicast scope exclusion with a range of IP addresses that starts at 224.2.2.10 and ends with 224.2.2.20 for the multicast scope.

delete excluderange 224.2.2.10 224.2.2.20

delete iprange

Deletes a range of IP addresses from the current multicast scope.

Syntax

delete iprange StartIP EndIP

Parameters

StartIP

Required. Specifies the IP address that starts the range to delete.

EndIP

Required. Specifies the IP address that ends the range to delete.

Examples

In the following example, this command deletes the IP address range 224.2.2.10 to 224.2.2.20 from the overall range of the full multicast scope.

delete iprange 224.2.2.10 224.2.2.20

dump

Dumps the configuration of the current multicast scope to the command prompt window when run within the netsh environment.

Syntax

dump

When run at the command prompt or in a batch file, output can be saved in a text file. Used without parameters, this command dumps the configuration of the current multicast scope to the command prompt window.

Syntax

netsh dhcp server [ ServerName | IPAddress ] mscope MscopeID dump >[PathAndFileName]

Parameters

ServerName | IPAddress

Specifies the server name or IP address of the DHCP server for which the scope configuration is output.

MscopeID

Required. Specifies the name of the multicast scope for which the configuration is output.

PathAndFileName

Specifies both the location where the file is saved, and the name of the destination file to which to dump the multicast scope configuration. If unspecified, scope configuration is dumped to the command prompt window.

Examples

The first command, which is run within the netsh environment, dumps the configuration of the current multicast scope to the command prompt window.

The second command, which is run from the command prompt, dumps the configuration of the local server multicast scope TestMscope to the file Mscopecfg.dmp on the shared network folder \\Backup\Dhcp\.

dump

netsh dhcp server mscope TestMscope dump > \\Backup\Dhcp\Mscopecfg.dmp

initiate reconcile

Checks and reconciles the current multicast scope.

Syntax

initiate reconcile

Parameters

none

Remarks

  • This command checks the integrity of the current multicast scope by comparing the current contents of the server database with a mirrored copy of the same information in the Windows registry. If inconsistencies are detected in the database, they are repaired based on the information that is duplicated in the registry. Repair is always attempted for any inconsistency that is found.

set comment

Sets the comment for the current multicast scope.

Syntax

set comment NewComment

Parameters

NewComment

Required. Specifies the new or revised comment for the multicast scope

Examples

In the first example, this command modifies the multicast scope comment with a new comment that contains no spaces.

In the second example, this command modifies the multicast scope comment with a new comment that contains spaces.

set comment NewCommentNoSpaces

set comment "New Comment With Spaces"

set lease

Sets the lease duration for the multicast scope IP addresses.

Syntax

set lease Time

Parameters

Time

Required. Specifies the lease duration for clients of the multicast scope. Specifying -1 sets the duration of the IP address lease to an unlimited or infinite time.

Examples

In the following example, this command sets the lease duration for the clients of the current multicast scope to 691200 seconds (eight days).

set lease 691200

set mscope

Sets the multicast scope to use in subsequent operations.

Syntax

set mscope NewName

Parameters

NewName

Required. Specifies the name of the multicast scope to which the command context is changed. NewName is case-sensitive.

Remarks

  • This command changes the context of the netsh dhcp server mscope> prompt from one multicast scope to another.

  • This command does not rename the current multicast scope. To change the name of the current multicast scope, use the command set name.

Examples

In the first example, this command changes the command context to a multicast scope named MyMulticastScope. Note that the multicast scope name contains no spaces.

In the second example, this command changes the command context to a multicast scope named My Multicast Scope. Note that the multicast scope name contains spaces.

set mscope MyMulticastScope

set mscope "My Multicast Scope"

set name

Changes the name of the current multicast scope.

Syntax

set name NewName

Parameters

NewName

Required. Specifies a new name for the current multicast scope.

Examples

In the first example, this command sets a new name that contains no spaces for the current multicast scope.

In the second example, this command sets a new name that contains spaces for the current multicast scope.

set name NewNameNoSpaces

set name "New Name With Spaces"

set state

Sets or resets the state of the current multicast scope to either an active or inactive state.

Syntax

set state {0 | 1}

Parameters

{0 | 1}

Required. Sets the state of the current multicast scope: 0-Deactivates the current multicast scope, 1-Activates the current multicast scope.

Examples

In the first example, this command activates the current multicast scope.

In the second example, this command deactivates the current multicast scope.

set state 1

set state 0

set ttl

Sets the Time-To-Live (TTL) value for the current multicast scope.

Syntax

set ttl TTL

Parameters

TTL

Required. Specifies the Time-to-Live (TTL) value. The valid range for this value is a number from 1 to 255.

Examples

In the following example, this command sets the TTL value for the current multicast scope to 32.

set ttl 32

show clients

Displays all available clients for the current multicast scope.

Syntax

show clients

Parameters

none

Remarks

  • To view the output of this command effectively, increase the width of the command prompt window to at least 95 characters.

show excluderange

Displays all currently excluded ranges of IP addresses for the current multicast scope.

Syntax

show excluderange

Parameters

none

Remarks

  • If no exclusion ranges have been previously defined for the scope, this command outputs an empty list.

show iprange

Displays all available IP address ranges for the current multicast scope.

Syntax

show iprange

Parameters

none

show lease

Displays the current lease duration settings for the current multicast scope.

Syntax

show lease

Parameters

none

show mibinfo

Displays management information base (MIB) information for the current multicast scope.

Syntax

show mibinfo

Parameters

none

show mscope

Displays information for the current multicast scope.

Syntax

show mscope

Parameters

none

show state

Displays the state of the current multicast scope.

Syntax

show state

Parameters

none

show ttl

Displays the Time-To-Live (TTL) value for the current multicast scope.

Syntax

show ttl

Parameters

none

Formatting legend

Format | Meaning
Italic | Information that the user must supply
Bold | Elements that the user must type exactly as shown
Ellipsis (...) | Parameter that can be repeated several times in a command line
Between brackets ([]) | Optional items
Between braces ({}); choices separated by pipe (|). Example: {even|odd} | Set of choices from which the user must choose only one
Courier font | Code or program output


Netsh Commands for Health Registration Authority

Provides Netsh commands for configuration of Health Registration Authority (HRA) for the Network Access Protection (NAP) Internet Protocol security (IPsec) enforcement method (netsh nap hra).

For information on how to interpret netsh command syntax, see Formatting Legend.

Netsh commands for HRA

The Netsh commands for HRA offer a command-line tool that helps with the administration of HRA servers and provides an equivalent alternative to console-based management. Netsh commands for HRA provide the same functionality as the HRA console, and can be useful in the following situations:

  • When managing HRA servers in wide area networks (WANs), commands can be used in interactive mode at the Netsh command prompt to better manage across slow-speed network links.

  • When managing multiple HRA servers, commands can be used in batch mode at the Netsh command prompt to help script and automate recurring administrative tasks that must be performed for all HRA servers.

To run these commands from the command prompt, you must either enter the netsh nap hra context or prepend the context to the command. For example, if you are at the command prompt but have not typed netsh and then typed nap hra to enter the netsh nap hra context, you must type:

netsh nap hra command

where command is the command that you want to run, including all of the required parameters for the command.

Netsh HRA command reference

The Netsh commands for HRA are grouped by the following command categories.

HRA Server Commands. These commands allow you to display, reset, back up, or restore your HRA server configuration.

HRA Certification Authority Commands. These commands allow you to configure servers running Active Directory Certificate Services that HRA uses to request health certificates.

HRA Request Policy Commands. These commands allow you to configure asymmetric keys algorithms, hash keys algorithms, cryptographic service providers, and HTTP client user agents in HRA.

The following sections provide the Netsh commands for these command categories.


HRA Server Commands

This section contains the following commands.

  • reset configuration

  • show configuration

  • export

  • import

  • dump

HRA server commands

The following entries provide details for each command.

reset config

Deletes the Health Registration Authority (HRA) server configuration, including request policy and certification authority settings, and restores the HRA server to the default post-installation state.

Caution
Do not run this command if you want to maintain any of the settings you have configured at the HRA server. This command deletes all custom settings that you have configured, and after running this command, your settings cannot be recovered. Before you run this command, it is recommended that you use the export command to save the HRA server configuration to an XML file.

Syntax

reset config

show config

Displays the HRA server configuration. The displayed settings are: certificate validity period, HRA mode, policy OID status, certification authority servers, and timeout configuration.

Syntax

show config

export

Exports the HRA server configuration to a file in Extensible Markup Language (XML) format.

Syntax

export [filename =] filename.xml

Parameters

filename

Required. Specifies the name of the XML file to which you want to export the HRA server configuration.

Example

export C:\hra.xml

import

Imports the HRA server configuration from a file in the XML file format.

Syntax

import [filename =] filename.xml

Parameters

filename

Required. Specifies the name of the XML file from which you want to import the HRA server configuration.

Example

import C:\hra.xml

dump

Creates a script that contains the current configuration. If saved to a file, the script can be used to restore configuration settings.

Syntax

dump


HRA Certification Authority Commands

This section contains the following commands.

  • add caserver

  • delete caserver

  • rename caserver

  • reset caserver

  • set caserver

  • reset opmode

  • set opmode

  • reset templates

  • set templates

  • reset timeout

  • set timeout

  • reset usepolicyOIDs

  • set usepolicyOIDs

  • reset validityperiod

  • set validityperiod

HRA certification authority commands

HRA certification authority (CA) commands are used to assign one or more CAs that Health Regulation Authority (HRA) can use to obtain Network Access Protection (NAP) health certificates. You can also use these commands to configure the validity period of health certificates, and specify certain properties of the CA server. The following entries provide details for each command.

add caserver

Adds a CA server to the HRA configuration.

Syntax

add caserver [ [ name = ] name [ processingorder = ] processingorder ]

Parameters

name

Required. Specifies the name of the CA server and certificate. The required format is "\\computername\CAname".

processingorder

Optional. Specifies the priority of the CA server in the list of CA servers.

Example

In the following example, a CA server is added to the HRA configuration. This CA server has the name server1 with a certificate name of CA, and is assigned the highest processing order.

add caserver name= "\\server1\CA" processingorder = "1"

delete caserver

Deletes an existing CA server.

Syntax

delete caserver [ name= ] name

Parameters

name

Required. Specifies the name of the CA server and the certificate. The required format is "\\computername\CAname".

Example

In the following example of command usage, a CA server with the name server1 and certificate name of CA is removed from the HRA configuration.

delete caserver name = "\\server1\CA"

rename caserver

Changes the name of a CA server.

Syntax

rename caserver [ [ name = ] name [ newname = ] newname ]

Parameters

name

Required. Specifies the current name of the CA server and the certificate. The required format is "\\oldcomputername\CAname".

newname

Required. Specifies the new name of the CA server and the certificate. The required format is "\\newcomputername\CAname".

Example

In the following example of command usage, a CA server with the name server1 is renamed to server2.

rename caserver name = "\\server1\CA" newname = "\\server2\CA"

reset caserver

Deletes all CA servers that are configured in HRA and resets the HRA configuration to default values.

Caution
Do not run this command if you want to maintain any of the CA server settings you have configured at the HRA server. This command deletes all CA server settings that you have configured, and after running this command, your settings cannot be recovered. Before you run this command, it is recommended that you use the export command to save the HRA server configuration to an XML file.

Syntax

reset caserver

set caserver

Changes the processing order of an existing CA server. This command cannot be used to change the name of a CA server.

Note
If you set the processing order to a number higher than the number of configured CA servers, the CA server will be assigned a processing order equal to the number of CA servers.

Syntax

set caserver [ [ name = ] name [ processingorder = ] processingorder ]

Parameters

name

Required. Specifies the name of the CA server and certificate. The required format is "\\computername\CAname".

processingorder

Required. Specifies the priority of the CA server in the list of CA servers.

Example

In the following example of command usage, a CA server with the name server1 and a processing order of 2 is changed to a processing order of 1. server2.

set caserver name = "\\server1\CA" processingorder = "1"

reset opmode

Resets the CA server operational mode to the default value of standalone only.

Syntax

reset opmode

set opmode

Sets the CA server operational mode. Two modes are available: 1) standalone and 2) enterprise and standalone. A value of zero is default and configures the CA server to operate in standalone mode only. A value of one configures the CA server to operate in an enterprise and standalone mode. In this mode, the CA server can request health certificates from either enterprise or standalone CA servers.

Important
You must configure certificate templates prior to assigning the CA server to operate in a mode that includes enterprise CA servers.

Syntax

set opmode [ [ mode = ] 0 | 1 ]

Parameters

0

Required. Specifies the operational mode of CA server as standalone only. This is the default setting.

1

Required. Specifies the operational mode of the CA server as enterprise and standalone. This setting allows HRA to obtain health certificates from CA servers operating in either an enterprise or standalone mode.

Example

In the following example of command usage, the CA server operational mode is set to enterprise and standalone.

set opmode mode = 1

reset templates

Deletes the anonymous and authenticated CA server template configurations from HRA.

Syntax

reset templates

set templates

Configures certificate templates for use with an enterprise CA server. Certificate templates are required prior to configuring the CA server to operate in enterprise mode. Anonymous and authenticated certificate template names must both be configured at the same time.

Important
Certificate templates with identical certificate simple names to those specified in the set template command must be available prior to configuring CA server templates. Certificate template names are case-sensitive.

Syntax

set templates [ [ anontemplate = ] anontemplate [ authtemplate = ] authtemplate ]

Parameters

anontemplate

Required. Specifies the simple name of the health certificate template to use when requesting certificates that do not require client authentication. This template can be used to perform client health authentication in a workgroup environment. Certificate template names are case-sensitive.

authtemplate

Required. Specifies the simple name of the health certificate template to use when requesting certificates that require both client authentication and system health authentication. This template can be used to perform client health authentication in a domain environment. Certificate template names are case-sensitive.

Note
Type certutil -template at the command line to display a list of available templates.

Example

In the following example of command usage, the CA server is configured to use a template simple name for anonymous certificate requests of AnonymousNAPCompliant and a template simple name for authenticated certificate requests of DomainNAPCompliant.

set templates anontemplate = AnonymousNAPCompliant authtemplate = DomainNAPCompliant

reset timeout

Resets the CA server timeout to defaults values. The default blackout time is five minutes, and the default no response time is 20 seconds.

Syntax

reset timeout

set timeout

Configures how long HRA will wait when no response is received from the CA server before sending another request. Two values are configurable, and these can be configured independently of each other. The blackout time specifies the time in minutes that the CA server remains identified as unavailable after no response has been received within the noresponse time. The no response time specifies the time in seconds to wait for the CA server to respond before identifying it as unavailable and starting the blackout timer.

Syntax

set timeout [ [ blackout = ] blackout [ noresponse = ] noresponse ]

Parameters

blackout

Optional. Specifies the time in minutes that the CA server remains identified as unavailable after no response has been received within the noresponse time.

noresponse

Optional. Specifies the time in seconds to wait for the CA server to respond before identifying it as unavailable and starting the blackout timer.

Example

Following is an example of the command usage. In this example, the CA server is configured to use a blackout time of 10 minutes and a no response time of 60 seconds.

set timeout blackout = "10" noresponse = "60"

reset usepolicyoids

Resets the CA server policyOID setting to the default value. By default, the use of policyOIDs by the CA server is disabled.

Syntax

reset usepolicyoids

set usepolicyoids

Changes the CA server policyOID setting to enable or disable. The default setting is disable.

Important
To enable policyOIDs, the CA server operational mode must be set to standalone only.

Syntax

set usepolicyoids [ state = ] enable | disable

Parameters

enable

Required. Enables use of policy object identifiers with the CA server in standalone mode.

disable

Required. Disables use of policy object identifiers with the CA server in standalone mode. This is the default setting.

Example

In the following example of the command usage, the CA server is configured to enable the use of policyOIDs.

set usepolicyoids state = "enable"

reset validityperiod

Resets the health certificate validity period the default value. The default health certificate validity period is four hours.

Syntax

reset validityperiod

set validityperiod

Configures the validity period in minutes of health certificates issued by the CA server. The default value is 240 minutes, and the minimum value allowed is five minutes. The validity period influences load on the CA server by affecting how often it issues new health certificates.

Syntax

set validityperiod [ duration = ] duration

Parameters

duration

Required. The time in minutes that health certificates issued by the CA server are considered valid. Client computers must obtain a new health certificate prior to expiration of the validity period or they will be considered noncompliant with health requirements.

Example

In the following example of command usage, the health certificate validity period is set to 24 hours.

set validityperiod duration = 1440


HRA Request Policy Commands

This section contains the following commands.

  • add asymmetrickey

  • delete asymmetrickey

  • reset asymmetrickey

  • show asymmetrickeys

  • add csp

  • delete csp

  • reset csp

  • show csps

  • add hash

  • delete hash

  • reset hash

  • show hashes

  • add useragent

  • delete useragent

  • reset useragent

HRA request policy commands

Health Registration Authority (HRA) request policy commands are used to configure security mechanisms that the HRA server uses to communicate with client computers. Settings include asymmetric key algorithms, hash keys algorithms, cryptographic service providers, and HTTP client user agents.

add asymmetrickey

Adds an asymmetric key algorithm to the HRA configuration.

Syntax

add asymmetrickey [ [ oid = ] oid [ minkeylength = ] minkeylength [ maxkeylength = ] maxkeylength ]

Parameters

oid

Required. Specifies the object identifier (oid) for the asymmetric key algorithm.

minkeylength

Optional. Specifies the minimum asymmetric key length.

maxkeylength

Optional. Specifies the maximum asymmetric key length.

Example

In the following example, an asymmetric key algorithm is added to the HRA configuration with an object identifier of 1.2.840.113549.1.1.1, a minimum key length of 1024 bytes, and maximum key length of 4096 bytes.

add asymmetrickey oid = "1.2.840.113549.1.1.1" minkeylength = "1024" maxkeylength = "4096"

delete asymmetrickey

Deletes an asymmetric key algorithm from the list of allowed asymmetric key algorithms.

Syntax

delete asymmetrickey [ oid = ] oid

Parameters

oid

Required. Specifies the object identifier.

Example

In the following example, an asymmetric key algorithm with an object identifier of 1.2.840.113549.1.1.1 is deleted from the HRA configuration.

delete asymmetrickey oid = "1.2.840.113549.1.1.1"

reset asymmetrickey

Resets the HRA configuration to use the default asymmetric key algorithm of RSA with a key length of 1024 bits.

Syntax

reset asymmetrickey

show asymmetrickeys

Shows all available asymmetric keys on the HRA server. Use this command to obtain the object identifiers that you can use with the "add asymmetrickey" command.

Syntax

show asymmetrickeys

add csp

Adds a cryptographic service provider (CSP) to the list of allowed CSPs in the HRA configuration.

Syntax

add csp [ name = ] name

Parameters

Name

Required. Specifies the name of the CSP you want to add.

Example

In the following example, a CSP with the name of "Microsoft RSA SChannel Cryptographic Provider" is added to the HRA configuration.

add csp name = "Microsoft RSA SChannel Cryptographic Provider"

delete csp

Deletes a CSP from the list of allowed CSPs.

Syntax

delete csp [ name = ] name

Parameters

Name

Required. Specifies the name of the CSP you want to delete.

Example

In the following example, a CSP with the name of "Microsoft RSA SChannel Cryptographic Provider" is deleted from the HRA configuration.

delete csp name = "Microsoft RSA SChannel Cryptographic Provider"

reset csp

Resets the HRA configuration to use the default CSP of "MS-Enhanced cryptographic service provider."

Syntax

reset csp

show csps

Shows all available CSPs on the HRA server. Use this command to obtain the names of CSPs that you can use with the "add csp" and "delete csp" commands.

Syntax

show csps

add hash

Adds a hash algorithm to the list of allowed hash algorithms in the HRA configuration. You can obtain the hash algorithm object identifier by using the "show hashes" command.

Syntax

add hash [ oid = ] oid

Parameters

oid

Required. Specifies the object identifier of the hash algorithm you want to add.

Example

In the following example, a hash algorithm with an object identifier of "1.2.840.113549.1.1.5" is added to the HRA configuration.

add hash oid = "1.2.840.113549.1.1.5"

delete hash

Deletes a hash algorithm from the list of allowed hashes.

Syntax

delete hash [ oid = ] oid

Parameters

oid

Required. Specifies the object identifier of the hash algorithm you want to delete.

Example

In the following example, a hash algorithm with an object identifier of "1.2.840.113549.1.1.5" is deleted from the HRA configuration.

delete hash oid = "1.2.840.113549.1.1.5"

reset hash

Resets the HRA configuration to use the default hash algorithm of "SHA1."

Syntax

reset hash

show hashes

Shows all available hash algorithms on the HRA server. Use this command to obtain the object identifiers that you can use with the "add hash" and "delete hash" commands.

Syntax

show hashes

add useragent

Adds a hash algorithm to the list of allowed hash algorithms in the HRA configuration. You can obtain the hash algorithm object identifier by using the "show hashes" command.

Caution
When you run this command for the first time, the default configuration allowing use of any user agent will be overwritten. After specifying user agents with the "add useragent" command, client computers will only be able to communicate with HRA using one of the allowed user agents.

Syntax

add useragent [ name = ] name

Parameters

name

Required. Specifies the name of the user agent you want to add.

Example

In the following example, a user agent with the name "NAP IPsec Enforcement v1.0" is added to the HRA configuration.

add useragent name = "NAP IPsec Enforcement v1.0"

delete useragent

Deletes a user agent from the list of allowed agents.

Syntax

delete useragent [ name = ] name

Parameters

name

Required. Specifies the name of the user agent you want to delete.

Example

In the following example, a user agent with the name "NAP IPsec Enforcement v1.0" is deleted from the HRA configuration.

delete useragent name = "NAP IPsec Enforcement v1.0"

reset useragent

Resets the HRA user agent configuration to the default value of "ANY."

Syntax

reset useragent


Netsh Commands for Hypertext Transfer Protocol (HTTP)

You can use commands in the netsh http context to configure properties of the HTTP service. The Netsh commands for HTTP can be run manually at the netsh prompt or in scripts and batch files.

To run these commands from the command prompt, you must either enter the netsh http context or prepend the context to the command. For example, if you are at the command prompt but have not typed netsh and then http to enter the netsh http context, you must type:

netsh http command

Where command is the command that you want to run, including all of the required parameters for the command.

This section contains the following commands.

  • add iplisten

  • add sslcert

  • add timeout

  • add urlacl

  • delete cache

  • delete iplisten

  • delete sslcert

  • delete timeout

  • delete urlacl

  • flush logbuffer

  • show cachestate

  • show iplisten

  • show servicestate

  • show sslcert

  • show timeout

  • show urlacl

For information on how to interpret netsh command syntax, see Formatting Legend.

Netsh http commands

The following entries provide details for each command.

add iplisten

Adds a new IP address to the IP listen list. This does not include the port number.

Syntax

add iplisten [ ipaddress= ] IPAddress

Parameters

ipaddress

Required. The IPv4 or IPv6 address to be added to the IP listen list. The IP listen list is used to scope the list of addresses to which the HTTP service binds. "0.0.0.0" means any IPv4 address and "::" means any IPv6 address.

Examples

Following are four examples of the add iplisten command.

add iplisten ipaddress=fe80::1

add iplisten ipaddress=1.1.1.1

add iplisten ipaddress=0.0.0.0

add iplisten ipaddress=::

add sslcert

Adds a new SSL server certificate binding and corresponding client certificate policies for an IP address and port.

Syntax

add sslcert [ ipport= ] IPAddress:port [ certhash= ] CertHash [ appid= ] GUID [ [ certstorename= ] CertStoreName [ verifyclientcertrevocation= ] enable | disable [ verifyrevocationwithcachedclientcertonly= ] enable | disable [ usagecheck= ] enable | disable [ revocationfreshnesstime= ] U-Int [ urlretrievaltimeout= ] U-Int [ sslctlidentifier= ] SSLCTIdentifier [ sslctlstorename= ] SSLCtStoreName [ dsmapperusage= ] enable | disable [ clientcertnegotiation= ] enable | disable ] ]

Parameters

ipport

Required. Specifies the IP address and port for the binding. A colon character (:) is used as a delimiter between the IP address and the port number.

certhash

Required. Specifies the SHA hash of the certificate. This hash is 20 bytes long and is specified as a hexadecimal string.

appid

Required. Specifies the GUID to identify the owning application.

certstorename

Optional. Specifies the store name for the certificate. Defaults to MY. Certificate must be stored in the local machine context.

verifyclientcertrevocation

Optional. Specifies the Turns on/off verification of revocation of client certificates.

verifyrevocationwithcachedclientcertonly

Optional. Specifies whether the usage of only cached client certificate for revocation checking is enabled or disabled.

usagecheck

Optional. Specifies whether the usage check is enabled or disabled. Default is enabled.

revocationfreshnesstime

Optional. Specifies the time interval, in seconds, to check for an updated certificate revocation list (CRL). If this value is zero, then the new CRL is updated only if the previous one expires.

urlretrievaltimeout

Optional. Specifies the timeout interval (in milliseconds) after the attempt to retrieve the certificate revocation list for the remote URL.

sslctlidentifier

Optional. Specifies the list of the certificate issuers that can be trusted. This list can be a subset of the certificate issuers that are trusted by the computer.

sslctlstorename

Optional. Specifies the certificate store name under LOCAL_MACHINE where SslCtlIdentifier is stored.

dsmapperusage

Optional. Specifies whether DS mappers is enabled or disabled. Default is disabled.

clientcertnegotiation

Optional. Specifies whether the negotiation of certificate is enabled or disabled. Default is disabled.

Examples

Following is an example of the add sslcert command.

add sslcert ipport=1.1.1.1:443 certhash=0102030405060708090A0B0C0D0E0F1011121314 appid={00112233-4455-6677-8899-AABBCCDDEEFF}

add timeout

Adds a global timeout to the service.

Syntax

add timeout [ timeouttype= ] IdleConnectionTimeout | HeaderWaitTimeout [ value= ] U-Short

Parameters

Timeouttype

Type of timeout for setting.

Value

Value of the timeout (in seconds). If value is in hexadecimal notation, then add the prefix 0x.

Examples

Following are two examples of the add timeout command.

add timeout timeouttype=idleconnectiontimeout value=120

add timeout timeouttype=headerwaittimeout value=0x40

add urlacl

Adds a Uniform Resource Locator (URL) reservation entry. This command reserves the URL for non-administrator users and accounts. The DACL can be specified by using an NT account name with the listen and delegate parameters or by using an SDDL string.

Syntax

add urlacl [ url= ] URL [ [user=] User [ [ listen= ] yes | no [ delegate= ] yes | no ] | [ sddl= ] SDDL ]

Parameters

url

Required. Specifies the fully qualified Uniform Resource Locator (URL).

user

Required. Specifies the user or user-group name

listen

Optional. Specifies one of the following values: yes: Allow the user to register URLs. This is the default value. no: Deny the user from registering URLs.

delegate

Optional. Specifies one of the following values: yes: Allow the user to delegate URLs no: Deny the user from delegating URLs. This is the default value.

sddl

Optional. Specifies an SDDL string that describes the DACL.

Examples

Following are four examples of the add urlacl command.

add urlacl url=http://+:80/MyUri user=DOMAIN\user

add urlacl url=http://www.contoso.com:80/MyUri user=DOMAIN\user listen=yes

add urlacl url=http://www.contoso.com:80/MyUri user=DOMAIN\user delegat

e=no

add urlacl url=http://+:80/MyUri sddl=...

delete cache

Deletes all entries or the specified entry from the HTTP service kernel URI cache.

Syntax

delete cache [ [ url= ] URL [ [recursive= ] yes | no ]

Parameters

url

Optional. Specifies the fully qualified Uniform Resource Locator (URL) that you want to delete.

recursive

Optional. Specifies whether all entries under the specified url cache are removed. yes: all entries are removed. no: all entries are not removed.

Examples

Following are two examples of the delete cache command.

delete cache url=http://www.contoso.com:80/myresource/ recursive=yes

delete cache

delete iplisten

Deletes an IP address from the IP listen list. The IP listen list is used to scope the list of addresses to which the HTTP service binds.

Syntax

delete iplisten [ ipaddress= ] IPAddress

Parameters

ipaddress

Required. The IPv4 or IPv6 address to be deleted from the IP listen list. The IP listen list is used to scope the list of addresses to which the HTTP service binds. "0.0.0.0" means any IPv4 address and "::" means any IPv6 address. This does not include the port number.

Examples

Following are four examples of the delete iplisten command.

delete iplisten ipaddress=fe80::1

delete iplisten ipaddress=1.1.1.1

delete iplisten ipaddress=0.0.0.0

delete iplisten ipaddress=::

delete sslcert

Deletes SSL server certificate bindings and corresponding client certificate policies for an IP address and port.

Syntax

delete sslcert [ ipport= ] IPAddress:port

Parameters

ipport

Required. Specifies the IPv4 or IPv6 address and port for for which the SSL certificate bindings will be deleted. A colon character (:) is used as a delimiter between the IP address and the port number.

Examples

Following are three examples of the delete sslcert command.

delete sslcert ipport=1.1.1.1:443

delete sslcert ipport=0.0.0.0:443

delete sslcert ipport=[::]:443

delete timeout

Deletes a global timeout and makes the service revert to default values.

Syntax

delete timeout [ timeouttype= ] idleconnectiontimeout | headerwaittimeout

Parameters

timeouttype

Required. Specifies the type of timeout for setting.

Examples

Following are two examples of the delete timeout command.

delete timeout timeouttype=idleconnectiontimeout

delete timeout timeouttype=headerwaittimeout

delete urlacl

Deletes a URL reservation.

Syntax

delete urlacl [ url= ] URL

Parameters

url

Required. Specifies the fully qualified Uniform Resource Locator (URL) that you want to delete.

Examples

Following are two examples of the delete urlacl command.

delete urlacl url=http://+:80/MyUri

delete urlacl url=http://www.contoso.com:80/MyUri

flush logbuffer

Flushes the internal buffers for the logfiles.

Syntax

flush logbuffer

show cachestate

Lists cached URI resources and their associated properties. This command lists all resources and their associated properties that are cached in HTTP response cache or displays a single resource and its associated properties.

Syntax

show cachestate [ [url= ] URL]

Parameters

url

Optional. Specifies the fully qualified URL that you want to display. If unspecified, displays all URLs. The URL could also be a prefix to registered URLs.

Examples

Following are two examples of the show cachestate command

show cachestate url=http://www.contoso.com:80/myresource

show cachestate

show iplisten

Displays all IP addresses in the IP listen list. The IP listen list is used to scope the list of addresses to which the HTTP service binds. "0.0.0.0" means any IPv4 address and "::" means any IPv6 address.

Syntax

show iplisten

show servicestate

Displays a snapshot of the HTTP service.

Syntax

show servicestate [ [ view= ] session | requestq ] [ [ verbose= ] yes |no ]

Parameters

View

Optional. Specifies whether to view a snapshot of the HTTP service state based on the server session or on the request queues.

Verbose

Optional. Specifies whether to display verbose information that also shows property information.

Examples

Following are two examples of the show servicestate command.

show servicestate view="session"

show servicestate view="requestq"

show sslcert

Displays Secure Sockets Layer (SSL) server certificate bindings and corresponding client certificate policies for an IP address and port.

Syntax

show sslcert [ ipport= ] IPAddress:port

Parameters

Ipport

Required. Specifies the IPv4 or IPv6 address and port for which the SSL certificate bindings will be displayed. A colon character (:) is used as a delimiter between the IP address and the port number. If you do not specify ipport, all bindings are displayed.

Examples

Following are five examples of the show sslcert command.

show sslcert ipport=[fe80::1]:443

show sslcert ipport=1.1.1.1:443

show sslcert ipport=0.0.0.0:443

show sslcert ipport=[::]:443

show sslcert

show timeout

Displays, in seconds, the timeout values of the HTTP service.

Syntax

show timeout

show urlacl

Displays discretionary access control lists (DACLs) for the specified reserved URL or all reserved URLs.

Syntax

show urlacl [ [url= ] URL]

Parameters

url

Optional. Specifies the fully qualified URL that you want to display. If unspecified, displays all URLs.

Examples

Following are three examples of the show urlacl command.

show urlacl url=http://+:80/MyUri

show urlacl url=http://www.contoso.com:80/MyUri

show urlacl


Netsh Commands for Interface (IPv4 and IPv6)
See Also

You can use commands in the Netsh Interface context and subcontexts to configure the TCP/IP version 4 protocol (including addresses, default gateways, Domain Name System (DNS) and WINS servers) and to display configuration and statistical information for IPv4.

In addition, you can use commands in this context and related subcontexts (6to4, isatap, portproxy, and teredo) to configure Internet Protocol version 6 (IPv6).

The netsh interface context contains the following commands:

  • add

  • delete

  • reset

  • set credentials

  • set interface

  • show credentials

  • show interface

To run these commands from the command prompt, you must either enter the netsh interface context or prepend the context to the command. For example, if you are at the command prompt but have not typed netsh and then interface to enter the netsh interface context, you must type:

netsh interface command

Where command is the command that you want to run, including all of the required parameters for the command.

The Netsh Interface context also includes several subcontexts.

Subcontexts of Netsh Interface

This context provides the following subcontexts:

Subcontext name | Result
6to4 | Changes to the netsh interface 6to4 context.
ipv4 | Changes to the netsh interface ipv4 context.
ipv6 | Changes to the netsh interface ipv6 context.
isatap | Changes to the netsh interface isatap context.
portproxy | Changes to the netsh interface portproxy context.
tcp | Changes to the netsh interface tcp context.
teredo | Changes to the netsh interface teredo context.

Formatting legend

For information on how to interpret netsh command syntax, see Formatting Legend.

Netsh Interface command reference

Following are the details for the commands in the Netsh Interface context.

add

Adds an interface to the router. For full interfaces, a phone book entry with the same name must already exist on the system.

Syntax

add [name=] Name [[type=]full]

Parameters

name

Required. Specifies the name of the interface to be added.

type

Optional. Specifies that a demand dial interface is created when full is designated.

Examples

Following is an example of the add interface command that creates a demand dial interface.

add name="Demand-Dial Interface" type=full

delete

Deletes an interface from the router.

Syntax

delete [ name= ] Name

Parameters

name

Required. Specifies the name of the interface to be deleted.

Examples:

The following example command deletes a demand dial interface at the router

delete name="Demand-Dial Interface"

reset

Deletes all of the interfaces that can be added through this context.

Syntax

reset

set credentials

Specifies the credentials that are used to connect to or add an interface.

Syntax

set credentials [ name= ] InterfaceName [ user= ]UserName [[ domain= ] Domain [password=] Password ]

Parameters

InterfaceName

Required. Specifies the name of the interface that you want to add.

UserName

Required. Specifies the user account name that has the required permissions to add an interface.

Domain

Optional. Specifies the domain where the user account is located.

Password

Optional. Specifies the password of the user account.

Examples

Following are two examples of the set credentials command.

set credentials name="Demand-Dial Interface" user=guest

set credentials name="Demand-Dial Interface" user=admin domain=mydomain password=mypassword

set interface

Changes the parameters for an existing interface.

Syntax

set interface [name = ] IfName [ [admin = ] ENABLED|DISABLED [connect = ] CONNECTED|DISCONNECTED [newname = ] NewName ]

Parameters

IfName

Required. Specifies the name of the interface that you want to modify.

admin

Optional. Specifies whether the interface should be enabled or disabled.

connect

Optional. Specifies whether or not to enable and connect the interface (non-LAN only).

newname

Optional. Specifies a new name for the interface (LAN only).

Remarks

  • At least one option other than the name must be specified.

  • If you specify that the value for connect equals CONNECTED, then the interface is automatically enabled even if you also specify that the value for admin equals DISABLED.

show credentials

Displays the credentials that are used to connect to an interface.

Syntax

show credentials [name = ] IfName

Parameters

IfName

Required. Specifies the name of the interface whose credentials you want to display.

show interface

Displays a list of the configured interfaces, including their current Name, Admin State, State, and Type.

Syntax

show interface [[name=] Name]

Parameters

Name

Optional. Specifies the name of the interface that you want to display. If Name is not specified, all interfaces are displayed.

Examples

Following is an example of the show interface command.

show interface name="Local Area Connection"

See Also

Concepts

Netsh commands for Interface 6to4
Netsh commands for Interface Internet Protocol version 4 (IPv4)
Netsh commands for Interface Internet Protocol version 6 (IPv6)
Netsh commands for Interface ISATAP
Netsh commands for Interface Portproxy
Netsh commands for Interface Transmission Control Protocol
Netsh commands for Interface Teredo


Netsh commands for Interface 6to4

This section contains the following commands:

  • add

  • delete

  • reset

  • set interface

  • set relay

  • set routing

  • set state

  • show interface

  • show relay

  • show routing

  • show state

Interface 6to4 commands

The following entries provide details for each command.

add

Adds an interface to the router. For full interfaces, a phone book entry with the same name must already exist on the system.

Syntax

add [name=] Name [[type=]full]

Parameters

name

Required. Specifies the name of the interface to be added.

type

Optional. Specifies that a demand dial interface is created when full is designated.

Examples

Following is an example of the add command that creates a demand-dial interface.

add name="Demand-Dial Interface" type=full

delete

Deletes an interface from the router.

Syntax

delete [ name= ] Name

Parameters

name

Required. Specifies the name of the interface to be deleted.

Examples:

The following example command deletes a demand-dial interface at the router

delete name="Demand-Dial Interface"

reset

Deletes all of the interfaces that can be added through this context.

Syntax

reset

set interface

Sets 6to4 interface configuration information.

Syntax

set interface [ name= ] Name [ [ routing= ]( enabled | disabled | default )]

Parameters

name

Required. Specifies the interface name.

routing

Optional. Specifies whether to act as a router.

Examples

Following is an example of the set interface command.

set interface "Private" enabled

set relay

Sets 6to4 relay information.

Syntax

set relay [ [ name= ]( Name | default )] [ [ state= ] ( enabled | disabled | automatic | default ) ] [[ interval= ] Integer ]

Parameters

name

Optional. Specifies the name of the 6to4 relay.

state

Optional. Specifies whether relay name resolution is enabled or disabled.

interval

Optional. Specifies an integer that is the resolution interval (in minutes).

Examples

Following is an example of the set relay command.

set relay 6to4.ipv6.org. enabled 1440

set routing

Sets 6to4 routing information.

Syntax

set routing [ [ routing= ]( enabled | disabled | automatic | default ) ] [ [ sitelocals= ] (enabled | disabled | default ) ]

Parameters

routing

Optional. Specifies the state of 6to4 routing.

sitelocalsq

Optional. Specifies whether to use Site-Local addresses.

Examples

Following are two examples of the set routing command.

set routing default default

set routing routing=enabled sitelocals=enabled

set state

Sets the 6to4 configuration state.

Syntax

set state [ [ state= ] ( enabled |disabled | automatic | default ) ] [ [ undoonstop= ] ( enabled | disabled | default ) ]

Parameters

state

Optional. Specifies whether 6to4 is enabled.

undoonstop

Optional. Specifies whether 6to4 is disabled on service stop.

Examples

Following are two examples of the set state command.

set state default default

set state state=enabled undoonstop=disabled

show interface

Displays the 6to4 interface configuration information.

Syntax

show interface

show relay

Displays the 6to4 relay information.

Syntax

show relay

show routing

Displays the 6to4 routing state.

Syntax

show routing

show state

Displays the 6to4 state.

Syntax

show state


Netsh commands for Interface Internet Protocol version 4 (IPv4)

Netsh commands for Interface IPv4

You can use commands in the Netsh Interface IP context to configure the TCP/IP protocol (including addresses, default gateways, DNS servers, and WINS servers) and to display configuration and statistical information.

You can run these commands at the command prompt for the netsh interface ip context. For these commands to work at the command prompt, you must type netsh interface ip before typing commands and parameters as they appear in the syntax below.

For more information on Netsh, see Netsh Overviewand Enter a Netsh Context.

To view the command syntax, click a command:

  • add address

  • add dnsserver

  • add neighbors

  • add route

  • add winsserver

  • delete address

  • delete arpcache

  • delete destinationcache

  • delete dnsserver

  • delete neighbors

  • delete route

  • delete winsserver

  • dump

  • install

  • reset

  • set address

  • set compartment

  • set dnsserver

  • set dynamicportrange

  • set global

  • set interface

  • set neighbors

  • set route

  • set subinterface

  • set winsserver

  • show addresses

  • show compartments

  • show config

  • show destinationcache

  • show dnsservers

  • show dynamicportrange

  • show global

  • show icmpstats

  • show interfaces

  • show ipaddresses

  • show ipnettomedia

  • show ipstats

  • show joins

  • show neighbors

  • show offload

  • show route

  • show subinterfaces

  • show tcpconnections

  • show tcpstats

  • show udpconnections

  • show udpstats

  • show winsservers

add address

Adds an IP address and a default gateway on a specified interface configured with a static IP address.

Syntax

add address [name=]InterfaceName [addr=]IPAddress [mask=]SubnetMask[[gateway=] DefaultGateway [gwmetric=]GatewayMetric]

Parameters

[name=] InterfaceName

Required. Specifies the name of the interface for which you want to add address and gateway information. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[ addr=] IPAddress[ mask=] SubnetMask

Required. Specifies the IP address to add and the subnet mask for that IP address.

[ gateway=] DefaultGateway[ gwmetric=] GatewayMetric

Specifies the IP address of the default gateway to add and the metric for that default gateway.

/?

Displays help at the command prompt.

add dnsserver

Adds a DNS server to a list of DNS servers for a specified interface.

Syntax

add dnsserver [name=]InterfaceName [addr=] DNSAddress [[index=]DNSIndex]

Parameters

[name=] InterfaceName

Required. Specifies the name of the interface for which you want to add DNS information. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[addr=] DNSAddress

Required. Specifies the IP address of the DNS server to add.

[index=] DNSIndex

Specifies the position of the added DNS server in the list of DNS servers for the interface.

/?

Displays help at the command prompt.

Remarks

  • A lower number for the DNSIndex parameter corresponds to a higher preference. If no index is specified, then the server is added with the lowest preference.

add neighbors

Specifies an entry in the neighbor cache.

Syntax

add neighbors [interface=]<string>[address=]<IPv4Address> [neighbor=]<string> [subinterface=]<string>[[store=]active|persistent]

Parameters

[interface=]<string>

Specifies an interface name or index.

[address=]<IPv4Address>

Specifies the address of the neighbor.

[neighbor=]<string>

Specifies the link layer address of the neighbor.

[subinterface=]<string>

Specifies the LUID of the subinterface. This is only needed on interfaces with multiple subinterfaces.

[[store=]active|persistent]

One of the following values:

  • active: Address will disappear on next boot.

  • Persistent (default): Address will be persistent.

Examples

This example command adds an entry to the neighbor cache on the interface named "Private."

add neighbors "Private" "10.1.1.1" "12-34-56-78-9a-bc"

add route

Adds a route for a specified prefix. Time values can be expressed in days (d), hours (h), minutes (m), and seconds (s). For example, 2d represents two days.

Syntax

add route [prefix=]IP4Address/Integer [[interface=]String] [[nexthop=]IPv4Address] [[siteprefixlength=]Integer] [[metric=]Integer] [[validlifetime=]{Integer | infinite}] [[preferredlifetime=]{Integer | infinite}] [[store=]{active | persistent}]

Parameters

[ prefix=] IPv6Address/Integer

Required. Specifies the prefix for which to add a route. Integer specifies the prefix length.

[[ interface=] String]

Specifies an interface name or index.

[[ nexthop=] IPv6Address]

Specifies the gateway address, if the prefix is not on-link.

[[ siteprefixlength=] Integer]

Specifies the prefix length for the entire site, if the prefix is not on-link.

[[ metric=] Integer]

Specifies the route metric.

[[ validlifetime=]{ Integer| infinite}]

Specifies the lifetime over which the route is valid. The default value is infinite.

[[ preferredlifetime=]{ Integer| infinite}]

Specifies the lifetime over which the route is preferred. The default value is infinite.

[[ store=]{ active| persistent}]

Specifies whether the change lasts only until the next boot (active) or is persistent (persistent). The default selection is persistent.

Examples

This example command adds a route on the interface named "Internet".

add route 10.2.0.0/16 "Internet" 10.0.0.1

add winsserver

Adds a WINS server to a list of WINS servers for a specified interface.

Syntax

add winsserver [name=]InterfaceName [addr=] WINSAddress [[index=]WINSIndex]

Parameters

[ name=] InterfaceName

Required. Specifies the name of the interface for which you want to add WINS information. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[ addr=] WINSAddress

Required. Specifies the IP address of the WINS server to add.

[ index=] WINSIndex

Specifies the position of the added WINS server in the WINS server list for that interface.

/?

Displays help at the command prompt.

Remarks

  • A lower number for the WINSIndex parameter corresponds to a higher preference. If no index is specified, then the server is added with the lowest preference.

delete address

Deletes an IP address or a default gateway on a statically configured interface.

Syntax

delete address [name=]InterfaceName [addr=] IPAddress [[gateway=]{DefaultGateway | all}]

Parameters

[ name=] InterfaceName

Required. Specifies the name of the interface for which you want to delete address and gateway information. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[ addr=] IPAddress

Required. Specifies the IP address to delete.

[ gateway=]{ DefaultGateway| all}

Specifies whether to delete one default gateway or all default gateways. If only one default gateway should be deleted, DefaultGateway specifies the IP address of the default gateway to be deleted.

/?

Displays help at the command prompt.

Remarks

  • This command will not delete the last IP address on the interface.

delete arpcache

Removes the entries in the Address Resolution Protocol (ARP) cache for a specified interface. Used without parameters, delete arpcache removes the entries in the ARP caches of all interfaces.

Syntax

delete arpcache [name=]<InterfaceName>

Parameters

[name=]<InterfaceName>

Specifies the name of the interface for which you want to remove the ARP cache entries. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

/?

Displays help at the command prompt.

delete destinationcache

Clears the destination cache. If an interface is specified, clears the cache only on that interface. If an address is also specified, deletes only that destination cache entry.

Syntax

delete destinationcache [[interface=]String] [[address=]IPv4Address]

Parameters

[[ interface=] String]

Specifies an interface name or index.

[[ address=] IPv4Address]

Specifies the address of the destination.

Remarks

When no parameters are specified, all entries in the destination caches for all interfaces are deleted.

Examples

This example command deletes the destination cache for the interface named "Private."

delete destinationcache "Private"

delete dnsserver

Deletes a DNS server or all DNS servers from a list of DNS servers for a specified interface or for all interfaces.

Syntax

delete dnsserver [name=]InterfaceName [addr=]{DNSAddress | all}

Parameters

[ name=] InterfaceName

Required. Specifies the name of the interface for which you want to delete DNS information. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[ addr=]{ DNSAddress| all}

Required. Specifies whether to delete the address of one DNS server or all servers for all interfaces. If only one DNS server should be deleted, DNSAddress specifies the IP address of the DNS server to delete.

/?

Displays help at the command prompt.

delete neighbors

Specifies that all entries in the neighbor cache are deleted. If an interface is specified, clears the cache only on that interface. If an address is also specified, deletes only that neighbor cache entry.

Syntax

delete neighbors [[interface=]String] [[address=]IPv4Address]

Parameters

[[ interface=] String]

Specifies an interface name or index.

[[ address=] IPv4Address]

Specifies the address of the neighbor.

Examples

This example command removes all entries from the neighbor cache on the interface named "Private."

delete neighbors "Private"

delete route

Deletes an IPv4 route.

Syntax

delete route [prefix=]IPv4Address/Integer [[interface=]String] [[nexthop=]IPv4Address] [[store=]{active | persistent}]

Parameters

[ prefix=] IPv4Address/Integer

Required. Specifies the prefix of the route to delete.

[[ interface=] String]

Specifies an interface name or index.

[[ nexthop=] IPv4Address]

Specifies the gateway address, if the prefix is not on-link.

[[ store=]{ active| persistent}]

Specifies whether the deletion lasts only until the next boot (active) or is persistent (persistent). The default selection is persistent.

Examples

This example command deletes a route from the interface named "Internet."

delete route 10.2/16 "Internet" 10.0.0.1

delete winsserver

Deletes a WINS server or servers from a list of WINS servers for a specified interface or all interfaces.

Syntax

delete winsserver [name=]InterfaceName [addr=]{WINSAddress | all}

Parameters

[ name=] InterfaceName

Required. Specifies the name of the interface for which you want to delete a WINS server or servers. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[ addr=]{ WINSAddress| all}

Required. Specifies whether to delete only one server for an interface or all servers for all interfaces. If only one server should be deleted, WINSAddress specifies the IP address of the WINS server to delete.

/?

Displays help at the command prompt.

dump

Displays the current configuration as a series of Netsh Interface IP commands.

Syntax

dump

Parameters

none

Remarks

  • To create a configuration script file, redirect the output of this command to a file.

install

Installs the IPv4 protocol. A reboot is required for the installation to take effect.

Syntax

install

reset

Resets the IPv4 configuration state. A reboot is required for changes to take effect.

Syntax

reset

set address

Configures an IP address and a default gateway on a specified interface.

Syntax

set address [name=]InterfaceName [source=]{dhcp | static [addr=]IPAddress[mask=]SubnetMask [gateway=]{none | DefaultGateway [[gwmetric=]GatewayMetric]}}

Parameters

[ name =] InterfaceName

Required. Specifies the name of the interface for which you want to configure address and gateway information. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[ source=]{ dhcp| static[ addr=] IPAddress[ mask=] SubnetMask[ gateway=]{ none| DefaultGateway[[ gwmetric=] GatewayMetric]}}

Required. Specifies whether the IP address to configure originates from a Dynamic Host Configuration Protocol (DHCP) server or is static. If the address is static, IPAddress specifies the address to configure, and SubnetMask specifies the subnet mask for the IP address being configured. If the address is static, you must also specify whether you want to leave the current default gateway (if any) in place or configure one for the address. If you configure a default gateway, DefaultGateway specifies the IP address of the default gateway to be configured, and GatewayMetric specifies the metric for the default gateway to be configured.

/?

Displays help at the command prompt.

Remarks

  • You can use this command to switch an interface between DHCP configuration and static configuration. If the interface is configured statically, the Domain Name System (DNS) and WINS server addresses for this interface must also be statically configured.

  • Omitting the DefaultGateway parameter does not clear gateway configuration but preserves whatever was previously configured.

set compartment

Modifies compartment configuration parameters.

Syntax

set compartment [compartment=]<integer> [defaultcurhoplimit=]<integer>[store=]active|persistent

Parameters

[compartment=]<integer>

Specifies an interface name or index.

[defaultcurhoplimit=]<integer>[

Specifies the address of the neighbor.

[[store=]active|persistent]

One of the following values:

  • active: Address will disappear on next boot.

  • Persistent (default): Address will be persistent.

Example

set compartment compartment=1 defaultcurhoplimit=255 store=active

set dnsserver

Configures a DNS server address for a specified interface.

Syntax

set dnsserver [name=]InterfaceName [source=]{dhcp | static } [addr=]{IP Address | none} [register=]{none | primary | both}

Parameters

[ name=] InterfaceName

Required. Specifies the name of the interface for which you want to set DNS information. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[ source=]{ dhcp| static }

Required. Specifies whether the IP address of the DNS server is configured by DHCP or is static.

[ addr=]{ IP Address| none }

If the IP address is static, IP Address specifies the IP address of the DNS server to configure, and none specifies that the DNS configuration should be removed.

[ register=]{ none| primary| both }

None specifies whether to disable dynamic update. Primary registers the computer name under the primary DNS suffix only. Both register the computer name under both the primary DNS suffix as well as under the connection-specific suffix.

/?

Displays help at the command prompt.

Remarks

  • If the interface is already statically configured, the static parameter replaces the existing list of DNS server addresses with the one specified in the command.

  • Only if the [source] is static is the [addr] option available for configuring a static list of DNS server IP addresses for the specified interface.

Examples

set dnsserver name="Local Area Connection" source=dhcp

set dnsserver "Local Area Connection" static 10.0.0.1 primary

set dynamicportrange

Modifies the range of ports used for dynamic port assignment. Dynamic port assignment is also known as wildcard port assignment.

Syntax

set dynamicportrange [[protocol=]tcp|udp][startport=]<integer> [numberofports=]<integer>[[store=]active|persistent]

Parameters

[[protocol=[tcp|udp]

One of the following values:

  • TCP: Display the dynamic port range for TCP.

UDP: Display the dynamic port range for UDP.

[startport=]<integer>

Specifies the starting port for dynamic port assignment.

[numberofports=]<integer>

  • Specifies the number of ports available for dynamic port assignment.

[[store=]active|persistent]

One of the following values:

  • Active: Address will disappear on next boot.

Example

set dynamicportrange protocol=tcp startport=10000 numberofports=20000

set global

Modifies global configuration parameters.

Syntax

set global [[defaultcurhoplimit=]Integer] [[neighborcachelimit=]Integer][[routecachelimit=]Integer] [[reassemblylimit=]Integer] [[store=]{active | persistent}]

Parameters

[[defaultcurhoplimit=] Integer]

Specifies the default hop limit of packets sent.

[[neighborcachelimit=] Integer

Required. Specifies the maximum number of neighbor cache entries.

[[routecachelimit=] Integer]

Specifies the maximum number of route cache entries.

[[reassemblylimit=] Integer]

Specifies the maximum size of the reassembly buffer.

[[store=]active|persistent]

Specifies whether the change lasts only until the next boot (active) or is persistent (persistent). The default selection is persistent.

Examples

This example command sets global parameters for all IPv6-enabled interfaces on the computer. The default hop limit is set to 32, the maximum number of neighbor cache entries is set to 100, and the maximum number of route cache entries is 100,000.

set global 32 100 100000

set interface

Modifies interface configuration parameters.

Syntax

set interface [[interface=]String] [[forwarding=]{enabled | disabled}] [[advertise=]{enabled | disabled}] [[mtu=]Integer] [[siteid=]Integer] [[metric=]Integer] [[firewall=]{enabled | disabled}] [[siteprefixlength=]Integer] [[store=]{active | persistent}]

Parameters

[[ interface=] String]

Specifies an interface name or index.

[[ forwarding=]{ enabled| disabled}]

Specifies whether packets arriving on this interface can be forwarded to other interfaces. The default selection is disabled.

[[ advertise=]{ enabled| disabled}]

Specifies whether Router Advertisements are sent on this interface. The default selection is disabled.

[[ mtu=] Integer]

Specifies the Maximum Transfer Unit (MTU) of this interface. The default MTU is the natural MTU of the link.

[[ siteid=] Integer]

Specifies the site scope zone identifier.

[[ metric=] Integer]

Specifies the interface metric, which is added to route metrics for all routes over the interface.

[[ firewall=]{ enabled| disabled}]

Specifies whether to operate in firewall mode.

[[ siteprefixlength=] Integer]

Specifies the default length of the global prefix for the entire site.

[[ store=]{ active| persistent}]

Specifies whether the change lasts only until the next boot (active) or is persistent (persistent). The default selection is persistent.

Examples

This example command sets the interface with the name "Private," with a siteid of two and a metric of two. All other parameter values are left at the default values.

set interface "Private" siteid=2 metric=2

set neighbors

Sets an entry in the neighbor cache.

Syntax

set neighbors [[interface=]String] [[address=]IPv4Address] [neighbor=]<string> [[subinterface=]<string>][[store=]active|persistent]

Parameters

[[ interface=] String]

Specifies an interface name or index.

[[ address=] IPv4Address]

Specifies the address of the neighbor.

[neighbor=]<string>

Specifies the link layer address of the neighbor.

[[subinterface=]<string>]

Specifies the LUID of the subinterface. This is only needed on interfaces with multiple subinterfaces.

[[store=]active|persistent]

One of the following values:

  • active: Address will disappear on next boot.

  • Persistent (default): Address will be persistent.

Examples

This example command sets an entry to the neighbor cache on the interface named "Private."

set neighbors "Private" "10.1.1.1" "12-34-56-78-9a-bc"

set route

Modifies route parameters. Time values can be expressed in days (d), hours (h), minutes (m), and seconds (s). For example, 2d represents two days.

Syntax

set route [prefix=]IPv4Address/Integer [[interface=]String] [[nexthop=]IPv4Address] [[siteprefixlength=]Integer] [[metric=]Integer] [publish=]{no | yes | immortal}] [[validlifetime=]{Integer | infinite}] [[preferredlifetime=]{Integer | infinite}] [[store=]{active | persistent}]

Parameters

[ prefix=] IPv6Address/Integer

Required. Specifies the prefix (IPv6Address) and prefix length (Integer) of the route to modify.

[[ interface=] String]

Specifies an interface name or index.

[[ nexthop=] IPv6Address]

Specifies the gateway address, if the prefix is not on-link.

[[ siteprefixlength=] Integer]

Specifies the prefix length for the entire site, if the prefix is not on-link.

[[ metric=] Integer]

Specifies the route metric.

[[ publish=]{ no| yes| immortal}]

Specifies whether routes are advertised (yes), advertised with an infinite lifetime (immortal), or not advertised (no) in Route Advertisements. The default selection is no.

[[ validlifetime=]{ Integer| infinite}]

Specifies the lifetime over which the route is valid. The default value is infinite.

[[ preferredlifetime=]{ Integer| infinite}]

Specifies the lifetime over which the route is preferred. The default value is infinite.

[[ store=]{ active| persistent}]

Specifies whether the change lasts only until the next boot (active) or is persistent (persistent). The default selection is persistent.

Examples

This example command sets a route on the interface named "Internet."

set route 10.2.0.0/16 "Internet" 10.0.0.1 0 2 yes 5000 5000 store=active

set subinterface

Modifies subinterface configuration parameters.

Syntax

set subinterface [interface=]<string> [[mtu=]<integer>] [[subinterface=]<string>] [[store=]active|persistent]

[[ interface=] String]

Specifies an interface name or index.

[[mtu=]<integer>]

Specifies the MTU of this subinterface. The default is the natural MTU of the link.

[[subinterface=]<string>]

Specifies the subinterface LUID. This is only required on interfaces with multiple subinterfaces.

[[ store=][active|persistent]

Specifies whether active (active) or persistent (persistent) addresses are displayed. The default selection is active.

Example

set subinterface "1" mtu=1500 store=active

set winsserver

Sets WINS server configuration to either DHCP or static mode for a specified interface.

Syntax

set winsserver [name=]InterfaceName [source=]{dhcp | static [addr=]{WINSAddress | none }}

Parameters

[ name=] InterfaceName

Required. Specifies the name of the interface for which you want to set WINS information. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[ source=]{ dhcp| static[ addr=]{ WINSAddress| none}}

Required. Specifies whether the IP address of the WINS server to configure should be assigned by DHCP or is static. If the IP address is static, WINSAddress specifies the IP address of the WINS server to configure, and none specifies that the WINS configuration should be removed.

/?

Displays help at the command prompt.

Remarks

  • If the interface is already statically configured, the static parameter replaces the existing WINS server address list with the one specified in the set winsserver command.

show address

Displays information about static IP addresses and default gateways on a specified interface. Used without parameters, show address displays address information for all interfaces.

Syntax

show address [[name=]InterfaceName]

Parameters

[ name=] InterfaceName

Specifies the name of the interface for which you want to display address information. The InterfaceName must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

/?

Displays help at the command prompt.

Remarks

  • For interfaces configured using DHCP, use the ipconfig command to display the assigned IP addresses, lease parameters, and other DHCP information.

show compartments

Displays information about all compartments, or about a given compartment if one is specified.

Syntax

show compartments [compartment=]<integer> [[level=]normal|verbose] [store=]active|persistent

Parameters

[compartment=]<integer>

Specifies an interface name or index.

[[level=]normal|verbose]

One of the following values:

  • normal: Display one line per compartment (default when no compartment is specified).

  • verbose: Display extra information about each compartment( default when a compartment is specified).

[[store=]active|persistent]

One of the following values:

  • active: Address will disappear on next boot.

  • Persistent (default): Address will be persistent.

Example

show compartments

show config

Displays IP address and other configuration information for a specified interface. Used without parameters, show config displays configuration information for all interfaces.

Syntax

show config [[name=]InterfaceName]

Parameters

[ name=] InterfaceName

Specifies the name of the interface for which you want to display configuration information. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

/?

Displays help at the command prompt.

show destinationcache

Displays destination cache entries. If an interface is specified, displays the cache only on that interface. If an address is also specified, displays only that destination cache entry.

Syntax

show destinationcache [[interface=]String] [[address=]IPv4Address]

Parameters

[[ interface=] String]

Specifies an interface name or index.

[[ address=] IPv4Address]

Specifies the address of the destination.

show dnsservers

Displays the DNS configuration of a specified interface. Used without parameters, show dnsservers displays the DNS configurations of all interfaces.

Syntax

show dnsservers [[name=]InterfaceName]

Parameters

[ name=] InterfaceName

Specifies the name of the interface whose DNS configuration you want to display. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

/?

Displays help at the command prompt.

show dynamicportrange

Displays dynamic port range configuration parameters.

Syntax

show dynamicportrange [[protocol=]tcp|udp] [[store=]active|persistent]

Parameters

[[protocol=[tcp|udp]

One of the following values:

  • TCP: Show the dynamic port range for TCP.

  • UDP: Show the dynamic port range for UDP.

[[store=]active|persistent]

One of the following values:

  • Active: Address will disappear on next boot.

  • Persistent (default): Address will be persistent.

Example

show dynamicportrange

show global

Displays global configuration parameters.

Syntax

show global [[store=]{active | persistent}]

Parameters

[[ store=]{ active| persistent}]

Specifies whether active (active) or persistent (persistent) information is displayed. The default selection is active.

show icmpstats

Displays ICMP statistics. Used without parameters, show icmp displays the statistics only once.

Syntax

show icmpstats [[rr=]RefreshRate]

Parameters

[ rr=] RefreshRate

Specifies the refresh rate (the number of seconds between refreshing the display of the statistics).

/?

Displays help at the command prompt.

show interfaces

Displays statistics for a specified interface. Used without parameters, show interfaces displays statistics for all interfaces only once.

Syntax

show interfaces [[index=]InterfaceIndex] [[rr=]RefreshRate]

Parameters

[ index=] InterfaceIndex

Specifies the interface index, an integer that identifies the interface.

[ rr=] RefreshRate

Specifies the refresh rate (the number of seconds between refreshing the display of the statistics).

/?

Displays help at the command prompt.

Remarks

  • To obtain the interface index for an interface, review the output of the show interfaces command used without parameters.

show ipaddresses

Displays information for a specified IP address. Used without parameters, show ipaddresses displays information for all IP addresses on all interfaces once.

Syntax

show ipaddresses [[index=]IPAddress] [[rr=]RefreshRate]

Parameters

[ index=] IPAddress

Specifies an IP address of an interface.

[ rr=] RefreshRate

Specifies the refresh rate (the number of seconds between refreshing the display of the statistics).

/?

Displays help at the command prompt.

Remarks

  • To obtain the IP addresses of all interfaces, review the display of the show ipaddresses command used without parameters.

show ipnettomedia

Displays the contents of the Address Resolution Protocol (ARP) cache, which contains the hardware addresses of resolved next-hop IP addresses. Used without parameters, show ipnettomedia displays the information once.

Syntax

show ipnettomedia [[rr=]RefreshRate]

Parameters

[ rr=] RefreshRate

Specifies the refresh rate (the number of seconds between refreshing the display of the statistics).

/?

Displays help at the command prompt.

show ipstats

Displays IP statistics. Used without parameters, show ipstats displays the statistics once.

Syntax

show ipstats [[rr=]RefreshRate]

Parameters

[ rr=] RefreshRate

Specifies the refresh rate (the number of seconds between refreshing the display of the statistics).

/?

Displays help at the command prompt.

show joins

Displays IP multicast groups that have been joined for the specified IP address. Used without parameters, show joins displays information for all IP addresses.

Syntax

show joins [[index=]IPAddress]

Parameters

[ index=] IPAddress

Specifies an IP address of an interface.

/?

Displays help at the command prompt.

Remarks

  • To obtain the IP addresses for all interfaces, review the display of the show ipaddress command used without parameters.

show neighbors

Displays neighbor cache entries. If an interface is specified, the command displays the cache only on that interface. If a subinterface is also specified, the command shows only the cache for that subinterface. If an address is specified as well, the command displays only that specific neighbor cache entry.

Syntax

show neighbors [[interface=]String] [[address=]IPv4Address] [neighbor=]<string> [[subinterface=]<string>][[store=]active|persistent] [[level=]normal|verbose]

Parameters

[[ interface=] String]

Specifies an interface name or index.

[[ address=] IP4Address]

Specifies the address of the neighbor.

[[subinterface=]<string>]

Specifies the LUID of the subinterface. This is only needed on interfaces with multiple subinterfaces.

[[store=]active|persistent]

One of the following values:

  • active: Address will disappear on next boot.

  • Persistent (default): Address will be persistent.

[[level=]normal|verbose]

One of the following values:

  • normal: Display one line per subinterface (default when no subinterface is specified).

  • verbose: Display extra information on each subinterface. (default when a subinterface is specified).

Example

show neighbors

show offload

Displays the tasks that can be performed by the network adapter for the specified interface corresponding to installed network hardware. Used without parameters, show offload displays offload information for all interfaces corresponding to installed network hardware.

Syntax

show offload [[name=]InterfaceName ]

Parameters

[ name=] InterfaceName

Specifies the name of the interface for which you want to display offload information. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

/?

Displays help at the command prompt.

show route

Displays route table entries.

Syntax

show route [[level=]normal | verbose] [[store=]active | persistent]

Parameters

[[ level=] normal| verbose]

Specifies whether only normal routes (normal) or routes used for loopback (verbose) are displayed. The default selection is normal.

[[ store=]active| persistent]

Specifies whether active (active) or persistent (persistent) routes are displayed. The default selection is active.

show subinterfaces

Displays information about all subinterfaces, or about all subinterfaces on a given interface if one is specified.

Syntax

show subinterfaces [interface=]<string> [[ level=]normal| verbose] [[subinterface=]<string>] [[store=]active|persistent]

[[ interface=] String]

Specifies an interface name or index.

[[ level=]normal|verbose]

Specifies whether only normal routes (normal) or routes used for loopback (verbose) are displayed. The default selection is normal.

[[subinterface=]<string>]

Specifies the subinterface LUID. This is only required on interfaces with multiple subinterfaces.

[[ store=][active|persistent]

Specifies whether active (active) or persistent (persistent) addresses are displayed. The default selection is active.

Example

show subinterfaces

show tcpconnections

Displays information on a specified TCP connection. Used without parameters, show tcpconnections displays information for all TCP connections once.

Syntax

show tcpconnections [[index=]{LocalIPAddress | LocalPort | RemoteIPAddress | RemotePort}] [[rr=]RefreshRate]

Parameters

[ index=]{ LocalIPAddress| LocalPort| RemoteIPAddress| RemotePort}

Specifies the connection about which to display information. The LocalIPAddress parameter specifies an IP address of an interface. The LocalPort parameter specifies a TCP port for a local process. The RemoteIPAddress parameter specifies an IP address of a remote host. The RemotePort parameter specifies a TCP port for a remote process.

[ rr=] RefreshRate

Specifies the refresh rate (the number of seconds between refreshing the display of the information).

/?

Displays help at the command prompt.

show tcpstats

Displays TCP statistics. Used without parameters, show tcpstats displays the statistics once.

Syntax

show tcpstats [[rr=]RefreshRate]

Parameters

[ rr=] RefreshRate

Specifies the refresh rate (the number of seconds between refreshing the display of the statistics).

/?

Displays help at the command prompt.

show udpconnections

Displays information about the (User Datagram Protocol) UDP ports used for each IP address. Used without parameters, show udpconnections displays UDP port information for all IP addresses once.

Syntax

show udpconnections [[index=]{LocalIPAddress | LocalPort}] [[rr=]RefreshRate]

Parameters

[ index=]{ LocalIPAddress| LocalPort}

Specifies the connection about which to display information. The LocalIPAddress parameter specifies an IP address of an interface. The LocalPort parameter specifies a UDP port for a local process.

[ rr=] RefreshRate

Specifies the refresh rate (the number of seconds between refreshing the display of the statistics).

/?

Displays help at the command prompt.

show udpstats

Displays UDP statistics. Used without parameters, show udpstats displays the statistics once.

Syntax

show udpstats [[rr=]RefreshRate]

Parameters

[ rr=] RefreshRate

Specifies the refresh rate (the number of seconds between refreshing the display of the statistics).

/?

Displays help at the command prompt.

show winsservers

Displays the WINS configuration for a specified interface. Used without parameters, show winsservers displays the WINS configuration for all interfaces.

Syntax

show winsservers [[name=]InterfaceName]

Parameters

[ name=] InterfaceName

Specifies the name of the interface whose WINS information you want to display. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

/?

Displays help at the command prompt.

Netsh Interface IP example

The following command configures the interface named Local Area Connection with the static IP address 10.0.5.99, the subnet mask of 255.255.255.0, and a default gateway of 10.0.5.1:

set address name="Local Area Connection" source=static addr=10.0.5.99 mask=255.255.255.0 gateway=10.0.5.1 gwmetric=1

For information on how to interpret netsh command syntax, see Formatting Legend.


Netsh commands for Interface Internet Protocol version 6 (IPv6)

Netsh commands for Interface IPv6

The Netsh commands for Interface IPv6 provide a command-line tool that you can use to query and configure IPv6 interfaces, address, caches, and routes.

In addition, the Interface IPv6 context of netsh has a subcontext for 6to4. You can use the commands in the netsh interface IPv6 6to4 context to configure or display the configuration of the 6to4 service on either a 6to4 host or a 6to4 router.

You can run these commands at the command prompt for the netsh interface ipv6 context. For these commands to work at the command, you must type netsh interface ipv6 before typing commands and parameters as they appear in the syntax below. To view help for a command at the command prompt, type CommandName/?, where CommandName is the name of the command.

For more information about netsh, see Netsh Overviewand Enter a Netsh Context.

To view the command syntax, click a command:

  • 6to4

  • add 6over4tunnel

  • add address

  • add dnsserver

  • add neighbors

  • add potentialrouter

  • add prefixpolicy

  • add route

  • add v6v4tunnel

  • delete address

  • delete destinationcache

  • delete dnsserver

  • delete interface

  • delete neighbors

  • delete potentialrouter

  • delete prefixpolicy

  • delete route

  • dump

  • isatap

  • reset

  • set address

  • set compartment

  • set dnsserver

  • set dynamicportrange

  • set global

  • set interface

  • set neighbors

  • set prefixpolicy

  • set privacy

  • set route

  • set state

  • set subinterface

  • set teredo

  • show address

  • show compartments

  • show destinationcache

  • show dnsservers

  • show dynamicportrange

  • show global

  • show interfaces

  • show ipstats

  • show joins

  • show neighbors

  • show offload

  • show potentialrouters

  • show prefixpolicies

  • show privacy

  • show route

  • show siteprefixes

  • show subinterfaces

  • show tcpstats

  • show teredo

  • show udpstats

6to4

Specifies that the 6to4 context of netsh interface IPv6 6to4 is used.

Syntax

6to4

add 6over4tunnel

Creates a 6over4 interface by using the specified IPv4 address.

Syntax

add 6over4tunnel [[interface=]String] [localaddress=]IPv4Address [[store=]{active | persistent}]

Parameters

[[ interface=] String]

Specifies an interface name or index.

[ localaddress=] IPv4Address

Required. Specifies the IPv4 address that is encapsulated.

[[ store=]{ active| persistent}]

Specifies whether the change lasts only until the next boot (active) or is persistent (persistent). The default selection is persistent.

Examples

This example command creates a 6over4 interface by using the IPv4 address 10.1.1.1 on the interface named "Private."

add 6over4tunnel "Private" 10.1.1.1

add address

Adds an IPv6 address to a specified interface. Time values can be expressed in days (d), hours (h), minutes (m), and seconds (s). For example, 2d represents two days.

Syntax

add address [[interface=]String] [address=]IPv6Address [[type=]{unicast | anycast}] [[validlifetime=]{Integer | infinite}] [[preferredlifetime=]{Integer | infinite}] [[store=]{active | persistent}]

Parameters

[[ interface=] String]

Specifies an interface name or index.

[ address=] IPv6Address

Required. Specifies the IPv6 address to add.

[[ type=]{ unicast| anycast}]

Specifies whether a unicast address (unicast) or an anycast address (anycast) is added. The default selection is unicast.

[[ validlifetime=]{ Integer| infinite}]

Specifies the lifetime over which the address is valid. The default value is infinite.

[[ preferredlifetime=]{ Integer| infinite}]

Specifies the lifetime over which the address is preferred. The default value is infinite.

[[ store=]{ active| persistent}]

Specifies whether the change lasts only until the next boot (active) or is persistent (persistent). The default selection is persistent.

Examples

This example command adds the IPv6 address FE80::2 to the interface named "Private."

add address "Private" FE80::2

add dnsserver

Adds a new DNS server IP address to the statically-configured list of DNS servers for the specified interface.

Syntax

add dnsserver [interface=]String [address=]IPAddress [[index=]Integer]

Parameters

[ interface=] String

Required. Specifies, by name, which interface will have a DNS server IP address added to its list of DNS server IP addresses.

[ address=] IPAddress

Required. Specifies the IPv6 address of the DNS server to add to the list.

[[ index=] Integer]

Specifies the position on the statically-configured list in which to place the DNS server IP address specified in address. By default, the DNS server IP address is added to the end of the list.

Remarks

If an index is specified, the Domain Name System (DNS) server is placed in that position in the list.

Examples

In the first example command, a DNS server with the IPv6 address FEC0:0:0:FFFF::1 is added to the list of DNS server IP addresses for the interface named "Local Area Connection." In the second example, a DNS server with the IPv6 address FEC0:0:0:FFFF::2 is added at index 2 as the second server on the list of servers for the interface named "Local Area Connection."

add dnsserver "Local Area Connection" FEC0:0:0:FFFF::1

add dnserver "Local Area Connection" FEC0:0:0:FFFF::2 index=2

add neighbors

Specifies an entry in the neighbor cache.

Syntax

add neighbors [[interface=]String] [[address=]IPv4Address] [neighbor=]<string> [[subinterface=]<string>]

Parameters

[[ interface=] String]

Specifies an interface name or index.

[[ address=] IPv4Address]

Specifies the address of the neighbor.

[neighbor=]<string>

Specifies the link layer address of the neighbor.

[[subinterface=]<string>]

Specifies the LUID of the subinterface. This is only needed on interfaces with multiple subinterfaces.

[[store=]active|persistent]

One of the following values:

  • active: Address will disappear on next boot.

  • Persistent (default): Address will be persistent.

Examples

This example command adds an entry to the neighbor cache on the interface named "Private."

add neighbors "Private" "3f::2" "12-34-56-78-9a-bc"

add potentialrouter

Adds a potential router to a given interface.

Syntax

add potentialrouter [interface=]<string> [[address=]<IPv6 address>]

Parameters

[[ interface=] String]

Specifies an interface name or index.

[[ address=] IPv6Address]

Specifies the address of the potential router.

add prefixpolicy

Adds a source and destination address selection policy for a specified prefix.

Syntax

add prefixpolicy [prefix=]IPv6Address/Integer [precedence=]Integer [label=]Integer [[store=]{active | persistent}]

Parameters

[ prefix=] IPv6Address/Integer

Required. Specifies the prefix for which to add a policy in the policy table. Integer specifies the prefix length.

[ precedence=] Integer

Required. Specifies the precedence value used for sorting destination addresses in the policy table.

[ label=] Integer

Required. Specifies the label value that allows for policies that require a specific source address prefix for use with a destination address prefix.

[[ store=]{ active| persistent}]

Specifies whether the change lasts only until the next boot (active) or is persistent (persistent). The default selection is persistent.

Examples

This example command adds a prefix policy for prefix ::/96, with a precedence value of three and a label value of four.

add prefixpolicy ::/96 3 4

add route

Adds a route for a specified prefix. Time values can be expressed in days (d), hours (h), minutes (m), and seconds (s). For example, 2d represents two days.

Syntax

add route [prefix=]IPv6Address/Integer [[interface=]String] [[nexthop=]IPv6Address] [[siteprefixlength=]Integer] [[metric=]Integer] [[publish=]{no | yes | immortal}] [[validlifetime=]{Integer | infinite}] [[preferredlifetime=]{Integer | infinite}] [[store=]{active | persistent}]

Parameters

[ prefix=] IPv6Address/Integer

Required. Specifies the prefix for which to add a route. Integer specifies the prefix length.

[[ interface=] String]

Specifies an interface name or index.

[[ nexthop=] IPv6Address]

Specifies the gateway address, if the prefix is not on-link.

[[ siteprefixlength=] Integer]

Specifies the prefix length for the entire site, if the prefix is not on-link.

[[ metric=] Integer]

Specifies the route metric.

[[ publish=]{ no| yes| immortal}]

Specifies whether routes are advertised (yes), advertised with an infinite lifetime (immortal), or not advertised (no) in Route Advertisements. The default selection is no.

[[ validlifetime=]{ Integer| infinite}]

Specifies the lifetime over which the route is valid. The default value is infinite.

[[ preferredlifetime=]{ Integer| infinite}]

Specifies the lifetime over which the route is preferred. The default value is infinite.

[[ store=]{ active| persistent}]

Specifies whether the change lasts only until the next boot (active) or is persistent (persistent). The default selection is persistent.

Examples

This example command adds a route on the interface named "Internet" with a prefix of 3FFE:: and a prefix length of 16 bits (3FFE::/16). The nexthop value is FE80::1.

add route 3FFE::/16 "Internet" FE80::1

add v6v4tunnel

Creates an IPv6-in-IPv4 tunnel.

Syntax

add v6v4tunnel [[interface=]String] [localaddress=]IPv4Address [remoteaddress=]IPv4Address [[neighbordiscovery=]{enabled | disabled}] [[store=]{active | persistent}]

Parameters

[[ interface=] String]

Specifies an interface name or index.

[ localaddress=] IPv4Address

Required. Specifies the IPv4 address of the local tunnel endpoint.

[ remoteaddress=] IPv4Address

Required. Specifies the IPv4 address of the remote tunnel endpoint.

[[ neighbordiscovery=]{ enabled| disabled}]

Specifies whether Neighbor Discovery is enabled (enabled) or disabled (disabled) on the interface. The default selection is disabled.

[[ store=]{ active| persistent}]

Specifies whether the change lasts only until the next boot (active) or is persistent (persistent). The default selection is persistent.

Examples

This example command creates an IPv6-in-IPv4 tunnel between the local address 10.0.0.1 and the remote address 192.168.1.1 on the interface "Private."

add v6v4tunnel "Private" 10.0.0.1 192.168.1.1

delete address

Syntax

delete address [[interface=]String] [address=]IPv6Address [[store=]{active | persistent}]

Modifies an IPv6 address on a specified interface.

Parameters

[[ interface=] String]

Specifies an interface name or index.

[ address=] IPv6Address

Required. Specifies the IPv6 address to delete.

[[ store=]{ active| persistent}]

Specifies whether the deletion lasts only until the next boot (active) or is persistent (persistent). The default selection is persistent.

Examples

This example command deletes the address FE80::2 from the interface named "Private."

delete address "Private" FE80::2

delete destinationcache

Clears the destination cache. If an interface is specified, clears the cache only on that interface. If an address is also specified, deletes only that destination cache entry.

Syntax

delete destinationcache [[interface=]String] [[address=]IPv6Address]

Parameters

[[ interface=] String]

Specifies an interface name or index.

[[ address=] IPv6Address]

Specifies the address of the destination.

Remarks

When no parameters are specified, all entries in the destination caches for all interfaces are deleted.

Examples

This example command deletes the destination cache for the interface named "Private."

delete destinationcache "Private"

delete dnsserver

Deletes statically configured DNS server IPv6 addresses for a specific interface.

Syntax

delete dnsserver [interface=]String [[address=]{IPv6Address | all}]

Parameters

[ interface=] String

Required. Specifies the interface, by name, for which you want to remove a DNS server from the list of DNS servers.

[[ address=]{ IPv6Address| all}]

Specifies the DNS server IPv6 address to delete. If all is specified, all DNS server IPv6 addresses on the list for the interface are deleted.

Examples

In the first example command, the DNS server IPv6 address FEC0:0:0:FFFF::1 is deleted from the list of addresses for the connection named "Local Area Connection." In the second example command, all DNS server IPv6 addresses are deleted for the connection named "Local Area Connection."

delete dnsserver "Local Area Connection" FEC0:0:0:FFFF::1

delete dnsserver "Local Area Connection" all

delete interface

Deletes a specified interface from the IPv6 stack.

Syntax

delete interface [[interface=]String] [[store=]{active | persistent}]

Parameters

[[ interface=] String]

Specifies an interface name or index.

[[ store=]{ active| persistent}]

Specifies whether the deletion lasts only until the next boot (active) or is persistent (persistent). The default selection is persistent.

Examples

This example command deletes the interface named "Private."

delete interface "Private"

delete neighbors

Specifies that all entries in the neighbor cache are deleted. If an interface is specified, clears the cache only on that interface. If an address is also specified, deletes only that neighbor cache entry.

Syntax

delete neighbors [[interface=]String] [[address=]IPv6Address]

Parameters

[[ interface=] String]

Specifies an interface name or index.

[[ address=] IPv6Address]

Specifies the address of the neighbor.

Examples

This example command removes all entries from the neighbor cache on the interface named "Private."

delete neighbors "Private"

delete potentialrouter

Delete a potential router from a given interface.

Syntax

delete potentialrouter [interface=]<string> [[address=]<IPv6 address>]

Parameters

[[ interface=] String]

Specifies an interface name or index.

[[ address=] IPv6Address]

Specifies the address of the potential router.

delete prefixpolicy

Deletes the source and destination address selection policy for a specified prefix.

Syntax

delete prefixpolicy [prefix=]IPv6Address/Integer [[store=]{active | persistent}]

Parameters

[ prefix=] IPv6Address/Integer

Required. Specifies the prefix (IPv6Address) and prefix length (Integer) to delete from the policy table.

[[ store=]{ active| persistent}]

Specifies whether the deletion lasts only until the next boot (active) or is persistent (persistent). The default selection is persistent.

Examples

This example command deletes the prefix ::/96 from the policy table.

delete prefixpolicy ::/96

delete route

Deletes an IPv6 route.

Syntax

delete route [prefix=]IPv6Address/Integer [[interface=]String] [[nexthop=]IPv6Address] [[store=]{active | persistent}]

Parameters

[ prefix=] IPv6Address/Integer

Required. Specifies the prefix of the route to delete.

[[ interface=] String]

Specifies an interface name or index.

[[ nexthop=] IPv6Address]

Specifies the gateway address, if the prefix is not on-link.

[[ store=]{ active| persistent}]

Specifies whether the deletion lasts only until the next boot (active) or is persistent (persistent). The default selection is persistent.

Examples

This example command deletes the route with the prefix 3FFE::/16 and the gateway FE80::1 from the interface named "Internet."

delete route 3FFE::/16 "Internet" FE80::1

dump

Dumps the network adapter IPv6 configuration to the command prompt window when run within the netsh context. When used in a batch file or script, output can be saved in a text file.

Syntax

netsh interface ipv6 dump > [PathAndFileName]

Parameters

[ PathAndFileName]

Specifies both the location where to the file is saved and the name of the destination file to which the configuration is saved.

Remarks

  • After file output is obtained, you can use the netsh exec command to either configure another computer with the same IPv6 configuration or to restore the original configuration on the same computer.

  • All IPv6 configuration information is saved with the dump command. For example, if an ISATAP or a 6to4 configuration is defined on an interface, the dump command saves these settings in the text file.

Examples

In the first example, the command is run manually at the netsh interface ipv6 context of a command prompt. The IPv6 configuration is displayed in the command prompt window, and can be copied and pasted into a text file. In the second example, the dump command is run in a batch file, and the configuration is saved to a text file named Ipv6_conf.txt at the location C:\Temp.

dump

netsh interface ipv6 dump > C:\temp\ipv6_conf.txt

isatap

Specifies that the isatap context of netsh interface IPv6 isatap is used.

Syntax

isatap

Remarks

  • Intrasite Automatic Tunnel Addressing Protocol (ISATAP) is used for communication between IPv6 and IPv4 nodes within an IPv4 site. It is described in the Internet draft titled "Intra-Site Automatic Tunnel Addressing Protocol (ISATAP)" (draft-ietf-ngtrans-isatap-00.txt).

reset

Resets the IPv6 configuration state.

Syntax

reset

set address

Modifies an IPv6 address on a specified interface. Time values can be expressed in days (d), hours (h), minutes (m), and seconds (s). For example, 2d represents two days.

Syntax

set address [[interface=]String] [address=]IPv6Address [[type=]{unicast | anycast}] [[validlifetime=]{Integer | infinite}] [[preferredlifetime=]{Integer | infinite}] [[store=]{active | persistent}]

Parameters

[[ interface=] String]

Specifies an interface name or index.

[ address=] IPv6Address

Required. Specifies the IPv6 address to modify.

[[ type=]{ unicast| anycast}]

Specifies whether the address is marked as a unicast address (unicast) or as an anycast address (anycast). The default selection is unicast.

[[ validlifetime=]{ Integer| infinite}]

Specifies the lifetime over which the address is valid. The default value is infinite.

[[ preferredlifetime=]{ Integer| infinite}]

Specifies the lifetime over which the address is preferred. The default value is infinite.

[[ store=]{ active| persistent}]

Specifies whether the change lasts only until the next boot (active) or is persistent (persistent). The default selection is persistent.

Examples

This example command sets the address FE80::2 on the interface named "Private" as an anycast address.

set address "Private" FE80::2 anycast

set compartment

Modifies compartment configuration parameters.

Syntax

set compartment [compartment=]<integer> [defaultcurhoplimit=]<integer>[store=]active|persistent

Parameters

[compartment=]<integer>

Specifies an interface name or index.

[defaultcurhoplimit=]<integer>[

Specifies the address of the neighbor.

[[store=]active|persistent]

One of the following values:

  • active: Address will disappear on next boot.

  • Persistent (default): Address will be persistent.

Example

set compartment compartment=1 defaultcurhoplimit=255 store=active

set dnsserver

Configures a DNS server address for a specified interface.

Syntax

set dnsserver [name=]InterfaceName [source=]{dhcp | static } [addr=]{IP Address | none} [register=]{none | primary | both}

Parameters

[ name=] InterfaceName

Required. Specifies the name of the interface for which you want to set DNS information. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[ source=]{ dhcp| static }

Required. Specifies whether the IP address of the DNS server is configured by DHCP or is static.

[ addr=]{ IP Address| none }

If the IP address is static, IP Address specifies the IP address of the DNS server to configure, and none specifies that the DNS configuration should be removed.

[ register=]{ none| primary| both }

None specifies whether to disable dynamic update. Primary registers the computer name under the primary DNS suffix only. Both register the computer name under both the primary DNS suffix as well as under the connection-specific suffix.

/?

Displays help at the command prompt.

Remarks

  • If the interface is already statically configured, the static parameter replaces the existing list of DNS server addresses with the one specified in the command.

  • Only if the [source] is static is the [addr] option available for configuring a static list of DNS server IP addresses for the specified interface.

Examples

set dnsserver name="Local Area Connection" source=dhcp

set dnsserver "Local Area Connection" static fec0:0:0:ffff::1 primary

set dynamicportrange

Modifies the range of ports used for dynamic port assignment. Dynamic port assignment is also known as wildcard port assignment.

Syntax

set dynamicportrange [[protocol=]tcp|udp][startport=]<integer> [numberofports=]<integer>[[store=]active|persistent]

Parameters

[[protocol=[tcp|udp]

One of the following values:

  • TCP: Display the dynamic port range for TCP.

UDP: Display the dynamic port range for UDP.

[startport=]<integer>

Specifies the starting port for dynamic port assignment.

[numberofports=]<integer>

  • Specifies the number of ports available for dynamic port assignment.

[[store=]active|persistent]

One of the following values:

  • Active: Address will disappear on next boot.

Example

set dynamicportrange protocol=tcp startport=10000 numberofports=20000

set global

Modifies global configuration parameters.

Syntax

set global [[defaultcurhoplimit=]Integer] [neighborcachelimit=]Integer [[routecachelimit=]Integer] [[reassemblylimit=]Integer] [[store=]{active | persistent}]

Parameters

[[ defaultcurhoplimit=] Integer]

Specifies the default hop limit of packets sent.

[ neighborcachelimit=] Integer

Required. Specifies the maximum number of neighbor cache entries.

[[ routecachelimit=] Integer]

Specifies the maximum number of route cache entries.

[[ reassemblylimit=] Integer]

Specifies the maximum size of the reassembly buffer.

[[ store=]{ active| persistent}]

Specifies whether the change lasts only until the next boot (active) or is persistent (persistent). The default selection is persistent.

Examples

This example command sets global parameters for all IPv6-enabled interfaces on the computer. The default hop limit is set to 32, the maximum number of neighbor cache entries is set to 100, and the maximum number of route cache entries is 100,000.

set global 32 100 100000

set interface

Modifies interface configuration parameters.

Syntax

set interface [[interface=]String] [[forwarding=]{enabled | disabled}] [[advertise=]{enabled | disabled}] [[mtu=]Integer] [[siteid=]Integer] [[metric=]Integer] [[firewall=]{enabled | disabled}] [[siteprefixlength=]Integer] [[store=]{active | persistent}]

Parameters

[[ interface=] String]

Specifies an interface name or index.

[[ forwarding=]{ enabled| disabled}]

Specifies whether packets arriving on this interface can be forwarded to other interfaces. The default selection is disabled.

[[ advertise=]{ enabled| disabled}]

Specifies whether Router Advertisements are sent on this interface. The default selection is disabled.

[[ mtu=] Integer]

Specifies the Maximum Transfer Unit (MTU) of this interface. The default MTU is the natural MTU of the link.

[[ siteid=] Integer]

Specifies the site scope zone identifier.

[[ metric=] Integer]

Specifies the interface metric, which is added to route metrics for all routes over the interface.

[[ firewall=]{ enabled| disabled}]

The Firewall can no longer be configured from Netsh. The value specified is ignored.

[[ siteprefixlength=] Integer]

Specifies the default length of the global prefix for the entire site.

[[ store=]{ active| persistent}]

Specifies whether the change lasts only until the next boot (active) or is persistent (persistent). The default selection is persistent.

Examples

This example command sets the interface with the name "Private," with a siteid of two and a metric of two. All other parameter values are left at the default values.

set interface "Private" siteid=2 metric=2

set neighbors

Sets an entry in the neighbor cache.

Syntax

set neighbors [[interface=]String] [[address=]IPv6Address] [neighbor=]<string> [[subinterface=]<string>][[store=]active|persistent]

Parameters

[[ interface=] String]

Specifies an interface name or index.

[[ address=] IPv6Address]

Specifies the address of the neighbor.

[neighbor=]<string>

Specifies the link layer address of the neighbor.

[[subinterface=]<string>]

Specifies the LUID of the subinterface. This is only needed on interfaces with multiple subinterfaces.

[[store=]active|persistent]

One of the following values:

  • active: Address will disappear on next boot.

  • Persistent (default): Address will be persistent.

Examples

This example command sets an entry to the neighbor cache on the interface named "Private."

set neighbors "Private" "fec0::2" "12-34-56-78-9a-bc"

set prefixpolicy

Modifies a source and destination address selection policy for a specified prefix.

Syntax

set prefixpolicy [prefix=]IPv6Address/Integer [precedence=]Integer [label=]Integer [[store=]{active | persistent}]

Parameters

[ prefix=] IPv6Address/Integer

Required. Specifies the prefix for which to add a policy in the policy table. Integer specifies the prefix length.

[ precedence=] Integer

Required. Specifies the precedence value used for sorting destination addresses in the policy table.

[ label=] Integer

Required. Specifies the label value that allows for policies that require a specific source address prefix for use with a destination address prefix.

[[ store=]{ active| persistent}]

Specifies whether the change lasts only until the next boot (active) or is persistent (persistent). The default selection is persistent.

Examples

This example command sets a policy in the policy table for the prefix ::/96, with a precedence value of three and a label value of four.

set prefixpolicy ::/96 3 4

set privacy

Modifies parameters related to temporary address generation. If randomtime= is specified, maxrandomtime= is not used. Time values can be expressed in days (d), hours (h), minutes (m), and seconds (s). For example, 2d represents two days.

Syntax

set privacy [[state=]{enabled | disabled}] [[maxdadattempts=]Integer] [[maxvalidlifetime=]Integer] [[maxpreferredlifetime=]Integer] [[regeneratetime=]Integer] [[maxrandomtime=]Integer] [[randomtime=]Integer] [[store=]{active | persistent}]

Parameters

[[ state=]{ enabled| disabled}]

Specifies whether temporary addresses are enabled.

[[ maxdadattempts=] Integer]

Specifies the number of duplicate address detection attempts made. The default value is five.

[[ maxvalidlifetime=] Integer]

Specifies the maximum lifetime over which a temporary address is valid. The default value is 7d (seven days).

[[ maxpreferredlifetime=] Integer]

Specifies the maximum lifetime over which an anonymous is preferred. The default value is 1d (one day).

[[ regeneratetime=] Integer]

Specifies the duration of time that elapses when a new address is generated prior to deprecating a temporary address. The default value is 5s (five seconds).

[[ maxrandomtime=] Integer]

Specifies the upper limit to use when computing a random delay at boot. The default value is 10m (10 minutes).

[[ randomtime=] Integer]

Specifies a time value to use, instead of a value generated at boot.

[[ store=]{ active| persistent}]

Specifies whether the change lasts only until the next boot (active) or is persistent (persistent). The default selection is persistent.

set route

Modifies route parameters. Time values can be expressed in days (d), hours (h), minutes (m), and seconds (s). For example, 2d represents two days.

Syntax

set route [prefix=]IPv6Address/Integer [[interface=]String] [[nexthop=]IPv6Address] [[siteprefixlength=]Integer] [[metric=]Integer] [publish=]{no | yes | immortal}] [[validlifetime=]{Integer | infinite}] [[preferredlifetime=]{Integer | infinite}] [[store=]{active | persistent}]

Parameters

[ prefix=] IPv6Address/Integer

Required. Specifies the prefix (IPv6Address) and prefix length (Integer) of the route to modify.

[[ interface=] String]

Specifies an interface name or index.

[[ nexthop=] IPv6Address]

Specifies the gateway address, if the prefix is not on-link.

[[ siteprefixlength=] Integer]

Specifies the prefix length for the entire site, if the prefix is not on-link.

[[ metric=] Integer]

Specifies the route metric.

[[ publish=]{ no| yes| immortal}]

Specifies whether routes are advertised (yes), advertised with an infinite lifetime (immortal), or not advertised (no) in Route Advertisements. The default selection is no.

[[ validlifetime=]{ Integer| infinite}]

Specifies the lifetime over which the route is valid. The default value is infinite.

[[ preferredlifetime=]{ Integer| infinite}]

Specifies the lifetime over which the route is preferred. The default value is infinite.

[[ store=]{ active| persistent}]

Specifies whether the change lasts only until the next boot (active) or is persistent (persistent). The default selection is persistent.

Examples

This example command sets a route on the interface named "Internet." The route prefix is 3FFE::, and has a length of 16 bits. The gateway address, defined by the nexthop= parameter, is FE80::1.

set route 3FFE::/16 "Internet" FE80::1

set state

Enables or disables IPv4 compatibility. The default value for all parameters is disabled.

Syntax

set state [[6over4=]{enabled | disabled | default}] [[v4compat=]{enabled | disabled | default}]

Parameters

[[6over4=]{enabled| disabled| default}]

Specifies whether 6over4 interfaces are created. To both disable and delete 6over4 compatible interfaces, specify default. To disable 6over4 compatible interfaces without deleting them, specify disabled.

[[ v4compat=]{ enabled| disabled| default}]

Specifies whether IPv4 compatible interfaces are created. To both disable and delete IPv4 compatible interfaces, specify default. To disable IPv4 compatible interfaces without deleting them, specify disabled.

Examples

In the first example command, IPv4-compatible addresses are disabled, and any previously existing interfaces are deleted. In the second example command, IPv4-compatible addresses are enabled.

set state default

set state 6over4=disabled v4compat=enabled

set subinterface

Modifies subinterface configuration parameters.

Syntax

set subinterface [interface=]<string> [[mtu=]<integer>] [[subinterface=]<string>] [[store=]active|persistent]

Parameters

[[ interface=] String]

Specifies an interface name or index.

[[mtu=]<integer>]

Specifies the MTU of this subinterface. The default is the natural MTU of the link.

[[subinterface=]<string>]

Specifies the subinterface LUID. This is only required on interfaces with multiple subinterfaces.

[[ store=][active|persistent]

Specifies whether active (active) or persistent (persistent) addresses are displayed. The default selection is active.

Example

set subinterface "1" mtu=1500 store=active

set teredo

Sets the Teredo state. A 'default' argument to a parameter sets it to the system default.

Syntax

set teredo [[type]=disabled|client|enterpriseclient|default][[servername=]<hostname>|<IPv4 address>|default][[refreshinterval=]<integer>|default][[clientport=]<integer>|default][[supernode=]<hostname>|<IPv4 address>|default]

Parameters

[[type]=disabled|client|enterpriseclient|default]

One of the following values:

  • Disabled: Disables the Teredo service.

  • Client: Enables the Teredo client.

  • Enterpriseclient: Skip managed network detection.

[servername=]<hostname>|<IPv4 address>|default]

Specifies the name or IPv4 address of the Teredo server.

[refreshinterval=]<integer>|default]

Specifies the client refresh interval (in seconds).

[clientport=]<integer>|default]

Specifies the client's UDP port (otherwise chosen by system).

[supernode=]<hostname>|<IPv4 address>|default]

Specifies the super-node to use when behind a firewall.

Examples

set teredo disable

set teredo client teredo.ipv6.microsoft.com 60 34567

show address

Displays all IPv6 addresses, or all addresses on a specified interface.

Syntax

show address [[interface=]String] [[level=]{normal | verbose}] [[store=]{active | persistent}]

Parameters

[[ interface=] String]

Specifies an interface name or index.

[[ level=]{ normal| verbose}]

Specifies whether one line per interface is displayed (normal) or additional information is displayed for each interface (verbose). When no interface is specified, the default selection is normal. When an interface is specified, the default selection is verbose.

[[ store=]{ active| persistent}]

Specifies whether active (active) or persistent (persistent) addresses are displayed. The default selection is active.

show compartments

Displays information about all compartments, or about a given compartment if one is specified.

Syntax

show compartments [compartment=]<integer> [[level=]normal|verbose] [store=]active|persistent

Parameters

[compartment=]<integer>

Specifies an interface name or index.

[[level=]normal|verbose]

One of the following values:

  • normal: Display one line per compartment (default when no compartment is specified).

  • verbose: Display extra information about each compartment( default when a compartment is specified).

[[store=]active|persistent]

One of the following values:

  • active: Address will disappear on next boot.

  • Persistent (default): Address will be persistent.

Example

show compartments

show destinationcache

Displays destination cache entries. If an interface is specified, displays the cache only on that interface. If an address is also specified, displays only that destination cache entry.

Syntax

show destinationcache [[interface=]String] [[address=]IPv6Address]

Parameters

[[ interface=] String]

Specifies an interface name or index.

[[ address=] IPv6Address]

Specifies the address of the destination.

show dnsservers

Displays the DNS server configuration for a specific interface or interfaces.

Syntax

show dnsservers [[interface=]String]

Parameters

[[ interface=] String]

Specifies the interface, by name, for which you want to display configured DNS server IPv6 addresses. If no interface is specified, servers for all interfaces are displayed.

Examples

In this example command, DNS server IPv6 addresses configured on the "Local Area Connection" interface are displayed.

show dnsservers "Local Area Connection"

show dynamicportrange

Displays dynamic port range configuration parameters.

Syntax

show dynamicportrange [[protocol=]tcp|udp] [[store=]active|persistent]

Parameters

[[protocol=[tcp|udp]

One of the following values:

  • TCP: Show the dynamic port range for TCP.

  • UDP: Show the dynamic port range for UDP.

[[store=]active|persistent]

One of the following values:

  • Active: Address will disappear on next boot.

  • Persistent (default): Address will be persistent.

Example

show dynamicportrange

show global

Displays global configuration parameters.

Syntax

show global [[store=]{active | persistent}]

Parameters

[[ store=]{ active| persistent}]

Specifies whether active (active) or persistent (persistent) information is displayed. The default selection is active.

show interfaces

Displays information about all interfaces, or about a specified interface.

Syntax

show interfaces [[interfaces=]String] [[level=]{normal | verbose}] [[store=]{active | persistent}]

Parameters

[[ interfaces=] String]

Specifies an interface name or index.

[[ level=]{ normal| verbose}]

Specifies whether one line per interface is displayed (normal) or additional information is displayed for each interface (verbose). When no interface is specified, the default selection is normal. When an interface is specified, the default selection is verbose.

[[ store=]{ active| persistent}]

Specifies whether active (active) or persistent (persistent) interfaces are displayed. The default selection is active.

show ipstats

Displays IP statistics. Used without parameters, show ipstats displays the statistics once.

Syntax

show ipstats [[rr=]RefreshRate]

Parameters

[ rr=] RefreshRate

Specifies the refresh rate (the number of seconds between refreshing the display of the statistics).

/?

Displays help at the command prompt.

show joins

Displays all IPv6 multicast addresses, or all multicast addresses on a specified interface.

Syntax

show joins [[interface=]String] [[level=]{normal | verbose}]

Parameters

[[ interface=] String]

Specifies an interface name or index.

[[ level=]{ normal| verbose}]

Specifies whether one line per interface is displayed (normal) or additional information is displayed for each interface (verbose). When no interface is specified, the default selection is normal. When an interface is specified, the default selection is verbose.

show neighbors

Displays neighbor cache entries. If an interface is specified, the command displays the cache only on that interface. If a subinterface is also specified, the command shows only the cache for that subinterface. If an address is specified as well, the command displays only that specific neighbor cache entry.

Syntax

show neighbors [[interface=]String] [[address=]IPv6Address] [neighbor=]<string> [[subinterface=]<string>][[store=]active|persistent] [[level=]normal|verbose]

Parameters

[[ interface=] String]

Specifies an interface name or index.

[[ address=] IP6Address]

Specifies the address of the neighbor.

[[subinterface=]<string>]

Specifies the LUID of the subinterface. This is only needed on interfaces with multiple subinterfaces.

[[store=]active|persistent]

One of the following values:

  • active: Address will disappear on next boot.

  • Persistent (default): Address will be persistent.

[[level=]normal|verbose]

One of the following values:

  • normal: Display one line per subinterface (default when no subinterface is specified).

  • verbose: Display extra information on each subinterface. (default when a subinterface is specified).

Example

show neighbors

show offload

Displays the tasks that can be performed by the network adapter for the specified interface corresponding to installed network hardware. Used without parameters, show offload displays offload information for all interfaces corresponding to installed network hardware.

Syntax

show offload [[name=]InterfaceName ]

Parameters

[ name=] InterfaceName

Specifies the name of the interface for which you want to display offload information. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

/?

Displays help at the command prompt.

show potentialrouters

Displays all potential routers, or all potential routers on a given

interface if one is specified.

Syntax

show potentialrouter [interface=]<string> [[level=]normal|verbose]

Parameters

[[ interface=] String]

Specifies an interface name or index.

[[level=]normal|verbose]

One of the following values:

  • normal: Display one line per subinterface (default when no subinterface is specified).

  • verbose: Display extra information on each subinterface. (default when a subinterface is specified).

show prefixpolicies

Displays prefix policy table entries used in source and destination address selection.

Syntax

show prefixpolicies [[store=]{active | persistent}]

Parameters

[[ store=]{ active| persistent}]

Specifies whether active (active) or persistent (persistent) information is displayed. The default selection is active.

show privacy

Displays privacy configuration parameters.

Syntax

show privacy [[store=]{active | persistent}]

Parameters

[[ store=]{ active| persistent}]

Specifies whether active (active) or persistent (persistent) information is displayed. The default selection is active.

show route

Displays route table entries.

Syntax

show route [[level=]{normal | verbose}] [[store=]{active | persistent}]

Parameters

[[ level=]{ normal| verbose}]

Specifies whether only normal routes (normal) or routes used for loopback (verbose) are displayed. The default selection is normal.

[[ store=]{ active| persistent}]

Specifies whether active (active) or persistent (persistent) routes are displayed. The default selection is active.

show siteprefixes

Displays the site prefix table.

Syntax

show siteprefixes

show subinterfaces

Displays information about all subinterfaces, or about all subinterfaces on a given interface if one is specified.

Syntax

show subinterfaces [interface=]<string> [[ level=]normal| verbose] [[subinterface=]<string>] [[store=]active|persistent]

[[ interface=] String]

Specifies an interface name or index.

[[ level=]normal|verbose]

Specifies whether only normal routes (normal) or routes used for loopback (verbose) are displayed. The default selection is normal.

[[subinterface=]<string>]

Specifies the subinterface LUID. This is only required on interfaces with multiple subinterfaces.

[[ store=][active|persistent]

Specifies whether active (active) or persistent (persistent) addresses are displayed. The default selection is active.

Example

show subinterfaces

show tcpstats

Displays TCP statistics. Used without parameters, show tcpstats displays the statistics once.

Syntax

show tcpstats [[rr=]RefreshRate]

Parameters

[ rr=] RefreshRate

Specifies the refresh rate (the number of seconds between refreshing the display of the statistics).

show teredo

shows the Teredo state.

Syntax

show teredo

Examples

show teredo

show udpstats

Displays UDP statistics. Used without parameters, show udpstats displays the statistics once.

Syntax

show udpstats [[rr=]RefreshRate]

Parameters

[ rr=] RefreshRate

Specifies the refresh rate (the number of seconds between refreshing the display of the statistics).

/?

Displays help at the command prompt.

Netsh interface IPv6 6to4

You can use the following commands in the netsh interface IPv6 6to4 context to display the configuration of or configure the 6to4 service on either a 6to4 host or a 6to4 router. For more information about Netsh, see Netsh Overview.

  • set interface

  • show interface

  • set relay

  • show relay

  • set routing

  • show routing

  • set state

  • show state

set interface

Configures the 6to4 service on an interface.

Syntax

set interface [name=] InterfaceName [[routing=] {enabled | disabled | default}]

Parameters

[ name=] InterfaceName

Required. Specifies the name of the interface for which you want to set 6to4 service configuration. InterfaceName must match the name of the interface specified in Network Connections. If InterfaceName contains any spaces, it must be enclosed in quotes.

[[ routing=] { enabled| disabled| default}]

Specifies whether the forwarding of 6to4 packets received on the interface is enabled, disabled, or set to its default value.

Remarks

  • This command enables, disables, or sets to default the routing behavior of the 6to4 service on a specified interface.

The default setting for the routing= parameter is enabled, which enables routing on private interfaces if Internet Connection Sharing (ICS) is used.

Note

  • Internet Connection Sharing and Network Bridge are not included in Windows Server 2003, Web Edition; Windows Server 2003, Datacenter Edition; and the Itanium-based versions of the original release of the Windows Server 2003 operating systems.

show interface

Displays the 6to4 service routing configuration on all interfaces, or on a specified interface.

Syntax

show interface [[name=] InterfaceName]

Parameters

[[ name=] InterfaceName]

Specifies the name of the interface for which you want to display the 6to4 service configuration. InterfaceName must match the name of the interface specified in Network Connections. If InterfaceName contains any spaces, it must be enclosed in quotes.

Remarks

  • If an interface name is not specified, the 6to4 configuration for all interfaces is displayed.

set relay

Configures the name of the 6to4 relay router for the 6to4 service. Additionally, specifies how often the name is resolved and the state of the relay component for the 6to4 service.

Syntax

set relay [[name=] {RelayDNSName | default}] [[state=] {enabled | disabled | automatic | default}] [[interval=] {ResInterval | default}]

Parameters

[[ name=] { RelayDNSName| default}]

Specifies either the fully qualified domain name (FQDN) of a 6to4 relay router on the IPv4 Internet (RelayDNSName), or sets the relay name to its default value of 6to4.ipv6.microsoft.com (default).

[[ state=] { enabled| disabled| automatic| default}]

Specifies whether the state of the relay component for the 6to4 service is enabled, disabled, automatically enabled if a public IPv4 address is configured, or set to its default value.

[[ interval=] { ResInterval| default}]

Specifies how often the name of the relay router is resolved in minutes (ResInterval) or sets the resolution interval to its default value of 1440 minutes (default).

Remarks

  • The 6to4 relay router is a router that provides an access point between the IPv4 Internet and the 6bone (the native IPv6 portion of the Internet). In order to access 6bone resources from a 6to4 router, the 6to4 router encapsulates 6to4 traffic with an IPv4 header and sends it to the IPv4 address of the 6to4 relay router. The 6to4 relay router removes the IPv4 header and forwards the traffic to the 6bone. For return traffic, the 6to4 relay router encapsulates IPv6 traffic and sends it to the 6to4 router at the 6to4 host's site.

  • The default name of the 6to4 relay router is 6to4.ipv6.microsoft.com.

  • The default state is automatic, which enables the forwarding of native IPv6 traffic to a relay router when a public IPv4 address is assigned to any interface.

  • The default resolution interval is 1440 minutes (once each day).

show relay

Displays the relay router configuration for the 6to4 service.

Syntax

show relay

set routing

Sets both the state of routing and the inclusion of site-local address prefixes in Router Advertisements that are sent by the 6to4 router.

Syntax

set routing [[routing=] {enabled | disabled | automatic | default}] [[sitelocals=] {enabled | disabled | default}]

Parameters

[[ routing=] { enabled| disabled| automatic| default}]

Specifies whether the state of routing on a 6to4 router is enabled, disabled, automatically enabled if Internet Connection Sharing (ICS) is enabled, or set to its default value.

[[ sitelocals=] { enabled| disabled| default}]

Specifies whether the advertising of site-local address prefixes, in addition to 6to4 address prefixes, is enabled, disabled, or set to its default value.

Remarks

  • The default setting for the routing= parameter is automatic, which enables routing on private interfaces when ICS is used.

  • The default setting for the sitelocals= parameter is enabled, which enables the advertising of site-local prefixes when site-local addresses are configured on private interfaces.

Note

  • Internet Connection Sharing and Network Bridge are not included in Windows Server 2003, Web Edition; Windows Server 2003, Datacenter Edition; and the Itanium-based versions of the original release of the Windows Server 2003 operating systems.

show routing

Displays the routing configuration of the 6to4 service.

Syntax

show routing

set state

Configures the state of the 6to4 service.

Syntax

set state [[state=] {enabled | disabled | default}] [[undoonstop=] {enabled | disabled | default}] [[6over4=] {enabled | disabled | default}]

Parameters

[[ state=] { enabled| disabled| default}]

Specifies whether the state of the 6to4 service is enabled, disabled, or set to its default value.

[[ undoonstop=] { enabled| disabled| default}]

Specifies whether the reversal of all automatic configuration that has been performed by the 6to4 service occurs when the service stops is enabled, disabled, or set to its default value.

Remarks

  • The default setting for the state= parameter is enabled, which enables the 6to4 service.

  • The default setting for the undoonstop= parameter is enabled, which reverses all automatic configuration performed by the 6to4 service when the service is stopped.

show state

Displays the state of the 6to4 service.

Syntax

show state

Netsh interface ipv6 isatap

Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) is an address assignment and tunneling mechanism for communication between IPv6/IPv4 nodes within an IPv4 site. It is described in the Internet draft titled "Intra-Site Automatic Tunnel Addressing Protocol (ISATAP)" (draft-ietf-ngtrans-isatap-00.txt). You can use the following commands to configure the ISATAP router.

  • set router

  • set state

  • show router

  • show state

set router

Specifies the Intra-Site Automatic Tunneling Address Protocol (ISATAP) router information, including router name, state, and resolution interval.

Syntax

set router [[name=]{String | default}] [[state=]{Enabled | Disabled | Default}] [[interval]=Integer]

Parameters

[[ name=]{ String| default}]

Specifies whether the router is named with a string. If default is specified, the system reverts to using the default name.

[[ state=]{ Enabled| Disabled| Default}]

Specifies whether the ISATAP router relays packets between subnets.

[[ interval]= Integer]

Specifies the router resolution interval, in minutes. The default interval is 1440 (24 hours).

Examples

The following example command sets the router name to isatap, enables the router, and sets the resolution interval to 120 minutes:

set router isatap enabled 120

set state

Enables or disables IPv4 compatibility. The default value for all parameters is disabled.

Syntax

set state [[state=]{enabled | disabled | default}]

Parameters

[[state=]{enabled| disabled| default}]

Specifies whether isatap interfaces are created. To both disable and delete isatap compatible interfaces, specify default. To disable isatap compatible interfaces without deleting them, specify disabled.

Examples

In this example command, IPv6-compatible addresses are disabled, and any previously existing interfaces are deleted.

set state default

show router

Displays configuration information for the ISATAP router.

Syntax

show router

Remarks

This command displays the router name, the relay state, and the resolution interval.

show state

Displays the ISATAP state.

Syntax

show state

For information on how to interpret netsh command syntax, see Formatting Legend.


Netsh commands for Interface ISATAP

This section contains the following commands.

  • set router

  • set state

  • show router

  • show state

Interface ISATAP commands

The following entries provide details for each command.

set router

Sets Intra-site Automatic Tunnel Address Protocol ISATAP router information.

Syntax

set router [ [ name= ] (Name | default )] [ [ state= ] ( enabled | disabled | default ) ] [[interval=] Interval ]

Parameters

name

Optional. Specifies the name of the ISATAP router.

state

Optional. Specifies the state of router name resolution.

interval

Optional. Specifies an integer that is the resolution interval (in minutes).

Examples

Following is an example of the set router command.

set router isatap enabled 1440

set state

Sets the ISATAP state.

Syntax

set state [ state= ] ( enabled | disabled | default)

Parameters

state

Optional. Specifies whether ISATAP is enabled.

show router

Shows the ISATAP router information.

Syntax

show router

show state

Shows the ISATAP state.

Syntax

show state


Netsh commands for Interface Portproxy

The Netsh Interface Portproxy commands provide a command-line tool for use in administering servers that act as proxies between IPv4 and IPv6 networks and applications. You can use these commands to establish proxy service in the following ways:

  • IPv4-configured computer and application messages sent to other IPv4-configured computers and applications.

  • IPv4-configured computer and application messages sent to IPv6-configured computers and applications.

  • IPv6-configured computer and application messages sent to IPv4-configured computers and applications.

  • IPv6-configured computer and application messages sent to other IPv6-configured computers and applications.

When writing batch files or scripts using these commands, each command must be preceded by netsh interface portproxy. For example, when using the delete v4tov6 command to specify that the portproxy server delete an IPv4 port and address from the list of IPv4 addresses for which the server listens, the batch file or script must use the following syntax:

netsh interface portproxy delete v4tov6 listenport= {Integer | ServiceName} [[listenaddress=] {IPv4Address| HostName}] [[protocol=]tcp]

You can run these commands at the command prompt in a Windows Server®2008 operating system or at the command prompt for the netsh interface portproxy context. For these commands to work at the command prompt in Windows Server 2008, you must type netsh interface portproxy before typing commands and parameters as they appear in the syntax below.

For more information about Netsh, see Netsh Overviewand Enter a Netsh Context

Interface Portproxy commands

To view the command syntax, click a command:

  • add v4tov4

  • add v4tov6

  • add v6tov4

  • add v6tov6

  • delete v4tov4

  • delete v4tov6

  • delete v6tov4

  • delete v6tov6

  • reset

  • set v4tov4

  • set v4tov6

  • set v6tov4

  • set v6tov6

  • show all

  • show v4tov4

  • show v4tov6

  • show v6tov4

  • show v6tov6

For information on how to interpret netsh command syntax, see Formatting Legend.

add v4tov4

Specifies that the portproxy server listen for messages sent to a specific port and IPv4 address, and maps a port and IPv4 address to which to send the messages received after establishing a separate TCP connection.

Syntax

add v4tov4 listenport= {Integer | ServiceName} [[connectaddress=] {IPv4Address | HostName}] [[connectport=] {Integer | ServiceName}] [[listenaddress=] {IPv4Address| HostName}] [[protocol=]tcp]

Parameters

listenport

Required. Specifies the IPv4 port, by port number or service name, on which to listen.

connectaddress

Specifies the IPv4 address to which to connect. Acceptable values are IP address, computer NetBIOS name, or computer DNS name. If an address is not specified, the default is the local computer.

connectport

Specifies the IPv4 port, by port number or service name, to which to connect. If connectport is not specified, the default is the value of listenport on the local computer.

listenaddress

Specifies the IPv4 address for which to listen. Acceptable values are IP address, computer NetBIOS name, or computer Domain Name System (DNS) name. If an address is not specified, the default is the local computer.

protocol

Specifies the protocol to use. Currently, only Transmission Control Protocol (TCP) is supported.

/?

Displays help at the command prompt.

add v4tov6

Specifies that the portproxy server listen for messages sent to a specific port and IPv4 address, and maps a port and IPv6 address to which to send the messages received after establishing a separate TCP connection.

Syntax

add v4tov6 listenport= {Integer | ServiceName} [[connectaddress=] {IPv6Address | HostName}] [[connectport=] {Integer | ServiceName}] [[listenaddress=] {IPv4Address| HostName}] [[protocol=]tcp]

Parameters

listenport

Required. Specifies the IPv4 port, by port number or service name, on which to listen.

connectaddress

Specifies the IPv6 address to which to connect. Acceptable values are IP address, computer NetBIOS name, or computer DNS name. If an address is not specified, the default is the local computer.

connectport

Specifies the IPv6 port, by port number or service name, to which to connect. If connectport is not specified, the default is the value of listenport on the local computer.

listenaddress

Specifies the IPv4 address on which to listen. Acceptable values are IP address, computer NetBIOS name, or computer DNS name. If an address is not specified, the default is the local computer.

protocol

Specifies the protocol to use. Currently only TCP is supported.

/?

Displays help at the command prompt.

add v6tov4

Specifies that the portproxy server listen for messages sent to a specific port and IPv6 address, and maps a port and IPv4 address to which to send the messages received after establishing a separate TCP connection.

Syntax

add v6tov4 listenport= {Integer | ServiceName} [[connectaddress=] {IPv4Address | HostName}] [[connectport=] {Integer | ServiceName}] [[listenaddress=] {IPv6Address| HostName}] [[protocol=]tcp]

Parameters

listenport

Required. Specifies the IPv6 port, by port number or service name, on which to listen.

connectaddress

Specifies the IPv4 address to which to connect. Acceptable values are IP address, computer NetBIOS name, or computer DNS name. If an address is not specified, the default is the local computer.

connectport

Specifies the IPv4 port, by port number or service name, to which to connect. If connectport is not specified, the default is the value of listenport on the local computer.

listenaddress

Specifies the IPv6 address on which to listen. Acceptable values are IP address, computer NetBIOS name, or computer DNS name. If an address is not specified, the default is the local computer.

protocol

Specifies the protocol to use. Currently only TCP is supported.

/?

Displays help at the command prompt.

add v6tov6

Specifies that the portproxy server listen for messages sent to a specific port and IPv6 address, and maps a port and IPv6 address to which to send the messages received after establishing a separate TCP connection.

Syntax

add v6tov6 listenport= {Integer | ServiceName} [[connectaddress=] {IPv6Address | HostName}] [[connectport=] {Integer | ServiceName}] [[listenaddress=] {IPv6Address| HostName}] [[protocol=]tcp]

Parameters

listenport

Required. Specifies the IPv6 port, by port number or service name, on which to listen.

connectaddress

Specifies the IPv6 address to which to connect. Acceptable values are IP address, computer NetBIOS name, or computer DNS name. If an address is not specified, the default is the local computer.

connectport

Specifies the IPv6 port, by port number or service name, to which to connect. If connectport is not specified, the default is the value of listenport on the local computer.

listenaddress

Specifies the IPv6 address on which to listen. Acceptable values are IP address, computer NetBIOS name, or computer DNS name. If an address is not specified, the default is the local computer.

protocol

Specifies the protocol to use. Currently only TCP is supported.

/?

Displays help at the command prompt.

delete v4tov4

Specifies that the portproxy server delete an IPv4 address from the list of IPv4 ports and addresses for which the server listens.

Syntax

delete v4tov4 listenport= {Integer | ServiceName} [[listenaddress=] {IPv4Address| HostName}] [[protocol=]tcp]

Parameters

listenport

Required. Specifies the IPv4 port to delete.

listenaddress

Specifies the IPv4 address to delete. If an address is not specified, the default is the local computer.

protocol

Specifies the protocol to use. Currently only TCP is supported.

/?

Displays help at the command prompt.

delete v4tov6

Specifies that the portproxy server delete an IPv4 port and address from the list of IPv4 addresses for which the server listens.

Syntax

delete v4tov6 listenport= {Integer | ServiceName} [[listenaddress=] {IPv4Address| HostName}] [[protocol=]tcp]

Parameters

listenport

Required. Specifies the IPv4 port to delete.

listenaddress

Specifies the IPv4 address to delete. If an address is not specified, the default is the local computer.

protocol

Specifies the protocol to use. Currently only TCP is supported.

/?

Displays help at the command prompt.

delete v6tov4

Specifies that the portproxy server delete an IPv6 port and address from the list of IPv6 addresses for which the server listens.

Syntax

delete v6tov4 listenport= {Integer | ServiceName} [[listenaddress=] {IPv6Address| HostName}] [[protocol=]tcp]

Parameters

listenport

Required. Specifies the IPv6 port to delete.

listenaddress

Specifies the IPv6 address to delete. If an address is not specified, the default is the local computer.

protocol

Specifies the protocol to use. Currently only TCP is supported.

/?

Displays help at the command prompt.

delete v6tov6

Specifies that the portproxy server delete an IPv6 address from the list of IPv6 addresses for which the server listens.

Syntax

delete v6tov6 listenport= {Integer | ServiceName} [[listenaddress=] {IPv6Address| HostName}] [[protocol=]tcp]

Parameters

listenport

Required. Specifies the IPv6 port to delete.

listenaddress

Specifies the IPv6 address to delete. If an address is not specified, the default is the local computer.

protocol

Specifies the protocol to use. Currently only TCP is supported.

/?

Displays help at the command prompt.

reset

Resets the IPv6 configuration state.

Syntax

reset

set v4tov4

Modifies the parameter values of an existing entry on the portproxy server created with the add v4tov4 command, or adds a new entry to the list that maps port/address pairs.

Syntax

set v4tov4 listenport= {Integer | ServiceName} [[connectaddress=] {IPv4Address | HostName}] [[connectport=] {Integer | ServiceName}] [listenaddress=] {IPv4Address| HostName}] [[protocol=]tcp]

Parameters

listenport

Required. Specifies the IPv4 port, by port number or service name, on which to listen.

connectaddress

Specifies the IPv4 address to which to connect. Acceptable values are IP address, computer NetBIOS name, or computer DNS name. If an address is not specified, the default is the local computer.

connectport

Specifies the IPv4 port, by port number or service name, to which to connect. If connectport is not specified, the default is the value of listenport on the local computer.

listenaddress

Specifies the IPv4 address for which to listen. Acceptable values are IP address, computer NetBIOS name, or computer DNS name. If an address is not specified, the default is the local computer.

protocol

Specifies the protocol to use. Currently, only Transmission Control Protocol (TCP) is supported.

/?

Displays help at the command prompt.

Remarks

  • You can change any parameter values for an existing portproxy server entry. If values are not supplied, no changes are made.

set v4tov6

Modifies the parameter values of an existing entry on the portproxy server created with the add v4tov6 command, or adds a new entry to the list that maps port/address pairs.

Syntax

set v4tov6 listenport= {Integer | ServiceName} [[connectaddress=] {IPv6Address | HostName}] [[connectport=] {Integer | ServiceName}] [[listenaddress=] {IPv4Address| HostName}] [[protocol=]tcp]

Parameters

listenport

Required. Specifies the IPv4 port, by port number or service name, on which to listen.

connectaddress

Specifies the IPv6 address to which to connect. Acceptable values are IP address, computer NetBIOS name, or computer DNS name. If an address is not specified, the default is the local computer.

connectport

Specifies the IPv6 port, by port number or service name, to which to connect. If connectport is not specified, the default is the value of listenport on the local computer.

listenaddress

Specifies the IPv4 address on which to listen. Acceptable values are IP address, computer NetBIOS name, or computer DNS name. If an address is not specified, the default is the local computer.

protocol

Specifies the protocol to use. Currently only TCP is supported.

/?

Displays help at the command prompt.

Remarks

  • You can change any parameter values for an existing portproxy server entry. If values are not supplied, no changes are made.

set v6tov4

Modifies the parameter values of an existing entry on the portproxy server created with the add v6tov4 command, or adds a new entry to the list that maps port/address pairs.

Syntax

set v6tov4 listenport= {Integer | ServiceName} [[connectaddress=] {IPv4Address | HostName}] [[connectport=] {Integer | ServiceName}] [[listenaddress=] {IPv6Address| HostName}] [[protocol=]tcp]

Parameters

listenport

Required. Specifies the IPv6 port, by port number or service name, on which to listen.

connectaddress

Specifies the IPv4 address to which to connect. Acceptable values are IP address, computer NetBIOS name, or computer DNS name. If an address is not specified, the default is the local computer.

connectport

Specifies the IPv4 port, by port number or service name, to which to connect. If connectport is not specified, the default is the value of listenport on the local computer.

listenaddress

Specifies the IPv6 address on which to listen. Acceptable values are IP address, computer NetBIOS name, or computer DNS name. If an address is not specified, the default is the local computer.

protocol

Specifies the protocol to use. Currently only TCP is supported.

/?

Displays help at the command prompt.

Remarks

  • You can change any parameter values for an existing portproxy server entry. If values are not supplied, no changes are made.

set v6tov6

Modifies the parameter values of an existing entry on the portproxy server created with the add v6tov6 command, or adds a new entry to the list that maps port/address pairs.

Syntax

set v6tov6 listenport= {Integer | ServiceName} [[connectaddress=] {IPv6Address | HostName}] [[connectport=] {Integer | ServiceName}] [[listenaddress=] {IPv6Address| HostName}] [[protocol=]tcp]

Parameters

listenport

Required. Specifies the IPv6 port, by port number or service name, on which to listen.

connectaddress

Specifies the IPv6 address to which to connect. Acceptable values are IP address, computer NetBIOS name, or computer DNS name. If an address is not specified, the default is the local computer.

connectport

Specifies the IPv6 port, by port number or service name, to which to connect. If connectport is not specified, the default is the value of listenport on the local computer.

listenaddress

Specifies the IPv6 address on which to listen. Acceptable values are IP address, computer NetBIOS name, or computer DNS name. If you do not specify an address, the default is the local computer.

protocol

Specifies the protocol to use. Currently only TCP is supported.

/?

Displays help at the command prompt.

Remarks

  • You can change any parameter values for an existing portproxy server entry. If values are not supplied, no changes are made.

show all

Displays all portproxy parameters, including port/address pairs for v4tov4, v4tov6, v6tov4, and v6tov6.

Syntax

show all

show v4tov4

Displays v4tov4 portproxy parameters.

Syntax

show v4tov4

show v4tov6

Displays v4tov6 portproxy parameters.

Syntax

show v4tov6

show v6tov4

Displays v6tov4 portproxy parameters.

Syntax

show v6tov4

show v6tov6

Displays v6tov6 portproxy parameters.

Syntax

show v6tov6

For information on how to interpret netsh command syntax, see Formatting Legend.


Netsh commands for Interface Transmission Control Protocol

The netsh interface TCP context contains the following commands:

  • add chimneyapplication

  • add chimneyport

  • delete chimneyapplication

  • delete chimneyport

  • reset

  • set global

  • show chimneyapplications

  • show chimneyports

  • show global

Interface TCP commands

The following sections provide details for each command.

add chimneyapplication

Sets the Transmission Control Protocol (TCP) chimney state for a particular application.

Syntax

add chimneyapplication [ state= ] disabled | enabled [ application= ] PathName

Parameters

state

Required. Specifies one of the following values: disabled: Disables TCP chimney offload for application. enabled: Enables TCP chimney offload for application. Applies to new connections only.

application

Required. Specifies the application name and path.

Examples

Following are two examples of the add chimneyapplication command.

add chimneyapplication disabled c:\path\database.exe

add chimneyapplication state=disabled application=c:\path\database.exe

add chimneyport

Sets the TCP chimney state for a source port, destination port pair.

Syntax

add chimneyport [ state= ] disabled | enabled [ localport= ] *| Integer [ remoteport= ] *| Integer

Parameters

state

Required. Specifies one of the following values: disabled: Disables TCP chimney offload for the local port, remote port pair. enabled: Enables TCP chimney offload for the local port, remote port pair. Applies to new connections only.

localport

Required. Specifies the source port. An asterisk (*) specifies all ports. To specify a specific port number, provide a value for Integer.

remoteport

Required. Specifies the destination port. An asterisk (*) specifies all ports. To specify a specific port number, provide a value for Integer.

Examples

Following are two examples of the add chimneyport command.

add chimneyport disabled 10000 *

add chimneyport state=disabled localport=10000 remoteport=*

delete chimneyapplication

Deletes the application from the TCP chimney offload selection table.

Syntax

delete chimneyapplication [application=] ApplicationName

Parameters

application

Required. Specifies the application name and path.

Example

Following are two examples of the delete chimneyapplication command.

delete chimneyapplication c:\path\database.exe

delete chimneyapplication application=c:\path\database.exe

delete chimneyport

Deletes the port entry from the TCP chimney offload selection table

Syntax

delete chimneyport [ localport= ] *| Integer [ remoteport= ] *| Integer

Parameters

localport

Required. Specifies the source port. An asterisk (*) specifies all ports. To specify a specific port number, provide a value for Integer.

remoteport

Required. Specifies the destination port. An asterisk (*) specifies all ports. To specify a specific port number, provide a value for Integer.

Examples

Following are two examples of the delete chimneyport command.

delete chimneyport 80 *

delete chimneyport localport=80 remoteport=*

reset

Removes all user configured settings and resets all TCP parameters to their default values.

Syntax

reset

set global

Sets TCP parameters that affect all connections.

Syntax

set global [ [ rss= ] disabled | enabled |default ] [ [ chimney= ] disabled | enabled | default ] [ [ autotuninglevel= ] disabled | highlyrestricted | restricted | normal |experimental ] [ [ congestionprovider= ] none |ctcp |default ] [ [ ecncapability= ] disabled | enabled | default ] [ [ timestamps= ] disabled | enabled | default ]

Parameters

rss

Optional. Specifies one of the following values:

disabled: Disable receive-side scaling.

enabled : Enable receive-side scaling.

default : Restore receive-side scaling state to the system default.

Chimney

Optional. Specifies one of the following values:

disabled: Disable Chimney offload.

enabled : Enable Chimney offload.

default : Restore Chimney offload state to the system default.

autotuninglevel

Optional. Specifies one of the following values:

disabled: Fix the receive window at its default value.

highlyrestricted: Allow the receive window to grow beyond its default value, but do so very conservatively.

restricted: Allow the receive window to grow beyond its default value, but limit such growth in some scenarios.

normal: Allow the receive window to grow to accommodate almost all scenarios.

experimental: Allow the receive window to grow to accommodate extreme scenarios. WARNING: This can dramatically degrade performance in common scenarios and should only be used for research purposes.

congestionprovider

Optional. Specifies one of the following values:

none: Use the built-in standard congestion control algorithm.

ctcp: Use the add-on Compound TCP congestion control algorithm.

default: Restore the selected provider to the system default.

ecncapability

Optional. Specifies one of the following values:

disabled: Disable ECN Capability.

enabled: Enable ECN Capability.

default: Restore ECN Capability state to the system default.

timestamps

Optional. Specifies one of the following values:

disabled: Disable RFC 1323 timestamps.

enabled: Enable RFC 1323 timestamps.

default: Restore RFC 1323 timestamps state to the system default.

Examples

Following are two examples of the set global command.

set global enabled enabled normal

set global rss=enabled chimney=enabled autotuninglevel=normal

show chimneyapplications

Shows TCP Chimney application filters.

Syntax

show chimneyapplications [ [ level= ] normal | verbose ]

Parameters:

level

Optional. Specifies one of the following values:

normal: Display the TCP connect IPv4 filters in the TCP chimney offload table. This is the default value.

verbose: Display filters for all events in the TCP chimney offload table.

show chimneyports

Shows TCP Chimney port filters.

Syntax

show chimneyports [ [ level= ] normal | verbose ]

Parameters:

level

Optional. Specifies one of the following values:

normal: Display the TCP connect IPv4 filters in the TCP chimney offload table. This is the default value.

verbose: Display filters for all events in the TCP chimney offload table.

show global

Shows TCP parameters that affect all connections.

Syntax

show global [ [ store= ] active | persistent ] ]

Parameters

store

Optional. Specifies one of the following values:

active: Show information in the stack (default).

persistent: Show persistent information.


Netsh commands for Interface Teredo

This section contains the following commands

  • set state

  • show state

Interface Teredo commands

The following entries provide details for each command.

set state

Sets the Teredo state. A default argument to a parameter sets it to the system default.

Syntax

set state [ [ type= ] disabled | client | enterpriseclient | default ] [ [ servername= ] HostName | IPv4Address | default ] [ [ refreshinterval= ] Integer | default ] [ [ clientport= ] Integer | default ] [ [ supernode= ] HostName | IPv4Address | default ]

Parameters

type

Optional. Specifies one of the following values: disabled: Disable the Teredo service. client: Enable the Teredo client. enterpriseclient: Skip managed network detection.

servername

Optional. Specifies the Host Name or IPv4 address of the Teredo server.

refreshinterval

Optional. Specifies an integer value for the client refresh interval (in seconds).

clientport

Optional. Specifies the an integer that is the client's UDP port (if default is specified, this value is chosen by system).

supernode

Optional. Specifies the Super-Node to use when behind a firewall.

Examples

Following are two examples of the set state command.

set state disable

set state client teredo.ipv6.microsoft.com 60 34567

show state

Shows the Teredo state.

Syntax

show state


Netsh Commands for Internet Protocol Security (IPsec)
Important
The ipsec context of the netsh command-line tool is provided for backwards-compatibility with previous versions of Windows. The ipsec context works on computers that are running Microsoft® Windows Vista® and Windows Server® 2008, but it does not allow you to manage or interact with any of the IPsec features that are new to Windows Vista or Windows Server 2008. You can use this context when you are working remotely with computers that are running Windows Server 2003, or when you need to configure policies that work on a combination of computers that are running Windows Vista, Windows Server 2008, and Windows Server 2003.

To use the new IPsec features included with Windows Vista and Windows Server 2008, use the advfirewall context instead. For more information, see Netsh Commands for Windows Firewall with Advanced Security.

The Netsh commands for Internet Protocol security (IPsec) provide an alternative to the console-based management and diagnostic capabilities provided by the IP Security Policy Management and IP Security Monitor snap-ins available for the Microsoft Management Console (MMC). By using the Netsh commands for IPsec, you can configure and view static or dynamic IPsec Main Mode settings, Quick Mode settings, rules, currently established security associations, and configuration parameters.

Administering IPsec from the command line is especially useful when you want to:

  • Script IPsec configuration.

  • Extend the security and manageability of IPsec by configuring the following features, which are not available in the IP Security Policy Management snap-in: IPsec diagnostics, default traffic exemptions, strong certificate revocation list (CRL) checking, IKE (Oakley) logging, logging intervals, computer startup security, and computer startup traffic exemptions.

You can run these commands from within the netsh tool at the netsh ipsec> prompt.

For these commands to work at a standard Windows command prompt, you must preface each command with netsh firewall, followed by the specific command and parameters as they appear in the syntax below.

Note
If User Account Control is enabled on your computer and you want to run a netsh ipsec command, you must run the command from a command prompt that was started with the Run as administrator option. If you run netsh ipsec commands without having administrator permissions available to the command-line tool, many of the commands fail with the message "The requested operation requires elevation."

The Netsh commands for IPsec can only be used to configure IPsec policies on computers that are running Windows Server 2008, Windows Vista, and Windows Server 2003.

To use the Windows command line to configure IPsec policies on computers that are running Windows XP, use IPsecCmd.exe, which is provided on the Windows XP CD, in the \Support\Tools folder.

For information on how to interpret netsh command syntax, see Formatting Legend.

For general information about netsh, see Netsh Overview and Enter a Netsh Context.

Netsh IPsec static-mode commands

You can use the netsh ipsec static commands to perform the same management and monitoring tasks that you can perform by using the IP Security Policy Management console. By using these commands, you can create and modify IPsec policies without immediately affecting the configuration of the active IPsec policy. Policies affect the operational state of computer when you use the assign=Yes parameter on an add policy or set policy command. If you make changes to an assigned policy, they will take affect immediately. A Group Policy assigned to the computer will override a local policy, even when the assign=yes option is part of the local policy command.

Netsh IPsec dynamic-mode commands

You can use the netsh ipsec dynamic commands to display the active state of IPsec and to immediately affect the configuration of the active IPsec policy. These commands directly configure the security policy database (SPD). Changes that you make to an IPsec policy while using these commands take effect only while the IPsec service is running. If the IPsec service is stopped, the dynamic policy settings are discarded. Although most of these commands take effect immediately, several configuration commands still require you to restart the IPsec service or restart the computer before they take effect. For more information about these commands, see the syntax descriptions for the netsh ipsec dynamic set config commands.

Caution
Because the IPsec Policy Agent does not interpret the netsh ipsec dynamic commands, you must be knowledgeable in the application of IKE Main Mode and Quick Mode policies to use these commands effectively. Exercise caution when using these commands, because it is possible to create IPsec policy configurations that are not valid without warning.

Netsh IPsec

The following commands are available at the IPsec> prompt, which is rooted within the netsh environment.

While the netsh ipsec dynamic commands modify the currently active configuration without storing the change anywhere, the netsh ipsec static commands modify a store which contains an IPsec configuration which allows the changes to persist, be saved, and recalled later.

Note
Although the dump command is available at the IPsec> prompt, it is not functional in this version of Windows.

To view the command syntax, click a command:

  • static

  • dynamic

static

Switches to the IPsec static context. In static mode you configure an IPsec policy which can be assigned to a computer at a later time. Changes made in this mode do not immediately affect the current IPsec state of the computer on which they are made, unless the policy being modified has the assign=yes property currently set and a Group Policy assigned IPsec policy is not currently overriding the local policy.

Commands that can be used at the netsh ipsec static command prompt can be found in the section Netsh IPsec static.

Syntax

static

Parameters

none

dynamic

Switches to the IPsec dynamic context. In dynamic mode, you are making changes to active IPsec state of the computer on which you run the command. The changes are not saved to a policy that can then be deployed to another computer.

Commands that can be used at the netsh ipsec dynamic command prompt can be found in the section Netsh IPsec static.

Syntax

dynamic

Parameters

none

Netsh IPsec static

The following commands are available at the ipsec static> prompt, which is rooted within the netsh environment.

To view the command syntax, click a command:

Add commands

  • add filter

  • add filteraction

  • add filterlist

  • add policy

  • add rule

Delete commands

  • delete all

  • delete filter

  • delete filteraction

  • delete filterlist

  • delete policy

  • delete rule

Import and Export commands

  • exportpolicy

  • importpolicy

Set commands

  • set batch

  • set defaultrule

  • set filteraction

  • set filterlist

  • set policy

  • set rule

  • set store

Show commands

  • show all

  • show filteraction

  • show filterlist

  • show gpoassignedpolicy

  • show policy

  • show rule

  • show store

add filter

Adds a filter to the specified filter list.

Syntax

add filter [ filterlist = ] FilterListName [ srcaddr = ] { me | any | IPAddr | IPAddr-IPAddr | ServerType } [ dstaddr = ] { me | any | IPAddr | IPAddr-IPAddr | ServerType } [ [ description = ] string ] [ [ protocol = ] { any | icmp | tcp | udp | raw | Integer } ] [ [ mirrored = ] { yes | no } ] [ [ srcmask = ] { Mask | Prefix } ] [ [ dstmask = ] { Mask | Prefix } ] [ [ srcport = ] Port ] [ [ dstport = ] Port ]

Parameters

[ filterlist = ] FilterListName

Required. Specifies the name of the filter list to which the filter is added. Each filter defines a set of inbound or outbound network traffic to be secured.

[ srcaddr = ] { me | any | IPAddr | IPAddr-IPAddr |ServerType}

Required. Specifies the source IP address, either IPv4 or IPv6, or an IPv4 or IPv6 address range, Domain Name System (DNS) name, or server type for the IP traffic. For ServerType, you can use wins, dns, dhcp, or gateway to match the locally configured IP addresses of the computers providing those services. The me keyword matches the IP address(es) assigned to the local computer, even when they change. Any matches any IP address.

[ dstaddr = ] { me | any | IPAddr | IPAddr-IPAddr |ServerType}

Required. Specifies the destination IP address, either IPv4 or IPv6, or an IPv4 or IPv6 address range, DNS name, or server type for the IP traffic. For ServerType, you can use wins, dns, dhcp, or gateway to match the locally configured IP addresses of the computers providing those services. The me keyword matches the IP address(es) assigned to the local computer, even when they change. Any matches any IP address.

[ [ description = ] String ]

Provides information about the filter.

[ [ protocol = ] { any | icmp | tcp | udp | raw | Integer } ]

Specifies the IP protocol if, in addition to addressing information, you want to filter a specific IP protocol. The default value is any.

[ [ mirrored= ] { yes | no } ]

Specifies whether to create a mirrored filter. Use yes to create two filters based on the filter settings--one for traffic to the destination and one for traffic from the destination. Both source and destination addresses and ports are mirrored. The default value is yes.

[ [ srcmask = ] {Mask|Prefix} ]

Specifies the source address subnet mask or the prefix of the packets to be filtered. You can specify a prefix value in the range of 1 through 32. The default value is the mask of 255.255.255.255.

[ [ dstmask = ] {Mask|Prefix} ]

Specifies the destination address subnet mask or the prefix value of the packets to be filtered. You can specify a prefix value in the range of 1 through 32. The default value is the mask of 255.255.255.255.

[ [ srcport = ] Port ]

Specifies the source port number of the packets to be filtered. This option only applies if you are filtering TCP or UDP packets. If 0 is specified, packets sent from any port are filtered. The default is any.

[ [ dstport = ] Port ]

Specifies the destination port number of the packets to be filtered. This option only applies if you are filtering TCP or UDP packets. If 0 is specified, packets sent to any port are filtered. The default is any.

Remarks

  • If a filter list does not exist, it is created.

  • Do not create a filter list with the name all. Doing this creates a conflict with the netsh ipsec option to select all IPsec filter lists (for example, delete filterlist all).

  • An address range must consist of two specific address of the same type, either IPv4 or IPv6.

  • To filter any packets sent from or to the computer, you can use srcaddr=me or dstaddr=me.

  • To filter packets sent from or to any computer, you can use srcaddr=any or dstaddr=any.

  • All string parameters are case-sensitive.

add filteraction

Creates a filter action with the specified Quick Mode security methods.

Syntax

add filteraction [ name = ] FilterActionName [ [ description = ] string ] [ [ qmpfs = ] { yes | no }] [ [ inpass = ] { yes | no } ] [ [ soft = ] { yes | no } ] [ [ action = ] { permit | block | negotiate } ] [ [ qmsecmethods = ] "SecMethodsString" ]

Parameters

[ name = ] FilterActionName

Required. Specifies the name of the filter action to be created.

[ [ description = ] string ]

Provides information about the filter action.

[ [ qmpfs = ] { yes | no } ]

Specifies whether to enable session key perfect forward secrecy (PFS). If yes is specified, new master key material is renegotiated each time a new session key is required. The default value is no.

[ [ inpass = ] { yes | no } ]

Specifies whether to allow an incoming packet that matches the configured filter list to be unsecured, but require IPsec-secured communication when replying. The default value is no.

[ [ soft = ] { yes | no } ]

Specifies whether to fall back to unsecured communication with other computers that do not support IPsec, or when IPsec negotiations with an IPsec-capable computer fail. The default value is no.

[ [ action = ] {permit | block | negotiate } ]

Specifies the action to take on the traffic that matches the rule containing this filter action. If permit is specified, traffic is transmitted or received without requiring IPsec protection. If block is specified, traffic is blocked. If negotiate is specified, IPsec is used with the specified list of security methods. The default value is negotiate.

[ [ qmsecmethods = ] "SecMethodsString" ]

Specifies one or more security methods. Each method is described by one of the following formats, separated by spaces:

  • ESP [ EncAlg,AuthAlg]:num k/num s

  • AH [ HashAlg ]: num k/ num s

  • AH [ HashAlg ]+ ESP[ EncAlg,AuthAlg]:num k/num s

Where:

EncAlg

Specifies the encryption algorithm. EncAlg can be DES, 3DES, or none.

AuthAlg

Specifies the integrity algorithm. AuthAlg can be MD5, SHA1, or none.

HashAlg

Specifies the hash function. HashAlg can be MD5 or SHA1.

num k

Specifies the session key lifetime in kilobytes. After the specified number of kilobytes of data is transferred, a new session key for the Quick Mode SA is generated. The default value is 100000 kilobytes.

num s

Specifies the session key lifetime in seconds. The default value is 3600 seconds.

Remarks

  • Do not create a filter action with the name all. Doing this creates a conflict with the netsh ipsec option to select all IPsec filter actions (for example, delete filteraction all).

  • If action=permit or action=block are specified, then any parameters for the options qmsecmethods, qmpfs, inpass, or soft are ignored and not used.

  • Session key regeneration will start based on whichever interval, seconds or kilobytes, is reached first. If you do not configure new intervals, the default intervals are used.

  • If you do not specify qmsecmethods, the default is a string equivalent to "ESP[3DES, SHA1]:100000k/3600s".

  • We recommend that you do not use DES or MD5. These cryptographic algorithms are no longer considered secure, and are provided for backward compatibility only.

  • The preference order of each Quick Mode security method is determined by the order in which it was specified in the command.

  • All string parameters are case-sensitive.

add filterlist

Creates an empty filter list with the specified name.

Syntax

add filterlist [ name = ] FilterListName [ [ description = ] string ]

Parameters

[ name = ] FilterListName

Required. Specifies the name of the filter list to be created.

[ [ description = ] string ]

Provides information about the filter list.

Remarks

  • Do not create a filter list with the name all. Doing this creates a conflict with the netsh ipsec option to select all IPsec filter lists (for example, delete filterlist all).

  • All string parameters are case-sensitive.

add policy

Creates an IPsec policy with the specified name.

Syntax

add policy [ name = ] PolicyName [ [ description = ] string ] [ [ mmpfs = ] { yes | no } ] [ [ qmpermm = ] Integer ] [ [ mmlifetime = ] Integer ] [ [ activatedefaultrule = ] { yes | no } ] [ [ pollinginterval = ] Integer ] [ [ assign = ] { yes | no } ] [ [ mmsecmethods = ] "KeyExchMethods" ]

Parameters

[ name = ] PolicyName

Required. Specifies the name of the IPsec policy to be created.

[ [ description = ] string ]

Provides information about the IPsec policy.

[ [ mmpfs = ] { yes | no } ]

Specifies whether to enable master key perfect forward secrecy (PFS). If yes is specified, Main Mode security SAs are reauthenticated and new master key keying material is negotiated each time session key material for a Quick Mode SA is required. The default value is no.

[ [ qmpermm = ] Integer ]

Specifies the number of times that master keying material can be used to derive the session key. The default value is 0, meaning an unlimited number of Quick Mode SAs can be derived from the Main Mode SA.

[ [ mmlifetime = ] Integer ]

Specifies the number of minutes after which a new master key will be generated. The default value is 480 minutes.

[ [ activatedefaultrule = ] { yes | no } ]

Specifies whether to activate the default response rule for this IPsec policy. The default value is no. This setting is not valid on Windows Vista or Windows Server 2008. When set through a Group Policy that is shared with earlier versions of Windows, computers running Windows Vista or Windows Server 2008 ignore the value. If you are running the command locally on a computer running Windows Vista or Windows Server 2008, it generates an error.

[ [ pollinginterval = ] Integer ]

Specifies how often IPsec polls for changes to this policy. The default value is 180 minutes.

[ [ assign = ] { yes | no } ]

Specifies whether to assign this IPsec policy (only one IPsec policy can be assigned) The default value is no.

[ [ mmsecmethods = ] "KeyExchMethods" ]

Specifies one or more key exchange security methods, separated by spaces. Each method is described by a string of the following format:

EncAlg-HashAlg-GroupNumb

Where:

EncAlg

Specifies the encryption algorithm. EncAlg can be DES or 3DES.

HashAlg

Specifies the hashing algorithm. HashAlg can be MD5 or SHA1.

GroupNum

Specifies the Diffie-Hellman group to be used for the base keying material. GroupNumb can be: 1 (low, protects with 768 bits of keying material), 2 (medium, protects with 1024 bits), and 3 (high, protects with 2048 bits).

Remarks

  • Do not create a policy with the name all. Doing this creates a conflict with the netsh ipsec option to select all IPsec policies (for example, delete policy all).

  • Because only one IPsec policy can be assigned, if a policy is currently assigned and you assign a new policy, the currently assigned policy is automatically unassigned.

  • If set store=domain is specified (when the IPsec policy is stored in Active Directory®), assign has no effect. To assign a policy to a Group Policy object (GPO), you must first create a policy by using the add policy command, and then use the set store command.

  • If mmpfs=yes is specified (master key PFS is enabled) then qmpermm is set to 1 and is not configurable, because each new session will cause the master key keying material to be renegotiated.

  • If you do not specify mmsecmethods (key exchange security methods), the default is a string equivalent to the following:

    "3DES-SHA1-2 3DES-SHA1-3"

  • We recommend that you do not use DES or MD5. These cryptographic algorithms are no longer considered secure, and are provided for backward compatibility only.

  • IPsec peers must have at least one key exchange security method in common (one that uses the same settings) or negotiations will fail.

  • All string parameters are case-sensitive.

add rule

Creates a rule that links a specified IPsec policy, filter list, and filter action with specified authentication methods.

Syntax

add rule [ name = ] RuleName [ policy = ] PolicyName [ filterlist = ] FilterListName [ filteraction = ] FilterActionName [ [ tunnel = ] { IPAddress | DNSName } ] [ [ conntype = ] { lan | dialup | all } ] [ [ activate = ] { yes | no } ] [ [ description = ] string ] [ [ kerberos = ] { yes | no } ] [ [ psk = ] PreSharedKey ] [ [ rootca = ] "String certmap:{ yes | no } excludecaname:{ yes | no }" ]

Parameters

[ name = ] RuleName

Required. Specifies the name of the IPsec rule to be created.

[ policy = ] PolicyName

Required. Specifies the name of the IPsec policy that contains this rule.

[ filterlist = ] FilterListName

Required. Specifies the name of the IP filter list for this rule.

[ filteraction = ] FilterActionName

Required. Specifies the name of the filter action for this rule.

[ [ tunnel = ] {IPAddress | DNSName} ]

Specifies the IP address (IPv4 or IPv6) or DNS name of the tunnel endpoint for tunnel mode. By default, this option is not specified and transport mode is used.

[ [ conntype = ] { lan | dialup | all }]

Specifies whether the rule applies only to dial-up connections, only to local area network (LAN) connections, or to all connections. The default value is all.

[ [ activate = ]{ yes | no } ]

Specifies whether to enable this rule in the specified IPsec policy. The default value is yes.

[ [ description = ] string]

Provides information about the rule.

[ [ kerberos = ]{ yes | no } ]

Specifies whether to use the Kerberos V5 protocol as an authentication method.

[ [ psk = ] PreSharedKey]

Specifies the string of characters to use for the preshared key, if a preshared key is used as an authentication method.

[ [ rootca = ] "CertName certmap:{ yes | no } excludecaname:{ yes | no } "]

Specifies certificate authentication options. The argument is a string in quotes that contains the following elements:

CertName

Specifies the distinguished name of the certificate, if a certificate is used as an authentication method.

certmap:{ yes | no }

Specifies whether to enable certificate-to-account mapping. You can enable certificate-to-account mapping to verify that the certificate is being used by a trusted computer.

excludecaname:{ yes | no }

Specifies whether to exclude from the certificate request the list of trusted root CA names from which a certificate is accepted.

Remarks

  • Do not create a rule with the name all. Doing this creates a conflict with the netsh ipsec option to select all IPsec rules (for example, delete rule all).

  • You can only use Kerberos V5 authentication or certificate-to-account mapping for computers that are members of an Active Directory domain.

  • Although you can use only one preshared key for authentication, you can use multiple certificates by specifying the rootca parameter multiple times, once for each certificate you want to use.

  • All certificate authentication parameters must be contained within a pair of quotation marks. To embed a quotation mark within the parameter, use a backslash followed by an apostrophe (\').

  • All string parameters are case-sensitive.

  • The preference order of each authentication method is determined by the order in which it was specified in the command.

  • If no authentication methods are specified, dynamic defaults are used. By default, IPsec policies use Kerberos V5 authentication. If the computer has a computer certificate, any root CA to which the computer certificate chains is also used for authentication.

  • If excludecaname:yes is specified, the list of trusted root CAs is not sent as part of the certificate request, which prevents the potential disclosure of sensitive information about the trust relationships of a computer. To enhance security for computers connected to the Internet, specify this option.

  • The use of preshared key authentication is not recommended because it is a relatively weak authentication method. In addition, preshared keys are stored in plaintext.

  • IPsec peers must have at least one key exchange security method in common (one that uses the same settings) or negotiations will fail.

delete all

Deletes all IPsec policies, filter lists, and filter actions.

Caution
Running this command deletes all currently configured IPsec policies, filter lists, and filter actions with no confirmation requested before the command is executed.

Syntax

delete all

Parameters

None.

delete filter

Deletes a filter from a filter list that matches the specified parameters.

Syntax

delete filter [ filterlist = ] FilterListName [ srcaddr = ] { me | any | IPAddr | IPAddr-IPAddr | ServerType } [ dstaddr = ] { me | any | IPAddr | IPAddr-IPAddr | ServerType } [ [ protocol = ] { any | icmp | tcp | udp | raw | Integer } ] [ [ srcmask = ] { Mask | Prefix } ] [ [ dstmask = ] { Mask | Prefix } ] [ [ srcport = ] Port ] [ [ dstport = ] Port ] [ [ mirrored = ] { yes | no } ]

Parameters

[ filterlist = ] FilterListName

Required. Specifies the name of the filter list to which the filter was added.

[ srcaddr = ] { me | any | IPAddr | IPAddr-IPAddr |ServerType}

Required. Specifies the source IP address or range, DNS name, or server type for the IP traffic being matched. For ServerType you can use WINS, DNS, DHCP, or gateway.

[ dstaddr = ] { me | any | IPAddr | IPAddr-IPAddr |ServerType}

Required. Specifies the destination IP address or range, DNS name, or server type for the IP traffic being matched. For ServerType you can use WINS, DNS, DHCP, or gateway.

[ [ protocol = ] {ANY|ICMP|TCP|UDP|RAW|Integer} ]

Specifies the IP protocol if, in addition to addressing information, a specific IP protocol is filtered. A value of ANY matches filters with a protocol setting of any.

[ [ srcmask = ] {Mask|Prefix} ]

Specifies the source address subnet mask or the prefix of the packets being filtered. You can specify a prefix value in the range of 0 through 32. The default value is the mask of 255.255.255.255, equivalent to the prefix value of 32.

[ [ dstmask = ] {Mask|Prefix} ]

Specifies the destination address subnet mask or the prefix of the packets being filtered. You can specify a prefix value in the range of 0 through 32. The default value is the mask of 255.255.255.255, equivalent to the prefix value of 32.

[ [ srcport = ] Port ]

Specifies the source port number of the packets being filtered. This option only applies if you are filtering TCP or UDP packets. The default is to match any port number.

[ [ dstport = ] Port ]

Specifies the destination port number of the packets being filtered. This option only applies if you are filtering TCP or UDP packets. The default is to match any port number.

[ [ mirrored = ] { yes | no } ]

Specifies whether a mirrored filter was created.

Remarks

  • This command only deletes a filter that matches the exact parameters specified.

  • If no optional parameters are specified, all filters that match the specified required parameters are deleted.

  • To delete a filter that filtered any packets sent from or to the local computer use srcaddr=me or dstaddr=me.

  • To delete a filter that filtered packets sent from or to any remote computer use srcaddr=any or dstaddr=any.

  • All string parameters are case-sensitive.

delete filteraction

Deletes the specified filter action, or all filter actions.

Syntax

delete filteraction { [ name = ] FilterActionName | all }

Parameters

{ [ name = ] FilterActionName | all}

Required. Specifies the name of the filter action to delete. Or, if all is specified, all filter actions are deleted.

Remarks

  • All string parameters are case-sensitive.

delete filterlist

Deletes the specified filter list, or all filter lists.

Syntax

delete filterlist { [ name = ] FilterListName | all }

Parameters

{ [ name = ] FilterListName | all }

Required. Specifies the name of the filter list to delete. Or, if all is specified, all filter lists are deleted.

Remarks

  • All string parameters are case-sensitive.

delete policy

Deletes the specified IPsec policy and all associated rules, or all IPsec policies.

Syntax

delete policy { [ name = ] PolicyName | all }

Parameters

{ [ name = ] PolicyName | all }

Required. Specifies the name of the IPsec policy to delete. Or, if all is specified, all IPsec policies are deleted.

Remarks

  • All string parameters are case-sensitive.

delete rule

Deletes a specified rule, or all rules from the specified IPsec policy.

Syntax

delete rule { [ name = ] RuleName | [ ID = ] Integer | all } [ policy = ] PolicyName

Parameters

{ [ name = ] RuleName | [ ID = ] Integer | all }

Required. Specifies the rule to delete. If either the rule name or the rule ID (the number identifying the position of the rule in the policy rule list) is specified, the corresponding rule is deleted. If all is specified, all rules are deleted.

[ policy = ] PolicyName

Required. Specifies the name of the policy from which one or more rules are deleted.

Remarks

  • The default response rule cannot be deleted.

  • After a rule is deleted, all IDs for the remaining rules change accordingly.

  • All string parameters are case-sensitive.

exportpolicy

Exports IPsec policy information to the specified file. You can export all policies, or a specified policy.

Syntax

Exportpolicy [ file = ] FilePathAndName [ name = ] PolicyName

Parameters

file= FilePathAndName

Required. Specifies the folder path and name of the file into which the IPsec policy information is exported.

[ [ name = ] PolicyName ]

Specifies the policy to export. If no value is provided, then all polices are exported.

Remarks

  • By default, if no file name extension is specified as part of the filename then .IPsec is added to the file name.

  • If no path is provided, then the file is placed in the current default folder. This is the folder displayed by the command prompt before you start netsh.

  • To enhance interoperablity in a mixed environment with computers running Windows 2000, limit the name of the file to which you want the policy information saved to 60 characters or less.

  • All string parameters are case-sensitive.

importpolicy

Imports IPsec policy information from the specified IPsec file.

Syntax

Importpolicy [ file = ] FilePathAndName

Parameters

[ file = ] FilePathAndName

Required. Specifies the folder path and name of the file from which the IPsec policy information is imported.

Remarks

  • All string parameters are case-sensitive.

  • By default, if no file name extension is specified as part of the filename then .IPsec is added to the file name.

  • If no path is provided, then the file is expected to be in the current default folder. This is the folder displayed by the command prompt before you start netsh.

set batch

Sets batch mode. When batch mode is enabled, netsh caches information used during the processing of commands. When other commands reference that same information, the command can typically be processed much more quickly since it is in the cache memory. This can significantly improve performance of scripts that run a sequence of netsh commands.

Syntax

set batch [ mode = ] { enable | disable }

Parameters

[ mode = ] { enable | disable }

Required. Turns batch mode with its associated caching of information on or off. Use enable to turn it on before running a sequence of commands.

Remarks

  • The set batch command is a per session command. If you start a new netsh session, batch mode is disabled, even if it was enabled when you last used netsh.

set defaultrule

Modifies the default response rule for the specified policy. This option is only applicable to computers running Windows XP or Windows Server 2003, and does not apply to Windows Vista or Windows Server 2008.

Syntax

set defaultrule [ policy = ] PolicyName [ [ qmpfs = ] { yes | no } ] [ [ activate = ] { yes | no } ] [ [ qmsecmethods = ] "SecMethodsString" ] [ [ kerberos = ] { yes | no } ] [ [ psk = ] PreSharedKey ] [ [ rootca = ] "CertName certmap:{ yes | no } excludecaname:{ yes | no }"]

Parameters

[ policy = ] PolicyName

Required. Specifies the name of the IPsec policy for which the default response rule is to be modified.

[ [ qmpfs = ]{ yes | no } ]

Specifies whether to enable session key perfect forward secrecy (PFS). If yes is specified, new master key material is renegotiated each time a new session key is required. The default value is no.

[ [ activate = ]{ yes | no } ]

Specifies whether to activate this rule for the specified IPsec policy. The default value is yes.

[ [ qmsecmethods = ] "SecMethodsString" ]

Specifies one or more security methods, separated by spaces and defined by the following format:

{ESP [EncAlg,AuthAlg]:k/s | AH [HashAlg]:k/s | AH [HashAlg]+ESP[EncAlg,AuthAlg]:k/s}]

Where:

EncAlg

Specifies the encryption algorithm. ConfigAlg can be DES (Data Encryption Standard), 3DES, or none.

AuthAlg

Specifies the integrity algorithm. AuthAlg can be MD5 (Message Digest 5), SHA1 (Secure Hash Algorithm 1), or none.

HashAlg

Specifies the hash function. HashAlg can be MD5 (Message Digest 5) or SHA1.

k

Specifies the session key lifetime in kilobytes. After the specified number of kilobytes of data is transferred, a new session key for the Quick Mode SA is generated. The default value is 100,000 kilobytes.

s

Specifies the session key lifetime in seconds. The default value is 3600 seconds.

[ [ kerberos = ]{ yes | no } ]

Specifies whether to use the Kerberos V5 protocol as an authentication method.

[ [ psk = ] PreSharedKey ]

Specifies the string of characters to use for the preshared key, if a preshared key is used as an authentication method.

[ [ rootca = ] "CertName certmap:{ yes | no } excludecaname: { yes | no }"]

Specifies certificate authentication options. The argument is a string in quotes that contains the following elements:

String

Specifies the distinguished name of the certificate, if a certificate is used as an authentication method.

certmap:{ yes | no }

Specifies whether to enable certificate-to-account mapping. You can enable certificate-to-account mapping to verify that the certificate is being used by a trusted computer.

excludecaname:{ yes | no }

Specifies whether to exclude from the certificate request the list of trusted root CA names from which a certificate is accepted.

Remarks

  • This option is only applicable to computers running Windows XP or Windows Server 2003, and is ignored on computers running Windows Vista or Windows Server 2008.

  • We recommend that you do not use DES or MD5. These cryptographic algorithms are no longer considered secure, and are provided for backwards-compatibility only.

  • You can only use Kerberos V5 authentication or certificate-to-account mapping for computers that are members of an Active Directory domain.

  • Although you can use only one preshared key for authentication, you can use multiple certificates by specifying the rootca parameter multiple times, once for each certificate you want to use.

  • All certificate authentication parameters must be contained within a pair of quotation marks. To embed a quotation mark within the parameter, use a backslash followed by an apostrophe (\').

  • The preference order of each authentication method is determined by the order in which it was specified in the command.

  • If no authentication methods are specified, dynamic defaults are used. By default, IPsec policies use Kerberos V5 authentication. If the computer has a computer certificate, any root CA to which the computer certificate chains is also used for authentication.

  • If excludecaname:yes is specified, the list of trusted root CAs is not sent as part of the certificate request, which prevents the potential disclosure of sensitive information about the trust relationships of a computer. To enhance security for computers connected to the Internet, specify this option.

  • The use of preshared key authentication is not recommended because it is a relatively weak authentication method. In addition, preshared keys are stored in plaintext.

  • IPsec peers must have at least one key exchange security method in common (one that uses the same settings) or negotiations will fail.

  • Modifying authentication methods will overwrite all previous authentication methods, even if the previous authentication methods were different. For example, if kerberos=yes and psk=PresharedKey were previously specified, and then you specify kerberos=no, the psk parameter will also be overwritten by the default value of no preshared key, and preshared key authentication will no longer be used.

  • EncAlg and AuthAlg cannot both be set to none.

  • All string parameters are case-sensitive.

set filteraction

Modifies a filter action.

Syntax

set filteraction { [ name = ] FilterActionName | [ guid = ] FilterActionGUID } [ [ newname = ] NewFilterActionName ] [ [ description = ] String ] [ [ qmpfs = ] { yes | no } ] [ [ inpass = ] { yes | no } ] [ [ soft = ] { yes | no } ] [ [ action = ] { permit | block | negotiate } ] [ [ qmsecmethods = ] "SecMethodsString" ]

Parameters

{ [ name = FilterActionName | [ guid = ] FilterActionGUID }

Required. Specifies the name or global unique identifier (GUID) of the filter action to modify.

[ [ newname = ] NewFilterActionName ]

Changes the name of the filter action to the specified value. If a value is not specified, then the name is not changed.

[ [ description = ] String ]

Changes the information about the filter action. If a value is not specified, then description is not changed.

[ [ qmpfs = ] { yes | no } ]

Changes the value that specifies whether to enable session key perfect forward secrecy (PFS). If yes is specified, new master key material is renegotiated each time a new session key is required. If a value is not specified, then qmpfs is not changed.

[ [ inpass = ] { yes | no } ]

Changes the value that specifies whether to allow an incoming packet that matches the configured filter list to be unsecured, but require IPsec-secured communication when replying. If a value is not specified, then inpass is not changed.

[ [ soft = ] { yes | no } ]

Changes the value that specifies whether to fall back to unsecured communications with other computers that do not support IPsec, or when IPsec negotiations with an IPsec-capable computer fail. If a value is not specified, then soft is not changed.

[ [ action = ] { permit | block | negotiate } ]

Changes the value that specifies whether to permit traffic without negotiating IPsec. If permit is specified, traffic is transmitted or received without negotiating or applying IP security. If block is specified, traffic is blocked. If negotiate is specified, IP security is used, with the specified list of security methods. If a value is not specified, then action is not changed.

[ [ qmsecmethods = ] "SecMethodsString" ]

Changes the string that specifies one or more security methods. Each method is described by one of the following formats, separated by spaces:

  • ESP [ EncAlg,AuthAlg]:num k/num s

  • AH [ HashAlg ]: num k/ num s

  • AH [ HashAlg ]+ ESP[ EncAlg,AuthAlg]:num k/num s

Where:

EncAlg

Specifies the encryption algorithm. EncAlg can be DES, 3DES, or none.

AuthAlg

Specifies the integrity algorithm. AuthAlg can be MD5, SHA1, or none.

HashAlg

Specifies the hash function. HashAlg can be MD5 or SHA1.

num k

Specifies the session key lifetime in kilobytes. After the specified number of kilobytes of data is transferred, a new session key for the Quick Mode SA is generated. The default value is 100000 kilobytes.

num s

Specifies the session key lifetime in seconds. The default value is 3600 seconds.

If a value is not specified, then qmsecmethods is not changed.

Remarks

  • If you rename the filter action, do not use the name all. Doing this creates a conflict with the netsh ipsec option to select all IPsec filter actions (for example, delete filteraction all).

  • We recommend that you do not use DES or MD5. These cryptographic algorithms are no longer considered secure, and are provided for backward compatibility only.

  • If action=permit or action=block are specified, then do not set qmpfs=yes, inpass=yes, or soft=yes.

  • Session key regeneration will start based on whichever interval, seconds or kilobytes, is reached first. If you do not configure new intervals, the default intervals are used.

  • The preference order of each Quick Mode security method is determined by the order in which it was specified in the command.

  • All string parameters are case-sensitive.

set filterlist

Modifies a filter list.

Syntax

set filterlist { [ name = FilterListName | [ guid = ] FilterListGUID } [ [ newname = ] NewFilterActionName ] [ [ description = ] String ]

Parameters

{ [ name = FilterListName | [ guid = ] FilterListGUID }

Required. Specifies the name or globally unique identifier (GUID) of the filter list to modify.

[ [ newname = ] NewFilterActionName ]

Changes the name of the filter list to the specified value. If a value is not specified, then the name is not changed.

[ [ description = ] String ]

Changes the information about the filter list. If a value is not specified, then description is not changed.

Remarks

  • If you specify a new name for the filter list, do not use the name all. Doing this creates a conflict with the netsh ipsec option to select all IPsec filter lists (for example, delete filterlist all).

  • All string parameters are case-sensitive.

set policy

Modifies an IPsec policy.

Syntax

set policy { [ name = PolicyName | [ guid = ] PolicyGUID } [ [ newname = ] NewPolicyName ] [ [ description = ] String ] [ [ mmpfs = ] { yes | no } ] [ [ qmpermm = ] Integer ] [ [ mmlifetime = ] Integer ] [ [ activatedefaultrule = ] { yes | no } ] [ [ pollinginterval = ] Integer ] [ [ assign = ] { yes | no } ] [ [ gponame = ] NameOfGPO ] [ [ mmsecmethods = ] "KeyExchMethods" ]

Parameters

name= String| guid=guid

Required. Specifies the name or GUID of the IPsec policy to modify.

[ [ newname = ] String ]

Changes the name of the IPsec policy to the specified value. If a value is not specified, then the name is not changed.

[ [ description = ] String ]

Changes the information about the IPsec policy. If a value is not specified, then description is not changed.

[ [ mmpfs = ] { yes | no } ]

Changes the value that specifies whether to enable master key perfect forward secrecy (PFS). If yes is specified, Main Mode security SAs are reauthenticated and new master key keying material is negotiated each time session key material for a Quick Mode SA is required. If a value is not specified, then mmpfs is not changed.

[ [ qmpermm = ] Integer ]

Changes the value that specifies the number of times that master keying material can be used to derive the session key. If a value is not specified, then qmpermm is not changed.

[ [ mmlifetime = ] Integer ]

Changes the value that specifies the number of minutes after which a new master key will be generated. If a value is not specified, then mmlifetime is not changed.

[ [ activatedefaultrule = ] { yes | no } ]

Changes the value that specifies whether to activate the default response rule for this IPsec policy. This setting is not valid on Windows Vista or Windows Server 2008. When set through a Group Policy that is shared with earlier versions of Windows, computers running Windows Vista or Windows Server 2008 ignore the value. If you are running the command locally on a computer running Windows Vista or Windows Server 2008, it generates an error. If a value is not specified, then activatedefaultrule is not changed.

[ [ pollinginterval = ] Integer ]

Changes the value that specifies how often IPsec polls for changes to this policy. If a value is not specified, then pollinginterval is not changed.

[ [ assign={ yes| no}] ]

Changes the value that specifies whether to assign this IPsec policy (only one IPsec policy can be assigned) If a value is not specified, then assign is not changed.

[ [ gponame = ] NameOfGPO ]

Changes the value that specifies the name of the Group Policy object to which the IPsec policy is assigned. This parameter is only applicable if you are configuring policy for a computer that is an Active Directory domain member. If a value is not specified, then gponame is not changed.

[ [ mmsecmethods = ] "KeyExchMethods" ]

Changes the string that specifies one or more key exchange security methods, separated by spaces. Each method is described by a string of the following format:

EncAlg - HashAlg - GroupNumb

Where:

EncAlg

Specifies the encryption algorithm. EncAlg can be DES or 3DES.

HashAlg

Specifies the hashing algorithm. HashAlg can be MD5 or SHA1.

GroupNum

Specifies the Diffie-Hellman group to be used for the base keying material. GroupNumb can be: 1 (low, protects with 768 bits of keying material), 2 (medium, protects with 1024 bits), and 3 (high, protects with 2048 bits).

If a value is not specified, then mmsecmethods is not changed.

Remarks

  • If you specify a new name for the policy, do not use the name all. Doing this creates a conflict with the netsh ipsec option to select all IPsec policies (for example, delete policy all).

  • We recommend that you do not use DES or MD5. These cryptographic algorithms are no longer considered secure, and are provided for backwards-compatibility only.

  • If set store=domain is specified (when the IPsec policy is stored in Active Directory), then assign has no effect.

  • If mmpfs=yes is specified (master key PFS is enabled), then qmpermm is set to 1 and not configurable, because each new session will cause the master key keying material to be renegotiated.

  • IPsec peers must have at least one common key exchange security method (one that uses the same settings) or negotiations will fail.

  • You can only specify a Group Policy object name if set store=domain.

  • All string parameters are case-sensitive.

set rule

Modifies a rule in an IPsec policy.

Syntax

set rule { [ name = ] RuleName | [ ID = ] Integer } [ policy = ] PolicyName [ [ newname = ] NewRuleName ] [ [ description = ] String ] [ [ filterlist = ] FilterListName ] [ [ filteraction = ] FilterActionName ] [ [ tunnel = ] { IPAddress | DNSName } ] [ [ conntype = ] { lan | dialup | all } ] [ [ activate = ] { yes | no } ] [ [ kerberos = ] { yes | no } ] [ [ psk = ] PreSharedKey ] [ [ rootca = ] "String certmap:{ yes | no } excludecaname:{ yes | no }" ]

Parameters

{ [ name = ] RuleName | [ ID = ] Integer }

Required. Specifies the name or ID (the number identifying the position of the rule in the policy rule list) of the rule to modify.

[ policy = ] PolicyName

Required. Specifies the name of the IPsec policy that contains the rule to modify.

[ [ newname = ] NewRuleName ]

Changes the name of the rule to the specified value. If a value is not specified, then the name is not changed.

[ [ description = ] String ]

Changes the information about the rule. If a value is not specified, then description is not changed.

[ [ filterlist = ] FilterListName ]

Changes the IP filter list associated with this rule. If a value is not specified, then filterlist is not changed.

[ [ filteraction = ] FilterActionName ]

Changes the filter action associated with this rule. If a value is not specified, then filteraction is not changed.

[ [ tunnel = ] {IPAddress|DNSName} ]

Changes the value that specifies the IP address or DNS name of the tunnel endpoint for tunnel mode. If a value is not specified, then tunnel is not changed.

[ [ conntype = ] { lan | dialup | all }]

Changes the value that specifies whether the rule applies only to dial-up connections or to local area network (LAN) connections, or to all connections. If a value is not specified, then conntype is not changed.

[ [ activate = ] { yes | no } ]

Changes the value that specifies whether to enable this rule for the specified IPsec policy. If a value is not specified, then activate is not changed.

[ [ kerberos = ] { yes | no } ]

Changes the value that specifies whether to use the Kerberos V5 protocol as an authentication method.

[ [ psk = ] PreSharedKey]

Changes the string of characters to use for the preshared key, if a preshared key is used as an authentication method. If a value is not specified, then psk is not changed.

[ [ rootca = ] "String certmap:{ yes | no } excludecaname:{ yes | no } "]

Changes the value that specifies certificate authentication options. The argument is a string in quotes that contains the following elements:

String

Specifies the distinguished name of the certificate, if a certificate is used as an authentication method.

certmap:{ yes | no }

Specifies whether to enable certificate-to-account mapping. You can enable certificate-to-account mapping to verify that the certificate is being used by a trusted computer.

excludecaname:{ yes | no }

Specifies whether to exclude from the certificate request the list of trusted root CA names from which a certificate is accepted.

If a value is not specified, then rootca is not changed.

Remarks

  • You can only use Kerberos V5 authentication or certificate-to-account mapping for computers that are members of an Active Directory domain.

  • Although you can use only one preshared key for authentication, you can use multiple certificates by specifying the rootca parameter multiple times, once for each certificate you want to use.

  • All certificate authentication parameters must be contained within a pair of quotation marks. To embed a quotation mark within the parameter, use a backslash followed by an apostrophe (\').

  • All string parameters are case-sensitive.

  • The preference order of each authentication method is determined by the order in which it was specified in the command.

  • If no authentication methods are specified, dynamic defaults are used. By default, IPsec policies use Kerberos V5 authentication. If the computer has a computer certificate, any root CA to which the computer certificate chains is also used for authentication.

  • If excludecaname:yes is specified, the list of trusted root CAs is not sent as part of the certificate request, which prevents the potential disclosure of sensitive information about the trust relationships of a computer. To enhance security for computers connected to the Internet, specify this option.

  • The use of preshared key authentication is not recommended because it is a relatively weak authentication method. In addition, preshared keys are stored in plaintext.

  • IPsec peers must have at least one common key exchange security method (one that uses the same settings) or negotiations will fail.

  • Modifying authentication methods will overwrite all previous authentication methods, even if the previous authentication methods were different. For example, if kerberos=yes and psk=PreSharedKey were previously specified, and then you specify kerberos=no, then the psk parameter will also be overwritten with the default value of not using a preshared key, and preshared key authentication will no longer be used.

set store

Sets the current IPsec policy storage location.

Syntax

set store [ location = ] { local | domain } [ [ domain = ] DomainName ]

Parameters

[ location = ] { local | domain }

Required. Specifies the storage location for the IPsec policy.

[ [ domain = ] DomainName ]

Specifies the name of the domain where the IPsec policy is stored, if the policy is stored in Active Directory (when location=domain is specified).

Remarks

  • The set store command only works from within the netsh environment, that is:

    • If you run this command from the command prompt for the netsh ipsec context).

    • If you run a batch file by using the netsh.exe command.

  • The local store contains IPsec policies that can be assigned to secure this computer. If a domain policy is available, the domain policy is applied instead of the local policy.

  • The domain store contains IPsec policies that can be assigned to secure groups of computers in a domain.

  • Use the set machine command to configure a remote computer.

  • All string parameters are case-sensitive.

show all

Displays configuration information for all IPsec policies, rules, filter lists, and filter actions.

Syntax

show all [ [ format = ] { list | table } ] [ [ wide = ] { yes | no } ]

Parameters

[ [ format = ] { list | table} ]

Specifies whether to display IPsec configuration information in screen or tab-delimited format. The default value is list, meaning that output is displayed in screen format.

[ [ wide = ] { yes | no } ]

Specifies whether to allow the display of IPsec configuration information to exceed the screen width of 80 characters. The default value is no, meaning that the display of configuration information is limited to the screen width.

Remarks

  • Because the show all command can result in lengthy, rapidly scrolling output, consider saving the output in a text file, unless you only need to view limited portions.

    To save output in a text file for the show all command, do either of the following:

    If you are in the netsh environment (netsh>)

    1. At the netsh prompt, type:

      set file open FileName.txt

    2. Then type:

      IPsec static show all

    3. To stop sending output and close the file, type:

      set file close

    If you are not in the netsh environment

    • At the command prompt, type:

      netsh ipsec static show all > FileName.txt

  • To stop the output of IPsec configuration information, you must exit Netsh by doing one of the following:

    • Close the Netsh window by clicking the X icon in the upper-right corner of the window.

    • Use Task Manager to end the Netsh program.

show filteraction

Displays configuration information for one or more filter actions.

Syntax

show filteraction { [ name = ] FilterActionName | [ rule = ] RuleName | all } [ [ level = ] { verbose | normal } ] [ [ format = ] { list | table } ] [ [ wide = ] { yes | no } ]

Parameters

{ [ name = ] FilterActionName | [ rule = ] RuleName | all }

Required. Specifies one or more filter actions for which configuration information is to be displayed.

  • If name is specified, then the filter action with the specified name is displayed.

  • If rule is specified, then the filter action associated with the specified rule is displayed.

  • If all is specified, all filter actions are displayed.

[ [ level = ] { verbose | normal } ]

Specifies the level of information to display. If verbose is specified, information about the security methods, policy storage location, and whether session key perfect forward secrecy (PFS) is enabled is displayed, in addition to basic filter action information. The default value is normal.

[ [ format = ] { list | table } ]

Specifies whether to display IPsec configuration information in screen or tab-delimited format. The default value is list, meaning that output is displayed in screen format.

[ [ wide = ] { yes | no } ]

Specifies whether to allow the display of IPsec configuration information to exceed the screen width of 80 characters. The default value is no, meaning that the display of configuration information is limited to the screen width.

Remarks

  • All string parameters are case-sensitive.

  • Because the show filteraction command can result in lengthy, rapidly scrolling output, consider saving the output in a text file, unless you only need to view limited portions.

    To save output in a text file for the show filteraction command, do either of the following:

    If you are in the netsh environment (netsh>)

    1. At the netsh prompt, type:

      set file open FileName.txt

    2. Then type (as an example that displays all filter actions):

      show filteraction all verbose table yes

    3. To stop sending output and close the file, type:

      set file close

    If you are not in the netsh environment

    • At the command prompt, type:

      netsh ipsec static show filteraction all verbose table yes>FileName.txt

  • To stop the output of IPsec configuration information, you must exit Netsh by doing one of the following:

    • Close the Netsh window by clicking the X icon in the upper-right corner of the window.

    • Use Task Manager to end the Netsh program.

show filterlist

Displays configuration information for one or more filter lists.

Syntax

show filterlist { [ name = ] FilterListName | [ rule = ] RuleName | all } [ [ level = ] { verbose | normal } ] [ [ format = ] { list | table } ] [ [ resolvedns = ] { yes | no } ] [ [ wide = ] { yes | no } ]

Parameters

{ [ name = ] FilterListName | [ rule = ] RuleName | all }

Required. Specifies one or more filter lists to display. If name is specified, the filter list with the specified name is displayed. If rule is specified, all filter lists associated with the specified rule are displayed. If all is specified, all filter lists are displayed.

[ [ level = ] { verbose | normal } ]

Specifies the level of information to display. If verbose is specified, information about the security methods, policy storage location, and whether session key perfect forward secrecy (PFS) is enabled is displayed, in addition to basic filter action information. The default value is normal.

[ [ format = ] { list | table } ]

Specifies whether to display IPsec configuration information in screen or tab-delimited format. The default value is list, meaning that output is displayed in screen format.

[ [ resolvedns = ] { yes | no } ]

Specifies whether to resolve the DNS or NetBIOS computer name associated with an IP address when displaying sources or destinations. If yes is specified, level must also be set to verbose, or the DNS names are not displayed. The default value is no.

[ [ wide = ] { yes | no } ]

Specifies whether to allow the display of IPsec configuration information to exceed the screen width of 80 characters. The default value is no, meaning that the display of configuration information is limited to the screen width.

Remarks

  • All string parameters are case-sensitive.

  • Because the show filterlist command can result in lengthy, rapidly scrolling output, consider saving the output in a text file, unless you only need to view limited portions.

    To save output in a text file for the show all command, do either of the following:

    If you are in the netsh environment (netsh>)

    1. At the netsh prompt, type:

      set file open FileName.txt

    2. Then type (as an example that displays all filter lists):

      IPsec static show filterlist all verbose yes yes

    3. To stop sending output and close the file, type:

      set file close

    If you are not in the netsh environment

    • At the command prompt, type:

      netsh ipsec static show filterlist all verbose yes yes >FileName.txt

  • To stop the output of IPsec configuration information, you must exit Netsh by doing one of the following:

    • Close the Netsh window by clicking the X icon in the upper-right corner of the window.

    • Use Task Manager to end the Netsh program.

show gpoassignedpolicy

Displays configuration information for the active IPsec policy assigned to the specified Group Policy object.

Syntax

show gpoassignedpolicy [ [ name = ] GPOName ]

Parameters

[ [ name = ] GPOName ]

Specifies the name of the Group Policy object to which the active IPsec policy is assigned. If no name is specified, the local IPsec policy is displayed.

Remarks

  • You can only specify a Group Policy object name if set store=domain.

  • All string parameters are case-sensitive.

    To save output in a text file for the show gpossignedpolicy command, do either of the following:

    If you are in the netsh environment (netsh>)

    1. At the netsh prompt, type:

      set file open FileName.txt

    2. Then type:

      IPsec static show gpoassignedpolicy [GPOName]

    3. To stop sending output and close the file, type:

      set file close

    If you are not in the netsh environment

    • At the command prompt, type:

      netsh ipsec static show gpoassignedpolicy [GPOName] >FileName.txt

show policy

Displays configuration information for the specified IPsec policy, or for all IPsec policies.

Syntax

show policy { [ name = ] PolicyName | all } [ [ level = ] { verbose | normal } ] [ [ format = ] { list | table } ] [ [ wide = ] { yes | no } ]

Parameters

{ [ name = ] PolicyName | all }

Required. Specifies the name of the IPsec policy to display or, if all is specified, that all IPsec policies are displayed.

[ [ level = ] { verbose | normal } ]

Specifies the level of information to display. If verbose is specified, the security methods and authentication method are displayed, in addition to information about filter actions and rules. The default value is normal.

[ [ format = ] { list | table } ]

Specifies whether to display IPsec configuration information in screen or tab-delimited format. The default value is list, meaning that output is displayed in screen format.

[ [ wide = ] { yes | no } ]

Specifies whether to allow the display of IPsec configuration information to exceed the screen width of 80 characters. The default value is no, meaning that the display of configuration information is limited to the screen width.

Remarks

  • All string parameters are case-sensitive.

  • Because the show policy command can result in lengthy, rapidly scrolling output, consider saving the output in a text file, unless you only need to view limited portions.

    To save output in a text file for the show policy command, do either of the following:

    If you are in the netsh environment (netsh>)

    1. At the netsh prompt, type:

      set file open FileName.txt

    2. Then type:

      IPsec static show policy PolicyName | all >FileName.txt

    3. To stop sending output and close the file, type:

      set file close

    If you are not in the netsh environment

    • At the command prompt, type:

      netsh ipsec static show policy PolicyName | all >FileName.txt

  • To stop the output of IPsec configuration information, you must exit Netsh by doing one of the following:

    • Close the Netsh window by clicking the X icon in the upper-right corner of the window.

    • Use Task Manager to end the Netsh program.

show rule

Displays configuration information for a rule for a specified policy, or for all rules for a specified policy.

Syntax

show rule { [ name = ] RuleName | [ id = ] Integer | all | default } [ policy = ] PolicyName [ [ type = ] { transport | tunnel } ] [ [ level = ] { verbose | normal } ] [ [ format = ] { list | table } ] [ [ wide = ] { yes | no } ]

Parameters

{ [ name = ] RuleName | [ id = ] Integer | all | default }

Required. Specifies one or more rules to display. If either the rule name or the rule ID (the number identifying the position of the rule in the policy rule list) is specified, the corresponding rule is displayed. If all is specified, all rules for the specified policy are displayed. If default is specified, the default response rule is displayed.

[ policy = ] PolicyName

Required. Specifies the name of the policy for which the specified rule, or all rules, are displayed.

[ [ type = ] { transport | tunnel } ]

Specifies whether to display all transport rules or all tunnel rules. The default value is to display all rules.

[ [ level = ] { verbose | normal } ]

Specifies the level of information to display. If verbose is specified, the security methods and authentication method are displayed, in addition to information about filter actions and rules. The default value is normal.

[ [ format = ] { list | table } ]

Specifies whether to display IPsec configuration information in screen or tab-delimited format. The default value is list, meaning that output is displayed in screen format.

[ [ wide = ] { yes | no } ]

Specifies whether to allow the display of IPsec configuration information to exceed the screen width of 80 characters. The default value is no, meaning that the display of configuration information is limited to the screen width.

Remarks

  • If you use the type parameter, you must also use the all parameter (you must specify show rule all).

  • All string parameters are case-sensitive.

  • Because the show rule command can result in lengthy, rapidly scrolling output, consider saving the output in a text file, unless you only need to view limited portions.

    To save output in a text file for the show rule command, do either of the following:

    If you are in the netsh environment (netsh>)

    1. At the netsh prompt, type:

      set file open FileName.txt

    2. Then type (as an example that displays all transport rules in a policy):

      IPsec static show rule all Policy transport

    3. To stop sending output and close the file, type:

      set file close

    If you are not in the netsh environment

    • At the command prompt, type:

      netsh ipsec static show rule all Policy transport >FileName.txt

  • To stop the output of IPsec configuration information, you must exit Netsh by doing one of the following:

    • Close the Netsh window by clicking the X icon in the upper-right corner of the window.

    • Use Task Manager to end the Netsh program.

show store

Displays the current IPsec policy storage location. Commands that you enter to change the state of the IPsec configuration apply to the displayed location unless you use the set store command to change the location first.

Syntax

show store

Parameters

None.

Remarks

  • The local store contains IPsec policies that can be assigned to secure this computer. If a domain policy is available, the domain policy is applied instead of the local policy.

  • The domain store contains IPsec policies that can be assigned to secure groups of computers in a domain.

Netsh IPsec dynamic

The following commands are available at the ipsec dynamic > prompt, which is rooted within the netsh environment.

While the netsh ipsec static commands modify a store which contains an IPsec configuration, the netsh ipsec dynamic commands modify the currently active configuration, without storing the change anywhere. If you restart the computer or the IPsec services, the change is lost. To make a change persistent, use the ipsec static commands to modify a store containing an IPsec configuration, and then ensure that configuration is the currently active configuration.

To view the command syntax, click a command:

Add commands

  • add mmpolicy

  • add qmpolicy

  • add rule

Delete commands

  • delete all

  • delete mmpolicy

  • delete qmpolicy

  • delete rule

  • delete sa

Set commands

  • set config

  • set mmpolicy

  • set qmpolicy

  • set rule

Show commands

  • show all

  • show config

  • show mmfilter

  • show mmpolicy

  • show mmsas

  • show qmfilter

  • show qmpolicy

  • show qmsas

  • show rule

  • show stats

add mmpolicy

Creates an IPsec Main Mode policy with the specified name and adds it to the security policy database (SPD).

Syntax

add mmpolicy name = PolicyName [ qmpermm = Integer ] [ mmlifetime = Integer ] [ softsaexpirationtime = Integer ] [ mmsecmethods = "KeyExchMethods" ]

Parameters

name = PolicyName

Required. Specifies the name of the IPsec policy to be created.

[ qmpermm = Integer ]

Specifies the number of times that master keying material can be used to derive the session key. The default value is 0, meaning an unlimited number of Quick Mode SAs can be derived from the Main Mode SA.

[ mmlifetime=Integer ]

Specifies the number of minutes after which a new master key is generated. If a new master key is generated sooner because of the qmpermm parameter, then this timer is reset and begins counting again. A value of 0 specifies that the master key is never regenerated because of time. The default value is 480 minutes.

[ softsaexpirationtime = Integer ]

Specifies the number of minutes after which an unprotected security association (a soft SA) expires. A value of 0 specifies that soft SAs do not expire. The default value is 480 minutes.

[ mmsecmethods = "KeyExchMethods" ]

Specifies one or more key exchange security methods, separated by spaces. Each method is described by a string of the following format:

EncAlg-HashAlg-GroupNumb

Where:

EncAlg

Specifies the encryption algorithm. EncAlg can be DES or 3DES.

HashAlg

Specifies the hashing algorithm. HashAlg can be MD5 or SHA1.

GroupNum

Specifies the Diffie-Hellman group to be used for the base keying material. GroupNumb can be: 1 (low, protects with 768 bits of keying material), 2 (medium, protects with 1024 bits), and 3 (high, protects with 2048 bits).

Remarks

  • Do not create a Main Mode policy with the name all. Doing this creates a conflict with the netsh ipsec option to select all IPsec Main Mode policies (for example, delete mmpolicy all).

  • If the number of Quick Mode negotiations exceeds the value set for the number of Quick Mode negotiations per Main Mode negotiation (qmpermm) during the Main Mode lifetime, a new Main Mode negotiation occurs.

  • If you do not specify mmsecmethods (key exchange security methods), the default is a string equivalent to the following:

    "3DES-SHA1-2 3DES-SHA1-3"

  • We recommend that you do not use DES or MD5. These cryptographic algorithms are no longer considered secure, and are provided for backwards-compatibility only.

  • IPsec peers must have at least one common key exchange security method (one that uses the same settings) or negotiations will fail.

  • Unlike most netsh commands, both the add mmpolicy and the set mmpolicy commands require that the parameter name and equal sign be included before the value for each parameter that you use.

  • All string parameters are case-sensitive.

add qmpolicy

Creates an IPsec Quick Mode policy with the specified name and adds it to the SPD.

Syntax

add qmpolicy name = PolicyName [ soft = { yes | no } ] [ pfsgroup = { grp1 | grp2 | grp3 | grpmm | nopfs } ] [ qmsecmethods = "SecMethodsString" ]

Parameters

name= String

Required. Specifies the name of the IPsec Quick Mode policy to be created.

[ soft={ yes| no}]

Specifies whether to fall back to unsecured communications with other computers that do not support IPsec, or when IPsec negotiations with an IPsec-capable computer fail. The default value is no.

[ pfsgroup = { grp1 | grp2 | grp3 | grpmm | nopfs } ]

Specifies the Diffie-Hellman group to use for session key PFS. If grp1 is specified, Group 1 (low, with 768 bits of keying material) is used. If grp2 is specified, Group 2 (medium, with 1024 bits of keying material) is used. If grp3 is specified, Group 3 (high, with 2048 bits of keying material) is used. If grpmm is specified, the group value is taken from the current Main Mode settings. The default value is nopfs, meaning session key PFS is disabled.

[ qmsecmethods = "SecMethodsString" ]

Specifies one or more security methods. Each method is described by one of the following formats, separated by spaces:

  • ESP [ EncAlg,AuthAlg]:num k/num s

  • AH [ HashAlg ]: num k/ num s

  • AH [ HashAlg ]+ ESP[ EncAlg,AuthAlg]:num k/num s

Where:

EncAlg

Specifies the encryption algorithm. ConfigAlg can be DES (Data Encryption Standard), 3DES, or none.

AuthAlg

Specifies the integrity algorithm. AuthAlg can be MD5 (Message Digest 5), SHA1 (Secure Hash Algorithm 1), or none.

HashAlg

Specifies the hash function. HashAlg can be MD5 (Message Digest 5) or SHA1.

k

Specifies the session key lifetime in kilobytes. After the specified number of kilobytes of data is transferred, a new session key for the Quick Mode SA is generated. The default value is 100,000 kilobytes.

s

Specifies the session key lifetime in seconds. The default value is 3600 seconds.

Remarks

  • Do not create a Quick Mode policy with the name all. Doing this creates a conflict with the netsh ipsec option to select all IPsec Quick Mode policies (for example, delete qmpolicy all).

  • If you do not specify qmsecmethods, the default is a string equivalent to "ESP[3DES, SHA1]:100000k/3600s".

  • We recommend that you do not use DES or MD5. These cryptographic algorithms are no longer considered secure, and are provided for backwards-compatibility only.

  • EncAlg and AuthAlg cannot both be set to none.

  • IPsec peers must have the same pfsgroup enabled (that is, both peers must use the same Diffie-Hellman group for session key PFS), or communication will fail.

  • For enhanced security, do not use Diffie-Hellman Group 1. For maximum security, use Group 3 whenever possible. Use Group 2 when required for interoperability with Windows 2000 and Windows XP.

  • All string parameters are case-sensitive.

  • Unlike most netsh commands, both the add qmpolicy and the set qmpolicy commands require that the parameter name and equal sign be included before the value for each parameter that you use.

add rule

Creates an IPsec rule with the specified Main Mode policy and Quick Mode policy and adds it to the security policy database.

Syntax

add rule [ srcaddr = ]{ Me | Any | IPAddress | IPRange | ServerType } [ dstaddr = ]{ Me | Any | IPAddress | IPRange | ServerType } [ mmpolicy = ] MMPolicyName [ [ qmpolicy = ] QMPolicyName ] [ [ protocol = ] { ANY | ICMP | TCP | UDP | RAW | Integer } ] [ [ srcport = ] Integer ] [ [ dstport = ] Integer ] [ [ mirrored = ] { yes | no } ] [ [ conntype = ]{ lan | dialup | all } ] [ [ actioninbound = ]{ permit | block | negotiate } ] [ [ actionoutbound = ] { permit | block | negotiate } ] [ [ srcmask = ]{ Mask | Prefix } ] [ [ dstmask = ]{ Mask | Prefix } ] [ [ tunneldstaddress = ]{ IPAddress | DNSName } ] [ [ kerberos = ]{ yes | no } ] [ [ psk = ] PreSharedKey ] [ [ rootca = ] "CertName certmap:{ yes | no } excludecaname:{ yes | no }"]

Parameters

[ srcaddr = ] { Me | Any | IPAddress | IPRange | dns | server }

Required. Specifies the source IPv4 or IPv6 address, an IP address range, a DNS name, or a server type for the IP traffic. For ServerType you can use WINS, DNS, DHCP, or gateway.

[ dstaddr = ] { Me | Any | IPAddress | IPRange | dns | server }

Required. Specifies the source IPv4 or IPv6 address, an IP address range, a DNS name, or a server type for the IP traffic. For ServerType you can use WINS, DNS, DHCP, or gateway.

[ mmpolicy = ] MMPolicyName

Required. Specifies the name of the Main Mode policy.

[ [ qmpolicy = ] QMPolicyName ]

Specifies the name of the Quick Mode policy. Required if actioninbound=negotiate or actionoutbound=negotiate are specified.

[ [ protocol = ] { ANY | ICMP | TCP | UDP | RAW | Integer } ]

Specifies the IP protocol if, in addition to address information, you want to filter a specific IP protocol. The default value is ANY, meaning all protocols are used for the filter.

[ [ srcport = ] Integer ]

Specifies the source port number of the packets to be filtered. This option only applies if you are filtering TCP or UDP packets. If 0 is specified, packets sent from any port are filtered. The default is 0.

[ [ dstport = ] Integer ]

Specifies the destination port number of the packets to be filtered. This option only applies if you are filtering TCP or UDP packets. If 0 is specified, packets sent to any port are filtered. The default is 0.

[ [ mirrored = ]{ yes | no } ]

Specifies whether to create a mirrored filter. Use yes to create two filters based on the filter settings, one for traffic to the destination and one for traffic from the destination. The default value is yes.

[ [ conntype=] = ] { lan | dialup | all } ]

Specifies whether the rule applies only to remote access/dial-up connections, to local area network (LAN) connections, or to all connections. The default value is all.

[ [ actioninbound = ] { permit | block | negotiate } ]

Specifies the action that IPsec is required to take for inbound traffic. If permit is specified, traffic is received without negotiating or applying IP security. If block is specified, traffic is blocked. If negotiate is specified, IPsec is used, with the list of security methods specified in the Main Mode and Quick Mode policies. The default value is negotiate.

[ [ actionoutbound = ] { permit | block | negotiate } ]

Specifies the action that IPsec is required to take for outbound traffic. If permit is specified, traffic is sent without negotiating or applying IP security. If block is specified, traffic is blocked. If negotiate is specified, IP security is used, with the list of security methods specified in the Main Mode and Quick Mode policies. The default value is negotiate.

[ [ srcmask = ] { Mask | Prefix } ]

Specifies the source address subnet mask or the prefix of the packets to be filtered. You can specify a prefix value in the range of 1 through 32. The default value is the mask of 255.255.255.255.

[ [ dstmask = ] { Mask | Prefix } ]

Specifies the destination address subnet mask or the prefix value of the packets to be filtered. You can specify a prefix value in the range of 1 through 32. The default value is the mask of 255.255.255.255.

[ [ tunneldstaddress = ] { IPAddress | DNSName } ]

Specifies whether the traffic is tunneled and, if it is, the IP address or DNS name of the tunnel destination (the computer or gateway on the other side of the tunnel). The default is to not create a tunnel, but to use IPsec in Transport mode.

[ [ kerberos = ] { yes | no } ]

Specifies whether to use the Kerberos V5 protocol as an authentication method.

[ [ psk = ] PreSharedKey ]

Specifies the string of characters to use for the preshared key, if a preshared key is used as an authentication method.

[ [ rootca = ] "CertName certmap:{ yes | no } excludecaname:{ yes | no } "]

Specifies certificate authentication options. The argument is a string in quotes that contains the following elements:

CertName

Specifies the distinguished name of the certificate, if a certificate is used as an authentication method.

certmap:{ yes | no }

Specifies whether to enable certificate-to-account mapping. You can enable certificate-to-account mapping to verify that the certificate is being used by a trusted computer.

excludecaname:{ yes | no }

Specifies whether to exclude from the certificate request the list of trusted root CA names from which a certificate is accepted.

Remarks

  • Do not create a rule with the name all. Doing this creates a conflict with the netsh ipsec option to select all IPsec rules (for example, delete rule all).

  • If the filter action for both inbound and outbound traffic (actioninbound and actionoutbound) are set to Permit or Block, a Quick Mode filter is not required. If either action is set to Negotiate, then a Quick Mode filter is required.

  • If a tunnel rule is specified, mirror should be set to no (by default, mirror is set to yes). For IPsec tunnels, you must create two rules--one rule describes the traffic to be sent through the tunnel (outbound traffic) and the other describes the traffic to be received through the tunnel (inbound). Next, create two rules that use the inbound and outbound filter lists in your policy.

  • To filter any packets sent from or to your local computer, you can use srcaddr=Me or dstaddr=Me.

  • To filter packets sent from or to any other computer, you can use srcaddr=Any or dstaddr=Any.

  • You can only use Kerberos V5 authentication or certificate-to-account mapping for computers that are members of an Active Directory domain.

  • Although you can use only one preshared key for authentication, you can use multiple certificates by specifying the rootca parameter multiple times, once for each certificate you want to use.

  • All certificate authentication parameters must be contained within a pair of quotation marks. To embed a quotation mark within the parameter, use a backslash followed by an apostrophe (\').

  • All string parameters are case-sensitive.

  • The preference order of each authentication method is determined by the order in which it was specified in the command.

  • If no authentication methods are specified, dynamic defaults are used. By default, IPsec policies use Kerberos V5 authentication. If the computer has a computer certificate, any root CA to which the computer certificate chains to is also used for authentication.

  • If excludecaname:yes is specified, the list of trusted root CAs is not sent as part of the certificate request, which prevents the potential disclosure of sensitive information about the trust relationships of a computer. To enhance security for computers connected to the Internet, specify this option.

  • The use of preshared key authentication is not recommended because it is a relatively weak authentication method. In addition, preshared keys are stored in plaintext.

  • IPsec peers must have at least one key exchange security method in common (one that uses the same settings) or negotiations will fail.

delete all

Deletes all IPsec policies, filters, and authentication methods, if possible, from the Security Policy Database (SPD).

Syntax

delete all

Parameters

None.

delete mmpolicy

Deletes the specified IPsec Main Mode policy, or all IPsec Main Mode policies, from the SPD.

Syntax

delete mmpolicy [ name = ]{ MMPolicyName | all }

Parameters

[ name = ] { MMPolicyName | all }

Required. Specifies the name of the IPsec Main Mode policy to delete. Or, if all is specified, all IPsec Main Mode policies are deleted.

Remarks

  • If a rule is associated with the Main Mode policy, you must delete the rule before you can delete the policy.

  • All string parameters are case-sensitive.

delete qmpolicy

Deletes the specified IPsec Quick Mode policy, or all IPsec Quick Mode policies, from the SPD.

Syntax

delete qmpolicy [ name = ]{ QMPolicyName | all }

Parameters

[ name = ] { QMPolicyName | all }

Required. Specifies the name of the IPsec Quick Mode policy to delete. Or, if all is specified, all IPsec Quick Mode policies are deleted.

Remarks

  • If a rule is associated with the Quick Mode policy, you must delete the rule before you can delete the policy.

  • All string parameters are case-sensitive.

delete rule

Deletes an IPsec rule from the security policy database.

Syntax

delete rule [ srcaddr = ]{ Me | Any | IPAddress | IPRange | ServerType } [ dstaddr = ]{ Me | Any | IPAddress | IPRange | ServerType } [ protocol = ]{ ANY | ICMP | TCP | UDP | RAW | Integer } [ srcport = ] Integer [ dstport = ] Integer [ mirrored = ]{ yes | no } [ conntype = ]{ lan | dialup | all } [ [ srcmask = ]{ Mask | Prefix } ] [ [ dstmask = ]{ Mask | Prefix } ] [ [ tunneldstaddress = ]{ IPAddress | DNSName } ]

Parameters

[ srcaddr = ] { Me | Any | IPAddress | IPRange | ServerType }

Required. Specifies the source IP address, DNS name, or server type for the IP traffic. You can use WINS, DNS, DHCP, or gateway for ServerType.

[ dstaddr = ] { Me | Any | IPAddress | IPRange | ServerType }

Required. Specifies the destination IP address, DNS name, or server type for the IP traffic. You can use WINS, DNS, DHCP, or gateway for ServerType.

[ protocol = ] { ANY | ICMP | TCP | UDP | RAW | Integer }

Required. Specifies the IP protocol used for the filter.

[ srcport = ] Integer

Required. Specifies the source port number of the packets being filtered. This option only applies if you are filtering TCP or UDP packets.

[ dstport = ] Integer

Required. Specifies the destination port number of the packets being filtered. This option only applies if you are filtering TCP or UDP packets.

[ mirrored = ]{ yes | no }

Required. Specifies whether the rule was created with mirrored filters.

[ conntype=] = ] { lan | dialup | all }

Required. Specifies whether the rule to be deleted applies only to remote access/dial-up connections, to local area network (LAN) connections, or to all connections.

[ [ srcmask = ] { Mask | Prefix } ]

Specifies the source address subnet mask or the prefix of the packets being filtered. You can specify a prefix value in the range of 1 through 32. The default value is the mask of 255.255.255.255.

[ [ dstmask = ] { Mask | Prefix } ]

Specifies the destination address subnet mask or the prefix value of the packets being filtered. You can specify a prefix value in the range of 1 through 32. The default value is the mask of 255.255.255.255.

[ [ tunneldstaddress = ] { IPAddress | DNSName } ]

Specifies whether the traffic is tunneled and, if it is, the IP address or DNS name of the tunnel destination (the computer or gateway on the other side of the tunnel).

delete sa

Deletes Main Mode security associations.

Syntax

delete sa [ [ srcaddr = ]{ IPv4Address } ] [ [ dstaddr = ]{ IPv4Address } ]

Parameters

[ [ srcaddr = ] { IPv4Address } ]

Specifies the source IPv4 address to match against existing SAs.

[ [ dstaddr = ] { IPv4Address } ]

Specifies the destination IPv4 address to match against existing SAs.

Remarks

  • If no parameters are supplied the command deletes all Main Mode associations. Any currently active network connections that require IPsec protection immediately renegotiate with the remote host.

set config

Creates or modifies the following IPsec settings: IPsec diagnostics, default traffic exemptions, strong certificate revocation list (CRL) checking, IKE (Oakley) logging, logging intervals, computer startup security, and computer startup traffic exemptions.

Syntax

set config [ property = ]{ PropertyToSet } [ value = ] ValueToAssign

Parameters

The property must be specified, and can be any of the options shown here:

IPsecdiagnostics { 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 }

Note
This option is included only for backwards compatibility. It is not valid on Windows Vista or later operating systems.

Specifies whether to enable IPsec diagnostic logging and, if so, which level of logging to provide. The default value is 0, meaning that logging is disabled. If you change the value for this setting, you must restart the computer for the new value to take effect.

You can specify other values as follows, to enable different levels of logging:

  • 1: Bad SPI packets (the total number of packets for which the Security Parameters Index or SPI was incorrect), IKE negotiation failures, IPsec processing failures, packets received with packet syntax that is not valid, and other errors are recorded in the System log. Unauthenticated hashes (with the exception of the "Clear text received when should have been secured" event) are logged as well.

  • 2: Inbound per-packet drop events are recorded in the System log.

  • 3: Level 1 and level 2 logging are performed. In addition, unexpected clear text events (packets that are sent or received in plaintext) are also recorded.

  • 4: Outbound per-packet drop events are recorded in the System log.

  • 5: Level 1 and level 4 logging are performed.

  • 6: Level 2 and level 4 logging are performed.

  • 7: All levels of logging are performed.

ikelogging { 0 | 1 }

Note
This option is included only for backwards compatibility. It is not valid on Windows Vista or later operating systems.

Specifies whether to enable IKE (Oakley) logging, to generate details about the SA establishment process. The default value is 0, meaning that IKE logging is disabled.

strongcrlcheck { 0 | 1 | 2 }

Specifies the level of CRL checking to use. The default value is 1.

  • 0: CRL checking is disabled.

  • 1: Standard CRL checking is used, and certificate validation fails only if the certificate is determined to be revoked.

  • 2: Strong CRL checking is used, and certificate validation fails if any CRL check error occurs.

IPsecloginterval {Integer}

Note
This option is included only for backwards compatibility. It is not valid on Windows Vista or later operating systems.

Specifies the interval, in seconds, after which IPsec event logs are sent to the System log. For Integer, valid values range from 60 through 86400. The default value is 3600. If you change the value for this setting, you must restart the computer for the new value to take effect.

IPsecexempt { 0 | 1 | 2 | 3 }

Specifies whether to modify the default IPsec traffic exemption (traffic that is not matched against IPsec filters but is still permitted). The default value is 3. If you change the value for this setting, you must restart the computer for the new value to take effect.

You can specify other values as follows:

  • 0: Multicast, broadcast, RSVP, Kerberos, and IKE traffic is exempted from IPsec filtering.

  • 1: Only multicast, broadcast, and IKE traffic is exempted from IPsec filtering (Kerberos and RSVP traffic is not exempted).

  • 2: Only RSVP, Kerberos, and IKE is exempted from IPsec filtering (multicast and broadcast traffic is not exempted).

  • 3: Only IKE traffic is exempted.

bootmode { stateful | block | permit }

Note
This option is included only for backwards compatibility. It is not valid on Windows Vista or later operating systems.

Specifies the action that IPsec is required to take when the computer starts.

  • stateful: Only the following traffic is permitted during computer startup: outbound traffic initiated by the computer during startup, inbound traffic that is sent in response to the outbound traffic, and DHCP traffic.

  • block: All inbound and outbound traffic is blocked until a local IPsec policy or a domain-based IPsec policy is applied.

  • permit: All traffic is transmitted and received.

The default value is stateful. If you use either of the values stateful or block, you can use the bootexemptions parameter to specify traffic types that you want to exempt from IPsec filtering during computer startup.

If you change the value for this setting, you must restart the computer for the new value to take effect.

bootexemptions { none | "Exempt1 Exempt2 …" }

Note
This option is included only for backwards compatibility. It is not valid on Windows Vista or later operating systems.

Specifies one or more IPsec traffic exemptions from startup security, separated by spaces and defined by the following format for TCP and UDP traffic: protocol:srcport:dstport:direction and the following format for non-TCP/UDP traffic: protocol:direction, where:

protocol ={ ICMP| TCP| UDP| RAW| Integer }

Specifies the IP protocol type to exempt from IPsec filtering during computer startup.

srcport = Port

Specifies the source port number of the packets to exempt from IPsec filtering during computer startup. A value of 0 means that any source port is exempted.

dstport = Port

Specifies the destination port number of the packets to exempt from IPsec filtering during computer startup. A value of 0 means that any destination port is exempted.

direction ={ inbound | outbound}

Specifies the direction of the traffic to exempt from IPsec filtering during computer startup.

Remarks

  • Use strong CRL checking (set property=strongcrlcheck value=2) if the CRL distribution point must be reachable on the network and certificates can only be validated if no CRL check error occurs.

  • IPsec can only negotiate security associations for Kerberos traffic if your IPsec policy does not use Kerberos as the authentication method. If Kerberos is required for authentication, you must exempt Kerberos traffic by using the IPsecexempt parameter.

  • By default, in Windows 2000, Windows XP, and Windows Server 2003, all broadcast, multicast, Internet Key Exchange (IKE), Kerberos, and Resource Reservation Protocol (RSVP) traffic was exempted from IPsec filtering. In Windows Vista and Windows Server 2008, only IKE traffic is exempted from IPsec filtering by default. All other traffic types are matched against IPsec filters, and you can configure block or permit filter actions specifically for multicast and broadcast traffic (IPsec does not negotiate security associations for multicast and broadcast traffic).

    As a result of this change in default behavior for IPsec, you should verify the behavior of IPsec policies designed for earlier versions of Windows to determine whether to configure explicit permit filters to permit specific traffic types. To restore the default behavior of IPsec policies in previous versions of Windows, edit the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPsec. Add a new DWORD value named NoDefaultExempt and assign to it a value of 0.

Caution
Modifying IPsec traffic exemptions from startup security (that is, modifying the bootexemptions= parameter) will overwrite all previous exemptions from startup security.

set mmpolicy

Modifies an IPsec Main Mode policy and writes the changes to the security policy database.

Syntax

set mmpolicy name = PolicyName [ qmperm = Integer ] [ mmlifetime = Integer ] [ softsaexpirationtime = Integer ] [ mmsecmethods = "KeyExchMethods" ]

Parameters

name = PolicyName

Required. Specifies the name of the IPsec Main Mode policy to modify.

[ qmperm = Integer ]

Specifies the number of times that master keying material is used to derive the session key. A value of 0 means that an unlimited number of Quick Mode SAs can be derived from the Main Mode SA.

[ mmlifetime = Integer ]

Specifies the number of minutes after which a new master key is generated.

[ softsaexpirationtime = Integer ]

Specifies the number of minutes after which an unprotected security association expires.

[ mmsecmethods = "KeyExchMethods" ]

Specifies one or more key exchange security methods, separated by spaces. Each method is described by a string of the following format:

EncAlg-HashAlg-GroupNumb

Where:

EncAlg

Specifies the encryption algorithm. EncAlg can be DES or 3DES.

HashAlg

Specifies the hashing algorithm. HashAlg can be MD5 or SHA1.

GroupNum

Specifies the Diffie-Hellman group to be used for the base keying material. GroupNumb can be: 1 (low, protects with 768 bits of keying material), 2 (medium, protects with 1024 bits), and 3 (high, protects with 2048 bits).

Remarks

  • IPsec peers must have at least one common key exchange security method (one that uses the same settings) or negotiations will fail.

  • We recommend that you do not use DES or MD5. These cryptographic algorithms are no longer considered secure, and are provided for backwards-compatibility only.

  • If the number of Quick Mode negotiations will exceed the value set for the number of Quick Mode negotiations per Main Mode negotiation during the Main Mode lifetime, a new Main Mode negotiation occurs.

  • Unlike most netsh commands, both the add mmpolicy and the set mmpolicy commands require that the parameter name and equal sign be included before the value for each parameter that you use.

  • All string parameters are case-sensitive.

set qmpolicy

Modifies an IPsec Quick Mode policy and writes the changes to the SPD.

Syntax

set qmpolicy name = PolicyName [ soft = { yes | no } ] [ pfsgroup = { grp1 | grp2 | grp3 | grpmm | nopfs } ] [ qmsecmethods = "SecMethodsString" ]

Parameters

name = PolicyName

Required. Specifies the name of the IPsec Quick Mode policy to modify.

[ soft = { yes | no } ]

Specifies whether to fall back to unsecured communications with other computers that do not support IPsec, or when IPsec negotiations with an IPsec-capable computer fail.

[ pfsgroup = { grp1 | grp2 | grp3 | grpmm | nopfs } ]

Specifies the Diffie-Hellman group to use for session key PFS. If grp1 is specified, Group 1 (low, with 768 bits of keying material) is used. If grp2 is specified, Group 2 (medium, with 1024 bits of keying material) is used. If grp3 is specified, Group 3 (high, with 2048 bits of keying material) is used. If grpmm is specified, the group value is taken from the current Main Mode settings.

[ qmsecmethods = "SecMethodsString" ]

Changes the string that specifies one or more security methods. Each method is described by one of the following formats, separated by spaces:

  • ESP [ EncAlg,AuthAlg]:num k/num s

  • AH [ HashAlg ]: num k/ num s

  • AH [ HashAlg ]+ ESP[ EncAlg,AuthAlg]:num k/num s

Where:

EncAlg

Specifies the encryption algorithm. ConfigAlg can be DES, 3DES, or none.

AuthAlg

Specifies the integrity algorithm. AuthAlg can be MD5, SHA1, or none.

HashAlg

Specifies the hash function. HashAlg can be MD5 or SHA1.

k

Specifies the session key lifetime in kilobytes. After the specified number of kilobytes of data is transferred, a new session key for the Quick Mode SA is generated. The default value is 100,000 kilobytes.

s

Specifies the session key lifetime in seconds. The default value is 3600 seconds.

Remarks

  • The preference order of each Quick Mode security method is determined by the order in which it was specified in the command.

  • IPsec peers must have the same pfsgroup enabled (that is, both peers must use the same Diffie-Hellman group for session key PFS), or communication will fail.

  • We recommend that you do not use DES or MD5. These cryptographic algorithms are no longer considered secure, and are provided for backwards-compatibility only.

  • For enhanced security, do not use Diffie-Hellman Group 1. For maximum security, use Group 3 whenever possible. Use Group 2 when required for interoperability with earlier versions of Windows.

  • Unlike most netsh commands, both the add qmpolicy and the set qmpolicy commands require that the parameter name and equal sign be included before the value for each parameter that you use.

  • All string parameters are case-sensitive.

set rule

Modifies an IPsec rule that defines a set of filters and writes the changes to the SPD.

Syntax

set rule [ srcaddr = ]{ me | any | IPAddr | IPAddr-IPAddr | ServerType } [ dstaddr = ]{ me | any | IPAddr | IPAddr-IPAddr | ServerType } [ protocol = ]{ ANY | ICMP | TCP | UDP | RAW | Integer } [ srcport = ] Integer [ dstport = ] Integer [ mirrored = ]{ yes | no } [ conntype = ]{ lan | dialup | all } [ [ srcmask = ]{ Mask | Prefix } ] [ [ dstmask = ]{ Mask | Prefix } ] [ [ tunneldstaddress = ] { IPAddress | DNSName } ] [ [ mmpolicy = ] MainModePolicyName ] [ [ qmpolicy = ] QuickModePolicyName ] [ [ actioninbound = ]{ permit | block | negotiate } ] [ [ actioninbound = ]{ permit | block | negotiate } ] [ [ kerberos = ]{ yes | no } ] [ [ psk = ] PreSharedKey ] [ [ rootca = ] "String certmap:{ yes | no } excludecaname:{ yes | no }" ]

Parameters

[ srcaddr = ] { me | any | IPAddr | IPAddr-IPAddr |ServerType}

Required. Specifies the source IP address or range, DNS name, or server type for the IP traffic being matched. For ServerType you can use WINS, DNS, DHCP, or gateway.

[ dstaddr = ] { me | any | IPAddr | IPAddr-IPAddr |ServerType}

Required. Specifies the destination IP address or range, DNS name, or server type for the IP traffic being matched. For ServerType you can use WINS, DNS, DHCP, or gateway.

[ protocol = ] { ANY | ICMP | TCP | UDP | RAW | Integer }

Specifies the IP protocol if, in addition to addressing information, a specific IP protocol is filtered. A value of ANY matches filters with a protocol setting of any.

[ srcport = ] Integer

Required. Specifies the source port number of the packets being filtered. This option only applies if you are filtering TCP or UDP packets.

[ dstport = ] Integer

Required. Specifies the destination port number of the packets being filtered. This option only applies if you are filtering TCP or UDP packets.

[ mirrored = ] { yes | no }

Required. Specifies whether the rule was created with mirrored filters.

[ conntype = ] { lan | dialup | all }

Required. Specifies whether the rule applies only to remote access or dial-up connections or to local area network (LAN) connections, or to all connections.

[ [ srcmask = ] {Mask|Prefix} ]

Specifies the source address subnet mask or the prefix of the packets being filtered. You can specify a prefix value in the range of 1 through 32. The default value is the mask of 255.255.255.255.

[ [ dstmask = ] {Mask|Prefix} ]

Specifies the destination address subnet mask or the prefix value of the packets being filtered. You can specify a prefix value in the range of 1 through 32. The default value is the mask of 255.255.255.255.

[ [ tunneldstaddress = ] { IPAddress | DNSName } ]

Specifies whether the traffic is tunneled and, if it is, the IP address or DNS name of the tunnel destination (the computer or gateway on the other side of the tunnel).

[ [ mmpolicy = ] MainModePolicyName ]

Specifies the name of the Main Mode policy.

[ [ qmpolicy = ] QuickModePolicyName ]

Specifies the name of the Quick Mode policy.

[ [ actioninbound = ] { permit | block | negotiate } ]

Specifies the action that IPsec is required to take for inbound traffic. If permit is specified, traffic is received without negotiating or applying IP security. If block is specified, traffic is blocked. If negotiate is specified, IP security is used, with the list of security methods specified in the Main Mode and Quick Mode policies.

[ [ actioninbound = ] { permit | block | negotiate } ]

Specifies the action that IPsec is required to take for outbound traffic. If permit is specified, traffic is sent without negotiating or applying IP security. If block is specified, traffic is blocked. If negotiate is specified, IP security is used, with the list of security methods specified in the Main Mode and Quick Mode policies.

[ [ kerberos = ]{ yes | no } ]

Specifies whether to use the Kerberos V5 protocol as an authentication method.

[ [ psk = ] PreSharedKey ]

Specifies the string of characters to use for the preshared key, if a preshared key is used as an authentication method.

[ [ rootca = ] "String certmap:{ yes | no } excludecaname:{ yes | no } " ]

Specifies certificate authentication options. The argument is a string in quotes that contains the following elements:

String

Specifies the distinguished name of the certificate, if a certificate is used as an authentication method.

certmap:{ yes | no }

Specifies whether to enable certificate-to-account mapping. You can enable certificate-to-account mapping to verify that the certificate is being used by a trusted computer.

excludecaname:{ yes | no }

Specifies whether to exclude from the certificate request the list of trusted root CA names from which a certificate is accepted.

Remarks

  • All parameters identified as required are used to identify the rule that you want to modify, and therefore they cannot be modified. You can modify any of the other parameters, and you must include at least one of the optional parameters to change.

  • If the filter action for both inbound and outbound traffic (actioninbound and actionoutbound) is set to Permit or Block, a Quick Mode filter is not required.

  • You can only use Kerberos V5 authentication or certificate-to-account mapping for computers that are members of an Active Directory domain.

  • Although you can use only one preshared key for authentication, you can use multiple certificates by specifying the rootca parameter multiple times, once for each certificate you want to use.

  • All certificate authentication parameters must be contained within a pair of quotation marks. To embed a quotation mark within the parameter, use a backslash followed by an apostrophe (\').

  • The preference order of each authentication method is determined by the order in which it was specified in the command.

  • If no authentication methods are specified, dynamic defaults are used. By default, IPsec policies use Kerberos V5 authentication. If the computer has a computer certificate, any root CA to which the computer certificate chains is also used for authentication.

  • If excludecaname:yes is specified, the list of trusted root CAs is not sent as part of the certificate request, which prevents the potential disclosure of sensitive information about the trust relationships of a computer. To enhance security for computers connected to the Internet, specify this option.

  • The use of preshared key authentication is not recommended because it is a relatively weak authentication method. In addition, preshared keys are stored in plaintext.

  • IPsec peers must have at least one key exchange security method in common (one that uses the same settings) or negotiations will fail.

  • Modifying authentication methods will overwrite all previous authentication methods, even if the previous authentication methods were different. For example, if kerberos=yes and a value for psk were previously specified, and then you specify kerberos=no, the psk parameter will also be overwritten, and preshared key authentication will no longer be used.

  • All string parameters are case-sensitive.

show all

Displays configuration information for all IPsec policies, filters, statistics, and security associations in the security policy database.

Syntax

show all [ [ resolvedns = ]{ yes | no } ]

Parameters

[ [ resolvedns = ] { yes | no } ]

Specifies whether to resolve the Domain Name System (DNS) or NETBIOS computer name associated with an IP address when displaying sources or destinations.

Remarks

  • Because the show all command can result in lengthy, rapidly scrolling output, consider saving the output in a text file, unless you only need to view limited portions.

    To save output in a text file for the show all command, do either of the following:

    If you are in the netsh environment (netsh>)

    1. At the netsh prompt, type:

      set file open FileName.txt

    2. Then type:

      IPsec dynamic show all

    3. To stop sending output and close the file, type:

      set file close

    If you are not in the netsh environment

    • At the command prompt, type:

      netsh ipsec dynamic show all > FileName.txt

  • To stop the output of IPsec configuration information, you must exit Netsh by doing one of the following:

    • Close the Netsh window by clicking the X icon in the upper-right corner of the window.

    • Use Task Manager to end the Netsh program.

show config

Displays values for the following IPsec settings: IPsec diagnostics, default traffic exemptions, strong certificate revocation list (CRL) checking, IKE (Oakley) logging, logging intervals, computer startup security, and computer startup traffic exemptions.

Syntax

show config

Parameters

None.

Remarks

  • To save output in a text file for the show config command, do either of the following:

    If you are in the netsh environment (netsh>)

    1. At the netsh prompt, type:

      set file open FileName.txt

    2. Then type:

      IPsec dynamic show config

    3. To stop sending output and close the file, type:

      set file close

    If you are not in the netsh environment

    • At the command prompt, type:

      netsh ipsec dynamic show config > FileName.txt

show mmfilter

Displays configuration information for the specified IPsec Main Mode filter, or for all IPsec Main Mode filters, in the SPD.

Syntax

show mmfilter { [ name = ] FilterName | all } [ [ type = ]{ generic | specific } ] [ [ srcaddr = ]{ me | any | IPAddr | IPAddr-IPAddr | ServerType } ] [ [ dstaddr = ]{ me | any | IPAddr | IPAddr-IPAddr | ServerType } ] [ [ srcmask = ]{ Mask | Prefix } ] [ [ dstmask = ]{ Mask | Prefix } ] [ resolvedns = { yes | no } ]

Parameters

{ [ name = ] FilterName | all }

Required. Specifies the name of the IPsec Main Mode filter to display. If all is specified, all IPsec Main Mode filters are displayed.

[ [ type = ] { generic| specific} ]

Specifies whether to display generic or specific Main Mode filters. The default value is generic.

[ [ srcaddr = ] { me | any | IPAddr | IPAddr-IPAddr |ServerType} ]

Specifies the source IP address, either IPv4 or IPv6, or an IPv4 or IPv6 address range, DNS name, or server type for the IP traffic. For ServerType, you can use WINS, DNS, DHCP, or GATEWAY.

[ [ dstaddr = ] { me | any | IPAddr | IPAddr-IPAddr |ServerType} ]

Specifies the destination IP address, either IPv4 or IPv6, or an IPv4 or IPv6 address range, DNS name, or server type for the IP traffic. For ServerType, you can use WINS, DNS, DHCP, or GATEWAY.

[ [ srcmask = ] { Mask | Prefix } ]

Specifies the source address subnet mask or the prefix of the packets to be filtered. You can specify a prefix value in the range of 1 through 32. The default value is the mask of 255.255.255.255.

[ [ dstmask = ] { Mask | Prefix } ]

Specifies the destination address subnet mask or the prefix value of the packets to be filtered. You can specify a prefix value in the range of 1 through 32. The default value is the mask of 255.255.255.255.

[ resolvedns={ yes | no}]

Specifies whether to resolve the Domain Name System (DNS) or NETBIOS computer name associated with an IP address when displaying sources or destinations. The default value is no.

Remarks

  • All string parameters are case-sensitive.

  • Because the show mmfilter command can result in lengthy, rapidly scrolling output, consider saving the output in a text file, unless you only need to view limited portions.

    To save output in a text file for the show mmfilter command, do either of the following:

    If you are in the netsh environment (netsh>)

    1. At the netsh prompt, type:

      set file open FileName.txt

    2. Then type:

      IPsec dynamic show mmfilter parameters

    3. To stop sending output and close the file, type:

      set file close

    If you are not in the netsh environment

    • At the command prompt, type:

      IPsec dynamic show mmfilter parameters >= FileName.txt

  • To stop the output of IPsec configuration information, you must exit Netsh by doing one of the following:

    • Close the Netsh window by clicking the X icon in the upper-right corner of the window.

    • Use Task Manager to end the Netsh program.

show mmpolicy

Displays configuration information for the specified IPsec Main Mode policy, or for all IPsec Main Mode policies, in the SPD.

Syntax

show mmpolicy { [ name = ] PolicyName | all }

Parameters

{ [ name = ] PolicyName | all }

Required. Specifies the name of the IPsec Main Mode policy to display. Or, if all is specified, all IPsec Main Mode policies are displayed.

Remarks

  • All string parameters are case-sensitive.

  • Because the show mmpolicy command can result in lengthy, rapidly scrolling output, consider saving the output in a text file, unless you only need to view limited portions.

    For example, to save output in a text file for the show mmpolicy all command, do either of the following:

    If you are in the netsh environment (netsh>)

    1. At the netsh prompt, type:

      set file open FileName.txt

    2. Then type:

      IPsec dynamic show mmpolicy all

    3. To stop sending output and close the file, type:

      set file close

    If you are not in the netsh environment

    • At the command prompt, type:

      IPsec dynamic show mmpolicy all > FileName.txt

  • To stop the output of IPsec configuration information, you must exit Netsh by doing one of the following:

    • Close the Netsh window by clicking the X icon in the upper-right corner of the window.

    • Use Task Manager to end the Netsh program.

show mmsas

Displays the IPsec Main Mode security associations for the specified source and destination addresses, or all IPsec Main Mode security associations, in the SPD.

Syntax

show mmsa [ all ] [ [ srcaddr = ]{ me | any | IPAddr | IPAddr-IPAddr | ServerType } ] [ [ dstaddr = ]{ me | any | IPAddr | IPAddr-IPAddr | ServerType } ] [ [ format = ]{ list | table } ] [ [ resolvedns = ]{ yes | no} ]

Parameters

[ all ]

Specifies that all Main Mode security associations are displayed. This is the default option if no other parameters are specified.

[ [ srcaddr = ] { me | any | IPAddr | IPAddr-IPAddr |ServerType} ]

Specifies the source IP address, either IPv4 or IPv6, or an IPv4 or IPv6 address range, DNS name, or server type for the IP traffic. For ServerType, you can use WINS, DNS, DHCP, or GATEWAY.

[ [ dstaddr = ] { me | any | IPAddr | IPAddr-IPAddr |ServerType} ]

Specifies the destination IP address, either IPv4 or IPv6, or an IPv4 or IPv6 address range, DNS name, or server type for the IP traffic. For ServerType, you can use WINS, DNS, DHCP, or GATEWAY.

[ [ format = ] { list | table } ]

Specifies whether to display IPsec configuration information in screen or tab-delimited format. The default value is list, meaning that output is displayed in screen format.

[ [ resolvedns={ yes | no} ] ]

Specifies whether to resolve the DNS or NETBIOS computer name associated with an IP address when displaying sources or destinations. The default value is no.

Remarks

  • If no parameters are specified, all Main Mode security associations are displayed in list format.

  • All string parameters are case-sensitive.

  • Because the show mmsas command can result in lengthy, rapidly scrolling output, consider saving the output in a text file, unless you only need to view limited portions.

    To save output in a text file for the show mmsas command, do either of the following:

    If you are in the netsh environment (netsh>)

    1. At the netsh prompt, type:

      set file open FileName.txt

    2. Then type:

      IPsec dynamic show mmsas

    3. To stop sending output and close the file, type:

      set file close

    If you are not in the netsh environment

    • At the command prompt, type:

      netsh ipsec dynamic show mmsas > FileName.txt

  • To stop the output of IPsec configuration information, you must exit Netsh by doing one of the following:

    • Close the Netsh window by clicking the X icon in the upper-right corner of the window.

    • Use Task Manager to end the Netsh program.

show qmfilter

Displays configuration information for the specified Quick Mode filter, or for all Quick Mode filters, in the SPD.

Syntax

show qmfilter { [ name = ] FilterName | all } [ [ type = ]{ generic | specific } ] [ [ srcaddr = ]{ me | any | IPAddr | IPAddr-IPAddr | ServerType } ] [ [ dstaddr = ]{ me | any | IPAddr | IPAddr-IPAddr | ServerType } ] [ [ srcmask = ]{ Mask | Prefix } ] [ [ dstmask = ]{ Mask | Prefix } ] [ [ protocol = ]{ ANY | ICMP | TCP | UDP | RAW | Integer } ] [ [ srcport = ] Integer ] [ [ dstport = ] Integer ] [ [ actioninbound = ]{ permit | block | negotiate } ] [ [ actionoutbound = ]{ permit | block | negotiate } ] [ [ resolvedns={ yes | no} ] ]

Parameters

{ [ name = ] FilterName | all }

Required. Specifies the name of the IPsec Quick Mode filter to display. If all is specified then all IPsec Quick Mode filters are displayed.

[ [ type = ] { generic | specific } ]

Specifies whether to display generic or specific Quick Mode filters. The default value is generic.

[ [ srcaddr = ] { me | any | IPAddr | IPAddr-IPAddr |ServerType} ]

Specifies that only filters matching the specified source IP address, DNS name, or server type are displayed. You can use WINS, DNS, DHCP, or gateway for ServerType.

[ [ dstaddr = ] { me | any | IPAddr | IPAddr-IPAddr |ServerType} ]

Specifies that only filters matching the destination IP address, DNS name, or server type are displayed. You can use WINS, DNS, DHCP, or gateway for ServerType.

[ [ srcmask = ] { Mask | Prefix } ]

Specifies the source address subnet mask or the prefix of the packets being filtered. You can specify a prefix value in the range of 1 through 32.

[ [ dstmask = ] { Mask | Prefix } ]

Specifies the destination address subnet mask or the prefix value of the packets being filtered. You can specify a prefix value in the range of 1 through 32.

[ [ protocol = ] { ANY | ICMP | TCP | UDP | RAW | Integer } ]

Specifies that only filters that match the IP protocol are displayed.

[ [ srcport = ] Integer ]

Specifies that only filters that match the source port number are displayed.

[ [ dstport = ] Integer ]

Specifies that only filters that match the destination port number are displayed.

[ [ actioninbound = ] { permit | block | negotiate } ]

Specifies that only filters matching the action are displayed.

[ [ actionoutbound = ] { permit | block | negotiate } ]

Specifies that only filters matching the action are displayed.

Remarks

  • All string parameters are case-sensitive.

  • Because the show qmfilter command can result in lengthy, rapidly scrolling output, consider saving the output in a text file, unless you only need to view limited portions.

    For example, to save output in a text file for the show qmfilter all command, do either of the following:

    If you are in the netsh environment (netsh>)

    1. At the netsh prompt, type:

      set file open FileName.txt

    2. Then type:

      IPsec dynamic show qmfilter all

    3. To stop sending output and close the file, type:

      set file close

    If you are not in the netsh environment

    • At the command prompt, type:

      netsh ipsec dynamic show qmfilter all >FileName.txt

  • To stop the output of IPsec configuration information, you must exit Netsh by doing one of the following:

    • Close the Netsh window by clicking the X icon in the upper-right corner of the window.

    • Use Task Manager to end the Netsh program.

show qmpolicy

Displays configuration information for the specified IPsec Quick Mode policy, or for all IPsec Quick Mode policies, in the SPD.

Syntax

show qmpolicy { [ name = ] FilterName | all }

Parameters

{ [ name = ] FilterName | all }

Required. Specifies the name of the IPsec Quick Mode policy to display. If all is specified then all IPsec Quick Mode policies are displayed.

Remarks

  • All string parameters are case-sensitive.

  • Because the show qmpolicy command can result in lengthy, rapidly scrolling output, consider saving the output in a text file, unless you only need to view limited portions.

    For example, to save output in a text file for the show qmpolicy all command, do either of the following:

    If you are in the netsh environment (netsh>)

    1. At the netsh prompt, type:

      set file open FileName.txt

    2. Then type:

      IPsec dynamic show qmpolicy all

    3. To stop sending output and close the file, type:

      set file close

    If you are not in the netsh environment

    • At the command prompt, type:

      netsh ipsec dynamic show qmpolicy all >FileName.txt

  • To stop the output of IPsec configuration information, you must exit Netsh by doing one of the following:

    • Close the Netsh window by clicking the X icon in the upper-right corner of the window.

    • Use Task Manager to end the Netsh program.

show qmsas

Displays the IPsec Quick Mode security associations for the specified source and destination addresses, or all IPsec Quick Mode security associations, in the SPD.

Syntax

show qmsas [ all ] [ [ srcaddr = ] { me | any | IPAddr | IPAddr-IPAddr | ServerType} ] [ [ dstaddr = ] { me | any | IPAddr | IPAddr-IPAddr | ServerType} ] [ [ protocol = ] { ANY | ICMP | TCP | UDP | RAW | Integer } ] [ [ format = ] { list | table } ] [ [ resolvedns={ yes | no} ] ]

Parameters

[ all]

Specifies that all IPsec Quick Mode security associations are displayed. This is the default option if no other parameters are specified.

[ [ srcaddr = ] { me | any | IPAddr | IPAddr-IPAddr | ServerType} ]

Specifies that only SAs that match the source IPv4 or IPv6 address, address range, DNS name, or server type are displayed. You can use WINS, DNS, DHCP, or gateway for ServerType.

[ [ dstaddr = ] { me | any | IPAddr | IPAddr-IPAddr | ServerType} ]

Specifies that only SAs that match the destination IPv4 or IPv6 address, address range, DNS name, or server type are displayed. You can use WINS, DNS, DHCP, or gateway for ServerType.

[ [ protocol = ] { ANY | ICMP | TCP | UDP | RAW | Integer } ]

Specifies that only SAs that match the IP protocol if, in addition to addressing information, a specific IP protocol is being used for the security association.

[ [ format = ] { list | table } ]

Specifies whether to display the results in screen or tab-delimited format. The default value is list, meaning that output is displayed in screen format.

[ [ resolvedns={ yes | no} ] ]

Specifies whether to resolve the Domain Name System (DNS) or NETBIOS computer name associated with an IP address when displaying sources or destinations. The default value is no.

Remarks

  • Because the show qmsas command can result in lengthy, rapidly scrolling output, consider saving the output in a text file, unless you only need to view limited portions.

    For example, to save output in a text file for the show qmsas all command, do either of the following:

    If you are in the netsh environment (netsh>)

    1. At the netsh prompt, type:

      set file open FileName.txt

    2. Then type:

      IPsec dynamic show qmsas all

    3. To stop sending output and close the file, type:

      set file close

    If you are not in the netsh environment

    • At the command prompt, type:

      netsh ipsec dynamic show qmsas all > FileName.txt

  • To stop the output of IPsec configuration information, you must exit Netsh by doing one of the following:

    • Close the Netsh window by clicking the X icon in the upper-right corner of the window.

    • Use Task Manager to end the Netsh program.

show rule

Displays configuration information for one or more IPsec rules in the SPD.

Syntax

show rule [ [ type = ]{ transport | tunnel } ] [ [ srcaddr = ]{ me | any | IPAddr | IPAddr-IPAddr |ServerType} ] [ [ dstaddr = ]{ me | any | IPAddr | IPAddr-IPAddr |ServerType} ] [ [ srcmask = ]{ Mask | Prefix } ] [ [ dstmask = ] { Mask | Prefix } ] [ [ protocol = ]{ ANY | ICMP | TCP | UDP | RAW | Integer } ] [ [ srcport = ] Integer ] [ [ dstport = ] Integer ] [ [ actioninbound = ]{ permit | block | negotiate } ] [ [ actionoutbound = ]{ permit | block | negotiate } ] [ [ resolvedns = ]{ yes | no} ]

Parameters

[ [ type = ] { transport | tunnel } ]

Specifies whether to display transport rules or tunnel rules. The default value is to display all rules.

[ [ srcaddr = ] { me | any | IPAddr | IPAddr-IPAddr |ServerType} ]

Specifies that only rules matching the source IP address, DNS name, or server type are displayed. You can use WINS, DNS, DHCP, or gateway for ServerType.

[ [ dstaddr = ] { me | any | IPAddr | IPAddr-IPAddr |ServerType} ]

Specifies that only rules matching the destination IP address, DNS name, or server type are displayed. You can use WINS, DNS, DHCP, or gateway for ServerType.

[ [ srcmask = ] { Mask | Prefix } ]

Specifies that only rules matching the source address subnet mask or the prefix of the packets are displayed. You can specify a prefix value in the range of 1 through 32.

[ [ dstmask = ] { Mask | Prefix } ]

Specifies that only rules matching the source address subnet mask or the prefix of the packets are displayed. You can specify a prefix value in the range of 1 through 32.

[ [ protocol = ] { ANY | ICMP | TCP | UDP | RAW | Integer } ]

Specifies that only filters that match the IP protocol are displayed.

[ [ srcport = ] Integer ]

Specifies that only filters that match the source port number are displayed.

[ [ dstport = ] Integer ]

Specifies that only filters that match the destination port number are displayed.

[ [ actioninbound = ] { permit | block | negotiate } ]

Specifies that only filters matching the action are displayed.

[ [ actionoutbound = ] { permit | block | negotiate } ]

Specifies that only filters matching the action are displayed.

[ resolvedns={ yes | no}]

Specifies whether to resolve the DNS or NETBIOS computer name associated with an IP address when displaying sources or destinations. The default value is no.

Remarks

  • All string parameters are case-sensitive.

  • Because the show rule command can result in lengthy, rapidly scrolling output, consider saving the output in a text file, unless you only need to view limited portions.

    For example, to save output in a text file for the show rule command, do either of the following:

    If you are in the netsh environment (netsh>)

    1. At the netsh prompt, type:

      set file open FileName.txt

    2. Then type:

      IPsec dynamic show rule

    3. To stop sending output and close the file, type:

      set file close

    If you are not in the netsh environment

    • At the command prompt, type:

      netsh ipsec dynamic show rule > FileName.txt

  • To stop the output of IPsec configuration information, you must exit Netsh by doing one of the following:

    • Close the Netsh window by clicking the X icon in the upper-right corner of the window.

    • Use Task Manager to end the Netsh program.

show stats

Displays Main Mode and Quick Mode statistics for IPsec.

Note
This command is included for backwards compatibility with earlier versions of Windows. Most of the statistics are only relevant on computers running those earlier versions of Windows.

Syntax

show stats [ [type = ]{ all | ike | ipsec } ]

Parameters

[ [type=] { all | ike | ipsec } ]

Specifies the IPsec statistics to display. If all is specified, IPsec Main Mode and Quick Mode statistics are displayed. If ike is specified, only IPsec Main Mode statistics are displayed. If ipsec is specified, only IPsec Quick Mode statistics are displayed.

Remarks

  • Because the show stats command can result in lengthy, rapidly scrolling output, consider saving the output in a text file, unless you only need to view limited portions.

    For example, to save output in a text file for the show stats command, do either of the following:

    If you are in the netsh environment (netsh>)

    1. At the netsh prompt, type:

      set file open FileName.txt

    2. Then type:

      IPsec dynamic show stats

    3. To stop sending output and close the file, type:

      set file close

    If you are not in the netsh environment

    • At the command prompt, type:

      netsh ipsec dynamic show stats > FileName.txt

  • To stop the output of IPsec configuration information, you must exit Netsh by doing one of the following:

    • Close the Netsh window by clicking the X icon in the upper-right corner of the window.

    • Use Task Manager to end the Netsh program.


Netsh Commands for Network Access Protection (NAP) Client
See Also

This section provides Netsh commands for NAP client configuration (netsh nap client).

NAP client commands

The following sections describe the commands for NAP client configuration.

You can use the commands in the Netsh NAP client context to configure all aspects of NAP clients. The Netsh commands for NAP client provide the same functionality as the NAP Client Management snap-in, and the commands can be run manually at the netsh prompt or in scripts and batch files.

To run these commands from the command prompt, you must either enter the netsh nap client context or prepend this context to the command. For example, if you are at the command prompt, you can enter the Netsh NAP client context by typing netsh and pressing ENTER, then typing nap client and pressing ENTER. Alternatively, you can issue a command by typing:

netsh nap client command

Where command is the command that you want to run, including all of the required parameters for the command.

For more information and a full netsh nap client command reference, see Netsh Commands for NAP Client.

For information on how to interpret netsh command syntax, see Formatting Legend.

See Also

Concepts

Network Access Protection Commands for NPS
Netsh Commands for NAP Client
Netsh Commands for Health Registration Authority


Netsh Commands for NAP Client

The following commands allow you to configure Network Access Protection (NAP) client from the nap client context of netsh.

  • add server

  • add trustedservergroup

  • delete server

  • delete trustedservergroup

  • dump

  • export

  • help

  • import

  • rename server

  • rename trustedservergroup

  • reset configuration

  • reset csp

  • reset enforcement

  • reset hash

  • reset server

  • reset tracing

  • reset trustedservergroup

  • reset userinterface

  • reset csp

  • set enforcement

  • set hash

  • set server

  • set tracing

  • set userinterface

  • show configuration

  • show csps

  • show grouppolicy

  • show hashes

  • show state

  • show trustedservergroup

NAP client commands

The following entries provide details for each command.

add server

Adds the uniform resource locator (URL) of a Health Registration Authority (HRA) server to a trusted server group.

Syntax

add server [ group = ] group [ url = ] url [ [ processingorder = ] processingorder ]

Parameters

group

Required. Specifies the name of the trusted server group to which you want to add an HRA server.

url

Required. Specifies the URL of an HRA server that you want to add to the trusted server group. If the trusted server group requires server verification (https:), then the URL must contain the https:// prefix.

processingorder

Optional. Designates the processing order of the HRA URL in the list of URLs in the trusted server group. If you do not specify the processing order, the URL is added to the end of the list and is processed last.

Example

add server group = "group1" url = "url1" processingorder = "1"

add trustedservergroup

Adds a trusted server group.

Syntax

add trustedservergroup [ name = ] name [ [ requirehttps = ] ENABLE | DISABLE ]

Parameters

name

Required. Specifies the name of the trusted server group that you want to add to the NAP client configuration.

requirehttps

Optional. Specifies whether server verification (https:) is required for all servers in this group. If not specified, https: is enabled by default.

Example

add trustedservergroup name = "group1" requirehttps = "ENABLE"

delete server

Deletes the URL of an HRA server from the specified trusted server group.

Syntax

delete server [ group = ] group [ url = ] url

Parameters

group

Required. Specifies the name of the trusted server group from which you want to remove an HRA server.

url

Required. Specifies the URL of the HRA server that you want to remove from the trusted server group.

Example

delete server group = "group1" url = "url1"

delete trustedservergroup

Deletes a trusted server group.

Syntax

delete trustedservergroup [ name = ] name

Parameters

name

Required. Specifies the name of the trusted server group that you want to remove from the NAP client configuration.

Example

delete trustedservergroup name = "group1"

dump

Creates a script that contains the current NAP client configuration.

Syntax

dump

Remarks

If saved to a file, this script can be used to restore altered configuration settings.

export

Exports an *.xml file that contains the current configuration settings for the NAP client.

Syntax

export [ filename = ] filename

Parameters

Filename

Required. Specifies the file name and folder location where you want to save the *.xml file.

Example

export filename = "c:\config.xml"

help

Displays a list of commands that are available at the netsh context where the command is run, and those inherited from the parent context.

Syntax

help

import

Imports an .xml file that contains configuration settings for the Network Access Protection (NAP) client.

Syntax

import [ filename = ] filename

Parameters

Filename

Required. Specifies the file name and folder location from which you want to import the *.xml file.

Example

import filename = "c:\config.xml"

rename server

Renames the HRA URL of an existing trusted server in the specified trusted server group.

Syntax

rename server [ group = ] group [ url = ] url [ newurl = ] newurl

Parameters

Group

Required. Specifies the name of the trusted server group that contains the HRA server URL that you want to change.

url

Required. Specifies the existing HRA server URL.

Newurl

Required. Specifies the new HRA server URL. If no value is supplied for newurl, the HRA server URL is not changed.

Example

rename server group = "group1" url = "url1" newurl = "url2"

rename trustedservergroup

Renames an existing trusted server group.

Syntax

rename trustedservergroup [ name = ] name [ newname = ] newname

Parameters

Name

Required. Specifies the name of the trusted server group that you want to rename.

Newname

Required. Specifies the new name of the trusted server group.

Example

rename trustedservergroup name = "group1" newname = "group2"

reset configuration

Restores the NAP client configuration to the default settings.

Syntax

reset configuration

reset csp

Sets the cryptographic service provider (CSP) Request Policy to Microsoft Enhanced Cryptographic Provider v1.0.

Syntax

reset csp

reset enforcement

Sets the enforcement client parameter to DISABLED.

Syntax

reset enforcement

reset hash

Sets the hash algorithm Request Policy to sha1RSA (1.3.14.3.2.29).

Syntax

reset hash

reset server

Deletes all URLs in a specified trusted server group.

Syntax

reset server [ group = ] group

Parameters

Group

Required. Specifies the name of the trusted server group.

Example

reset server group = "group1"

reset tracing

Sets the tracing parameter to DISABLE.

Syntax

reset tracing

reset trustedservergroup

Deletes all trusted server groups and the list of all health registration authority servers (by URL) contained in each trusted server group.

Syntax

reset trustedservergroup

reset userinterface

Deletes all user interface settings in the NAP client configuration.

Syntax

reset userinterface

set csp

Changes the cryptographic service provider (CSP) in the NAP client configuration. You can display name of the currently available CSPs with the show csps command.

Syntax

set csp [ name = ] name [ [ keylength = ] keylength ]

Parameters

name

Required. Specifies the name of the cryptographic service provider (CSP).

keylength

Optional. Specifies the length of the asymmetric key. The default key length is 2048.

Example

set csp name = "Microsoft RSA SChannel Cryptographic Provider" keylength = "2048"

set enforcement

Enables or disables NAP enforcement clients in the NAP client configuration. When NAP enforcement clients are enabled, NAP clients can connect to a network with the same type of enforcement server. For example, if a NAP client has the DHCP enforcement client enabled, the NAP client can connect to your network with a DHCP NAP enforcement server. You must specify one or more enforcement clients. By default, all enforcement clients are disabled.

Syntax

set enforcement [ ID = ] ID [ ADMIN = ] ENABLE | DISABLE

Parameters

ID

Required. Specifies the identifier of an installed enforcement client to be enabled or disabled. You can view a list of available enforcement clients and their associated IDs with the show configuration command.

ADMIN

Required. Specifies the administrative state of the specified enforcement client. You must specify ENABLE in order for a NAP client to connect to a network using the type of NAP enforcement method specified by the ID parameter.

Example

set enforcement ID = 79619 ADMIN = "ENABLE"

set hash

Sets the hash algorithm that will be used on the target computer. You can obtain the object identifier (OID) from the "show hashes" command.

Syntax

set hash [ oid = ] oid

Parameters

oid

Required. Specifies the OID of the hash algorithm. You can specify only one OID.

Example

set hash oid = "1.2.840.113549.1.1.5"

set server

Sets the URL and processing order of an HRA server within an existing trusted server group.

Syntax

set server [ group = ] group [ url = ] url [ processingorder = ] processingorder

Parameters

group

Required. Specifies the name of an existing trusted server group that contains the HRA server that you want to add or modify.

url

Required. Specifies the HRA server URL. If the trusted server group requires server verification (https:), then the URL must use the https:// prefix. If the URL is not found in the specified trusted server group, it will be added.

processingorder

Required. Designates the processing order of the HRA URL in the list of URLs in the trusted server group.

Example

set server group = "group1" url = "url1" processingorder = "1"

set tracing

Specifies whether tracing is enabled and the amount of information that is logged by NAP client. Although both parameters are optional, you must specify at least one parameter.

Syntax

set tracing [ [ state = ] ENABLE | DISABLE [ level = ] BASIC | ADVANCED | VERBOSE ]

Parameters

state

Optional. Specifies whether tracing is enabled or disabled. If you specify ENABLE, NAP client creates a trace log file. If you specify DISABLE, NAP client does not create a trace log file. The default is DISABLE. If you enable tracing but do not specify a value for level, NAP client uses the default level value of BASIC

level

Optional. Specifies the amount of information that is logged by NAP client and that appears in the tracing log file. If you specify BASIC, the least amount of information is logged in the trace log file. If you specify ADVANCED, a greater amount of information is logged in the trace log file. If you specify VERBOSE, all information is logged in the trace log file. The default is BASIC. If you do not specify a value for state, NAP client uses the default state value of DISABLE.

Example

set tracing state = "ENABLE" level = "ADVANCED"

set userinterface

Specifies the NAP client user interface settings. Although all parameters are optional, you must specify at least one parameter.

Syntax

set userinterface [ [ title = ] title [ text = ] text [ image = ] image ]

Parameters

title

Optional. Specifies the title that appears in the NAP client user interface.

text

Optional. Specifies the description that appears in the NAP client user interface.

Image

Optional. Specifies the image that appears in the NAP client user interface.

Example

set userinterface title = "My company" text = "Protecting your computer" image = "c:\Logo.jpg"

show configuration

Displays configuration settings and state information for NAP client, including CSP, enforcement client, tracing, and trusted server group configurations.

Syntax

show configuration

show csps

Displays all available cryptographic service providers (CSPs) on the target system. Use this command to obtain the names that you can use in the add csp and delete csp commands.

Syntax

show csps

show grouppolicy

Displays Group Policy configuration settings and state information for NAP client.

Syntax

show grouppolicy

show hashes

Displays all available hash algorithms on the target system. Use this command to obtain the OIDs that you can use in the add hash and delete hash commands.

Syntax

show hashes

Example

Following is an example of the information displayed when you run the show hashes command at the netsh nap client prompt.

Hash | OID
sha1RSA | 1.2.840.113549.1.1.5
md5RSA | 1.2.840.113549.1.1.4
sha1DSA | 1.2.840.10040.4.3
sha1RSA | 1.3.14.3.2.29
shaRSA | 1.3.14.3.2.15
md5RSA | 1.3.14.3.2.3
md2RSA | 1.2.840.113549.1.1.2
md4RSA | 1.2.840.113549.1.1.3
md4RSA | 1.3.14.3.2.2
md4RSA | 1.3.14.3.2.4
md2RSA | 1.3.14.7.2.3.1
sha1DSA | 1.3.14.3.2.13
dsaSHA1 | 1.3.14.3.2.27
mosaicUpdatedSig | 2.16.840.1.101.2.1.1.19
sha1NoSign | 1.3.14.3.2.26
md5NoSign | 1.2.840.113549.2.5
sha256NoSign | 2.16.840.1.101.3.4.2.1
sha384NoSign | 2.16.840.1.101.3.4.2.2
sha512NoSign | 2.16.840.1.101.3.4.2.3
sha256RSA | 1.2.840.113549.1.1.11
sha384RSA | 1.2.840.113549.1.1.12
sha512RSA | 1.2.840.113549.1.1.13
RSASSA-PSS | 1.2.840.113549.1.1.10
sha1ECDSA | 1.2.840.10045.4.1
sha256ECDSA | 1.2.840.10045.4.3.2
sha384ECDSA | 1.2.840.10045.4.3.3
sha512ECDSA | 1.2.840.10045.4.3.4
specifiedECDSA | 1.2.840.10045.4.3

show state

Displays state information, including client access restriction state, the state of installed enforcement clients and system health agents, and the client compliance and remediation results.

Syntax

show state

show trustedservergroup

Displays all trusted server groups and the HRA server URLs in each group.

Syntax

show trustedservergroup

Example

Following is an example of the information displayed when you run the show trustedservergroup command at the netsh nap client prompt.

Setting | Value
Group | Trusted server group 1
Require Https | Enabled
URL | https://www.example.com
Processing order | 1
Group | Trusted server group 2
Require Https | Enabled
URL | https://www.contoso.com
Processing order | 1
Group | Trusted server group 2
Require Https | Enabled
URL | https://www.example.com
Processing order | 2


Netsh Commands for Network Bridge

For adapters that are part of the Network Bridge, you can use commands in the netsh bridge context to enable or disable Layer 3 compatibility mode and show configuration information for these adapters.

Caution
Use caution when enabling the Network Bridge component in Windows®. It causes a computer attached to two or more networks to rebroadcast all traffic from each network to the others that are part of the bridge. This can be a significant security risk if you enable the bridge on a computer that contains a network adapter attached to your private LAN and another adapter that is connected to the Internet.

You can run these commands from the command prompt on a computer running Microsoft® Windows Vista® or Windows Server® 2008 from the netsh bridge context. To successfully run these commands at the command prompt on a computer running Windows Server 2008, you must type netsh bridge before typing the commands and parameters as they appear in this topic.

For more information about netsh, see Netsh Overview and Enter a Netsh Context.

Netsh commands for Network Bridge

To view the command syntax, click a command:

  • show adapter

  • set adapter

For information on how to interpret netsh command syntax, see Formatting Legend.

show adapter

Displays adapter identification, adapter names, and the state of the Layer 3 compatibility mode of adapters that are part of Network Bridge.

Syntax:

Show adapter [[id=] AdapterID ]

Parameters:

[[id=] AdapterID ]

Optional. Specifies the information to display for a specific adapter.

/?

Displays help at the command prompt.

Example commands:

Show adapter

This command lists all of the adapters that are part of Network Bridge and provides adapter ID numbers, friendly names, and the state of the Layer 3 compatibility mode that corresponds to each adapter.

show adapter 2

This command lists the adapter ID, friendly name, and the state of the Layer 3 compatibility mode information for adapter 2.

set adapter

This command modifies the configuration of a specified adapter that is part of Network Bridge by setting the state of the adapter to either enable or disable network layer (Layer 3) compatibility mode.

Syntax:

set adapter [id=] AdapterID [forcecompatmode=]{enable | disable}

Parameters:

[id=] AdapterID

Required. Specifies which adapter that is part of Network Bridge to configure.

[forcecompatmode=]{ enable| disable}

Required. Specifies whether Layer 3 mode compatibility is enabled or disabled for the specified adapter.

/?

Displays help at the command prompt.

Remarks:
  • This command should be run only if an enabled Network Bridge does not forward network traffic to all network segments. This condition can exist if one or more network adapters (typically wireless) included in the bridge do not support promiscuous mode.

  • For more information about determining adapter ID values, see show adapter.

  • The install and uninstall commands are not supported in the netsh bridge context. Network Bridge can be set up or removed only through Network Connections.

Example commands:

set adapter 2 forcecompatmode=enable

This command is used to force adapter 2 to run in Layer 3 compatibility mode.
Note
The dump command is not supported in the netsh bridge context.


Netsh Commands for Network Input Output (NETIO)

You can use commands in the Netsh netio context to configure binding filters. The Netsh commands for netio can be run manually at the netsh prompt or in scripts and batch files.

To run these commands from the command prompt, you must either enter the netsh netio context or prepend the context to the command. For example, if you are at the command prompt but have not typed netsh and then netio to enter the netsh netio context, you must type:

netsh netio command

Where command is the command that you want to run, including all of the required parameters for the command.

For information on how to interpret netsh command syntax, see Formatting Legend.

Netsh netio command reference

This section contains the following commands.

  • add bindingfilter

  • delete bindingfilter

  • show bindingfilters

The following entries provide details for each command.

add bindingfilter

Adds a binding filter.

Syntax

add bindingfilter [npi=]NPI [client=] client [provider=] provider [[type=]block|singleclient] [[store=]active|persistent]

Parameters

npi

Required. Specifies the network programming interface GUID or name as a string value.

client

Required. Specifies the client name or GUID as a string value.

provider

Required. Specifies the client name or GUID as a string value.

type

Optional. Specifies either block or singleclient. Singleclient is the default. If you specify block, the specified client cannot bind to the provider. If you specify singleclient, only the specified client can bind to the provider.

store

Optional. Specifies that the binding filter is either active or persistent. Persistent is the default. If you specify active, the filter is applied only until the computer is restarted; after it is restarted the binding filter is not applied. If you specify persistent, the filter is permanently applied.

Examples

The following example disables IPv4 loopback by installing an NMR filter to prevent the binding.

netsh netio add bindingfilter framing ipv4 fl4l block persistent

The following example disables IPv6 loopback by installing an NMR filter to prevent the binding.

netsh netio add bindingfilter framing ipv6 fl6l block persistent

Note
To prevent bindings with the 802 framing layer, use fl48 or fl68.

delete bindingfilter

Deletes a binding filter.

Syntax

delete bindingfilter [npi=]NPI [client=] client [provider=] provider [[store=]active|persistent]

Parameters

npi

Required. Specifies the network programming interface guid or name as a string value.

client

Required. Specifies the client name or guid as a string value.

provider

Required. Specifies the client name or guid as a string value.

store

Optional. Specifies that the deletion of the binding filter is either active or persistent. Persistent is the default. If you specify active, the filter is deleted only until the computer is restarted; after it is restarted the binding filter is applied again. If you specify persistent, the filter is permanently deleted.

show bindingfilters

Displays all binding filters.

Syntax

show bindingfilters [[store=]active|persistent]

Parameters

store

Optional. Specifies that the binding filters that are displayed are either active or persistent. Persistent is the default. If you specify active, the binding filters in the stack are displayed. If you specify persistent, only persistent binding filters are displayed.


Netsh Commands for Network Policy Server

You can use commands in the Netsh Network Policy Server (NPS) context to configure all aspects of NPS. The Netsh commands for NPS provide the same functionality as the NPS console, and the commands can be run manually at the netsh prompt or in scripts and batch files.

To run these commands from the command prompt, you must either enter the netsh nps context or prepend the context to the command. For example, if you are at the command prompt but have not typed netsh and then nps to enter the netsh nps context, you must type:

netsh nps command

Where command is the command that you want to run, including all of the required parameters for the command.

Netsh NPS command reference

The Netsh commands for NPS are grouped by the following command categories.

NPS Server Commands. These commands allow you to configure NPS ports, event log settings, and other general server settings. They also allow you to back up and restore your NPS server configuration.

RADIUS Client Commands. These commands allow you to configure RADIUS clients in NPS.

Connection Request Policy Commands. These commands allow you to configure connection request policies in NPS.

Remote RADIUS Server Group Commands. These commands allow you to configure remote RADIUS server groups in NPS.

Network Policy Commands. These commands allow you to configure network policy in NPS. Network policy was formerly known as remote access policy.

Network Access Protection Commands for NPS. These commands allow you to configure NAP policy settings in NPS.

Accounting Commands . These commands allow you to configure NPS log file settings and Microsoft SQL Server™ logging in NPS.

For information on how to interpret netsh command syntax, see Formatting Legend.


NPS Server Commands
See Also

This section contains the following commands.

  • add registeredserver

  • delete registeredserver

  • dump

  • export

  • import

  • reset config

  • reset eventlog

  • reset ports

  • set eventlog

  • set ports

  • show config

  • show eventlog

  • show ports

  • show registeredserver

  • show vendors

For information on how to interpret netsh command syntax, see Formatting Legend.

NPS server commands

The following entries provide details for each command.

add registeredserver

Adds a Network Policy Server (NPS) to the list of registered servers in Active Directory®.

Syntax

add registeredserver [[ domain = ] domain [ server = ] server ]

Parameters

domain

Optional. Specifies the domain in which you want to register the server. If domain is not specified, the server is registered in the local domain.

server

Optional. Specifies, by IP address or Fully Qualified Domain Name (FQDN), the server that you want to register in the domain. If server is not specified, the local server is registered in either the local domain or in the domain specified with the domain parameter.

Examples

The first example registers the local NPS server in the local domain. The second example registers an NPS server with the IP address 192.168.0.2 in a domain named example.com. The third example registers an NPS server with the FQDN NPS-01.example.com in the example.com domain.

netsh nps add registeredserver

netsh nps add registeredserver domain = example.com server = 192.168.0.2

netsh nps add registeredserver example.com NPS-01.example.com

delete registeredserver

Deletes an NPS server from the list of registered servers in Active Directory.

Syntax

delete registeredserver [[ domain = ] domain [ server = ] server ]

Parameters

domain

Optional. Specifies the domain in which you want to register the server. If domain is not specified, the server is registered in the local domain.

server

Optional. Specifies, by IP address or Fully Qualified Domain Name (FQDN), the server that you want to register in the domain. If server is not specified, the local server is registered in either the local domain or in the domain specified with the domain parameter.

Examples

The first example removes the local NPS server in the local domain from the list of registered NPS servers in Active Directory. The second example removes an NPS server with the IP address 192.168.0.2 in a domain named example.com. The third example removes an NPS server with the FQDN NPS-01.example.com in the example.com domain.

netsh nps delete registeredserver

netsh nps delete registeredserver domain = example.com server = 192.168.0.2

netsh nps delete registeredserver example.com NPS-01.example.com

dump

Displays the NPS server configuration in the command prompt window. To save the NPS server configuration to a file, use the export command.

Syntax

dump [ exportPSK = ] YES

Parameters

exportPSK

Required. Specifies that you want to display the shared secrets for RADIUS clients and remote RADIUS servers.

Remarks

To export the NPS server configuration, you must also export all shared secrets. Export of NPS server configuration without shared secrets is not supported.

The exported file contains unencrypted shared secrets for RADIUS clients and members of remote RADIUS server groups. Because of this, you should ensure that the file is stored in a secure location to prevent malicious users from accessing the file.

In addition, SQL Server® logging settings are not exported to the file. After you import the file on another NPS server, you must manually configure SQL Server logging.

Example

dump exportPSK = YES

export

Exports the NPS server configuration to a file in Extensible Markup Language (XML) format.

Syntax

export [filename =] filename.xml [ exportPSK = ] YES

Parameters

filename

Required. Specifies the name of the XML file to which you want to export the NPS server configuration.

exportPSK

Required. Specifies that you want to export the shared secrets for RADIUS clients and remote RADIUS servers.

Remarks

If you want to export the NPS server configuration, you must also export all shared secrets. Export of NPS server configuration without shared secrets is not supported.

The exported file contains unencrypted shared secrets for RADIUS clients and members of remote RADIUS server groups. Because of this, you should ensure that the file is stored in a secure location to prevent malicious users from accessing the file.

In addition, SQL Server Logging settings are not exported to the file. After you import the file on another NPS server, you must manually configure SQL Server Logging.

Example

export filename = "c:\config.xml" exportPSK = YES

import

Imports the NPS server configuration from a file in the Extensible Markup Language (XML) file format.

Syntax

import [filename =] filename.xml

Parameters

filename

Required. Specifies the name of the XML file from which you want to import the NPS server configuration.

Example

import C:\nps.xml

reset config

Deletes the NPS server configuration, including RADIUS clients, connection request policies, network policies, accounting configuration, and other items, and restores the NPS server to the default post-installation state.

Caution
Do not run this command if you want to maintain any of the settings you have configured at the NPS server. This command deletes all custom settings that you have configured, and after running this command, your settings cannot be recovered. Before you run this command, it is recommended that you use the export command to save the NPS server configuration to an XML file.

Syntax

reset config

reset eventlog

Deletes the event log configuration and restores the NPS server to the default post-installation state.

Caution
Do not run this command if you want to maintain any of the settings you have configured at the NPS server. This command deletes all custom settings that you have configured, and after running this command, your settings cannot be recovered. Before you run this command, it is recommended that you use the export command to save the NPS server configuration to an XML file.

Syntax

reset eventlog

reset ports

Deletes the User Datagram Protocol (UDP) ports that RADIUS servers, RADIUS proxies, and RADIUS clients use for RADIUS authentication and accounting messages, and restores them to the default values of UDP ports 1812 and 1645 for RADIUS authentication messages and UDP ports 1813 and 1646 for accounting messages.

Syntax

reset ports

set eventlog

Specifies whether successful and rejected authentication events are recorded in the event log.

Note
Event log entries are viewed with Event Viewer.

Syntax

set eventlog [ [accept = ] Enable | Disable [reject = ] Enable | Disable ]

Parameters

Accept

Optional. Specifies whether successful authentication requests are recorded in the event log. By default, successful authentication requests are logged by NPS.

Reject

Optional. Specifies whether unsuccessful authentication requests are recorded in the event log. By default, rejected authentication requests are logged by NPS.

Remarks

  • Although both parameters are optional, you must designate at least one parameter for the command to change event log settings in NPS.

  • For commands related to NPS log files and SQL Server logging, see the section "Accounting Commands."

set ports

Specifies the User Datagram Protocol (UDP) ports that RADIUS servers, RADIUS proxies, and RADIUS clients use for RADIUS authentication and accounting messages. By default, NPS is configured to use UDP ports 1812 and 1645 for RADIUS authentication messages and UDP ports 1813 and 1646 for accounting messages.

Important
The ports you configure on your NPS server must match the ports used by your network access servers and RADIUS proxies, or network access authentication will fail.

Syntax

set ports [ accounting = ] ports [ authentication = ] ports

Parameters

accounting

Optional. Specifies the port numbers used for RADIUS accounting message traffic. If accounting is not specified, the default ports of 1646 and 1813 are used for RADIUS accounting traffic. To specify the network interface and the port number, use the following syntax: IPaddress:portnumber

authentication

Optional. Specifies the port numbers used for RADIUS authentication message traffic. If authentication is not specified, the default ports of 1645 and 1812 are used for RADIUS authentication traffic. To specify the network interface and the port number, use the following syntax: IPaddress:portnumber

Remarks

  • Although both parameters are optional, you must specify at least one parameter for any change to occur to the NPS server port configuration. Running this command without parameters results in no change to the current port configuration on the NPS server.

  • If you have previously changed the default values for accounting (1646, 1813) and authentication (1645, 1812) ports and you want to restore the defaults, you must specify the default values when running this command.

show config

Displays the NPS server configuration. The displayed settings are: event logging settings, accounting file log configuration, ports, server registration status, system health validator (SHV) configuration, and SQL Server logging settings.

Syntax

show config

show eventlog

Displays the NPS event log configuration, including whether accepted and rejected authentication requests are logged by NPS.

Syntax

show eventlog

show ports

Displays the RADIUS port configuration for the local NPS server.

Syntax

show ports

show registeredserver

Displays information for a server that is registered in Active Directory.

Syntax

show registeredserver [[ domain = ] domain [ server = ] server ]

Parameters

domain

Optional. Specifies the domain in which the server is registered. If domain is not specified, the local domain is automatically queried.

Server

Optional. Specifies, by IP address or Fully Qualified Domain Name (FQDN), the server whose information you want to display. If server is not specified, information for the local server is displayed.

Example

show registeredserver server = "Server1"

show vendors

Displays a list of hardware and software vendors.

Syntax

show vendors

Remarks

The following list of hardware vendors, protocols, and software vendors is available when you run the show vendors command.

Vendor name

RADIUS Standard

3Com

ACC

ADC Kentrox

Ascend Communications Inc.

BBN

BinTec Communications GmbH

Cabletron Systems

Cisco

Digi International

EICON

Gandalf

Intel Corporation

Lantronix

Livingston Enterprises, Inc.

Proteon

Shiva Corporation

Telebit

U.S. Robotics, Inc.

Xylogics, Inc.

Microsoft

RedBack Networks

Nortel Networks

See Also

Concepts

RADIUS Client Commands
Connection Request Policy Commands
Remote RADIUS Server Group Commands
Network Policy Commands
Network Access Protection Commands for NPS
Accounting Commands


RADIUS Client Commands
See Also

This section contains the following commands.

  • add client

  • delete client

  • rename client

  • reset client

  • set client

  • show client

For information on how to interpret netsh command syntax, see Formatting Legend.

RADIUS client commands

The following entries provide details for each command.

Important
Client computers, such as wireless laptop computers and other computers running client operating systems, are not RADIUS clients. RADIUS clients are network access servers—such as wireless access points, 802.1X authenticating switches, virtual private network (VPN) servers, and dial-up servers—because they use the RADIUS protocol to communicate with RADIUS servers such as Network Policy Server (NPS) servers.

add client

Adds a RADIUS client to the Network Policy Server (NPS) configuration.

Syntax

add client [ name = ] name [ address = ] address [ state = ] Enable | Disable [ [ sharedsecret = ] sharedsecret [ requireauthattrib = ] Yes | No [ napcompatible = ] Yes | No [ vendorname = ] vendorname ] ]

Parameters

name

Required. Specifies the friendly name of the RADIUS client.

address

Required. Specifies the Fully Qualified Domain Name (FQDN) or IP address of the RADIUS client.

state

Optional. Specifies whether the RADIUS client is enabled or disabled. The default is enabled.

sharedsecret

Optional. Specifies the shared secret that is also configured at the RADIUS client. The shared secret is used to validate messages between the RADIUS client and NPS.

requireauthattrib

Optional. Specifies whether verification for Access-Request messages is enabled or disabled. The default is disabled.

napcompatible

Optional. Specifies whether the RADIUS client is compatible with Network Access Protection (NAP). The default is No, which means that the RADIUS client is not compatible with Network Access Protection (NAP).

vendor

Optional. Specifies the RADIUS client vendor name. The default is RADIUS standard.

Example

In the following example, a NAP-compatible wireless access point is added as a RADIUS client to the NPS configuration. This RADIUS client has the name WirelessAP, the IP address 10.0.0.200, an enabled state, and a shared secret of 9vq7822hFsJ8rm.

netsh nps add client name= WirelessAP address= 10.0.0.200 state=Enable sharedsecret=9vq7822hFsJ8rm napcompatible=Yes

Remarks

  • RADIUS clients are network access servers, such as a dial-up server, wireless access point, or virtual private network (VPN) server. Client computers, also called access clients, are not RADIUS clients.

delete client

Deletes one or more existing RADIUS clients.

Syntax

delete client [ name= ] name

Parameters

name

Required. Specifies the friendly name of the RADIUS client that you want to delete. If more than one RADIUS client is specified, the friendly names must be separated by commas.

Example

Following is an example of the command usage. In this example, three wireless access points with the friendly names WirelessAP1, WirelessAP2, and WirelessAP3 are removed as RADIUS clients from the NPS configuration.

delete client WirelessAP1,WirelessAP2,WirelessAP3

rename client

Changes the friendly name of a RADIUS client.

Syntax

rename client [ name = ] name [ newname = ] newname

Parameters

name

Required. Specifies the friendly name of the RADIUS client that you want to rename.

newname

Required. Specifies the new friendly name for the RADIUS client.

reset client

Deletes all RADIUS clients that are configured in NPS.

Caution
Do not run this command if you want to maintain any of the RADIUS client settings you have configured at the NPS server. This command deletes all RADIUS client settings that you have configured, and after running this command, your settings cannot be recovered. Before you run this command, it is recommended that you use the export command to save the NPS server configuration to an XML file.

Syntax

reset client

set client

Changes the value of one or more properties of an existing RADIUS client. This command cannot be used to change the RADIUS client friendly name. For other properties, values specified by this command overwrite the existing values.

Syntax

set client [ name = ] name [ address = ] address [ state = ] Enable | Disable [ [ sharedsecret = ] sharedsecret [ requireauthattrib = ] Yes | No [ napcompatible = ] Yes | No [ vendorname = ] vendorname ] ]

Parameters

name

Required. Specifies the RADIUS client friendly name. To change the RADIUS client friendly name, use the rename client command.

address

Optional. Specifies the Fully Qualified Domain Name (FQDN) or IP address of the RADIUS client.

state

Optional. Specifies whether the RADIUS client is enabled or disabled.

sharedsecret

Optional. Specifies the shared secret that is also configured at the RADIUS client. The shared secret is used to validate messages between the RADIUS client and NPS.

requireauthattriube

Optional. Specifies whether verification for Access-Request messages is enabled or disabled.

napcompatible

Optional. Specifies whether the RADIUS client is compatible with the Network Access Protection (NAP) feature of Network Policy Server (NPS).

vendor

Optional. Specifies the RADIUS client vendor name. The default is RADIUS standard.

show client

Displays the RADIUS client list for the local NPS server.

Syntax

show client

Remarks

  • This command displays the RADIUS client list of the NPS server on which the command is run. In the NPS console, this client list is displayed in RADIUS Clients.

See Also

Concepts

NPS Server Commands
Connection Request Policy Commands
Remote RADIUS Server Group Commands
Network Policy Commands
Network Access Protection Commands for NPS
Accounting Commands


Connection Request Policy Commands
See Also

This section contains the following commands.

  • add crp

  • delete crp

  • rename crp

  • reset crp

  • set crp

  • show crp

  • show crpconditionattributes

  • show crpprofileattributes

For information on how to interpret netsh command syntax, see Formatting Legend.

Connection Request Policies commands

The following entries provide details for each command.

add crp

Adds a connection request policy to the Network Policy Server (NPS) configuration and defines the conditions and settings of the policy.

Syntax

add crp [ name = ] name [ [ state = ] ENABLE|DISABLE [ processingorder = ] processingorder [ policysource = ] policysource [ conditionid = ] conditionid [ conditiondata = ] conditiondata [ profileid = ] profileid ([ advprofiletype = ] type [ advprofiledata = ] data ) [ profiledata = ] profiledata ]

Parameters

name

Required. Specifies the name of the connection request policy that you want to add.

state

Optional. Specifies whether the policy is enabled or disabled. The default is enabled.

processingorder

Optional. Specifies the numeric position of this policy in the list of policies configured on the NPS. Policies highest in the list (for example, at first position) are processed by NPS first. Policies added at positions above other policies cause the positions of the other policies to drop in the list by one position. If processingorder is not specified, the policy is added at the end of the list.

policysource

Optional. Specifies the type of RADIUS client that can send connection requests that match this policy. An integer value of aero through five must be used to designate the type of RADIUS client that is allowed for the policy. The default value of zero allows connection requests from any type of RADIUS client. See the Remarks section for more information.

conditionid

Optional. Specifies the condition name or ID that you want to configure in this connection request policy.

You can view the list of available condition attributes at the netsh prompt by running the show crpconditionattributes command. See the section "NPS attributes" for more information.

profileid

Optional. Specifies an attribute that you want to add to the connection request policy. Use profiledata to specify the value of the attribute defined by profileid. In addition, each profileid that you specify can be followed by multiple pairs of parameters named advprofiletype and advprofiledata. The syntax for these parameters is:

[advprofiletype= ] type [advprofiledata=] data

You can view the list of available settings attributes at the netsh prompt by running the show crpprofileattributes command.

See the Remarks section and "NPS attributes" for more information.

advprofiletype

Optional. Specifies an attribute that you want to add to the connection request policy. This parameter is a sub-parameter of and must be preceded by the profileid parameter. Use advprofiledata to add values for the attribute defined with advprofiletype.

advprofiledata

Optional. Specifies the value of the attribute defined with advprofiletype. This parameter is a sub-parameter of and must be preceded by the profileid parameter. In addition, you must specify advprofiletype when you use advprofiledata.

profiledata

Optional. Specifies the value of the attribute defined with profileid. For example, if the attribute specified in profileid is NP-Authentication-Type (0x1009), the value of profiledata might be 0x3 (MS-CHAP v1) or 0x4 (MS-CHAP v2). In cases where multiple values are allowed for an attribute, they can be listed:

profileid = "0x1009" profiledata = "0x3" profiledata = "0x4" profiledata = "0x9" profiledata = "0xa"

Example

The following example adds a connection request policy named Test CRP to the NPS server configuration. The policy is enabled, is positioned first in processing order, and has an unspecified policy source. In addition, Day and Time Restrictions and IPv4 input filters are configured.

add crp name = "Test CRP" state = "ENABLE" processingorder = "1" policysource = "0" conditionid ="0x1006" conditiondata = "0 00:00-24:00; 1 00:00-24:00" profileid = "0x1025" profiledata = "0x1" profileid = "0x1045" advprofiletype = "IPFILTER_IPV4INFILTER" advprofiledata = "PERMIT,123.123.123.0,255.255.255.0,0,0,0"

Remarks on policysource

For policysource, valid values are:

ID | Policy Source
0 | Unspecified (default).
1 | Terminal Server Gateway.
2 | Remote Access Server (VPN or Dial up).
3 | DHCP server.
4 | Wireless Access Point.
5 | Health Registration Authority.

Remarks on configuring IP filters

You can use the profileid, advprofiletype, and advprofiledata parameters to configure IP filters for the connection request policy that you want to add. For more information, see the section "Configuring IP filters with Netsh NPS commands."

delete crp

Deletes the specified connection request policy.

Syntax

delete crp [ name = ] name

Parameters

name

Required. Specifies the name of the connection request policy that you want to delete.

Example

The following examples delete a connection request policy named "CRP1" from the NPS server configuration.

delete crp name = CRP1

delete crp CRP1

rename crp

Changes the name of a connection request policy.

Syntax

rename crp [ name = ] name [ newname = ] newname

Parameters

name

Required. Specifies the friendly name of the connection request policy that you want to rename.

newname

Required. Specifies the new name for the connection request policy.

Examples

The following examples rename a connection request policy from CRP1 to CRP2. The examples demonstrate that the command can be run with the parameter tags, such as name=, and without them.

rename crp name = CRP1 newname = CRP2

rename crp CRP1 CRP2

reset crp

Deletes all connection request policies that are configured in NPS and restores the default connection request policy.

Caution
Do not run this command if you want to maintain any of the connection request policies that you have configured at the NPS server. This command deletes all connection request policies that you have configured, and after running this command, your connection request policies cannot be recovered. Before you run this command, it is recommended that you use the export command to save the NPS server configuration to an XML file.

Syntax

reset crp

set crp

Changes the value of one or more properties of an existing connection request policy. Values specified by this command overwrite the existing values.

Syntax

set crp [ name = ] name [ [ state = ] ENABLE|DISABLE [ processingorder = ] processingorder [ policysource = ] policysource [ conditionid = ] conditionid [ conditiondata = ] conditiondata [ profileid = ] profileid [ profiledata = ] profiledata ]

Parameters

name

Required. Specifies the name of the connection request policy that you want to add.

state

Optional. Specifies whether the policy is enabled or disabled. The default is enabled.

processingorder

Optional. Specifies the numeric position of this policy in the list of policies configured on the NPS. Policies highest in the list (for example, at first position) are processed by NPS first. Policies added at positions above other policies cause the positions of the other policies to drop in the list by one position. If processingorder is not specified, the policy is added at the end of the list.

policysource

Optional. Specifies the type of RADIUS client that can send connection requests that match this policy. An integer value of zero through five must be used to designate the type of RADIUS client that is allowed for the policy. The default value of 0 allows connection requests from any type of RADIUS client. See the Remarks section for more information.

conditionid

Optional. Specifies the condition name or ID that you want to configure in this connection request policy.

You can view the list of available condition attributes at the netsh prompt by running the show crpconditionattributes command. See the section "NPS attributes" for more information.

profileid

Optional. Specifies an attribute that you want to add to the connection request policy. Use profiledata to specify the value of the attribute defined by profileid. In addition, each profileid that you specify can be followed by multiple pairs of parameters named advprofiletype and advprofiledata. The syntax for these parameters is:

[advprofiletype= ] type [advprofiledata=] data

You can view the list of available settings attributes at the netsh prompt by running the show crpprofileattributes command.

See the Remarks section and "NPS attributes" for more information.

advprofiletype

Optional. Specifies an attribute that you want to add to the connection request policy. This parameter is a sub-parameter of and must be preceded by the profileid parameter. Use advprofiledata to add values for the attribute defined with advprofiletype.

advprofiledata

Optional. Specifies the value of the attribute defined with advprofiletype. This parameter is a sub-parameter of and must be preceded by the profileid parameter. In addition, you must specify advprofiletype when you use advprofiledata.

profiledata

Optional. Specifies the value of the attribute defined with profileid. For example, if the attribute specified in profileid is NP-Authentication-Type (0x1009), the value of profiledata might be 0x3 (MS-CHAP v1) or 0x4 (MS-CHAP v2). In cases where multiple values are allowed for an attribute, they can be listed:

profileid = "0x1009" profiledata = "0x3" profiledata = "0x4" profiledata = "0x9" profiledata = "0xa"

Remarks on policysource

For policysource, valid values are:

ID | Policy Source
0 | Unspecified (default)
1 | Terminal Server Gateway
2 | Remote Access Server (VPN or Dial-up)
3 | DHCP server
4 | Wireless Access Point
5 | Health Registration Authority

Remarks on configuring IP filters

You can use the profileid, advprofiletype, and advprofiledata parameters to configure IP filters for the connection request policy that you want to modify. For more information, see the section "Configuring IP filters with Netsh NPS commands."

show crp

Displays all of the conditions that can be applied to a connection request policy and exposes the full range of configuration options for each condition.

Syntax

show crp [ name = ] name

Parameters

name

Optional. Specifies the name of a condition for which you want to display information. If name is not specified, then the full list of conditions is displayed.

Appendix A lists the possible crp conditions.

show crpconditionattributes

Displays all of the attributes that can be applied to the conditions of a connection request policy.

Syntax

show crpconditionattributes

show crpprofileattributes

Displays all of the attributes that can be added to the settings of a connection request policy and returned to a network access server when the conditions of the policy are met by the connection request.

Syntax

show crpprofileattributes

See Also

Concepts

NPS Server Commands
RADIUS Client Commands
Remote RADIUS Server Group Commands
Network Policy Commands
Network Access Protection Commands for NPS
Accounting Commands
Configuring IP Filters with Netsh NPS Commands
NPS Attributes


Remote RADIUS Server Group Commands
See Also

This section contains the following commands.

  • add remoteserver

  • add remoteservergroup

  • delete remoteserver

  • delete remoteservergroup

  • rename remoteserver

  • rename remoteservergroup

  • reset remoteserver

  • reset remoteservergroup

  • set remoteserver

  • show remoteserver

  • show remoteservergroup

For information on how to interpret netsh command syntax, see Formatting Legend.

Remote RADIUS Server Group commands

The following entries provide details for each command.

add remoteserver

Adds a RADIUS server to a remote RADIUS server group.

Syntax

add remoteserver [ remoteservergroup = ] remoteservergroup [ address = ] address [ [ acctport = ] acctport [ authport = ] authport [ acctsharedsecret = ] acctsharedsecret [ authsharedsecret = ] authsharedsecret [ requireauthattrib = ] Yes | No [ priority = ] priority [ weight = ] weight [ timeout = ] timeout [ maxdropped = ] maxdropped [ blackout = ] blackout [ notifications = ] Yes | No ]

Parameters

remoteservergroup

Required. Specifies the name of the remote RADIUS server group to which you want to add a RADIUS server.

address

Required. Specifies the Fully Qualified Domain Name (FQDN) or IP address of the RADIUS server that you want to add to the remote RADIUS server group.

acctport

Optional. Specifies the UDP ports that are used for RADIUS accounting messages. The defaults are 1813 and 1646.

authport

Optional. Specifies the User Datagram Protocol (UDP) ports that are used for RADIUS authentication messages. The defaults are 1812 and 1645.

acctsharedsecret

Optional. Specifies the shared secret used for RADIUS accounting messages.

authsharedsecret

Optional. Specifies the shared secret used for RADIUS authentication messages.

requireauthattrib

Optional. Specifies whether use of the message authenticator attribute is used for verification and is required for RADIUS Access-Request messages. If you specify Yes, verification of messages is required by the RADIUS server you are adding to a remote RADIUS server group. If you specify No, verification of messages is not required. The default value is Yes.

priority

Optional. Specifies whether the server is a primary or backup server. Primary servers are specified as one. The default value is one (primary). The value must be between one and 65535.

weight

Optional. Specifies the frequency with which requests are sent to servers in that priority group. The default value is 50. The value must be between one and 65535.

timeout

Optional. Specifies the maximum non-responsive time, in seconds, before the request is considered dropped. The value must be equal to or less than the blackout value. The default value is three.

maxdropped

Optional. Specifies the maximum number of requests that can be dropped before the server is considered to be unavailable. The default value is five.

blackout

Optional. Specifies the time that elapses between requests, in seconds, before the server is considered unavailable. The default is 30.

notifications

Optional. Specifies whether the RADIUS server forwards start and stop notifications. If you specify Yes, the RADIUS server forwards notifications. If you specify No, the RADIUS server does not forward notifications. The default value is Yes.

Example

The following example adds a RADIUS server named nps-01.example.com to a remote RADIUS server group named Servers1.

add remoteserver remoteservergroup = "Servers1" address = nps-01.example.com

add remoteservergroup

Adds a remote RADIUS server group to which you want to forward connection requests.

Syntax

addremoteservergroup [name =] name

Parameters

name

Required. Specifies the name of the remote RADIUS server group that you want to add to the Network Policy Server (NPS) configuration.

delete remoteserver

Deletes the specified RADIUS server from the specified remote RADIUS server group.

Syntax

delete remoteserver [remoteservergroup =] remoteservergroup [address = ] address

Parameters

remoteservergroup

Required. Specifies the name of the remote RADIUS server group from which you want to delete a server.

address

Required. Specifies the FQDNor the IP address of the RADIUS server that you want to delete from the remote RADIUS server group.

delete remoteservergroup

Deletes a remote RADIUS server group from the NPS server configuration. If you delete a remote RADIUS server group, all RADIUS servers contained within the group are deleted.

Syntax

delete remoteservergroup [name =] name

Parameters

name

Required. Specifies the name of the remote RADIUS server group that you want to delete.

Example

The following example deletes a remote RADIUS server group named Servers1 from the NPS server configuration.

delete remoteservergroup name = Servers1

rename remoteserver

Specifies a new FQDN or IP address for an existing remote RADIUS server that is a member of an existing remote RADIUS server group.

Syntax

rename remoteserver [ remoteservergroup = ] remoteservergroup [ address = ] address [ newaddress = ] newaddress

Parameters

remoteservergroup

Required. Specifies the name of the remote RADIUS server group that contains the remote RADIUS server that you want to rename.

address

Required. Specifies the FQDNor the IP address of the RADIUS server that you want to rename.

newaddress

Required. Specifies the new FQDN or IP address of the RADIUS server that you want to rename.

Example

The following example changes the name of the server Server1.adatum.com in the remote RADIUS server group Servers1 to RADIUS-01. adatum.com.

rename remoteserver remoteservergroup = "Servers1" address = "Server1.adatum.com" newaddress = "RADIUS-01.adatum.com"

rename remoteservergroup

Renames the specified remote RADIUS server group.

Syntax

rename remoteservergroup [ name = ] name [newname =] new name

Parameters

name

Required. Specifies the name of the remote RADIUS server group that you want to rename.

newname

Required. Specifies the new name for the remote RADIUS server group.

Example

The following example changes the name of a remote RADIUS server group from Servers1 to Servers2.

rename remoteservergroup name = Servers1 newname = Servers2

reset remoteserver

Deletes the remote RADIUS servers configured in the specified remote RADIUS server group.

Syntax

reset remoteserver [ remoteservergroup = ] remoteservergroup

Parameters

remoteservergroup

Required. Specifies the name of the remote RADIUS server group that contains the remote RADIUS servers you want to delete from the group.

reset remoteservergroup

Deletes the remote RADIUS server groups and restores the default configuration of NPS server remote RADIUS server groups, which contains no groups.

Syntax

reset remoteservergroup

set remoteserver

Changes the value of one or more properties of an existing RADIUS server that is a member of the specified remote RADIUS server group. Values specified by this command overwrite the existing values. This command cannot be used to change the name of the remote RADIUS server group. To rename a group, use the command rename remoteservergroup.

set remoteserver [ remoteservergroup = ] remoteservergroup [ address = ] address [ [ acctport = ] acctport [ authport = ] authport [ acctsharedsecret = ] acctsharedsecret [ authsharedsecret = ] authsharedsecret [ requireauthattrib = ] Yes | No [ priority = ] priority [ weight = ] weight [ timeout = ] timeout [ maxdropped = ] maxdropped [ blackout = ] blackout [ notifications = ] Yes | No ]

Syntax

Parameters

remoteservergroup

Required. Specifies the name of the remote RADIUS server group whose configuration you want to change.

address

Required. Specifies the FQDNor IP address of the RADIUS server that you want to modify.

acctport

Optional. Specifies the UDP ports that are used for RADIUS accounting messages by the RADIUS server you specify with address. The defaults are 1813 and 1646.

authport

Optional. Specifies the UDP ports that are used for RADIUS authentication messages by the RADIUS server you specify with address. The defaults are 1812 and 1645.

acctsharedsecret

Optional. Specifies the shared secret that is used for accounting messages by the RADIUS server you specify with address.

authsharedsecret

Optional. Specifies the shared secret that is used for authentication messages by the RADIUS server you specify with address.

requireauthattrib

Optional. Specifies whether verification for Access-Request messages is enabled or disabled on the RADIUS server you specify with address. If you specify Yes, verification is enabled. If you specify No, verification is disabled. The default is disabled, or No.

priority

Optional. Specifies whether the RADIUS server you designate with address is a primary or backup server. Primary servers are specified as one. The default value is one (primary). The value must be between one and 65535.

weight

Optional. Specifies the frequency with which requests are sent to servers in that priority group. The default value is 50. The value must be between 1 and 65535.

timeout

Optional. Specifies the maximum non-response time, in seconds, before the request is considered dropped by the RADIUS server you specify with address. The value must be equal to or less than the blackout value. The default value is three.

maxdropped

Optional. Specifies the maximum number of requests that can be dropped before the server is considered to be unavailable. The default value is five.

blackout

Optional. Specifies the time that elapses between requests, in seconds, before the server is considered unavailable. The default is 30.

notifications

Optional. Specifies whether network access server start and stop notifications are forwarded. If you specify Yes, notifications are forwarded. If you specify No, notifications are not forwarded. The default is Yes.

show remoteserver

Displays the properties of a RADIUS server that is a member of the specified remote RADIUS server group. The following RADIUS server properties are displayed: authentication and accounting UDP ports; shared secret (displayed as asterisks only); priority; weight; timeout; max dropped requests; blackout time.

Syntax

show remoteserver [remoteservergroup =] remoteservergroup

Parameters

remoteservergroup

Required. Specifies the name of the remote RADIUS server group of which the RADIUS server is a member.

show remoteservergroup

Displays the list of RADIUS servers configured in all remote RADIUS server groups.

Syntax

show remoteservergroup

See Also

Concepts

NPS Server Commands
RADIUS Client Commands
Connection Request Policy Commands
Network Policy Commands
Network Access Protection Commands for NPS
Accounting Commands


Network Access Protection Commands for NPS
See Also

This section contains the following commands.

  • add remediationserver

  • add remediationservergroup

  • add shvtemplate

  • delete remediationserver

  • delete remediationservergroup

  • delete shvtemplate

  • rename remediationserver

  • rename remediationservergroup

  • rename shvtemplate

  • reset remediationserver

  • reset remediationservergroup

  • reset shv

  • reset shvtemplate

  • set remediationserver

  • set shv

  • set shvtemplate

  • show napserverinfo

  • show remediationserver

  • show remediationservergroup

  • show shv

  • show shvtemplate

For information on how to interpret netsh command syntax, see Formatting Legend.

Network Access Protection commands

The following entries provide details for each command.

add remediationserver

Adds one or more servers to the specified remediation server group.

Syntax

add remediationserver [ remediationservergroup = ] remediationservergroup [ address = ] address [ [ name = ] name ]

Parameters

remediationservergroup

Required. Specifies the name of the remediation server group to which you want to add servers.

address

Required. Specifies the Fully Qualified Domain Name (FQDN) or IP address Of the remediation server that you want to add.

name

Optional. Specifies the friendly name of the remediation server that you want to add.

Example

The following example adds a remediation server with the FQDN Server1.adatum.com to a remediation server group named Servers1. The friendly name for the server is Seattle Remediation server.

add remediationserver remediationservergroup = "Servers1" address = "Server1.adatum.com" name = "Seattle Remediation server"

add remediationservergroup

Adds a remediation server group to the NPS server configuration.

Syntax

add remediationservergroup [ name = ] name

Parameters

name

Required. Specifies the name of the remediation server group that you want to add to the Network Policy Server (NPS) configuration.

add shvtemplate

Adds a system health validator (SHV) template, also called a health policy, to the NPS server configuration.

Syntax

add shvtemplate [ name = ] name [ [ id = ] id [ config = ] ALLMUSTPASS | ALLMUSTFAIL | ONEMUSTPASS | ONEMUSTFAIL ]

Parameters

name

Required. Specifies the friendly name of the health policy.

id

Optional. Specifies one or more valid SHV IDs separated by a comma. If no ID is specified, all SHVs are selected.

config

Optional. Specifies the amount of SHVs that must pass or fail for the conditions of the network policy to be matched. If ALLMUSTPASS is designated, all SHVs configured in the health policy must pass for the conditions of the network policy to be matched. If ALLMUSTFAIL is designated, all SHVs configured in the health policy must fail for the conditions of the network policy to be matched. If ONEMUSTPASS is designated, one SHV configured in the health policy must pass for the conditions of the network policy to be matched. If ONEMUSTFAIL is designated, one SHV configured in the health policy must fail for the conditions of the network policy to be matched. The default is ALLMUSTPASS.

Example

In the following example, a health policy named HealthPolicy1 is added to the NPS server configuration.

add shvtemplate name = "HealthPolicy1"

delete remediationserver

Deletes one or more servers from the specified remediation server group.

Syntax

delete remediationserver [ remediationservergroup = ] remediationservergroup [ address = ] address [ [ name = ] name ]

Parameters

remediationservergroup

Required. Specifies the name of the remediation server group from which you want to delete a server.

address

Required. Specifies the FQDN or IP address of the remediation server that you want to delete.

name

Optional. Specifies the friendly name of the remediation server that you want to delete.

delete remediationservergroup

Deletes a remediation server group.

Syntax

delete remediationservergroup [ name = ] name

Parameters

name

Required. Specifies the name of the remediation server group that you want to delete from the NPS server configuration.

delete shvtemplate

Deletes the specified health policy (also called an SHV template).

Syntax

delete shvtemplate [ name = ] name

Parameters

name

Required. Specifies the friendly name of the health policy that you want to delete.

rename remediationserver

Specifies a new Fully Qualified Domain Name (FQDN) or IP address for an existing remediation server that is a member of an existing remediation server group.

Syntax

rename remediationserver [remediationservergroup = ] remediationservergroup [ address = ] address [ newaddress = ] newaddress

Parameters

remediationservergroup

Required. Specifies the name of the remediation server group that contains the remediation server that you want to rename.

address

Required. Specifies the FQDN or the IP address of the remediation server that you want to rename.

newaddress

Required. Specifies the new FQDN or IP address of the remediation server that you want to rename.

Example

The following example changes the name of the remediation server Server1.adatum.com in the remote remediation server group Servers1 to Remediation-01.adatum.com.

rename remediationserver remediationservergroup = "Servers1" address = "Server1.adatum.com" newaddress = "Remediation-01.adatum.com"

rename remediationservergroup

Renames the specified remediation server group.

Syntax

rename remediationservergroup [ name = ] name [newname =] new name

Parameters

name

Required. Specifies the name of the remediation server group that you want to rename.

newname

Required. Specifies the new name for the remediation server group.

Example

The following example changes the name of a remediation server group from Servers1 to Servers2.

rename remediationservergroup name = Servers1 newname = Servers2

rename shvtemplate

Renames an existing health policy (also called an SHV template).

Syntax

rename shvtemplate [ name = ] name [ newname = ] new name

Parameters

name

Required. Specifies the existing name of the health policy.

newname

Required. Specifies the new name for the health policy.

Example

The following example changes the name of a health policy from HealthPolicy1 to HealthPolicy2.

rename shvtemplate name = "HealthPolicy1" newname = "HealthPolicy2"

reset remediationserver

Resets a remediation server in the remediation server group that you specify.

Syntax

reset remediationserver [ remediationservergroup = ] remediationservergroup

Parameters

remediationservergroup

Required. Specifies the name of the remediation server group that contains the remediation server that you want to reset.

reset remediationservergroup

Resets a remediation server group.

Syntax

reset remediationservergroup

reset shv

Resets the SHV configuration.

Syntax

reset shv

reset shvtemplate

Resets the health policy configuration.

Syntax

reset shvtemplate

set remediationserver

Modifies the configuration of a remediation server in the specified remediation server group.

Syntax

set remediationserver [ remediationservergroup = ] remediationservergroup [ address = ] address [ [ name = ] name ]

Parameters

remediationservergroup

Required. Specifies the name of the remediation server group to which you want to add servers.

address

Required. Specifies the FQDN or IP address of the remediation server that you want to add.

name

Optional. Specifies the friendly name of the remediation server that you want to add.

set shv

Modifies the system health validator configuration.

Syntax

set shv [ id = ] id [ [ unreachablepolicyserver = ] NONCOMPLIANT | COMPLIANT [ unreachableremediationserver = ] NONCOMPLIANT | COMPLIANT [ shafailure = ] NONCOMPLIANT | COMPLIANT [ napserverfailure = ] NONCOMPLIANT | COMPLIANT [ othererrors = ] NONCOMPLIANT | COMPLIANT ]

Parameters

id

Required. Specifies the ID number of the SHV.

unreachablepolicyserver

Optional. Specifies the error that is returned when the SHV's policy server cannot be contacted. If you specify NONCOMPLIANT, the NAP client is treated as noncompliant. If you specify COMPLIANT, the NAP client is treated as compliant. The default is NONCOMPLIANT.

unreachableremediationserver

Optional. Specifies the error that is returned when the system health agent (SHA) cannot contact the remediation server and cannot successfully update a noncompliant NAP client. If you specify NONCOMPLIANT, the NAP client is treated as noncompliant. If you specify COMPLIANT, the NAP client is treated as compliant. The default is NONCOMPLIANT.

shafailure

Optional. Specifies the error that is returned when the SHA has an internal failure. If you specify NONCOMPLIANT, the NAP client is treated as noncompliant. If you specify COMPLIANT, the NAP client is treated as compliant. The default is NONCOMPLIANT.

napserverfailure

Optional. Specifies the error that is returned when the NAP server produces an internal failure. If you specify NONCOMPLIANT, the NAP client is treated as noncompliant. If you specify COMPLIANT, the NAP client is treated as compliant. The default is NONCOMPLIANT.

othererrors

Optional. Specifies all other errors in the NAP infrastructure. If you specify NONCOMPLIANT, the NAP client is treated as noncompliant. If you specify COMPLIANT, the NAP client is treated as compliant. The default is NONCOMPLIANT.

Example

The following example sets an SHV with the ID of 79744.

set shv id = "79744"

set shvtemplate

Changes the value of one or more properties of an existing health policy. Values specified by this command overwrite the existing values.

Syntax

set shvtemplate [ name = ] name [ [ id = ] id [ config = ] ALLMUSTPASS | ALLMUSTFAIL | ONEMUSTPASS | ONEMUSTFAIL ]

Parameters

name

Required. Specifies the friendly name of the health policy.

id

Optional. Specifies one or more valid SHV IDs separated by a comma. If no ID is specified, all SHVs are selected.

config

Optional. Specifies the amount of SHVs that must pass or fail for the conditions of the network policy to be matched. If ALLMUSTPASS is designated, all SHVs configured in the health policy must pass for the conditions of the network policy to be matched. If ALLMUSTFAIL is designated, all SHVs configured in the health policy must fail for the conditions of the network policy to be matched. If ONEMUSTPASS is designated, one SHV configured in the health policy must pass for the conditions of the network policy to be matched. If ONEMUSTFAIL is designated, one SHV configured in the health policy must fail for the conditions of the network policy to be matched. The default is ALLMUSTPASS.

show napserverinfo

Displays the Network Access Protection (NAP) configuration of the specified server.

Syntax

show napserverinfo

show remediationserver

Displays the properties of the remediation servers in the specified group.

Syntax

[ remediationservergroup = ] remediationservergroup

Parameters

Remediationservergroup

Required. Specifies the name of the remediation server group in which the server(s) reside.

show remediationservergroup

Displays the remediation server groups and the servers configured within each group.

Syntax

show remediationservergroup

show shv

Displays all of the system health validators (SHVs) that are registered in NPS.

Syntax

show shv

show shvtemplate

Displays all health policies.

Syntax

show shvtemplate

See Also

Concepts

NPS Server Commands
RADIUS Client Commands
Connection Request Policy Commands
Remote RADIUS Server Group Commands
Network Policy Commands
Accounting Commands


Accounting Commands
See Also

This section contains the following commands:

  • reset filelog

  • reset sqllog

  • set filelog

  • set sqllog

  • show filelog

  • show sqllog

For information on how to interpret netsh command syntax, see Formatting Legend.

Accounting commands

The following entries provide details for each command.

reset filelog

Restores the log file configuration to the default settings.

Syntax

reset filelog

Remarks

By default, the following information is logged by Network Policy Server (NPS):

  • Accounting requests

  • Authentication requests

  • Periodic accounting status

  • Periodic authentication status

The default log file format is database-compatible, and a new log file is created monthly. When the hard disk is full, old log files are automatically deleted to create disk space for new log files. The default log file directory is windir\System32\LogFiles.

reset sqllog

Restores the Microsoft SQL Server™ logging configuration to the default settings.

Syntax

reset sqllog

Remarks

By default, SQL Server logging settings are not configured.

set filelog

Sets the configuration for the NPS log file.

Syntax

set filelog [ [ accounting = ] Enable | Disable [ authentication = ] Enable | Disable [ periodicstatus = ] Enable | Disable [ directory = ] directory [ format = ] IAS | ODBC [ deleteold = ] Enable | Disable [ frequency = ] Daily | Weekly | Monthly | Unlimited | Size [ maxsize = ] maxsize ]

Parameters

accounting

Optional. Specifies whether accounting requests are logged by NPS. If you specify Enable, these requests are logged. If you specify Disable, these requests are not logged. The default is Disable.

authentication

Optional. Specifies whether authentication requests are logged by NPS. If you specify Enable, these requests are logged. If you specify Disable, these requests are not logged. The default is Disable.

periodicstatus

Optional. Specifies whether periodic status requests are logged by NPS. If you specify Enable, these requests are logged. If you specify Disable, these requests are not logged. The default is Disable.

periodicauthstatus

Optional. Specifies whether periodic authentication status requests are logged by NPS. If you specify Enable, these requests are logged. If you specify Disable, these requests are not logged. The default is Disable.

directory

Optional. Specifies the folder location where log files are stored. If no folder location is specified, the default folder location is windir\System32\LogFiles.

format

Optional. Specifies the logging format used by NPS. If you specify IAS, IAS format is used. If you specify ODBC, database-compatible format is used.

deleteold

Optional. Specifies whether old log files are deleted when hard disk space is full. If you specify Enable, old log files are automatically deleted when disk space is full. If you specify Disable, old log files are not deleted when disk space is full. The default is Enable.

frequency

Optional. Specifies the frequency at which new log files are created by NPS. If you specify Daily, new log files are created on a daily basis. If you specify Weekly, new log files are created every seven days. If you specify Monthly, new log files are created once per month. If you specify Unlimited, a new log file is never created and NPS always logs to the same file. If you specify Size, NPS creates a new log file when the old log file reaches the size specified with the maxsize parameter. The default is Monthly.

maxsize

Optional. Specifies the maximum size, in megabytes (MB), for the NPS log file. 1-100000 are valid sizes. If you specify a value for maxsize, you must also specify frequency=Size. If you specify frequency=Size and you do not specify a value for maxsize, the value for maxsize is automatically set to 10 MB.

Remarks

You must provide at least one parameter for this command to change log file settings. If you do not supply at least one parameter, no settings are changed.

set sqllog

Modifies the SQL Server logging settings in the NPS configuration.

Syntax

set sqllog [ [ connection = ] connection [ description = ] description [ accounting = ] Enable | Disable [ authentication = ] Enable | Disable [ periodicstatus = ] Enable | Disable [ maxsessions = ] maxsessions ]

Parameters

connection

Optional. Specifies the SQL Server connection initialization string. The basic format of a connection string is based on the Open Database Connectivity (ODBC) connection string. See Remarks for more information.

description

Optional. Specifies a description for the SQL Server connection.

accounting

Optional. Specifies whether accounting requests are logged by NPS. If you specify Enable, these requests are logged. If you specify Disable, these requests are not logged. The default is Disable.

authentication

Optional. Specifies whether authentication requests are logged by NPS. If you specify Enable, these requests are logged. If you specify Disable, these requests are not logged. The default is Disable.

periodicstatus

Optional. Specifies whether periodic status requests are logged by NPS. If you specify Enable, these requests are logged. If you specify Disable, these requests are not logged. The default is Disable.

periodicauthstatus

Optional. Specifies whether periodic authentication status requests are logged by NPS. If you specify Enable, these requests are logged. If you specify Disable, these requests are not logged. The default is Disable.

maxsessions

Optional. Specifies the maximum number of concurrent sessions allowed between the NPS server and the server running SQL Server. 1-100 are valid values. If you do not specify a value for maxsessions, the value for maxsessions is automatically set to 2.

Remarks

  • You must provide at least one parameter for this command to change SQL Server logging settings. If you do not supply at least one parameter, no settings are changed.

  • The format of a SQL Server connection string is based on ODBC connection string syntax. For more information, see the topic Connection String Syntax in the "OLE DB Programmer's Reference" on the Web at http://go.microsoft.com/fwlink/?LinkId=70406.

Example

set sqllog connection = "Provider=SQLOLEDB.1;Integrated Security=SSPI;Initial Catalog= database_name ;Data Source= server_name"

show filelog

Displays the log file configuration for the local NPS server.

Syntax

show filelog

Remarks

This command displays the accounting configuration for the NPS server on which the command is run. In the NPS console, this information is displayed in Accounting.

Example

Following is an example of the log file settings that are displayed when you run the show filelog command.

Accounting | = Enabled
Authentication | = Enabled
Periodic status | = Enabled
Periodic authentication status | = Enabled
Directory | = C:\Windows\system32\LogFiles
Format | = ODBC formatting
Delete old logs | = Enabled
Frequency | = Monthly logs
Max size | = 10 MB

show sqllog

Displays the SQL Server logging configuration for the local NPS server.

Syntax

show sqllog

Remarks

This command displays the SQL Server accounting configuration for the NPS server on which the command is run. In the NPS console, this information is displayed in Accounting.

Example

Following is an example of the SQL Server logging settings that are displayed when you run the show sqllog command.

Connection | =
Description | =
Accounting | = Enabled
Authentication | = Enabled
Periodic status | = Enabled
Periodic authentication status | = Enabled
Max sessions | = 2

See Also

Concepts

NPS Server Commands
RADIUS Client Commands
Connection Request Policy Commands
Remote RADIUS Server Group Commands
Network Policy Commands
Network Access Protection Commands for NPS


Configuring IP Filters with Netsh NPS Commands
See Also

You can configure IP filters in both connection request policies and network policies by using netsh nps commands. The following sections provide details on the commands and parameters to use to configure IP filters for IPv4 or IPv6.

Commands for configuration of IP filters

The following netsh nps commands allow you to configure IP filters that are applied at the network access server for connection requests that match the respective policies.

  • add crp. This command allows you to add a new connection request policy to the Network Policy Server (NPS) configuration.

  • set crp. This command allows you to modify an existing connection request policy.

  • add np. This command allows you to add a new network policy to the NPS server configuration.

  • set np. This command allows you to modify an existing network policy.

With these commands, you can configure IP filters using the parameters profileid, advprofiletype, and advprofiledata. The following sections provide details for each parameter.

profileid

The following values for profileid are valid for the configuration of IP filters.

Name | ID
MS-Quarantine-IPFilter | 0x1045
MS-Filter | 0x102f
MS-IPv6-Filter | 0x1fd0

advprofiletype

The following values for advprofiletype are valid for the configuration of IP filters.

Name | Type
IPv4 Input filters | IPFILTER_IPV4INFILTER
IPv4 Output filters | IPFILTER_IPV4OUTFILTER
IPv6 Input filters | IPFILTER_IPV6INFILTER
IPv6 Output filters | IPFILTER_IPV6OUTFILTER

advprofiledata

The following syntax and comma-separated list of parameters for advprofiledata are valid for the configuration of IP filters.

Syntax

advprofiledata= action,ip address,mask,protocol,source port,destination port

Parameters

Name | Description
action | Required. Specifies whether IP traffic is permitted or denied. PERMIT specifies that all IP traffic is permitted except for the packets that you designate with the ip address, mask, protocol, source port, and destination port parameters. DENY specifies that all IP traffic is denied except for the packets that you designate with the ip address, mask, protocol, source port, and destination port parameters.
ip address | Required. Specifies either an IPv4 or an IPv6 address.
mask | Required. Specifies the subnet mask for an IPv4 address or the prefix length for an IPv6 address in the following formats: "x.x.x.x" specifies an IPv4 subnet mask, while <number> specifies an IPv6 prefix length.
protocol | Optional. Specifies the protocol number as an integer, such as 6 for TCP or 17 for User Datagram Protocol (UDP).
source port and destination port | Optional. Specifies the source port and destination port as integers. If specified, you must designate both a source port and a destination port. If you do not specify a source port and destination port, all IP traffic to the specified IP address is permitted or denied, depending on the value of action.

See Also

Concepts

Connection Request Policy Commands
Network Policy Commands
NPS Attributes


Network Policy Commands
See Also

This section contains the following commands:

  • add np

  • delete np

  • rename np

  • reset np

  • set np

  • show np

  • show npconditionattributes

  • show npprofileattributes

For information on how to interpret netsh command syntax, see Formatting Legend.

Network Policy commands

The following entries provide details for each command.

add np

Adds a network policy to the Network Policy Server (NPS) configuration.

Syntax

add np [ name = ] name [ [ state = ] Enable | Disable [ processingorder = ] processingorder [ policysource = ] policysource [ conditionid = ] conditionid [ conditiondata = ] conditiondata [ profileid = ] profileid ([ advprofiletype = ] type [ advprofiledata = ] data ) [ profiledata = ] profiledata ]

Parameters

name

Required. Specifies the name of the network policy that you want to add.

state

Optional. Specifies whether the network policy is enabled or disabled. The default is enabled.

processingorder

Optional. Specifies the numeric position of this policy in the list of policies configured in NPS. Policies highest in the list (for example, at first position) are processed by NPS first. Policies added at positions above other policies cause the positions of the other policies to drop in the list by one position. If processingorder is not specified, the policy is added at the end of the list.

policysource

Optional. Specifies the type of RADIUS client that can send connection requests that match this policy. An integer value of zero through five must be used to designate the type of RADIUS client that is allowed for the policy. The default value of zero allows connection requests from any type of RADIUS client. See the Remarks section for all valid values.

conditionid

Required. Specifies the condition attribute name or ID that you want to configure in this network policy.

You can view the list of available condition attributes at the netsh prompt by running the show npconditionattributes command. See the section "NPS attributes" for more information.

profileid

Optional. Specifies an attribute that you want to add to the network policy. Use profiledata to specify the value of the attribute defined by profileid. In addition, each profileid that you specify can be followed by multiple pairs of parameters named advprofiletype and advprofiledata. The syntax for these parameters is:

[advprofiletype= ] type [advprofiledata=] data

You can view the list of available settings attributes at the netsh prompt by running the show npprofileattributes command.

See the Remarks section and "NPS attributes" for more information.

advprofiletype

Optional. Specifies an attribute that you want to add to the network policy. This parameter is a sub-parameter of and must be preceded by the profileid parameter. Use advprofiledata to add values for the attribute defined with advprofiletype.

advprofiledata

Optional. Specifies the value of the attribute defined with advprofiletype. This parameter is a sub-parameter of and must be preceded by the profileid parameter. In addition, you must specify advprofiletype when you use advprofiledata.

profiledata

Optional. Specifies the value of the attribute defined with profileid. For example, if the attribute specified in profileid is NP-Authentication-Type (0x1009), the value of profiledata might be 0x3 (MS-CHAP v1) or 0x4 (MS-CHAP v2). In cases where multiple values are allowed for an attribute, they can be listed:

profileid = "0x1009" profiledata = "0x3" profiledata = "0x4" profiledata = "0x9" profiledata = "0xa"

Remarks on authentication methods

Network policy is configured by default with the following authentication method settings:

  • Microsoft Encrypted Authentication version 2 (MS-CHAP v2, profiledata=0x4) and User can change password after it has expired (profiledata=0xa)

  • Microsoft Encrypted Authentication (MS-CHAP, profiledata=0x3) and User can change password after it has expired (profiledata=0x9)

In the NPS console, these authentication settings are located on the Settings tab of network policies under Constraints and Authentication Methods.

Remarks on policysource

For policysource, valid values are:

ID | Policy Source
0 | Unspecified (default)
1 | Terminal Services Gateway
2 | Remote Access Server (VPN or Dial-up)
3 | DHCP server
4 | Wireless Access Point
5 | Health Registration Authority

Remarks on configuring IP filters

You can use the profileid, advprofiletype, and advprofiledata parameters to configure IP filters for the network policy that you add. For more information, see the section "Configuring IP filters with Netsh NPS commands."

delete np

Deletes the specified network policy.

Syntax

delete np [ name = ] name

Parameters

name

Required. Specifies the name of the network policy that you want to delete.

Example

The following examples delete a network policy named NP1 from the NPS server configuration.

delete np name = NP1

delete np NP1

rename np

Changes the name of a network policy.

Syntax

rename np [ name = ] name [ newname = ] newname

Parameters

name

Required. Specifies the network policy that you want to rename.

newname

Required. Specifies the new name for the network policy.

Examples

The following examples rename a network policy from NP1 to NP2. The examples demonstrate that the command can be run with the parameter tags, such as name=, and without them.

rename np name = NP1 newname = NP2

rename np NP1 NP2

reset np

Deletes all network policies that are configured in NPS and restores the default network policy.

Caution
Do not run this command if you want to maintain any of the network policies that you have configured at the NPS server. This command deletes all network policies that you have configured, and after running this command, your network policies cannot be recovered. Before you run this command, it is recommended that you use the export command to save the NPS server configuration to an XML file.

Syntax

reset np

set np

Changes the value of one or more properties of an existing network policy. Values specified by this command overwrite the existing values.

Syntax

set np [ name = ] name [ [ state = ] Enable | Disable [ processingorder = ] processingorder [ policysource = ] policysource [ conditionid = ] conditionid [ conditiondata = ] conditiondata [ profileid = ] profileid ([ advprofiletype = ] type [ advprofiledata = ] data ) [ profiledata = ] profiledata ]

Parameters

name

Required. Specifies the name of the network policy that you want to add.

state

Optional. Specifies whether the network policy is enabled or disabled. The default is enabled.

processingorder

Optional. Specifies the numeric position of this policy in the list of policies configured in NPS. Policies highest in the list (for example, at first position) are processed by NPS first. Policies added at positions above other policies cause the positions of the other policies to drop in the list by one position. If processingorder is not specified, the policy is added at the end of the list.

policysource

Optional. Specifies the type of RADIUS client that can send connection requests that match this policy. An integer value of zero through five must be used to designate the type of RADIUS client that is allowed for the policy. The default value of zero allows connection requests from any type of RADIUS client. See the Remarks section for all valid values.

conditionid

Required. Specifies the condition attribute name or ID that you want to configure in this network policy.

You can view the list of available condition attributes at the netsh prompt by running the show npconditionattributes command. See the section "NPS attributes" for more information.

profileid

Optional. Specifies an attribute that you want to add to the network policy. Use profiledata to specify the value of the attribute defined by profileid. In addition, each profileid that you specify can be followed by multiple pairs of parameters named advprofiletype and advprofiledata. The syntax for these parameters is:

[advprofiletype= ] type [advprofiledata=] data

You can view the list of available settings attributes at the netsh prompt by running the show npprofileattributes command.

See the Remarks section and "NPS attributes" for more information.

advprofiletype

Optional. Specifies an attribute that you want to add to the network policy. This parameter is a sub-parameter of and must be preceded by the profileid parameter. Use advprofiledata to add values for the attribute defined with advprofiletype.

advprofiledata

Optional. Specifies the value of the attribute defined with advprofiletype. This parameter is a sub-parameter of and must be preceded by the profileid parameter. In addition, you must specify advprofiletype when you use advprofiledata.

profiledata

Optional. Specifies the value of the attribute defined with profileid. For example, if the attribute specified in profileid is NP-Authentication-Type (0x1009), the value of profiledata might be 0x3 (MS-CHAP v1) or 0x4 (MS-CHAP v2). In cases where multiple values are allowed for an attribute, they can be listed:

profileid = "0x1009" profiledata = "0x3" profiledata = "0x4" profiledata = "0x9" profiledata = "0xa"

Remarks on authentication methods

Network policy is configured by default with the following authentication method settings:

  • Microsoft Encrypted Authentication version 2 (MS-CHAP v2, profiledata=0x4) and User can change password after it has expired (profiledata=0xa)

  • Microsoft Encrypted Authentication (MS-CHAP, profiledata=0x3) and User can change password after it has expired (profiledata=0x9)

In the NPS console, these authentication settings are located on the Settings tab of network policies under Constraints and Authentication Methods.

Remarks on policysource

For policysource, valid values are:

ID | Policy Source
0 | Unspecified (default).
1 | Terminal Services Gateway.
2 | Remote Access Server (VPN or Dial up).
3 | DHCP server.
4 | Wireless Access Point.
5 | Health Registration Authority.

Remarks on configuring IP filters

You can use the profileid, advprofiletype, and advprofiledata parameters to configure IP filters for the network policy that you want to modify. For more information, see the section "Configuring IP filters with Netsh NPS commands."

show np

Displays the full configuration of a network policy, including all of the conditions, settings, and attributes configured in the policy.

Syntax

show np [ name = ] name

Parameters

name

Optional. Specifies the name of a condition for which you want to display information. If name is not specified, then the full list of conditions is displayed.

show npconditionattributes

Displays the list of attributes that you can add to the conditions of a network policy.

Syntax

show npconditionattributes

show npprofileattributes

Displays the list of attributes that you can add to the settings of a network policy.

Syntax

show npprofileattributes

See Also

Concepts

NPS Server Commands
RADIUS Client Commands
Connection Request Policy Commands
Remote RADIUS Server Group Commands
Configuring a Network Policy to Grant Access
Network Access Protection Commands for NPS
Accounting Commands
Configuring IP Filters with Netsh NPS Commands
NPS Attributes


Configuring a Network Policy to Grant Access
See Also

When you add a new network policy to the Network Policy Server (NPS) configuration, the default value of Access Permission is Deny access, and the default value of Ignore user account dial-in properties is false, or not selected. These settings have the following effect on the way in which NPS evaluates the policy and authorizes the connection request:

  • Access Permission. When the value of Access Permission is Deny access, all connection requests that match the network policy are denied.

  • Ignore user account dial in properties. When this setting is not selected, NPS checks the dial-in properties of the user account in Active Directory while performing authorization. These properties affect how NPS authorizes the connection request. For example, if the Network Access Permission setting in user account dial-in properties is set to Deny access, NPS denies the connection request.

In some circumstances, this configuration of network policy is appropriate, but in other circumstances, you might want the network policy to allow rather than deny access, or you might want to configure the policy so that NPS ignores the dial-in properties of user accounts.

Commands for Access Permission configuration

To manually configure the Access Permission settings in the NPS console, obtain the properties of the network policy and then click the Overview tab. You can also configure these settings by using the following commands at the netsh nps prompt and in scripts and batch files.

  • add np. This command allows you to add a new network policy to the NPS server configuration.

  • set np. This command allows you to modify an existing network policy.

With these commands, you can configure Access Permission settings by using the parameters profileid and profiledata.

The following table provides the details for each attribute.

NPS console setting | Attribute name | profileid | profiledata
Access Permission | NP-Allow-Dial-in | 0x100f | True | False
Ignore user account dial-in properties | Ignore-User-Dial-in-Properties | 0x1005 | True | False

Example

The following example adds a network policy named "Example network policy" to the NPS configuration. The parameters profileid = "0x1005" profiledata = "True" add the attribute Ignore-User-Dial-in-Properties to the network policy and configure NPS not to check user account dial-in properties in Active Directory if the connection request matches this network policy. In addition, the parameters profileid = "0x100f" profiledata = "True" add the attribute NP-Allow-Dial-In to the network policy with a value of Grant Access, so that all connection requests that match the network policy are granted if the user or computer is authenticated.

add np name = "Example network policy" state = "enable" processingorder = "2" policysource = "0" conditionid = "0x1006" conditiondata = "0 00:00-24:00; 1 00:00-24:00; 2 00:00-24:00; 3 00:00-24:00; 4 00:00-24:00; 5 00:00-24:00; 6 00:00-24:00" profileid = "0x1005" profiledata = "True" profileid = "0x100f" profiledata = "True" profileid = "0x1009" profiledata = "0x3" profiledata = "0x4" profiledata = "0x9" profiledata = "0xa" profileid = "0x1fc8" profiledata = "TRUE" profileid = "0x7" profiledata = "0x1" profileid = "0x6" profiledata = "0x2"

See Also

Concepts

Network Policy Commands


NPS Attributes

Network Policy Server (NPS) provides RADIUS attributes that you can configure in the conditions and settings of both connection request and network policies.

The following sections contain a list of the RADIUS attributes, including their hexadecimal identifier (ID) and type, such as string or integer.

  • NPS Connection Request Policy Condition Attributes

  • NPS Connection Request Policy Profile Attributes

  • NPS Network Policy Condition Attributes

  • NPS Network Policy Profile Attributes

In addition, you can view these attribute lists at the netsh nps prompt by issuing the following commands:

show crpconditionattributes

show crpprofileattributes

show npconditionattributes

show npprofileattributes


NPS Connection Request Policy Condition Attributes

The following list of attributes can be added to the conditions of connection request policies in Network Policy Server (NPS).

Connection request policy condition attributes

This list can also be viewed at the netsh nps prompt with the command show crpconditionattributes.

Name | ID | Type
User-Name | 0x1 | Octet string
NAS-IP-Address | 0x4 | Internet address v4
Service-Type | 0x6 | Enumerator
Framed-Protocol | 0x7 | Enumerator
Called-Station-Id | 0x1e | Octet string
Calling-Station-Id | 0x1f | Octet string
NAS-Identifier | 0x20 | Octet string
NAS-Port-Type | 0x3d | Enumerator
Tunnel-Type | 0x40 | Enumerator
NAS-IPv6-Address | 0x5f | Internet address v6
Day-And-Time-Restrictions | 0x1006 | String
Client-IP-Address | 0x100c | Internet address v4
Client-Vendor | 0x1014 | Enumerator
Client-Friendly-Name | 0x1020 | String
MS-Identity-Type | 0x1fac | Enumerator
MS-Network-Access-Server-Type | 0x1fc4 | Enumerator
Client-IPv6-Address | 0x1fcb | Internet address v6
Machine-Inventory-Restrictions | 0x1fd5 | String


NPS Connection Request Policy Profile Attributes

The following list of attributes can be added to the settings of connection request policies in Network Policy Server (NPS).

Connection request policy profile attributes

This list can also be viewed at the netsh nps prompt with the command show crpprofileattributes.

Name | ID | Type
Ascend-Remove-Seconds | 0xf1 | Integer
Ascend-Data-Filter | 0xf2 | Octet string
Ascend-Call-Filter | 0xf3 | Octet string
Ascend-Idle-Limit | 0xf4 | Integer
Ascend-Preempt-Limit | 0xf5 | Integer
Ascend-Callback | 0xf6 | Enumerator
Ascend-Data-Svc | 0xf7 | Enumerator
Ascend-Force56 | 0xf8 | Enumerator
Ascend-Billing-Number | 0xf9 | String
Ascend-Call-By-Call | 0xfa | Integer
Ascend-Transit-Number | 0xfb | String
Ascend-Host-Info | 0xfc | String
Ascend-PPP-Address | 0xfd | Integer
Ascend-MPP-Idle-Percent | 0xfe | Integer
Ascend-Xmit-Rate | 0xff | Integer
NP-Authentication-Type | 0x1009 | Integer
NP-Allowed-EAP-Type | 0x100a | Octet string
Manipulation-Target | 0x1011 | Enumerator
Manipulation-Rule | 0x1012 | String
Auth-Provider-Type | 0x1025 | Enumerator
Auth-Provider-Name | 0x1029 | String
Acct-Provider-Type | 0x102a | Enumerator
Acct-Provider-Name | 0x102b | String
MS-Filter | 0x102f | Octet string
MS-Quarantine-IPFilter | 0x1045 | Octet string
MS-Quarantine-Session-Timeout | 0x1046 | Integer
Remote-RADIUS-to-Windows-User-Mapping | 0x1048 | Boolean
Passport-User-Mapping-UPN-Suffix | 0x1049 | String
Tunnel-Tag | 0x104a | Integer
Cisco-AV-Pair | 0x1388 | String
Nortel-Port-QOS | 0x1770 | Enumerator
Nortel-Port-Priority | 0x1771 | Octet string
EAP-Configuration | 0x1fa2 | Octet string
Override-RAP-Auth | 0x1fb0 | Boolean
MS-IPv6-Filter | 0x1fd0 | Octet string
USR-Last-Number-Dialed-Out | 0x2af8 | Octet string
USR-Last-Number-Dialed-In-DNIS | 0x2af9 | Octet string
USR-Last-Callers-Number-ANI | 0x2afa | Octet string
USR-Channel | 0x2afb | Integer
USR-Event-Id | 0x2afc | Enumerator
USR-Event-Date-Time | 0x2afd | Integer
USR-Call-Start-Date-Time | 0x2afe | Integer
USR-Call-End-Date-Time | 0x2aff | Integer
USR-Default-DTE-Data-Rate | 0x2b00 | Enumerator
USR-Initial-Rx-Link-Data-Rate | 0x2b01 | Enumerator
USR-Final-Rx-Link-Data-Rate | 0x2b02 | Enumerator
USR-Initial-Tx-Link-Data-Rate | 0x2b03 | Enumerator
USR-Final-Tx-Link-Data-Rate | 0x2b04 | Enumerator
USR-Chassis-Temperature | 0x2b05 | Integer
USR-Chassis-Temp-Threshold | 0x2b06 | Integer
USR-Actual-Voltage | 0x2b07 | Integer
USR-Expected-Voltage | 0x2b08 | Integer
USR-Power-Supply-Number | 0x2b09 | Integer
USR-Card-Type | 0x2b0a | Enumerator
USR-Chassis-Slot | 0x2b0b | Integer
USR-Sync-Async-Mode | 0x2b0c | Enumerator
USR-Originate-Answer-Mode | 0x2b0d | Enumerator
USR-Modulation-Type | 0x2b0e | Enumerator
USR-Initial-Modulation-Type | 0x2b0f | Enumerator
USR-Connect-Term-Reason | 0x2b10 | Enumerator
USR-Failure-to-Connect-Reason | 0x2b11 | Enumerator
USR-Equalization-Type | 0x2b12 | Enumerator
USR-Fallback-Enabled | 0x2b13 | Enumerator
USR-Connect-Time-Limit | 0x2b14 | Integer
USR-Number-of-Rings-Limit | 0x2b15 | Integer
USR-DTE-Data-Idle-Timeout | 0x2b16 | Integer
USR-Characters-Sent | 0x2b17 | Integer
USR-Characters-Received | 0x2b18 | Integer
USR-Blocks-Sent | 0x2b19 | Integer
USR-Blocks-Received | 0x2b1a | Integer
USR-Blocks-Resent | 0x2b1b | Integer
USR-Retrains-Requested | 0x2b1c | Integer
USR-Retrains-Granted | 0x2b1d | Integer
USR-Line-Reversals | 0x2b1e | Integer
USR-Number-Of-Characters-Lost | 0x2b1f | Integer
USR-Number-of-Blers | 0x2b20 | Integer
USR-Number-of-Link-Timeouts | 0x2b21 | Integer
USR-Number-of-Fallbacks | 0x2b22 | Integer
USR-Number-of-Upshifts | 0x2b23 | Integer
USR-Number-of-Link-NAKs | 0x2b24 | Integer
USR-DTR-False-Timeout | 0x2b25 | Integer
USR-Fallback-Limit | 0x2b26 | Integer
USR-Block-Error-Count-Limit | 0x2b27 | Integer
USR-DTR-True-Timeout | 0x2b28 | Integer
USR-Security-Login-Limit | 0x2b29 | Integer
USR-Security-Resp-Limit | 0x2b2a | Integer
USR-DTE-Ring-No-Answer-Limit | 0x2b2b | Integer
USR-Back-Channel-Data-Rate | 0x2b2c | Enumerator
USR-Simplified-MNP-Levels | 0x2b2d | Enumerator
USR-Simplified-V42bis-Usage | 0x2b2e | Enumerator
USR-Mbi-Ct-PRI-Card-Slot | 0x2b2f | Integer
USR-Mbi-Ct-TDM-Time-Slot | 0x2b30 | Integer
USR-Mbi-Ct-PRI-Card-Span-Line | 0x2b31 | Integer
USR-Mbi-Ct-BChannel-Used | 0x2b32 | Integer
USR-Physical-State | 0x2b33 | Integer
USR-Packet-Bus-Session | 0x2b34 | Integer
USR-Server-Time | 0x2b35 | Integer
USR-Channel-Connected-To | 0x2b36 | Integer
USR-Slot-Connected-To | 0x2b37 | Integer
USR-Device-Connected-To | 0x2b38 | Enumerator
USR-NFAS-ID | 0x2b39 | Integer
USR-Q931-Call-Reference-Value | 0x2b3a | Integer
USR-Call-Event-Code | 0x2b3b | Enumerator
USR-DS0 | 0x2b3c | Integer
USR-DS0s | 0x2b3d | Octet string
USR-Gateway-IP-Address | 0x2b3e | Internet address v4
USR-Call-Arrival-in-GMT | 0x2b3f | Integer
USR-Call-Connect-in-GMT | 0x2b40 | Integer
USR-Call-Terminate-in-GMT | 0x2b41 | Integer
USR-IDS0-Call-Type | 0x2b42 | Integer
USR-Call-Reference-Number | 0x2b43 | Integer
USR-CDMA-Call-Reference-Number | 0x2b44 | Integer
USR-Mobile-IP-Address | 0x2b45 | Internet address v4
USR-IWF-IP-Address | 0x2b46 | Internet address v4
USR-Called-Party-Number | 0x2b47 | Octet string
USR-Calling-Party-Number | 0x2b48 | Octet string
USR-Call-Type | 0x2b49 | Integer
USR-ESN | 0x2b4a | Octet string
USR-IWF-Call-Identifier | 0x2b4b | Integer
USR-IMSI | 0x2b4c | Octet string
USR-Service-Option | 0x2b4d | Integer
USR-Disconnect-Cause-Indicator | 0x2b4e | Integer
USR-Mobile-NumBytes-Txed | 0x2b4f | Integer
USR-Mobile-NumBytes-Rxed | 0x2b50 | Integer
USR-Num-Fax-Pages-Processed | 0x2b51 | Integer
USR-Compression-Type | 0x2b52 | Integer
USR-Call-Error-Code | 0x2b53 | Integer
USR-Modem-Setup-Time | 0x2b54 | Integer
USR-Call-Connecting-Time | 0x2b55 | Integer
USR-Connect-Time | 0x2b56 | Integer
USR-RMMIE-Manufacturer-ID | 0x2b57 | Integer
USR-RMMIE-Product-Code | 0x2b58 | Octet string
USR-RMMIE-Serial-Number | 0x2b59 | Octet string
USR-RMMIE-Firmware-Version | 0x2b5a | Octet string
USR-RMMIE-Firmware-Build-Date | 0x2b5b | Octet string
USR-RMMIE-Status | 0x2b5c | Enumerator
USR-RMMIE-Num-Of-Updates | 0x2b5d | Integer
USR-RMMIE-x2-Status | 0x2b5e | Enumerator
USR-RMMIE-Planned-Disconnect | 0x2b5f | Enumerator
USR-RMMIE-Last-Update-Time | 0x2b60 | Integer
USR-RMMIE-Last-Update-Event | 0x2b61 | Enumerator
USR-RMMIE-Rcv-Tot-PwrLvl | 0x2b62 | Integer
USR-RMMIE-Rcv-PwrLvl-3300Hz | 0x2b63 | Integer
USR-RMMIE-Rcv-PwrLvl-3750Hz | 0x2b64 | Integer
USR-RMMIE-PwrLvl-NearEcho-Canc | 0x2b65 | Integer
USR-RMMIE-PwrLvl-FarEcho-Canc | 0x2b66 | Integer
USR-RMMIE-PwrLvl-Noise-Lvl | 0x2b67 | Integer
USR-RMMIE-PwrLvl-Xmit-Lvl | 0x2b68 | Integer
USR-PW-USR-IFilter-IP | 0x2b69 | Octet string
USR-PW-USR-IFilter-IPX | 0x2b6a | Octet string
USR-PW-USR-IFilter-SAP | 0x2b6b | Octet string
USR-PW-USR-OFilter-IP | 0x2b6c | Octet string
USR-PW-USR-OFilter-IPX | 0x2b6d | Octet string
USR-PW-USR-OFilter-SAP | 0x2b6e | Octet string
USR-PW-VPN-ID | 0x2b6f | Integer
USR-PW-VPN-Name | 0x2b70 | Octet string
USR-PW-VPN-Neighbor | 0x2b71 | Internet address v4
USR-PW-Framed-Routing-V2 | 0x2b72 | Enumerator
USR-PW-VPN-Gateway | 0x2b73 | Octet string
USR-PW-Tunnel-Authentication | 0x2b74 | Octet string
USR-PW-Index | 0x2b75 | Integer
USR-PW-Cutoff | 0x2b76 | Octet string
USR-PW-Packet | 0x2b77 | Octet string
USR-Primary-DNS-Server | 0x2b78 | Internet address v4
USR-Secondary-DNS-Server | 0x2b79 | Internet address v4
USR-Primary-NBNS-Server | 0x2b7a | Internet address v4
USR-Secondary-NBNS-Server | 0x2b7b | Internet address v4
USR-Syslog-Tap | 0x2b7c | Enumerator
USR-Log-Filter-Packet | 0x2b7d | Integer
USR-Chassis-Call-Slot | 0x2b7e | Integer
USR-Chassis-Call-Span | 0x2b7f | Integer
USR-Chassis-Call-Channel | 0x2b80 | Integer
USR-Keypress-Timeout | 0x2b81 | Integer
USR-Unauthenticated-Time | 0x2b82 | Integer
USR-VPN-Encryptor | 0x2b83 | Octet string
USR-VPN-GW-Location-Id | 0x2b84 | Octet string
USR-Re-Chap-Timeout | 0x2b85 | Integer
USR-CCP-Algorithm | 0x2b86 | Enumerator
USR-ACCM-Type | 0x2b87 | Integer
USR-Connect-Speed | 0x2b88 | Enumerator
USR-Framed-IP-Address-Pool-Name | 0x2b89 | Octet string
USR-MP-EDO | 0x2b8a | Octet string
USR-Local-Framed-IP-Addr | 0x2b8b | Internet address v4
USR-Framed-IPX-Route | 0x2b8c | Internet address v4
USR-MPIP-Tunnel-Originator | 0x2b8d | Internet address v4
USR-Bearer-Capabilities | 0x2b8e | Integer
USR-Speed-Of-Connection | 0x2b8f | Enumerator
USR-Max-Channels | 0x2b90 | Integer
USR-Channel-Expansion | 0x2b91 | Integer
USR-Channel-Decrement | 0x2b92 | Integer
USR-Expansion-Algorithm | 0x2b93 | Enumerator
USR-Compression-Algorithm | 0x2b94 | Enumerator
USR-Receive-Acc-Map | 0x2b95 | Integer
USR-Transmit-Acc-Map | 0x2b96 | Integer
USR-Compression-Reset-Mode | 0x2b97 | Enumerator
USR-Min-Compression-Size | 0x2b98 | Integer
USR-IP | 0x2b99 | Integer
USR-IPX | 0x2b9a | Integer
USR-Filter-Zones | 0x2b9b | Enumerator
USR-Appletalk | 0x2b9c | Enumerator
USR-Bridging | 0x2b9d | Enumerator
USR-Spoofing | 0x2b9e | Enumerator
USR-Host-Type | 0x2b9f | Integer
USR-Send-Name | 0x2ba0 | Octet string
USR-Send-Password | 0x2ba1 | Octet string
USR-Start-Time | 0x2ba2 | Integer
USR-End-Time | 0x2ba3 | Integer
USR-Send-Script1 | 0x2ba4 | Octet string
USR-Reply-Script1 | 0x2ba5 | Octet string
USR-Send-Script2 | 0x2ba6 | Octet string
USR-Reply-Script2 | 0x2ba7 | Octet string
USR-Send-Script3 | 0x2ba8 | Octet string
USR-Reply-Script3 | 0x2ba9 | Octet string
USR-Send-Script4 | 0x2baa | Octet string
USR-Reply-Script4 | 0x2bab | Octet string
USR-Send-Script5 | 0x2bac | Octet string
USR-Reply-Script5 | 0x2bad | Octet string
USR-Send-Script6 | 0x2bae | Octet string
USR-Reply-Script6 | 0x2baf | Octet string
USR-Terminal-Type | 0x2bb0 | Octet string
USR-Appletalk-Network-Range | 0x2bb1 | Integer
USR-Local-IP-Address | 0x2bb2 | Octet string
USR-Routing-Protocol | 0x2bb3 | Enumerator
USR-Modem-Group | 0x2bb4 | Octet string
USR-IPX-Routing | 0x2bb5 | Enumerator
USR-IPX-WAN | 0x2bb6 | Enumerator
USR-IP-RIP-Policies | 0x2bb7 | Enumerator
USR-IP-RIP-Simple-Auth-Password | 0x2bb8 | Octet string
USR-IP-RIP-Input-Filter | 0x2bb9 | Octet string
USR-IP-Call-Input-Filter | 0x2bba | Octet string
USR-IPX-RIP-Input-Filter | 0x2bbb | Octet string
USR-MP-MRRU | 0x2bbc | Integer
USR-IPX-Call-Input-Filter | 0x2bbd | Octet string
USR-AT-Input-Filter | 0x2bbe | Octet string
USR-AT-RTMP-Input-Filter | 0x2bbf | Octet string
USR-AT-Zip-Input-Filter | 0x2bc0 | Octet string
USR-AT-Call-Input-Filter | 0x2bc1 | Octet string
USR-ET-Bridge-Input-Filter | 0x2bc2 | Octet string
USR-IP-RIP-Output-Filter | 0x2bc3 | Octet string
USR-IP-Call-Output-Filter | 0x2bc4 | Octet string
USR-IPX-RIP-Output-Filter | 0x2bc5 | Octet string
USR-IPX-Call-Output-Filter | 0x2bc6 | Octet string
USR-AT-Output-Filter | 0x2bc7 | Octet string
USR-AT-RTMP-Output-Filter | 0x2bc8 | Octet string
USR-AT-Zip-Output-Filter | 0x2bc9 | Octet string
USR-AT-Call-Output-Filter | 0x2bca | Octet string
USR-ET-Bridge-Output-Filter | 0x2bcb | Octet string
USR-ET-Bridge-Call-Output-Filter | 0x2bcc | Octet string
USR-IP-Default-Route-Option | 0x2bcd | Enumerator
USR-MP-EDO-HIPER | 0x2bce | Octet string
USR-Modem-Training-Time | 0x2bcf | Integer
USR-Interface-Index | 0x2bd0 | Integer
USR-Tunnel-Security | 0x2bd1 | Enumerator
USR-Port-Tap | 0x2bd2 | Integer
USR-Port-Tap-Format | 0x2bd3 | Integer
USR-Port-Tap-Output | 0x2bd4 | Integer
USR-Port-Tap-Facility | 0x2bd5 | Integer
USR-Port-Tap-Priority | 0x2bd6 | Integer
USR-Port-Tap-Address | 0x2bd7 | Internet address v4
USR-MobileIP-Home-Agent-Address | 0x2bd8 | Internet address v4
USR-Tunneled-MLPP | 0x2bd9 | Integer
USR-Multicast-Proxy | 0x2bda | Integer
USR-Multicast-Receive | 0x2bdb | Integer
USR-Multicast-Forwarding | 0x2bdc | Integer
USR-IGMP-Query-Interval | 0x2bdd | Integer
USR-IGMP-Maximum-Response-Time | 0x2bde | Integer
USR-IGMP-Robustness | 0x2bdf | Integer
USR-IGMP-Version | 0x2be0 | Integer
USR-IGMP-Routing | 0x2be1 | Integer
USR-VTS-Session-Key | 0x2be2 | Octet string
USR-Orig-NAS-Type | 0x2be3 | Octet string
USR-Call-Arrival-Time | 0x2be4 | Integer
USR-Call-End-Time | 0x2be5 | Integer
USR-Rad-Multicast-Routing-Ttl | 0x2be6 | Integer
USR-Rad-Multicast-Routing-Rate-Limit | 0x2be7 | Integer
USR-Rad-Multicast-Routing-Protocol | 0x2be8 | Integer
USR-Rad-Multicast-Routing-Boundary | 0x2be9 | Octet string
USR-Rad-Dvmrp-Metric | 0x2bea | Integer
USR-Chat-Script-Name | 0x2beb | Octet string
USR-Chat-Script-Rules | 0x2bec | Octet string
USR-Rad-Location-Type | 0x2bed | Integer
USR-Tunnel-Switch-Endpoint | 0x2bee | Octet string
USR-OSPF-Addressless-Index | 0x2bef | Integer
USR-Callback-Type | 0x2bf0 | Enumerator
USR-Tunnel-Auth-Hostname | 0x2bf1 | Octet string
USR-Acct-Reason-Code | 0x2bf2 | Integer
USR-DNIS-ReAuthentication | 0x2bf3 | Integer
USR-PPP-Source-IP-Filter | 0x2bf4 | Octet string
USR-Auth-Mode | 0x2bf5 | Enumerator
USR-NAS-Type | 0x2bf6 | Enumerator
USR-Request-Type | 0x2bf7 | Enumerator
MS-MPPE-Encryption-Types | 0xffffffa6 | Integer
MS-MPPE-Encryption-Policy | 0xffffffa7 | Integer
MS-BAP-Usage | 0xffffffa8 | Integer
MS-Link-Drop-Time-Limit | 0xffffffa9 | Integer
MS-Link-Utilization-Threshold | 0xffffffaa | Integer


NPS Network Policy Condition Attributes

The following list of attributes can be added to the conditions of network policies in Network Policy Server (NPS).

Network policy condition attributes

This list can also be viewed at the netsh nps prompt with the command show npconditionattributes.

Name | ID | Type
NAS-IP-Address | 0x4 | Internet address v4
Service-Type | 0x6 | Enumerator
Framed-Protocol | 0x7 | Enumerator
Called-Station-Id | 0x1e | Octet string
Calling-Station-Id | 0x1f | Octet string
NAS-Identifier | 0x20 | Octet string
NAS-Port-Type | 0x3d | Enumerator
Tunnel-Type | 0x40 | Enumerator
NAS-IPv6-Address | 0x5f | Internet address v6
Day-And-Time-Restrictions | 0x1006 | String
Client-IP-Address | 0x100c | Internet address v4
Client-Vendor | 0x1014 | Enumerator
Authentication-Type | 0x101f | Enumerator
Client-Friendly-Name | 0x1020 | String
Windows-Groups | 0x1023 | String
MS-RAS-Vendor | 0x1033 | Integer
MS-Identity-Type | 0x1fac | Enumerator
MS-Service-Class | 0x1fad | Octet string
Windows-Machine-Groups | 0x1fb4 | String
Windows-User-Groups | 0x1fb5 | String
Not-Quarantine-Capable | 0x1fbb | Boolean
System-Health-Validators | 0x1fbd | String
MS-Network-Access-Server-Type | 0x1fc4 | Enumerator
Client-IPv6-Address | 0x1fcb | Internet address v6
Machine-Inventory-Restrictions | 0x1fd5 | String


NPS Network Policy Profile Attributes

The following list of attributes can be added to the settings of network policies in Network Policy Server (NPS).

Network policy profile attributes

This list can also be viewed at the netsh nps prompt with the command show npprofileattributes.

Name | ID | Type
Ascend-Force56 | 0xf8 | Enumerator
Ascend-Billing-Number | 0xf9 | String
Ascend-Call-By-Call | 0xfa | Integer
Ascend-Transit-Number | 0xfb | String
Ascend-Host-Info | 0xfc | String
Ascend-PPP-Address | 0xfd | Integer
Ascend-MPP-Idle-Percent | 0xfe | Integer
Ascend-Xmit-Rate | 0xff | Integer
Ignore-User-Dialin-Properties | 0x1005 | Boolean
Day-And-Time-Restrictions | 0x1006 | String
NP-Called-Station-ID | 0x1007 | String
NP-Allowed-Port-Types | 0x1008 | Enumerator
NP-Authentication-Type | 0x1009 | Integer
NP-Allowed-EAP-Type | 0x100a | Octet string
NP-Allow-Dial-in | 0x100f | Boolean
MS-Filter | 0x102f | Octet string
Generate-Class-Attribute | 0x103e | Boolean
Allowed-Certificate-OID | 0x1041 | String
Generate-Session-Timeout | 0x1043 | Boolean
MS-Quarantine-IPFilter | 0x1045 | Octet string
MS-Quarantine-Session-Timeout | 0x1046 | Integer
Tunnel-Tag | 0x104a | Integer
Cisco-AV-Pair | 0x1388 | String
Nortel-Port-QOS | 0x1770 | Enumerator
Nortel-Port-Priority | 0x1771 | Octet string
EAP-Configuration | 0x1fa2 | Octet string
MS-Quarantine-User-Class | 0x1fae | Octet string
MS-Quarantine-State | 0x1faf | Enumerator
Quarantine-URL | 0x1fb9 | String
Quarantine-Fixup-Servers-Configuration | 0x1fc2 | String
MS-AFW-Zone | 0x1fc6 | Enumerator
MS-AFW-Protection-Level | 0x1fc7 | Enumerator
Quarantine-Update-Non-Compliant | 0x1fc8 | Boolean
Quarantine-Grace-Time-Configuration | 0x1fcf | String
MS-IPv6-Filter | 0x1fd0 | Octet string
USR-Last-Number-Dialed-Out | 0x2af8 | Octet string
USR-Last-Number-Dialed-In-DNIS | 0x2af9 | Octet string
USR-Last-Callers-Number-ANI | 0x2afa | Octet string
USR-Channel | 0x2afb | Integer
USR-Event-Id | 0x2afc | Enumerator
USR-Event-Date-Time | 0x2afd | Integer
USR-Call-Start-Date-Time | 0x2afe | Integer
USR-Call-End-Date-Time | 0x2aff | Integer
USR-Default-DTE-Data-Rate | 0x2b00 | Enumerator
USR-Initial-Rx-Link-Data-Rate | 0x2b01 | Enumerator
USR-Final-Rx-Link-Data-Rate | 0x2b02 | Enumerator
USR-Initial-Tx-Link-Data-Rate | 0x2b03 | Enumerator
USR-Final-Tx-Link-Data-Rate | 0x2b04 | Enumerator
USR-Chassis-Temperature | 0x2b05 | Integer
USR-Chassis-Temp-Threshold | 0x2b06 | Integer
USR-Actual-Voltage | 0x2b07 | Integer
USR-Expected-Voltage | 0x2b08 | Integer
USR-Power-Supply-Number | 0x2b09 | Integer
USR-Card-Type | 0x2b0a | Enumerator
USR-Chassis-Slot | 0x2b0b | Integer
USR-Sync-Async-Mode | 0x2b0c | Enumerator
USR-Originate-Answer-Mode | 0x2b0d | Enumerator
USR-Modulation-Type | 0x2b0e | Enumerator
USR-Initial-Modulation-Type | 0x2b0f | Enumerator
USR-Connect-Term-Reason | 0x2b10 | Enumerator
USR-Failure-to-Connect-Reason | 0x2b11 | Enumerator
USR-Equalization-Type | 0x2b12 | Enumerator
USR-Fallback-Enabled | 0x2b13 | Enumerator
USR-Connect-Time-Limit | 0x2b14 | Integer
USR-Number-of-Rings-Limit | 0x2b15 | Integer
USR-DTE-Data-Idle-Timeout | 0x2b16 | Integer
USR-Characters-Sent | 0x2b17 | Integer
USR-Characters-Received | 0x2b18 | Integer
USR-Blocks-Sent | 0x2b19 | Integer
USR-Blocks-Received | 0x2b1a | Integer
USR-Blocks-Resent | 0x2b1b | Integer
USR-Retrains-Requested | 0x2b1c | Integer
USR-Retrains-Granted | 0x2b1d | Integer
USR-Line-Reversals | 0x2b1e | Integer
USR-Number-Of-Characters-Lost | 0x2b1f | Integer
USR-Number-of-Blers | 0x2b20 | Integer
USR-Number-of-Link-Timeouts | 0x2b21 | Integer
USR-Number-of-Fallbacks | 0x2b22 | Integer
USR-Number-of-Upshifts | 0x2b23 | Integer
USR-Number-of-Link-NAKs | 0x2b24 | Integer
USR-DTR-False-Timeout | 0x2b25 | Integer
USR-Fallback-Limit | 0x2b26 | Integer
USR-Block-Error-Count-Limit | 0x2b27 | Integer
USR-DTR-True-Timeout | 0x2b28 | Integer
USR-Security-Login-Limit | 0x2b29 | Integer
USR-Security-Resp-Limit | 0x2b2a | Integer
USR-DTE-Ring-No-Answer-Limit | 0x2b2b | Integer
USR-Back-Channel-Data-Rate | 0x2b2c | Enumerator
USR-Simplified-MNP-Levels | 0x2b2d | Enumerator
USR-Simplified-V42bis-Usage | 0x2b2e | Enumerator
USR-Mbi-Ct-PRI-Card-Slot | 0x2b2f | Integer
USR-Mbi-Ct-TDM-Time-Slot | 0x2b30 | Integer
USR-Mbi-Ct-PRI-Card-Span-Line | 0x2b31 | Integer
USR-Mbi-Ct-BChannel-Used | 0x2b32 | Integer
USR-Physical-State | 0x2b33 | Integer
USR-Packet-Bus-Session | 0x2b34 | Integer
USR-Server-Time | 0x2b35 | Integer
USR-Channel-Connected-To | 0x2b36 | Integer
USR-Slot-Connected-To | 0x2b37 | Integer
USR-Device-Connected-To | 0x2b38 | Enumerator
USR-NFAS-ID | 0x2b39 | Integer
USR-Q931-Call-Reference-Value | 0x2b3a | Integer
USR-Call-Event-Code | 0x2b3b | Enumerator
USR-DS0 | 0x2b3c | Integer
USR-DS0s | 0x2b3d | Octet string
USR-Gateway-IP-Address | 0x2b3e | Internet address v4
USR-Call-Arrival-in-GMT | 0x2b3f | Integer
USR-Call-Connect-in-GMT | 0x2b40 | Integer
USR-Call-Terminate-in-GMT | 0x2b41 | Integer
USR-IDS0-Call-Type | 0x2b42 | Integer
USR-Call-Reference-Number | 0x2b43 | Integer
USR-CDMA-Call-Reference-Number | 0x2b44 | Integer
USR-Mobile-IP-Address | 0x2b45 | Internet address v4
USR-IWF-IP-Address | 0x2b46 | Internet address v4
USR-Called-Party-Number | 0x2b47 | Octet string
USR-Calling-Party-Number | 0x2b48 | Octet string
USR-Call-Type | 0x2b49 | Integer
USR-ESN | 0x2b4a | Octet string
USR-IWF-Call-Identifier | 0x2b4b | Integer
USR-IMSI | 0x2b4c | Octet string
USR-Service-Option | 0x2b4d | Integer
USR-Disconnect-Cause-Indicator | 0x2b4e | Integer
USR-Mobile-NumBytes-Txed | 0x2b4f | Integer
USR-Mobile-NumBytes-Rxed | 0x2b50 | Integer
USR-Num-Fax-Pages-Processed | 0x2b51 | Integer
USR-Compression-Type | 0x2b52 | Integer
USR-Call-Error-Code | 0x2b53 | Integer
USR-Modem-Setup-Time | 0x2b54 | Integer
USR-Call-Connecting-Time | 0x2b55 | Integer
USR-Connect-Time | 0x2b56 | Integer
USR-RMMIE-Manufacturer-ID | 0x2b57 | Integer
USR-RMMIE-Product-Code | 0x2b58 | Octet string
USR-RMMIE-Serial-Number | 0x2b59 | Octet string
USR-RMMIE-Firmware-Version | 0x2b5a | Octet string
USR-RMMIE-Firmware-Build-Date | 0x2b5b | Octet string
USR-RMMIE-Status | 0x2b5c | Enumerator
USR-RMMIE-Num-Of-Updates | 0x2b5d | Integer
USR-RMMIE-x2-Status | 0x2b5e | Enumerator
USR-RMMIE-Planned-Disconnect | 0x2b5f | Enumerator
USR-RMMIE-Last-Update-Time | 0x2b60 | Integer
USR-RMMIE-Last-Update-Event | 0x2b61 | Enumerator
USR-RMMIE-Rcv-Tot-PwrLvl | 0x2b62 | Integer
USR-RMMIE-Rcv-PwrLvl-3300Hz | 0x2b63 | Integer
USR-RMMIE-Rcv-PwrLvl-3750Hz | 0x2b64 | Integer
USR-RMMIE-PwrLvl-NearEcho-Canc | 0x2b65 | Integer
USR-RMMIE-PwrLvl-FarEcho-Canc | 0x2b66 | Integer
USR-RMMIE-PwrLvl-Noise-Lvl | 0x2b67 | Integer
USR-RMMIE-PwrLvl-Xmit-Lvl | 0x2b68 | Integer
USR-PW-USR-IFilter-IP | 0x2b69 | Octet string
USR-PW-USR-IFilter-IPX | 0x2b6a | Octet string
USR-PW-USR-IFilter-SAP | 0x2b6b | Octet string
USR-PW-USR-OFilter-IP | 0x2b6c | Octet string
USR-PW-USR-OFilter-IPX | 0x2b6d | Octet string
USR-PW-USR-OFilter-SAP | 0x2b6e | Octet string
USR-PW-VPN-ID | 0x2b6f | Integer
USR-PW-VPN-Name | 0x2b70 | Octet string
USR-PW-VPN-Neighbor | 0x2b71 | Internet address v4
USR-PW-Framed-Routing-V2 | 0x2b72 | Enumerator
USR-PW-VPN-Gateway | 0x2b73 | Octet string
USR-PW-Tunnel-Authentication | 0x2b74 | Octet string
USR-PW-Index | 0x2b75 | Integer
USR-PW-Cutoff | 0x2b76 | Octet string
USR-PW-Packet | 0x2b77 | Octet string
USR-Primary-DNS-Server | 0x2b78 | Internet address v4
USR-Secondary-DNS-Server | 0x2b79 | Internet address v4
USR-Primary-NBNS-Server | 0x2b7a | Internet address v4
USR-Secondary-NBNS-Server | 0x2b7b | Internet address v4
USR-Syslog-Tap | 0x2b7c | Enumerator
USR-Log-Filter-Packet | 0x2b7d | Integer
USR-Chassis-Call-Slot | 0x2b7e | Integer
USR-Chassis-Call-Span | 0x2b7f | Integer
USR-Chassis-Call-Channel | 0x2b80 | Integer
USR-Keypress-Timeout | 0x2b81 | Integer
USR-Unauthenticated-Time | 0x2b82 | Integer
USR-VPN-Encryptor | 0x2b83 | Octet string
USR-VPN-GW-Location-Id | 0x2b84 | Octet string
USR-Re-Chap-Timeout | 0x2b85 | Integer
USR-CCP-Algorithm | 0x2b86 | Enumerator
USR-ACCM-Type | 0x2b87 | Integer
USR-Connect-Speed | 0x2b88 | Enumerator
USR-Framed-IP-Address-Pool-Name | 0x2b89 | Octet string
USR-MP-EDO | 0x2b8a | Octet string
USR-Local-Framed-IP-Addr | 0x2b8b | Internet address v4
USR-Framed-IPX-Route | 0x2b8c | Internet address v4
USR-MPIP-Tunnel-Originator | 0x2b8d | Internet address v4
USR-Bearer-Capabilities | 0x2b8e | Integer
USR-Speed-Of-Connection | 0x2b8f | Enumerator
USR-Max-Channels | 0x2b90 | Integer
USR-Channel-Expansion | 0x2b91 | Integer
USR-Channel-Decrement | 0x2b92 | Integer
USR-Expansion-Algorithm | 0x2b93 | Enumerator
USR-Compression-Algorithm | 0x2b94 | Enumerator
USR-Receive-Acc-Map | 0x2b95 | Integer
USR-Transmit-Acc-Map | 0x2b96 | Integer
USR-Compression-Reset-Mode | 0x2b97 | Enumerator
USR-Min-Compression-Size | 0x2b98 | Integer
USR-IP | 0x2b99 | Integer
USR-IPX | 0x2b9a | Integer
USR-Filter-Zones | 0x2b9b | Enumerator
USR-Appletalk | 0x2b9c | Enumerator
USR-Bridging | 0x2b9d | Enumerator
USR-Spoofing | 0x2b9e | Enumerator
USR-Host-Type | 0x2b9f | Integer
USR-Send-Name | 0x2ba0 | Octet string
USR-Send-Password | 0x2ba1 | Octet string
USR-Start-Time | 0x2ba2 | Integer
USR-End-Time | 0x2ba3 | Integer
USR-Send-Script1 | 0x2ba4 | Octet string
USR-Reply-Script1 | 0x2ba5 | Octet string
USR-Send-Script2 | 0x2ba6 | Octet string
USR-Reply-Script2 | 0x2ba7 | Octet string
USR-Send-Script3 | 0x2ba8 | Octet string
USR-Reply-Script3 | 0x2ba9 | Octet string
USR-Send-Script4 | 0x2baa | Octet string
USR-Reply-Script4 | 0x2bab | Octet string
USR-Send-Script5 | 0x2bac | Octet string
USR-Reply-Script5 | 0x2bad | Octet string
USR-Send-Script6 | 0x2bae | Octet string
USR-Reply-Script6 | 0x2baf | Octet string
USR-Terminal-Type | 0x2bb0 | Octet string
USR-Appletalk-Network-Range | 0x2bb1 | Integer
USR-Local-IP-Address | 0x2bb2 | Octet string
USR-Routing-Protocol | 0x2bb3 | Enumerator
USR-Modem-Group | 0x2bb4 | Octet string
USR-IPX-Routing | 0x2bb5 | Enumerator
USR-IPX-WAN | 0x2bb6 | Enumerator
USR-IP-RIP-Policies | 0x2bb7 | Enumerator
USR-IP-RIP-Simple-Auth-Password | 0x2bb8 | Octet string
USR-IP-RIP-Input-Filter | 0x2bb9 | Octet string
USR-IP-Call-Input-Filter | 0x2bba | Octet string
USR-IPX-RIP-Input-Filter | 0x2bbb | Octet string
USR-MP-MRRU | 0x2bbc | Integer
USR-IPX-Call-Input-Filter | 0x2bbd | Octet string
USR-AT-Input-Filter | 0x2bbe | Octet string
USR-AT-RTMP-Input-Filter | 0x2bbf | Octet string
USR-AT-Zip-Input-Filter | 0x2bc0 | Octet string
USR-AT-Call-Input-Filter | 0x2bc1 | Octet string
USR-ET-Bridge-Input-Filter | 0x2bc2 | Octet string
USR-IP-RIP-Output-Filter | 0x2bc3 | Octet string
USR-IP-Call-Output-Filter | 0x2bc4 | Octet string
USR-IPX-RIP-Output-Filter | 0x2bc5 | Octet string
USR-IPX-Call-Output-Filter | 0x2bc6 | Octet string
USR-AT-Output-Filter | 0x2bc7 | Octet string
USR-AT-RTMP-Output-Filter | 0x2bc8 | Octet string
USR-AT-Zip-Output-Filter | 0x2bc9 | Octet string
USR-AT-Call-Output-Filter | 0x2bca | Octet string
USR-ET-Bridge-Output-Filter | 0x2bcb | Octet string
USR-ET-Bridge-Call-Output-Filter | 0x2bcc | Octet string
USR-IP-Default-Route-Option | 0x2bcd | Enumerator
USR-MP-EDO-HIPER | 0x2bce | Octet string
USR-Modem-Training-Time | 0x2bcf | Integer
USR-Interface-Index | 0x2bd0 | Integer
USR-Tunnel-Security | 0x2bd1 | Enumerator
USR-Port-Tap | 0x2bd2 | Integer
USR-Port-Tap-Format | 0x2bd3 | Integer
USR-Port-Tap-Output | 0x2bd4 | Integer
USR-Port-Tap-Facility | 0x2bd5 | Integer
USR-Port-Tap-Priority | 0x2bd6 | Integer
USR-Port-Tap-Address | 0x2bd7 | Internet address v4
USR-MobileIP-Home-Agent-Address | 0x2bd8 | Internet address v4
USR-Tunneled-MLPP | 0x2bd9 | Integer
USR-Multicast-Proxy | 0x2bda | Integer
USR-Multicast-Receive | 0x2bdb | Integer
USR-Multicast-Forwarding | 0x2bdc | Integer
USR-IGMP-Query-Interval | 0x2bdd | Integer
USR-IGMP-Maximum-Response-Time | 0x2bde | Integer
USR-IGMP-Robustness | 0x2bdf | Integer
USR-IGMP-Version | 0x2be0 | Integer
USR-IGMP-Routing | 0x2be1 | Integer
USR-VTS-Session-Key | 0x2be2 | Octet string
USR-Orig-NAS-Type | 0x2be3 | Octet string
USR-Call-Arrival-Time | 0x2be4 | Integer
USR-Call-End-Time | 0x2be5 | Integer
USR-Rad-Multicast-Routing-Ttl | 0x2be6 | Integer
USR-Rad-Multicast-Routing-Rate-Limit | 0x2be7 | Integer
USR-Rad-Multicast-Routing-Protocol | 0x2be8 | Integer
USR-Rad-Multicast-Routing-Boundary | 0x2be9 | Octet string
USR-Rad-Dvmrp-Metric | 0x2bea | Integer
USR-Chat-Script-Name | 0x2beb | Octet string
USR-Chat-Script-Rules | 0x2bec | Octet string
USR-Rad-Location-Type | 0x2bed | Integer
USR-Tunnel-Switch-Endpoint | 0x2bee | Octet string
USR-OSPF-Addressless-Index | 0x2bef | Integer
USR-Callback-Type | 0x2bf0 | Enumerator
USR-Tunnel-Auth-Hostname | 0x2bf1 | Octet string
USR-Acct-Reason-Code | 0x2bf2 | Integer
USR-DNIS-ReAuthentication | 0x2bf3 | Integer
USR-PPP-Source-IP-Filter | 0x2bf4 | Octet string
USR-Auth-Mode | 0x2bf5 | Enumerator
USR-NAS-Type | 0x2bf6 | Enumerator
USR-Request-Type | 0x2bf7 | Enumerator
MS-MPPE-Encryption-Types | 0xffffffa6 | Integer
MS-MPPE-Encryption-Policy | 0xffffffa7 | Integer
MS-BAP-Usage | 0xffffffa8 | Integer
MS-Link-Drop-Time-Limit | 0xffffffa9 | Integer
MS-Link-Utilization-Threshold | 0xffffffaa | Integer


Netsh Commands for Peer-to-Peer Networking (P2P)

Peer-to-peer (P2P) technologies are used to facilitate real-time communication and collaboration across distributed networks. In the peer-to-peer model, without using Internet servers, each computer user can do the following:

  • Exchange data

  • Share resources

  • Locate other users

  • Communicate

  • Collaborate directly in real time

By using peer-to-peer technologies, applications that coordinate the use of computer CPU cycles and storage can share resources among large or small groups of computers connected to the Internet. P2P is configured and administered by using Netsh commands.

You can run these commands from the command prompt for the Netsh P2P context. For these commands to work at the command prompt, you must type netsh p2p before typing commands and parameters as they appear in the syntax below.

For more information about netsh, see Netsh Overview and Enter a Netsh Context.

  • Netsh P2P

  • Netsh P2P collab

  • Netsh P2P group

  • Netsh P2P idmgr

  • Netsh P2P pnrp

For information on how to interpret netsh command syntax, see Formatting Legend.

Netsh P2P

The following commands are available at the p2p> prompt, which is rooted within the netsh environment.

To view the command syntax, click a command:

  • collab

  • dump

  • group

  • idmgr

  • pnrp

collab

Changes to the netsh p2p collab context.

dump

Creates a script that contains the current configuration. If saved to a

file, this script can be used to restore altered configuration settings.

group

Changes to the netsh p2p group context.

idmgr

Changes to the netsh p2p idmgr context.

pnrp

Changes to the netsh p2p pnrp context.

Netsh P2P collab

The following commands are available at the p2p collab> prompt, which is rooted within the netsh environment.

To view the command syntax, click a command:

  • contact

contact

Changes to the netsh p2p collab contact context.

Netsh P2P collab contact

The following commands are available at the p2p collab contact> prompt, which is rooted within the netsh environment.

To view the command syntax, click a command:

  • delete

  • export

  • import

  • set

  • show contacts

  • show xml

delete

Deletes a contact from the contact store.

Syntax

delete peer name

export

Exports the Me contact to a file name. This file can be later copied to another machine and is imported there.

Syntax

Export file name

import

Imports a contact from a file to the contact store.

Syntax

import file name

set

Sets the properties of a contact.

Syntax

set {Id=<Peer Name>]<FriendlyName=<friendly name>Watch=<true | false> WatchPerm=<allow | block>}

show contacts

Displays all contacts.

Syntax

show contacts

show xml

Displays the contents of the contact XML file.

Syntax

show xml file name

Netsh P2P group

The following commands are available at the p2p group> prompt, which is rooted within the netsh environment.

To view the command syntax, click a command:

  • database

  • resolve

  • show acl

  • show address

database

Changes to the netsh p2p group database context.

resolve

Resolves a participant in the group and lists its address.

Syntax

resolve {ANY | REMOTE} <group P2PID> [<cloud name>]

show acl

Lists access control list (ACL) information.

Syntax

show acl { identity <identity P2PID> | db <identity P2PID> <group P2PID>| <File path> }

show address

Resolves a participant in the current node and lists its address.

Syntax

show address <group P2PID> [ <cloud name> ]

Netsh P2P group database

The following commands are available at the p2p group database> prompt, which is rooted within the netsh environment.

To view the command syntax, click a command:

  • show statistics

show statistics

Lists database stats for given <identity P2PID> <group P2PID>.

Syntax

show statistics <identity P2PID> <group P2PID>

Netsh P2P idmgr

The following commands are available at the p2p idmgr> prompt, which is rooted within the netsh environment.

To view the command syntax, click a command:

  • delete group

  • delete identity

  • show groups

  • show identities

  • show statistics

delete group

Deletes groups from identities.

Syntax

delete group <identity P2PID> { <group P2PID> | ALL | EXPIRED }

delete identity

Deletes identities.

Syntax

delete identity <identity P2PID> { <identity P2PID> | ALL | QUIET }

show groups

Displays identity and related group information.

Syntax

show groups { <identity P2PID> | ALL } [ EXPIRED ]

show identities

Displays identity information.

Syntax

show identities { ALL | <identity P2PID> }

show statistics

Displays a count of identities and associated groups.

Syntax

show statistics

Netsh P2P pnrp

The following commands are available at the p2p pnrp> prompt, which is rooted within the netsh environment.

To view the command syntax, click a command:

  • cloud

  • diagnostics

  • peer

cloud

Changes to the netsh p2p pnrp cloud context.

diagnostics

Changes to the netsh p2p pnrp diagnostics context.

peer

Changes to the netsh p2p pnrp peer context.

Netsh P2P pnrp cloud

The following commands are available at the p2p pnrp> prompt, which is rooted within the netsh environment.

To view the command syntax, click a command:

  • flush

  • repair

  • set

  • show initialization

  • show list

  • show names

  • show pnrpmode

  • show seed

  • show statistics

  • start

  • synchronize host

  • synchronize seed

flush

Deletes all cache entries.

Syntax

flush [cloud=]<cloud name>

Example

flush Global_

repair

Detects and repairs Peer Name Resolution Protocol (PNRP) cloud fragmentation.

Syntax

repair [cloud=]<cloud name>

Example

repair Global_

show initialization

Displays cloud bootstrap configuration and status.

Syntax

show initialization [[cloud=]{ * | <cloud name>}]

Remarks

Use * for all clouds. Default is Global_.

Examples

show initialization cloud=Global_

show initialization *

show list

Displays a list of clouds.

Syntax

show list [[cloud=] <cloud name>]

Remarks

Default is all clouds.

Examples

show list Global_

show list

show names

Displays all names registered on the local machine.

Syntax

show names [[cloud=]{ * | <cloud name>}]

Remarks

Default is all clouds.

Examples

show names cloud=Global_

show names

show pnrpmode

Displays PNRP mode configuration parameters.

Syntax

show pnrpmode [[cloud=]<cloud name>]

Remarks

Default is all clouds. The mode can be one of the following: RO (Resolve-only), Auto.

Example

show pnrpmode Global_

show seed

Displays PNRP seed server configuration parameters.

Syntax

show seed [cloud=]<cloud name>

Example

Show seed Global_

show statistics

Displays cloud statistics.

Syntax

show statistics [[cloud=]{ * | <cloud name>}]

Remarks

Default is all clouds.

Examples

Show statistics names cloud=Global_

show statistics names

start

Bootstraps a cloud.

Syntax

start [cloud=]<cloud name>

Example

start Global_

synchronize host

Queries a specified host for the addresses of other members of the cloud.

Syntax

synchronize host [host=]<host name> [cloud=]<cloud name>

Example

synchronize host host1 Global_

synchronize seed

Queries the seed server for the addresses of other members of the cloud.

Syntax

synchronize seed [cloud=]<cloud name>

Example

synchronize seed Global_

Netsh P2P pnrp diagnostics

The following commands are available at the p2p pnrp> prompt, which is rooted within the netsh environment.

To view the command syntax, click a command:

  • ping host

  • ping seed

ping host

Tests PNRP connectivity to a node by specifying an address or a host name.

Syntax

ping host [host=]{<ip address> | <host name>} [cloud=]<cloud name>

Example

ping host myhost Global_

ping seed

Tests PNRP connectivity to the configured seed server.

Syntax

ping seed [cloud=]<cloud name>

Example

ping seed Global_

Netsh P2P pnrp peer

The following commands are available at the p2p pnrp> prompt, which is rooted within the netsh environment.

To view the command syntax, click a command:

  • add registration

  • delete

  • enumerate

  • resolve

  • set file

  • set machine

  • set mode

  • show convertedname

  • show machinename

  • show registration

  • traceroute

add registration

Registers a peer name. (Note that the registration will only last as long as the Netsh instance.)

Syntax

add registration [peername=]<peer name> [cloud=]<cloud name>

[[comment]=<comment>]

Parameters

Peer name

  • <canonical pnrp name>|<dns encoded pnrp name>

Cloud

The cloud where the name should be registered. Default is all Clouds.

Comment

The comment that should be registered for the name.

Examples

add registration peername=0.0

add registration 0.0 Global_

delete registration

Unregisters a peer name.

Syntax

delete registration [peername=]{ * | <peer name>} [cloud=]<cloud name>

Parameters

Peername

  • <canonical pnrp name>|<dns-encoded pnrp name>

Cloud

The cloud from which the name should be unregistered. Default is all Clouds.

Examples

delete registration *

delete registration peername=0.0 cloud=Global_

enumerate

Search for multiple registrations of a peer name in the specified cloud.

Syntax

enumerate [peername=]<peer name> [cloud=]<cloud name>

[[maxresults=]<number>]

Parameters

Peername

  • <canonical pnrp name>|<dns-encoded pnrp name>

Cloud

The cloud where the enumeration should happen.

Maxresults

Should be a number between one and 500. Default is 50.

Examples

enumerate 0.0 cloud=Global_ maxresults=2

enumerate peername=0.0 cloud=Global_

resolve

Resolves a peer name.

Syntax

resolve [peername=]<peer name> [[cloud=]<cloud name>]

Parameters

Peername

  • <canonical pnrp name>|<dns-encoded pnrp name>

Examples

resolve peername=0.0 cloud=Global_

resolve 0.anyname

set file

Copies the console output to a file.

Syntax

set file [ mode= ] { open [ name= ] <filename> | append [ name = ]<filename> | close }

Parameters

Mode

One of the following values:

  • Open: Creates a new file or overwrites an existing file and streams the console output to the file.

  • Append: Opens an existing file and streams the console output to the end of the existing file.

  • Close: Stops streaming and closes a file.

Name

Name of the file (full path optional)

Examples

set file open c:\logfiles\logfile.txt

The above command creates a file and logs all output to it.

set machinename

Configure the PNRP Machine Name Publication Service.

Syntax

set machinename [[name=]<PeerName>] [[publish=]Start|Stop] [[autopublish=]enable|disable]

Parameters

Name

The name to use as the machine name. If value is null, a secured name is automatically generated.

Publish

If set to 'start,' will cause the name to start being published immediately. If set to 'stop,' will stop the publication of the name.

Autopublish

Sets whether or not automatic publication is enabled. When autopublish is enabled, the machine automatically begins publishing the name at boot.

Remarks

This command allows the user to control the publication of a Peer Name

for the machine using the Peer Name Resolution Protocol (PNRP).

If you use this functionality, it will allow you to resolve the Peer

Name of the this machine from other remote machines subject to network

reachability. If you start publication through this command without

setting a name, then a secured name will be automatically generated

for you and will be visible through the 'show machinename' command.

Examples

set machinename publish=start autopublish=enable

set mode

Sets the current mode to online or offline.

Syntax

set mode [ mode= ] { online | offline }

Parameters

Mode

One of the following values:

  • online: Commit changes immediately

  • offline: Delay commit until explicitly requested

Example

Set mode online

show convertedname

Converts standard peer names to DNS encoded peer names and vice versa.

Syntax

show convertedname [peername=]<peer name>

Example

show convertedname 0.anyname

show machinename

Display the PNRP Machine Name Publication Service configuration.

Syntax

show machinename

Example

show machinename

show registration

List peer names registered by this instance of netsh.

Syntax

show registration [[cloud=]<cloud name>]

Example

show registration cloud=Global_

traceroute

Resolves a peer name with path tracing.

Syntax

traceroute [peername =]<peer name> [cloud=]<cloud name>

Examples

traceroute peername=0.0 Global_

traceroute 0.anyname Global_


Netsh Commands for Remote Access

You can use commands in the Netsh ras context to configure all aspects of remote access. The Netsh commands for remote access provide the same functionality as the Routing and Remote Access console, and the commands can be run manually at the netsh prompt or in scripts and batch files.

To run these commands from the command prompt, you must either enter the netsh ras context or prepend the context to the command. For example, if you are at the command prompt but have not typed netsh and then ras to enter the netsh ras context, you must type:

netsh ras command

Where command is the command that you want to run, including all of the required parameters for the command.

For more information about Netsh, see Netsh Overview and Enter a Netsh Context.

For information on how to interpret netsh command syntax, see Formatting Legend.

Netsh remote access command reference

The Netsh commands for remote access are grouped by the following command categories.

Netsh RAS Commands. These commands allow you to configure many remote access settings, such as: tracing, link properties, and properties of remote access users.

Netsh RAS AAAA Context Commands. These commands allow you to view and configure the authentication, authorization, accounting, and auditing (AAAA) database used by the Routing and Remote Access service.

Netsh Routing Demand-dial Context Commands. These commands allow you to view and configure demand-dial interface settings.

Netsh RAS Diagnostic Context Commands. These commands allow you to diagnose remote access connections and view logs.

Netsh RAS IP Context Commands. These commands allow you to view and configure IP-related remote access settings.

Netsh RAS IPv6 Context Commands. These commands allow you to view and configure IPv6-related remote access settings.


Netsh RAS Commands

The following commands are specific to the ras context within the Netsh environment.

To view the command syntax, click a command:

  • dump

Add commands

  • add authtype

  • add link

  • add multilink

  • add registeredserver

Delete commands

  • delete authtype

  • delete link

  • delete multilink

  • delete registeredserver

Set commands

  • set authmode

  • set client

  • set conf

  • set portstatus

  • set tracing

  • set type

  • set user

Show commands

  • show activeservers

  • show authmode

  • show authtype

  • show client

  • show conf

  • show link

  • show multilink

  • show portstatus

  • show registeredserver

  • show status

  • show tracing

  • show type

  • show user

Netsh commands for RAS

The following entries provide details for each command.

show activeservers

Displays a list of remote access server (RAS) advertisements.

Syntax

show activeservers

show client

Lists remote access clients connected to this server.

Syntax

show client

[[name=] Name]

Parameters

[[name=] Name]

Shows the status of a given client connected to the server. If this parameter is "*", show client enumerates the status of all clients. If no name is specified, show client shows which, if any, remote access clients are connected to the server.

set client

Resets the user statistics and disconnects a remote access client.

Syntax

set client

[name=] Name

[state=] {disconnect | resetstats}

Parameters

[name=] Name

Required. Specifies the user name of the client to disconnect or reset statistics.

[state=] {disconnect | resetstats}

Required. Specifies the action to perform. The parameter disconnect disconnects the specified user. The parameter resetstats resets the statistics for the specified user.

dump

Displays the configuration of the remote access server in script form.

Syntax

dump

Remarks

  • You can dump the contents of the current configuration to a file that can be used to restore altered configuration settings.

Example

The following command saves the current configuration as a script in the rascfg.dmp file.

dump > rascfg.dmp

show tracing

Shows whether tracing is enabled for the specified component. To see a list of all installed components and whether tracing is enabled for each, use the show tracing command without parameters.

Syntax

show tracing [component]

Parameters

component

Specifies the component for which to display information. If no component is specified, show tracing shows the state of all installed components.

set tracing

Enables or disables tracing for the specified component.

Syntax

set tracing component {enabled | disabled}

Parameters

Component

Required. Specifies the component for which you want to enable or disable tracing. Use "*" to specify all components.

{enabled | disabled}

Required. Specifies whether to enable or disable tracing for the specified component.

Remarks

  • To see a list of all installed components, use the show tracing command without parameters.

Example

To set tracing for the PPP component, type:

set tracing ppp enabled

show authmode

Shows whether dial-up clients using certain types of devices should be authenticated.

Syntax

show authmode

set authmode

Specifies whether dial-up clients using certain types of devices should be authenticated.

Syntax

set authmode {standard | nodcc | bypass}

Parameters

{standard | nodcc | bypass}

Required. Specifies whether dial-up clients using certain types of devices should be authenticated. The parameter standard specifies that clients using any type of device should be authenticated. The parameter nodcc specifies that clients using any type of device except a direct-connect device should be authenticated. The parameter bypass specifies that no clients should be authenticated.

add authtype

Adds an authentication type to the list of types through which the remote access server should attempt to negotiate authentication.

Syntax

add authtype {pap | md5chap | mschap | mschapv2 | eap}

Parameters

{pap | md5chap | mschap | mschapv2 | eap}

Required. Specifies which authentication type to add to the list of types through which the remote access server should attempt to negotiate authentication. The pap parameter specifies that the remote access server should use the Password Authentication Protocol (plaintext). The md5chap parameter specifies that the remote access server should use the Challenge Handshake Authentication Protocol (using the Message Digest 5 hashing scheme to encrypt the response). The mschap parameter specifies that the remote access server should use the Microsoft Challenge-Handshake Authentication Protocol. The mschapv2 parameter specifies that the remote access server should use version 2 of MSCHAP. The eap parameter specifies that the remote access server should use Extensible Authentication Protocol.

Remarks

  • The remote access server will attempt to negotiate authentication by using protocols in order from the most secure to the least secure. After both the client and the server have agreed on an authentication type, PPP negotiation proceeds according to the appropriate RFCs.

delete authtype

Deletes an authentication type from the list of types through which the remote access server should attempt to negotiate authentication.

Syntax

delete authtype{pap | md5chap | mschap | mschapv2 | eap}

Parameters

{pap| md5chap | mschap | mschapv2 | eap}

Required. Specifies which authentication type to delete from the list of types through which the remote access server should attempt to negotiate authentication. The pap parameter specifies that the remote access server should not use the Password Authentication Protocol (plaintext). The md5chap parameter specifies that the remote access server should not use the Challenge Handshake Authentication Protocol (using the Message Digest 5 hashing scheme to encrypt the response). The mschap parameter specifies that the remote access server should not use the Microsoft Challenge-Handshake Authentication Protocol. The mschapv2 parameter specifies that the remote access server should not use version 2 of MSCHAP. The eap parameter specifies that the remote access server should not use Extensible Authentication Protocol.

show authtype

Lists the authentication type (or types) that the remote access server uses to attempt to negotiate authentication.

Syntax

show authtype

add link

Adds a link property to the list of link properties PPP will negotiate.

Syntax

add link {swc | lcp}

Parameters

{swc | lcp}

Required. Specifies which link property to add to the list of link properties PPP will negotiate. The parameter swc specifies that software compression (MPPC) should be added. The parameter lcp specifies that Link Control Protocol extensions from the PPP suite of protocols should be added.

delete link

Deletes a link property from the list of link properties PPP will negotiate.

Syntax

delete link {swc | lcp}

Parameters

{swc | lcp}

Required. Specifies which link property to delete from the list of link properties PPP will negotiate. The parameter swc specifies that software compression (MPPC) should be deleted. The parameter lcp specifies that Link Control Protocol extensions from the PPP suite of protocols should be deleted.

show link

Displays the link properties PPP will negotiate.

Syntax

show link

add multilink

Adds a multilink type to the list of multilink types PPP will negotiate.

Syntax

add multilink {multi | bacp}

Parameters

{multi | bacp}

Required. Specifies which multilink type to add to the list of multilink types PPP will negotiate. The parameter multi specifies that multilink PPP sessions should be added. The parameter bacp specifies that Bandwidth Allocation Control Protocol should be added.

delete multilink

Deletes a multilink type from the list of multilink types PPP will negotiate.

Syntax

delete multilink {multi | bacp}

Parameters

{multi | bacp}

Required. Specifies which multilink type to delete from the list of multilink types PPP will negotiate. The parameter multi specifies that multilink PPP sessions should be deleted. The parameter bacp specifies that Bandwidth Allocation Control Protocol should be deleted.

show multilink

Shows the multilink types PPP will negotiate.

Syntax

show multilink

add registeredserver

Registers the specified server as a remote access server in the specified Active Directory® domain. Used without parameters, add registeredserver registers the computer from which you type the command in its primary domain.

Syntax

add registeredserver

[[domain=] DomainName]

[[server=] ServerName]

Parameters

[[domain=] DomainName]

Specifies, by domain name, the domain in which to register the server. If you do not specify a domain, the server is registered in its primary domain.

[[server=] ServerName]

Specifies, by Domain Name System (DNS) name or IP address, the server to register. If you do not specify a server, the computer from which you type the command is registered.

delete registeredserver

Deletes the registration of the specified server as a remote access server from the specified Active Directory domain. Used without parameters, delete registeredserver deletes the registration of the computer from which you type the command from its primary domain.

Syntax

delete registeredserver

[[domain=] DomainName]

[[server=] ServerName]

Parameters

[[domain=] DomainName]

Specifies, by domain name, the domain from which to remove the registration. If you do not specify a domain, the registration is removed from the primary domain of the computer from which you type the command.

[[server=] ServerName]

Specifies, by IP address or DNS name, the server whose registration you want to remove. If you do not specify a server, the registration is removed for the computer from which you type the command.

show registeredserver

Displays status information about the specified server registered as a remote access server in the specified Active Directory domain. Used without parameters, the computer and primary domain from which the command is issued is assumed.

Syntax

show registeredserver

[[domain=] DomainName]

[[server=] ServerName]

Parameters

[[domain=] DomainName]

Specifies, by domain name, the domain in which the server about which you want to display information is registered. If you do not specify a domain, the primary domain of the computer from which the command is issued is assumed.

[[server=] ServerName]

Specifies, by IP address or DNS name, the server about which you want to display information. If you do not specify a server, the computer from which the command is issued is assumed.

show user

Displays the properties of a specified remote access user or users. Used without parameters, show user displays the properties of all remote access users.

Syntax

show user

[name=] UserName

[[mode=] {permit | report}]

Parameters

[name=] UserName

Specifies, by logon name, the user whose properties you want to display. If you do not specify a user, the properties of all users are displayed.

[[mode=] {permit | report}]

Specifies whether to show properties for all users or only those whose dial-up permission is set to permit. The permit parameter specifies that properties should be displayed only for users whose dial-up permission is permit. The report parameter specifies that properties should be displayed for all users.

set user

Sets the properties of the specified remote access user.

Syntax

set user

[name=] UserName

[dialin=] {permit | deny | policy}

[cbpolicy=] {none | caller | admin

[cbnumber=] CallbackNumber}

Parameters

[name=] UserName

Required. Specifies, by logon name, the user for which you want to set properties.

[dialin=] {permit | deny | policy}

Required. Specifies under what circumstances the user should be allowed to connect. The permit parameter specifies that the user should always be allowed to connect. The deny parameter specifies that the user should never be allowed to connect. The policy parameter specifies that remote access policies should determine whether the user is allowed to connect.

[cbpolicy] {none | caller | admin [cbnumber=] CallbackNumber}

Required. Specifies the callback policy for the user. The callback feature saves the user the cost of the phone call used to connect to a remote access server. The none parameter specifies that the user should not be called back. The caller parameter specifies that the user should be called back at a number specified by the user at connection time. The admin parameter specifies that the user should be called back at the number specified by the CallbackNumber parameter.

Remarks

  • The policy option is not available for users that belong to a mixed-mode domain. For users in a mixed-mode domain, the policy parameter and the deny parameter are equivalent.

Example

To allow GuestUser to connect and be called back at (425) 555-0110, type:

set user guestuser permit admin 4255550110

show status

Shows the status of server running Routing and Remote Access.

Syntax

show status

show conf

Shows the remote access configuration state of the server.

Syntax

show conf

set conf

Sets the remote access configuration state of the server.

Syntax

set conf

[confstate=] {enabled | disabled}

Parameters

[confstate=] {enabled | disabled}

Required. Specifies the remote access configuration state. The enabled parameter enables the server configuration. The disabled parameter disables the server configuration and removes the server from the list of remote access servers.

show portstatus

Shows the current status of RAS ports.

Syntax

show portstatus

[[name=] PortName]

[[state=] State]

Parameters

[[name=] PortName]

Specifies the port for which to display status.

[[state=] State]

Display ports with the specified state.

Remarks

The following are the RAS port states:

nonoperational

Non-operational ports

disconnected

Disconnected ports

callingback

Ports calling back

listening

Ports listening

authenticating

Ports authenticating

connected

Authenticated and connected ports

initializing

Ports initializing

Examples

The following show the port status using the name and state parameters.

show portstatus name=VPN0-127

show portstatus state=connected

set portstatus

Resets the RAS ports statistics.

Syntax

set portstatus

[[name=] PortName]

Parameters

[[name=] PortName]

Specifies the name of the port. If none is specified, resets statistics of all active ports.

show type

Shows the router and RAS properties.

Syntax

show type

set type

Specifies the router and RAS roles of the server.

Syntax

set type

[ipv4rtrtype=] {lanonly | lananddd | none}

[ipv6rtrtype=] {lanonly | lananddd | none}

[rastype=] {ipv4 | ipv6 | both | none}

Parameters

[ipv4rtrtype=] {lanonly | lananddd | none}

Specifies the computer is configured as an IPv4 router. The lanonly parameter specifies that this computer is a LAN-only router and does not require demand-dial or VPN connections. The lananddd parameter specifies that this computer is a LAN and demand-dial router and supports VPN connections. The none parameter specifies that this computer is not enabled as an IPv4 router.

[ipv6rtrtype=] {lanonly | lananddd | none}

Specifies the computer is configured as an IPv6 router. The lanonly parameter specifies that this computer is a LAN-only router and does not require demand-dial or VPN connections. The lananddd parameter specifies that this computer is a LAN and demand-dial router and supports VPN connections. The none parameter specifies that this computer is not enabled as an IPv6 router.

[rastype=] {ipv4 | ipv6 | both | none}

Specifies the computer is configured as a remote access server. The ipv4 parameter specifies the computer is configured for IPv4. The ipv6 parameter specifies the computer is configured for IPv6. The both parameter specifies the computer is configured for IPv4 and IPv6. The none parameter specifies the computer is not configured as a remote access server.


Netsh RAS AAAA Context Commands

The following commands are specific to the ras AAAA context within the Netsh environment.

To view the command syntax, click a command:

  • dump

Add commands

  • add acctserver

  • add authserver

Delete commands

  • delete acctserver

  • delete authserver

Set commands

  • set accounting

  • set acctserver

  • set authentication

  • set authserver

  • set ipsecpolicy

Show commands

  • show accounting

  • show acctserver

  • show authentication

  • show authserver

  • show ipsecpolicy

Netsh commands for ras AAAA

The following entries provide details for each command.

dump

Displays the AAAA configuration of a remote access server in script form.

Syntax

dump

Remarks

  • You can dump the contents of the current configuration to a file that can be used to restore altered configuration settings.

Example

The following is the command to save the current configuration as a script in the rasaaaacfg.dmp file.

dump > rasaaaacfg.dmp

add acctserver

Specifies the IP address or the Domain Name System (DNS) name of a RADIUS server to use for accounting.

Syntax

add acctserver

[name=] ServerID

[[secret=] SharedSecret]

[[init-score=] ServerPriority]

[[port=] Port]

[[timeout=] Seconds]

[[messages] {enabled | disabled}]

Parameters

[name=] ServerID

Required. Specifies, by IP address or DNS name, the RADIUS server.

[[secret=] SharedSecret]

Specifies the preshared key.

[[init-score=] ServerPriority]

Specifies the initial score (server priority).

[[port=] Port]

Specifies the port to which accounting requests should be sent.

[[timeout=] Seconds]

Specifies the timeout period, in seconds, during which the RADIUS server can be idle before it should be marked unavailable.

[[messages] {enabled | disabled}]

Specifies whether to send accounting on/off messages. The enabled parameter specifies that messages should be sent. The disabled parameter specifies that messages should not be sent.

delete acctserver

Deletes a RADIUS accounting server.

Syntax

delete acctserver

[name=] ServerID

Parameters

[name=] ServerID

Required. Specifies, by DNS name or IP address, which server to delete.

set acctserver

Provides the IP address or the DNS name of a RADIUS server to use for accounting.

Syntax

add acctserver

[name=] ServerID

[[secret=] SharedSecret]

[[init-score=] ServerPriority]

[[port=] Port]

[[timeout=] Seconds]

[[messages] {enabled | disabled}]

Parameters

[name=] ServerID

Required. Specifies, by IP address or DNS name, the RADIUS server.

[[secret=] SharedSecret]

Specifies the preshared key.

[[init-score=] ServerPriority]

Specifies the initial score (server priority).

[[port=] Port]

Specifies the port on which to send the authentication requests.

[[timeout=] Seconds]

Specifies, in seconds, the amount of time that should elapse before the RADIUS server is marked unavailable.

[[messages=] {enabled | disabled}]

Specifies whether accounting on/off messages should be sent.

show acctserver

Displays detailed information about an accounting server. Used without parameters, show acctserver displays information about all configured accounting servers.

Syntax

show acctserver

[[name=] ServerID]

Parameters

[name=] ServerID

Specifies, by DNS name or IP address, the RADIUS server about which to display information.

add authserver

Provides the IP address or the DNS name of a RADIUS server to which authentication requests should be passed.

Syntax

add authserver

[name=] ServerID

[[secret=] SharedSecret]

[[init-score=] ServerPriority]

[[port=] Port]

[[timeout=] Seconds]

[[signature] {enabled | disabled}]

Parameters

[name=] ServerID]

Required. Specifies, by IP address or DNS name, the RADIUS server.

[[secret=] SharedSecret]

Specifies the preshared key.

[[init-score=] ServerPriority]

Specifies the initial score (server priority).

[[port=] Port]

Specifies the port to which authentication requests should be sent.

[[timeout=] Seconds]

Specifies the timeout period, in seconds, during which the RADIUS server can be idle before it should be marked unavailable.

[[signature] {enabled | disabled}]

Specifies whether to use digital signatures. The enabled parameter specifies that digital signatures should be used. The disabled parameter specifies that digital signatures should not be used.

delete authserver

Deletes a RADIUS authentication server.

Syntax

delete authserver

[name=]ServerID

Parameters

[name=] ServerID

Required. Specifies, by DNS name or IP address, which server to delete.

set authserver

Provides the IP address or the DNS name of a RADIUS server to which authentication requests should be passed.

Syntax

set authserver

[name=] ServerID

[[secret=] SharedSecret]

[[init-score=] ServerPriority]

[[port=] Port]

[[timeout=] Seconds]

[[signature] {enabled | disabled}]

Parameters

[name=] ServerID]

Required. Specifies, by IP address or DNS name, the RADIUS server.

[[secret=] SharedSecret]

Specifies the preshared key.

[[init-score=] ServerPriority]

Specifies the initial score (server priority).

[[port=] Port]

Specifies the port on which to send the authentication requests.

[[timeout=] Seconds]

Specifies the amount of time, in seconds, that should elapse before the RADIUS server is marked unavailable.

[[signature=] { enabled | disabled}]

Specifies whether digital signatures should be used.

show authserver

Displays detailed information about an authentication server. Used without parameters, show authserver displays information about all configured authentication servers.

Syntax

show authserver

[[name=] ServerID]

Parameters

[[name=] ServerID]

Specifies, by DNS name or IP address, the RADIUS server about which to display information.

set accounting

Specifies the accounting provider.

Syntax

set accounting {windows | radius | none}

Parameters

{windows | radius | none}

Required. Specifies whether accounting should be performed and by which server. The windows parameter specifies that Windows security should perform accounting. The radius parameter specifies that a RADIUS server should perform accounting. The none parameter specifies that no accounting should be performed.

show accounting

Displays the accounting provider.

Syntax

show accounting

set authentication

Specifies the authentication provider.

Syntax

set authentication {windows | radius}

Parameters

{windows | radius}

Required. Specifies which technology should perform authentication. The windows parameter specifies that Windows security should perform authentication. The radius parameter specifies that a RADIUS server should perform authentication.

show authentication

Displays the authentication provider.

Syntax

show authentication

set ipsecpolicy

Sets the IPsec policy for the L2TP connection.

Syntax

set ipsecpolicy

[psk = ] {enabled | disabled}

[secret = ] SharedSecret

Parameters

[psk = ] {enabled | disabled}

Required. Specifies whether an L2TP connection can use a custom IPsec policy. The enabled parameter specifies that the IPsec policy is set to a custom IPsec policy using a preshared key. The disabled parameter specifies that the IPsec policy is set to certificate.

[secret = ] SharedSecret

Required when psk authentication is enabled. Specifies the preshared key to be used with the custom IPsec policy.

Example

The following sets the IPsec policy for the L2TP connection.

set ipsecpolicy psk=enabled secret="P@ssword"

show ipsecpolicy

Shows the IPsec policy for the L2TP connection.

Syntax

show ipsecpolicy


Netsh RAS Diagnostic Context Commands

The following commands are specific to the ras diagnostics context within the Netsh environment.

To view the command syntax, click a command:

  • dump

Set commands

  • set cmtracing

  • set loglevel

  • set modemtracing

  • set rastracing

  • set securityeventlog

  • set tracefacilities

Show commands

  • show all

  • show cmtracing

  • show configuration

  • show installation

  • show loglevel

  • show logs

  • show modemtracing

  • show rastracing

  • show securityeventlog

  • show tracefacilities

Netsh commands for RAS diagnostics

The following entries provide details for each command.

dump

Displays the configuration of Remote Access Diagnostics in script form.

Syntax

dump

Remarks

  • You can dump the contents of the current configuration to a file that can be used to restore altered configuration settings.

Example

The following is the command to save the current configuration as a script in the rasdiag.dmp file.

dump > rasdiag.dmp

show installation

Creates a Remote Access Diagnostic Report that includes only diagnostics results for Information Files, Installation Check, Installed Networking Components, and Registry Check and delivers the report to a location you specify.

Syntax

show installation

[type=] {file | email}

[destination=] {FileLocation | EmailAddress}

[[compression=] {enabled | disabled}]

[[hours=] NumberOfHours]

[[verbose=] {enabled | disabled}]

Parameters

[type=] {file | email}

Specifies whether the report should be saved to a file or sent to an e-mail address.

[destination=] {FileLocation| EmailAddress}

Required. Specifies the full path and file name to which the report should be saved or the full e-mail address to which the report should be sent.

[[compression=] {enabled | disabled}]

Specifies whether to compress the report into a .cab file. If you do not specify this parameter, the report is compressed if you send it to an e-mail address but not if you save it to a file.

[[hours=] NumberOfHours]

Specifies the number of past hours for which to show activity in the report. This parameter must be an integer between 1 and 24. If you do not specify this parameter, all past information is included.

[[verbose=] {enabled | disabled}]

Specifies the amount of data to include in the report. If you do not specify this parameter, only minimal data is included.

Remarks

  • The Remote Access Diagnostic Report is saved as an HTML file (.htm).

Example

To save a diagnostic report to c:\mytemp\rasdiag.htm, type:

show installation type=file destination="c:\mytemp\rasdiag"

show loglevel

Shows the global logging level for Routing and Remote Access service.

Syntax

show loglevel

set loglevel

Sets the global logging level for Routing and Remote Access service.

Syntax

set loglevel

[state=] {error | warn | all | none}

Parameters

[state=] {error | warn | all | none}

Required. Specifies the level of global logging. The none parameter specifies that no events are logged. The error parameter specifies that only errors are logged. The warn parameter specifies that errors and warnings are logged. The all parameter specifies that all events are logged.

show logs

Creates a Remote Access Diagnostic Report that contains only diagnostics results for Tracing Logs, Modem Logs, Connection Manager Logs, IP Security Log, Remote Access Event Logs, and Security Event Logs and delivers the report to a location you specify.

Syntax

show logs

[type=] {file | email}

[destination=] {FileLocation | EmailAddress}

[[compression=] {enabled | disabled}]

[[hours=] NumberOfHours]

[[verbose=] {enabled | disabled}]

Parameters

[type=] {file | email}

Required. Specifies whether the report should be saved to a file or sent to an e-mail address.

[destination=] {FileLocation| EmailAddress}

Required. Specifies the full path and file name to which the report should be saved or the full e-mail address to which the report should be sent.

[[compression=] {enabled | disabled}]

Specifies whether to compress the report into a .cab file. If you do not specify this parameter, the report is compressed if you send it to an e-mail address but not if you save it to a file.

[[hours=] NumberOfHours]

Specifies the number of past hours for which to show activity in the report. This parameter must be an integer between 1 and 24. If you do not specify this parameter, all past information will be included in the report.

[[verbose=] {enabled | disabled}]

Specifies the amount of data to include in the report. If you do not specify this parameter, minimal data is included.

Remarks

  • The Remote Access Diagnostic Report is saved as an HTML file (.htm).

Example

To save a diagnostic report to c:\mytemp\rasdiag.htm, type:

show logs type=file destination="c:\mytemp\rasdiag"

show configuration

Creates a Remote Access Diagnostic Report that includes only diagnostics results for Installed Devices, Process Information, Command-line Utilities, and Phone Book Files and delivers the report to a location you specify.

Syntax

show configuration

[type=] {file | email}

[destination=] {FileLocation | EmailAddress}

[[compression=] {enabled | disabled}]

[[hours=] NumberOfHours]

[[verbose=] {enabled | disabled}]

Parameters

[type=] {file | email}

Required. Specifies whether the report should be saved to a file or sent to an e-mail address.

[destination=] {FileLocation| EmailAddress}

Required. Specifies the full path and file name to which the report should be saved or the full e-mail address to which the report should be sent.

[[compression=] {enabled | disabled}]

Specifies whether to compress the report into a .cab file. If you do not specify this parameter, the report is compressed if you send it to an e-mail address but not if you save it to a file.

[[hours=] NumberOfHours]

Specifies the number of past hours for which to show activity in the report. This parameter must be an integer between 1 and 24. If you do not specify this parameter, all past information is included.

[[verbose=] {enabled | disabled}]

Specifies the amount of data to include in the report. If you do not specify this parameter, minimal data is included.

Remarks

  • The Remote Access Diagnostic Report is saved as an HTML file (.htm).

Example

To save a diagnostic report to c:\mytemp\rasdiag.htm, type:

show configuration type=file destination="c:\mytemp\rasdiag"

show all

Creates a Remote Access Diagnostic Report for all remote access logs and delivers the report to a location you specify.

Syntax

show all

[type=] {file | email}

[destination=] {FileLocation | EmailAddress}

[[compression=] {enabled | disabled}]

[[hours=] NumberOfHours]

[[verbose=] {enabled | disabled}]

Parameters

[type=] {file | email}

Required. Specifies whether the report should be saved to a file or sent to an e-mail address.

[destination=] {FileLocation| EmailAddress}

Required. Specifies the full path and file name to which the report should be saved or the full e-mail address to which the report should be sent.

[[compression=] {enabled | disabled}]

Specifies whether to compress the report into a .cab file. If you do not specify this parameter, the report is compressed if you send it to an e-mail address but not if you save it to a file.

[[hours=] NumberOfHours]

Specifies the number of past hours for which to show activity in the report. This parameter must be an integer between 1 and 24. If you do not specify this parameter, all past information is included.

[[verbose=] {enabled | disabled}]

Specifies the amount of data to include in the report. If you do not specify this parameter, minimal data is included.

Remarks

  • The Remote Access Diagnostic Report is saved as an HTML file (.htm).

  • The Remote Access Diagnostic Report that you create by using the show all command contains all diagnostic information available. You can use other commands, such as show configuration, to create reports that contain a narrower scope of information.

Example

To save a diagnostic report to c:\mytemp\rasdiag.htm that includes all diagnostic information, type:

show all type=file destination="c:\mytemp\rasdiag"

show cmtracing

Shows whether information about Connection Manager connections is being logged.

Syntax

show cmtracing

set cmtracing

Enables or disables logging of information about all Connection Manager connections.

Syntax

set cmtracing {enabled | disabled}

Parameters

{enabled | disabled}

Required. Specifies whether you want information about Connection Manager connections to be logged. The enabled parameter specifies that you want information to be logged. The disabled parameter specifies that you do not want information to be logged.

Remarks

  • Each log file for a Connection Manager connection contains information that is specific to the history of that connection. Each Connection Manager connection generates a unique log file. Depending on the configuration of the connection, the log file might be saved in any of various locations.

  • This command will be overridden for a particular connection if the user enables or disables logging for that connection or if the user installs and uses a Connection Manager profile for which an administrator has enabled or disabled logging.

show modemtracing

Shows whether modem tracing is enabled or disabled.

Syntax

show modemtracing

set modemtracing

Enables or disables modem tracing for all modems installed for the local computer.

Syntax

set modemtracing {enabled | disabled}

Parameters

{enabled | disabled}

Required. Specifies whether you want modem activity for each modem to be logged. The enabled parameter specifies that you want activity to be logged. The disabled parameter specifies that you do not want activity to be logged.

Remarks

  • This command enables or disables the logging of modem activity for all modems. If you want to enable or disable modem logging for a specific modem, you should configure the modem in Device Manager.

show rastracing

Shows whether tracing for the given component is enabled. If no component is specified, shows the state of all components.

Syntax

show rastracing [component=] Component

Parameters

[component=] Component

Specifies the component for which you want to determine whether tracing is enabled or disabled. If no component is specified, the state of all components is displayed.

set rastracing

Enables or disables tracing and logging of all activity for all remote access components or for a specific remote access component.

Syntax

set rastracing

[component=] {Component | *} {enabled | disabled}

[state=] {enabled | disabled}

Parameters

[ component=] {Component| *}

Required. Specifies whether you want to enable or disable tracing and logging for a component that you specify or for all components. The Component parameter specifies the component for which you want to enable or disable tracing and logging. Use '*' to denote all components.

[state=] {enabled | disabled}

Required. Specifies whether you want activity to be traced and logged. The enabled parameter specifies that you want activity to be traced and logged. The disabled parameter specifies that you do not want activity to be traced and logged.

Remarks

  • If you enable tracing and logging, a log file named Component.txt is created in the %windir%\tracing directory for each component being traced.

show securityeventlog

Shows whether security events are being logged.

Syntax

show securityeventlog

set securityeventlog

Enables or disables logging of all security events.

Syntax

set securityeventlog {enabled | disabled}

Parameters

{enabled | disabled}

Required. Specifies whether you want security events to be logged. The enabled parameter specifies that you want security events to be logged. The disabled parameter specifies that you do not want security events to be logged.

Remarks

  • You can also view security event logs in the Event Viewer.

show tracefacilities

Shows whether all activity for all remote access components or for a remote access component that you specify is being traced and logged.

Syntax

show tracefacilities

set tracefacilities

Enables or disables tracing and logging of all activity for all remote access components that are configured on the local computer.

Syntax

set tracefacilities

[state=] {enabled | disabled | clear}

Parameters

[state=] {enabled | disabled | clear}

Required. Specifies whether you want to enable tracing for all remote access components, to disable tracing, or to clear all logs generated by tracefacilities. The enabled parameter specifies that you want to enable tracing. The disabled parameter specifies that you want to disable tracing. The clear parameter specifies that you want to clear all logs.


Netsh RAS IP Context Commands

The following commands are specific to the ras IP context within the Netsh environment.

To view the command syntax, click a command:

  • dump

Add commands

  • add range

Delete commands

  • delete pool

  • delete range

Set commands

  • set access

  • set addrassign

  • set addrreq

  • set broadcastnameresolution

  • set negotiation

  • set preferredadapter

Show commands

  • show config

  • show preferredadapter

Netsh commands for ras IP

  • The following entries provide details for each command.

dump

Displays the IP configuration of a remote access server in script form.

Syntax

dump

Remarks

  • You can dump the contents of the current configuration to a file that can be used to restore altered configuration settings.

Example

Following is the command to save the current configuration as a script in the rasipcfg.dmp file.

dump > rasipcfg.dmp

show config

Displays the current IP configuration of the remote access server.

Syntax

show config

set negotiation

Specifies whether the remote access server should allow IP to be configured for any client connections the server accepts.

Syntax

set negotiation

[mode=] {allow | deny}

Parameters

[mode=] {allow | deny}

Required. Specifies whether to permit IP over client connections. The allow parameter allows IP over client connections. The deny parameter prevents IP over client connections.

set access

Specifies whether IP network traffic from any client should be forwarded to the network or networks to which the remote access server is connected.

Syntax

set access

[mode=] {all | serveronly}

Parameters

[mode=] {all | serveronly}

Required. Specifies whether clients should be able to reach the remote access server and any networks to which it is connected. The all parameter allows clients to reach networks through the server. The serveronly parameter allows clients to reach only the server.

set addrassign

Sets the method by which the remote access server should assign IP addresses to its clients.

Syntax

set addrassign

[method=] {auto | pool}

Parameters

[method=] {auto | pool}

Required. Specifies whether IP addresses should be assigned by using DHCP or from a pool of addresses held by the remote access server. The auto parameter specifies that addresses should be assigned by using DHCP. If no DHCP server is available, a random, private address is assigned. The pool parameter specifies that addresses should be assigned from a pool.

set addrreq

Specifies whether dial-in clients should be able to request their own IP addresses.

Syntax

set addrreq

[mode=] {allow | deny}

Parameters

[mode=] {allow | deny}

Required. Specifies whether clients should be able to request their own IP addresses. The allow parameter allows clients to request addresses. The deny parameter prevents clients from requesting addresses.

set broadcastnameresolution

Enables or disables broadcast name resolution using NetBIOS over TCP/IP.

Syntax

set broadcastnameresolution

[mode=] {enabled | disabled}

Parameters

[mode=] {enabled | disabled}

Required. Specifies whether to enable or disable broadcast name resolution using NetBIOS over TCP/IP. The enabled parameter enables broadcast name resolution using NetBIOS over TCP/IP. The disabled parameter disables broadcast name resolution using NetBIOS over TCP/IP.

Remarks

  • To check the status of broadcastnameresolution, use the dump command.

show broadcastnameresolution

Displays whether broadcast name resolution using NetBIOS over TCP/IP has been enabled or disabled for the remote access server.

Syntax

show broadcastnameresolution

add range

Adds a range of addresses to the pool of static IP addresses that the remote access server can assign to clients.

Syntax

add range

[from=] StartingIPAddress

[to=] EndingIPAddress

Parameters

[from=] StartingIPAddress [to=] EndingIPAddress

Required. Specifies the range of IP addresses to add. The StartingIPAddress parameter specifies the first IP address in the range. The EndingIPAddress parameter specifies the last IP address in the range.

Example

To add the range of IP addresses 10.2.2.10 to 10.2.2.20 to the static pool of IP addresses that the remote access server can assign, type:

add range from=10.2.2.10 to=10.2.2.20

delete range

Deletes a range of addresses from the pool of static IP addresses that the remote access server can assign to clients.

Syntax

delete range

[from=] StartingIPAddress

[to=] EndingIPAddress

Parameters

[from=] StartingIPAddress [to=] EndingIPAddress

Required. Specifies the range of IP addresses to delete. The StartingIPAddress parameter specifies the first IP address in the range. The EndingIPAddress parameter specifies the last IP address in the range.

Example

To delete the range of IP addresses 10.2.2.10 to 10.2.2.20 from the pool of static IP addresses that the remote access server can assign, type:

delete range from=10.2.2.10 to=10.2.2.20

delete pool

Deletes all addresses from the pool of static IP addresses that the remote access server can assign to clients.

Syntax

delete pool

set preferredadapter

Specifies the preferred adapter for Routing and Remote Access service.

Syntax

set preferredadapter

[name=] InterfaceName

Parameters

[name=] InterfaceName

Specifies that the adapter to be used to obtain the IP addresses for allocation (if configured to use DHCP) and the IP address of DHCP and WINS servers for assignment to remote access clients and demand-dial routers. If no interface is specified, the server randomly selects an adapter when the Routing and Remote Access service is started.

show preferredadapter

Displays the preferred adapter for Routing and Remote Access service.

Syntax

show preferredadapter


Netsh RAS IPv6 Context Commands

The following commands are specific to the ras IPv6 context within the Netsh environment.

To view the command syntax, click a command:

  • dump

Set commands

  • set access

  • set negotiation

  • set prefix

Show commands

  • show config

Netsh commands for ras IPv6

The following entries provide details for each command.

dump

Displays the IPv6 configuration of a remote access server in script form.

Syntax

dump

Remarks

  • You can dump the contents of the current configuration to a file that can be used to restore altered configuration settings.

Example

The following is the command to save the current configuration as a script in the rasipv6cfg.dmp file.

dump > rasipv6cfg.dmp

set negotiation

Specifies whether the remote access server should allow IPv6 to be configured for any client connections the server accepts.

Syntax

set negotiation

[mode=] {allow | deny}

Parameters

[mode=] {allow | deny}

Required. Specifies whether to permit IPv6 over client connections. The allow parameter allows IPv6 over client connections. The deny parameter prevents IPv6 over client connections.

set access

Specifies whether IPv6 network traffic from any client should be forwarded to the network or networks to which the remote access server is connected.

Syntax

set access

[mode=] {all | serveronly}

Parameters

[mode=] {all | serveronly}

Required. Specifies whether clients should be able to reach the remote access server and any networks to which it is connected. The all parameter allows clients to reach networks through the server. The serveronly parameter allows clients to reach only the server.

set prefix

Sets the static IPv6 prefix that the remote access server users to advertise to clients.

Syntax

set prefix

[prefix=] IPv6Prefix

Parameters

[prefix=] IPv6Prefix

Required. Specifies the IPv6 prefix in the form: 'x:x:x:x::'

Example

The following sets the IPv6 prefix to 3ffe:ffff:a:1.

set prefix prefix=3ffe:ffff:a:1::

show config

Displays the current IP configuration of the remote access server.

Syntax

show config


Netsh Commands for Remote Procedure Call (RPC)

netsh rpc is a command-line tool that you can use to create remote procedure call (RPC) Firewall Filters and the rules and conditions that are associated with the filters.

You can run the Netsh RPC commands from the command prompt for the netsh rpc context. For these commands to work at the Windows Server 2008 command prompt, you must type netsh rpc before typing commands and parameters as they appear in the syntax.

For more information about netsh, see Netsh Overview and Enter a Netsh Context.

You must have the required permissions to run the netsh rpc commands:

  • If you are a member of the Administrators group, and User Account Control is enabled on your computer, run the commands from a command prompt with elevated permissions. To open a command prompt with elevated permissions, find the icon or Start menu entry that you use to start a command prompt session, right-click it, and then click Run as administrator.

  • If you are a member of the Network Operators group, you can run the commands from any command prompt.

  • If you are a not a member of Administrators or Network Operators and you have not been delegated any other permissions to run this command, you can run only the commands that display the settings, not the commands that change the settings.

To view the command syntax, click a command:

  • filter

To view the command syntax for add commands in the RPC Filter context, click a command:

  • add rule

  • add condition

  • add filter

To view the command syntax for show commands in the RPC Filter context, click a command:

  • show filter

To view the command syntax for delete commands in the RPC Filter context, click a command:

  • delete filter

  • delete rule

For information on how to interpret netsh command syntax, see Formatting Legend.

Netsh RPC commands

The following entries provide details for each command.

filter

This command changes the command-line context to the netsh rpc filter subcontext. This subcontext is for running commands that set rules and conditions for RPC Firewall filtering.

Syntax

Copy Code
filter

Parameters

add rule

Adds an RPC Firewall Filter rule.

add condition

Adds a condition to an existing RPC Firewall Filter rule.

add filter

Adds an RPC Firewall Filter.

show filter

Displays a list of active RPC Firewall Filters.

delete filter

Deletes all active RPC Firewall Filters and the rules and conditions that are associated with those filters.

delete rule

Deletes the existing RPC Firewall Filter rules.

/?

Displays help at the command prompt.

add rule

Adds a rule to specify an action when a given condition is met. Rules and conditions are combined to specify RPC Firewall Filters.

Use the following order when you add rules, conditions, and filters:

  1. Add rule. The information in this "add rule" section provides details for step 1 (adding rules), including syntax, parameters, and allowed values.

  2. Add conditions.

  3. Add the filter that is created by the combination of rules and conditions that you enter.

Syntax

Copy Code
filter add rule [layer=]<string> [actiontype=]<string> [[filterkey=]<string>] [[persistence=]volatile] [[audit=]enable]

Parameters

The following sections provide information about the Layer tag and the values of the parameters that are associated with the Layer tag.

Layer tag

RPC Firewall layers represent abstract connection types. Each layer applies to a different aspect of an RPC connection. RPC Firewall layers are not directly related to RPC architectural components, but they are used to specify an aspect or type of RPC connection.

Tag | Required | Default | Description | Allowed values
Layer | Yes | None | Specifies an RPC communications protocol layer. | Um, Epmap, Ep_add, Proxy_conn, Proxy_if
Actiontype | Yes | None | Describes the action to take for the specified layer: block the item, permit the item to invoke a function that executes in another process, or continue processing the rule. | Block, Permit, Continue
Filterkey | No | A randomly generated Universally Unique Identifier (UUID) | A 128-bit, unique identifier to uniquely identify this filter. | UUID
Persistence | No | Persistent | Persists or does not persist if the system is restarted. | Persistent, Volatile
Audit | No | Disabled | Allows auditing of the process or does not audit the process. In Audit mode, rules are not applied and traffic is not filtered. Instead, the RPC filtering engine logs events where a rule would have been applied. | Enabled, Disabled

Allowed values for the Layer tag

Value | Name | Description
um | User Mode layer | An RPC communications protocol layer that is used for high-level policies, such as filtering on a user or application identity.
epmap | The Endpoint Mapper layer | An RPC communications protocol layer that is used to write interface-specific rules.
ep_add | Endpoint Addition layer | A layer that allows dynamic or static endpoint ports to be added for each interface. These layers are not used for filtering. Instead, they are containers that specify an interface and an endpoint to add to the process hosting the interfaces.
proxy_conn | RPC Proxy Connect layer | An RPC communications protocol layer that is used to write non-interface-specific rules for an RPC proxy role.
proxy_if | RPC Proxy Interface layer | An RPC communications protocol layer that is used to write interface-specific rules for an RPC proxy role.

Allowed values for the Actiontype tag

Value | Description
Block | Does not allow the specified item access over RPC.
Permit | Allows the specified item access over RPC.
Continue | Does not allow the specified item access over RPC until all rules in the filter are run. Access is based on the cumulative results of all the rules in the filter.

Allowed values for the Filterkey tag

Value | Name | Description
UUID | Universally Unique Identifier | A unique, 128-bit identifier that identifies this filter.

Allowed values for the Persistence tag

Value | Description
Persistent | The value is stored on the disk and persists through a system restart. This is the default value.
Volatile | The value is not stored. If the system is restarted, the value is lost.

Allowed values for the Audit tag

Value

Description

Enabled

Specifies that the RPC filtering engine runs in Audit mode. In Audit mode, rules are not applied and traffic is not filtered. Instead, the RPC filtering engine logs events when a rule would be applied.

Note
Auditing is not allowed for the ep_add layer.

Disabled

Specifies that the RPC filtering engine does not run in Audit mode. Instead, the RPC filtering engine actively filters traffic and applies the filtering rules. This is the default value.

Examples

The following example adds a rule to block RPC traffic that matches the given condition. This rule applies to the user mode (um) layer. A specific filter key identifies the filter.

Copy Code
add rule layer=um actiontype=block

The following example is a rule to add an endpoint to an interface. The rule references a specific filterkey. This is the only rule that is necessary for adding a dynamic endpoint to an interface.

Copy Code
add rule layer=epmap actiontype=permit filterkey=11111111-2222-3333-4444-555555555555

add condition

Adds a condition that must be met so that a filtering rule can be applied. Conditions are combined with rules to specify RPC Firewall Filters.

Use the following order when you add rules, conditions, and filters:

  1. Add rule.

  2. Add conditions. The information in this "add condition" section provides details for step 2, including syntax, parameters, and allowed values

  3. Add the filter that is created by the combination of rules and conditions that you enter.

Syntax

Copy Code
Filter add condition [field=]<string> [matchtype=]<string> [data=]<string>

Parameters

See the following tables for the add condition parameters and their values. The filtering engine checks that the condition you specify is met before the associated rule is run and the filtering is applied. An administrator can use the parameters and their values to fine-tune the filter so that it applies only to the specified RPC port, interface, or transport.

Tag | Required | Default | Description | Allowed Values
Field | Yes | None | Identifies the RPC field where the condition applies. The allowed values of the field tag vary, depending on the layer that is specified in the filtering rule. | See the tables in the section "Allowed values for the Field tag by Layer."
MatchType | Yes | None | Defines the type of comparison to perform on a given field. | See the tables in the section "Allowed values for the MatchType tag."
Data | Yes | None | The data that is used for making comparisons to the value in the field to determine whether your condition is met or not met. The data is compared to the value using the comparison that is defined in the MatchType tag. | The value that is allowed for the Data tag varies for each field that is specified.

Allowed values for the Field tag by Layer

The allowed values for the Field tag depend on the RPC layer to which the rules apply. For each layer, there is a set of allowed Field values. The layer is specified in the add rule command. The following tables describe the allowed values for the Field tag by RPC layer.

Allowed values for the User Mode Layer

The following values for filtering are allowed for User Mode (UM) Layer conditions. There are no required fields for UM Layer conditions.

Allowed value Description

if_uuid

The 128-bit interface UUID. The UUID is formatted as follows:

XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX

if_version

The version of the interface as defined in the RPC Interface Definition Language (IDL) file. This is a decimal number For information about the IDL file, see RPC Architecture (http://go.microsoft.com/fwlink/?LinkId=108499).

if_flag

The RPF Firewall Interface flag. The value is a hexadecimal number in 0x notation. The recognized flag as described in the following table.

Flag | Value | Description
RPC_FW_IF_FLAG_DCOM | 0x0001 | This flag indicates the condition applies to DCOM activations or calls to DCOM interfaces.

For example, to create a condition to block a DCOM activation, use the following command:

Netsh rpc filter add condition field=if_flag matchtype=equals data=0x0001

dcom_app_id

The UUID of the DCOM application where the condition is applied. The UUID is formatted as follows:

XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX

For information about application identifiers, see DCOM Architecture (http://go.microsoft.com/fwlink/?LinkId=108500).

image_name

The name of the executable image. It is specified with an s preceding the name if the name is given in ASCII or with a w if the name is Unicode. For example, to apply this condition on Image.exe, use the following command:

Netsh rpc filter add condition field=image_name matchtype=equal data=simage.exe

protocol

The protocol over which to block. It must be one of the following strings:

NCACN_IP_TCP to indicate the TCP protocol

NCACN_NP to indicate the named pipes protocol

For example, to create a rule that applies to the TCP protocol, use the following command:

netsh rpc filter add condition field=protocol matchtype=equal data=NCACN_IP_TCP

auth_type

The authentication service type. The value is specified as a decimal number.

For more information about authentication service types, see Authentication-Service Constants (http://go.microsoft.com/fwlink/?LinkId=107910).

auth_level

The authentication-level constant. This value represents authentication levels that are passed to various run-time functions. The value is specified as a decimal number in increasing order, starting with 0.

For more information about authentication-level constants, see Authentication-Level Constants (http://go.microsoft.com/fwlink/?LinkId=107912).

sec_encrypt_alg

The certificate-based, security service provider interface (SSPI) encryption algorithm.

sec_key_size

The certificate-based, SSPI encryption key size.

remote_user_token

A data structure that contains authentication and authorization information for a remote user.

local_addr_v4

The local IP version 4 (IPv4) address over which to apply the condition. The data is in hexadecimal 0x notation.

local_addr_v6

The local IP version 6 (IPv6) address over which to apply the condition. The data is in standard colon notation.

remote_addr_v4

The remote IPv4 address over which to apply the condition. The data is in hexadecimal 0x notation.

remote_addr_v6

The remote IPv6 address over which to apply the condition. The data is in standard colon notation.

local_port

The local port where the condition is applied. The port is a decimal number.

pipe

The remote named pipe that provides communication between processes on different computers.

Allowed values for the Endpoint Mapper (EPMAP) Layer

The following values for filtering are allowed for EPMAP Layer conditions. Conditions for the EPMAP layer are used to create interface-specific rules. If_uuid and if_version are both required values. The if_uuid value must be the first value that is specified

Value | Description
if_uuid | The 128-bit, interface UUID. The UUID is formatted as follows: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX The if_uuid is a required value for the EPMAP Layer, and it must be the first value that is specified.
if_version | The version of the interface as defined in the RPC IDL file. This is a decimal number The if_version field is a required value for the EPMAP Layer, and it must be the second value that is specified.
protocol | The protocol over which to block. It must be one of the following strings: NCACN_IP_TCP, to indicate the TCP protocol NCACN_NP, to indicate the named pipes protocol For example, to create a rule that applies to the TCP protocol, use the following command: netsh rpc filter add condition field=protocol matchtype=equal data=NCACN_IP_TCP
auth_type | The authentication service type. For more information about authentication service types, see Authentication-Service Constants (http://go.microsoft.com/fwlink/?LinkID=107910). The value is specified as a decimal number.
auth_level | The authentication-level constant. This represents authentication levels that are passed to various run-time functions. For more information about authentication-level constants, see Authentication-Level Constants (http://go.microsoft.com/fwlink/?LinkID=107912). The value is specified as a decimal number in increasing order starting with 0.
sec_encrypt_alg | The certificate-based, SSPI encryption algorithm.
sec_key_size | The certificate-based, SSPI encryption key size.
remote_user_token | A data structure that contains authentication and authorization information for a remote user.
local_addr_v4 | The local IPv4 address over which to apply the condition. The data is in hexadecimal 0x notation.
local_addr_v6 | The local IPv6 address over which to apply the condition. The data is in standard colon notation.
remote_addr_v4 | The remote IPv4 address over which to apply the condition. The data is in hexadecimal 0x notation.
remote_addr_v6 | The remote IPv6 address over which to apply the condition. The data is in standard colon notation.
local_port | The local port on which to apply the condition. The port is a decimal number.
pipe | The remote named pipe that provides communication between processes on different computers.

Allowed values for the Proxy Interface (PROXY_IF) layer

The following values for filtering are allowed for PROXY_IF Layer conditions. The proxy_if layer applies to interface-specific conditions and rules on an RPC proxy. The if_uuid value is required, and it must be the first value that is specified.

Value | Description
if_uuid | The 128-bit interface UUID. The UUID is formatted as follows: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX The if_uuid value is required, and it must be the first value that is specified.
if_version | The version of the interface as defined in the RPC IDL file. This is a decimal number.
server_name | The name of the server that is the target for the condition. The name is specified as a string, preceded by s for ASCII or w for Unicode.
server_port | The server port that is the target for the condition. The port is specified as a decimal value.
proxy_auth_type | The RPC proxy authentication service type.
client_token | A data structure that contains authentication and authorization information for the client when it is using an RPC proxy.
client_cert_oid | The object identifier in the client certificate.
cert_key_length | The SSL key length in the client certificate.

Allowed values for the Endpoint Addition (EP_ADD) layer

The following values for filtering are allowed for EP_ADD Layer conditions. The EP_ADD layer allows dynamic or static ports to be added to interfaces at run time, regardless of the application. The process_with_if_uuid value is required for the EP_ADD layer, and it must be the first value that is specified. The protocol value is required for the EP_ADD layer, and it must be the second value that is specified.

Value

Description

process_with_if_uuid

The UUID of the interface on which to add the dynamic endpoint port. This value is required, and it must be the first value that is specified.

Protocol

The protocol over which to block. It must be one of the following strings:

NCACN_IP_TCP, to indicate the TCP protocol.

NCACN_NP, to indicate the named pipes protocol.

For example, to create a rule that applies to the TCP protocol, use the following command:

netsh rpc filter add condition field=protocol matchtype=equal data=NCACN_IP_TCP

The protocol value is a required value for the EP_ADD layer, and it must be the second value that is specified.

ep_value

The port on which to add the endpoint. The value is specified as a decimal value. If it is not specified, a dynamic endpoint, rather than a static endpoint port, is added to the interface.

ep_flags

The RPC Firewall Interface flag. The value is a hexadecimal number in 0x notation. The recognized flag is described in the following table.

Flag | Value | Description
RPC_FW_IF_FLAG_DCOM | 0x0001 | This flag indicates that the condition applies to DCOM activations or calls to DCOM interfaces.

For example, to create a condition to block a DCOM activation, use the following command:

Netsh rpc filter add condition field=if_flag matchtype=equals data=0x0001

Allowed values for the Proxy Connect (PROXY_CONN) layer

The following values for filtering are allowed for PROXY_CONN Layer conditions. The PROXY_CONN layer is an RPC communications protocol layer that is used to write non-interface-specific rules for an RPC proxy role.

Value | Description
server_name | The name of the target server that the condition applies to. This is specified as a string preceded with s for ASCII or w for Unicode.
server_port | The target server port that the condition applies to. This is specified as a decimal value.
proxy_auth_type | The RPC proxy authentication service type.
client_token | The client user identity that is produced by the front-end authentication.
client_cert_key_name | The client certificate key name.
client_cert_oid | The object identifier in the client certificate.

Allowed values for the MATCHTYPE tag

The match type specifies the type of comparison to perform on a given value.

Value | Description
Equal | Tests whether the value is equal to the condition value.
Greater | Tests whether the value is greater than the condition value.
Less | Tests whether the value is less than the condition value.
Greater or equal | Tests whether the value is greater than or equal to the condition value.
Less or equal | Tests whether the value is less than or equal to the condition value.
Range | Tests whether the value is within a given range of condition values.
All set | Tests whether all flags are set.
Any set | Tests whether any flags are set.
None set | Tests whether no flags are set.

add filter

You can specify the rule and the conditions and run the add filter command, which takes those rules and conditions and adds them as a filter to the firewall. You must already have added at least one rule and one condition.

Use the following order when you add rules, conditions, and filters:

  1. Add rule.

  2. Add conditions.

  3. Add the filter that is created by the combination of rules and conditions that you enter. This "add filter" section provides the syntax.

Syntax

Copy Code
filter add filter

Parameters

This command has no parameters. The command combines the rule and conditions to create an RPC Firewall Filter.

show filter

Lists the active RPC Firewall Filters.

Syntax

Copy Code
filter show filter

Parameters

This command has no parameters. This command lists the currently active RPC filters.

delete filter

Deletes all active RPC Firewall Filters.

Syntax

Copy Code
filter delete filter.<filter key>

Parameters

Value | Description
All | Deletes all filters. Removes all filters and all rules and conditions that are associated with the filters.
<GUID> | Globally unique identifier (GUID). The 128-bit filter identifier. This value is specified in the filterkey tag when you use the add filter command or it is automatically generated. If it is not specified, you can find the filter key by running the show filter command. The identifier is specified in the following notation: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX

Remarks

Deleting an RPC Firewall Filter deletes the rules and conditions that are associated with the filter.

Example

The following example deletes all RPC Firewall Filters:

Copy Code
delete filter filterkey=all

The following example deletes the filter identified by filter key 11111111-2222-3333-4444-555555555555:

Copy Code
Delete filter filterkey=11111111-2222-3333-4444-555555555555

delete rule

Deletes the current RPC Firewall Filter rule.

Syntax

Copy Code
filter delete rule

Parameters

This command has no parameters. This command deletes the current RPC Firewall Filter rule. The command deletes the firewall filter rule and associated conditions.

Examples of RPC Firewall Filter commands

The following examples demonstrate the use of RPC Firewall Filters in real-world situations.

To block all RPC connections over TCP:

Copy Code
netsh rpc filter add rule layer=um actiontype=block
netsh rpc filter add condition field=protocol matchtype=equals data= NCACN_IP_TCP
netsh rpc filter add filter

To block RPC connections on port 12345:

Copy Code
netsh rpc filter add rule layer=um actiontype=block
netsh rpc filter add condition field=local_port matchtype=equals data=12345
netsh rpc filter add filter

To block RPC connections from server 192.168.1.1:

Copy Code
netsh rpc filter add rule layer=um actiontype=block
netsh rpc filter add condition field=remot_addr_v4 matchtype=equals data=0xC0A80101
netsh rpc filter add filter

To add a dynamic endpoint for version 1 of the interface with UUID 11111111-1111-1111-1111-111111111111:

Copy Code
netsh rpc filter add rule layer=ep_add actiontype=permit
netsh rpc filter add condition field= process_with_if_uuid matchtype=equal data=11111111-1111-1111-1111-111111111111
netsh rpc filter add condition field=protocol matchtype=equal data=ncacn_ip_tcp
netsh rpc filter add filter

To block RPC connections for version 1 of the interface with UUID 11111111-1111-1111-1111-111111111111:

Copy Code
netsh rpc filter add rule layer=epmap actiontype=block
netsh rpc filter add condition field=if_uuid matchtype=equal data=11111111-1111-1111-1111-111111111111
netsh rpc filter add condition field=if_version matchtype=equal data=1
netsh rpc filter add filter

For an RPC proxy, it is possible to block RPC connections through the RPC proxy where the target server is named TargetServer:

Copy Code
netsh rpc filter add rule layer=proxy_conn actiontype=block
netsh rpc filter add condition field=server_name matchtype=equals data=sTargetServer
netsh rpc filter add filter


Netsh Commands for Routing

You can use commands in the Netsh routing context to configure all aspects of routing. The Netsh commands for routing provide the same functionality as the Routing and Remote Access console, and the commands can be run manually at the netsh prompt or in scripts and batch files.

To run these commands from the command prompt, you must either enter the netsh routing context or prepend the context to the command. For example, if you are at the command prompt but have not typed netsh and then routing to enter the netsh routing context, you must type:

netsh routing command

Where command is the command that you want to run, including all of the required parameters for the command.

For more information about Netsh, see Netsh Overview and Enter a Netsh Context.

Netsh routing command reference

The Netsh commands for routing are grouped by the following command categories.

Netsh Routing IP Autodhcp Context Commands. These commands allow you to configure the DHCP allocator.

Netsh Routing IP Dnsproxy Context Commands. These commands allow you to configure Domain Name System (DNS) proxy parameters and install the routing protocol.

Netsh Routing IP IGMP Context Commands. These commands allow you to display and configure IGMP parameters.

Netsh Routing IP NAT Context Commands. These commands allow you to view and configure network address translation (NAT).

Netsh Routing IP Relay Context Commands. These commands allow you to view and configure the DHCP Relay Agent.

Netsh Routing IP RIP Context Commands. These commands allow you to display and configure various Routing Information Protocol (RIP) settings, such as: filters, RIP neighbors, and RIP statistics.

Netsh Routing IP Routerdiscovery Context Commands. These commands allow you to display and configure router discovery.

Netsh Routing IPv6 Context Commands. These commands allow you to view and configure IPv6-related routing settings.

Netsh Routing IPv6 Relayv6 Context Commands. These commands allow you to view and configure the DHCPv6 relay agent settings.

Netsh Routing example

To enable router discovery for the interface named Local Area Connection, specifying a minimum interval of 7 minutes, a maximum interval of 10 minutes, a life of 30 minutes for router discovery packets, and a zero (0) or no preference level, type the following from the netsh routing prompt:

add interface "Local Area Connection" enable 7 10 30 0

For information on how to interpret netsh command syntax, see Formatting Legend.


Netsh Routing Commands

The following commands are specific to the routing context within the Netsh environment.

To view the command syntax, click a command:

  • dump

  • reset

Netsh commands for routing

The following entries provide details for each command.

dump

Displays the configuration of the remote access server in script form.

Syntax

dump

Remarks

  • You can dump the contents of the current configuration to a file that can be used to restore altered configuration settings.

Example

The following is the command to save the current configuration as a script in the routingcfg.dmp file.

dump > routingcfg.dmp

reset

Resets IP routing to a clean state.

Syntax

reset


Netsh Routing Demand-dial Context Commands

The following commands are specific to the routing demand-dial context within the Netsh environment.

To view the command syntax, click a command:

  • dump

Add commands

  • add interface

Delete commands

  • delete interface

Set commands

  • set callbackdevice

  • set credentials

  • set interface

  • set ppp

  • set security

Show commands

  • show callbackdevice

  • show interface

  • show ppp

  • show security

Netsh commands for routing demand dial

The following entries provide details for each command.

dump

Displays the demand-dial configuration of a remote access server in script form.

Syntax

dump

Remarks

  • You can dump the contents of the current configuration to a file that can be used to restore altered configuration settings.

Example

The following command saves the current configuration as a script in the routingdemanddialcfg.dmp file.

dump > routingdemanddialcfg.dmp

add interface

Adds a new demand-dial interface.

Syntax

add interface

[name=] InterfaceName

[type=] vpn | dialup

[host=] HostName

[device=] DeviceName

[user=] UserName

[password=] Password

Parameters

[name=] InterfaceName

Required. Specifies the name of the demand-dial interface.

[type=] {vpn | dialup}

Required. Specifies the type of demand-dial connection: VPN or dial-up.

[host=] HostName

Required. For a connection using a VPN device, specifies the host name or IP address of the remote computer. For a connection using a physical device, such as a modem, specifies a comma-separated list of phone numbers (primary, alternate1, alternate2, and so on).

[device=] DeviceName

Required. For a connection using a VPN device, specifies the type of VPN connection. For a connection using a physical device, such as a modem, specifies the name of the dial-up device.

[user=] UserName

Required. Specifies the user name dial-out credential in the format domain\username.

[password=] Password

Required. Specifies the password dial-out credential.

Remarks

By default, the following parameters are set for the new demand-dial connection:

idletime= 5

Idle time, in minutes, before hanging up

redialatt= 0

Redial attempts

redialinterval= 1

Interval, in minutes, between redial attempts

swc= enabled, lcp= enabled

PPP settings: enable Link Control Protocol (LCP) extensions, enable software compression

encryption= req

Require data encryption

mschapv2= enabled

MS-CHAP v2 enabled for logon security

restrictions= none

No restriction on dial-out hours

Example

In the following example, a VPN demand-dial interface named VPN1 is added with a connection to host 10.0.0.200. Dial-out credentials are user name Dialin1 and password P@ssword.

add interface name=VPN1 type=vpn host=10.0.0.200

device= auto user=Dialin1 password=P@ssword

delete interface

Deletes a demand-dial interface.

Syntax

delete interface

[name=] InterfaceName

Parameters

[name=] InterfaceName

Required. Specifies the name of the demand-dial interface.

Example

The following is an example of removing the VPN1 demand-dial interface.

delete interface VPN1

set interface

Sets the options for a demand-dial interface.

Syntax

set interface

[name=] InterfaceName

[host=] HostName

[device=] DeviceName

[conntype=] {dd | persistent}

[idletime=] Time

[redialatt=] Number

[redialinterval=] Interval

[callback=] {enabled | disabled}

[restrictions=] Times

Parameters

[name=] InterfaceName

Required. Specifies the name of the demand-dial interface.

[host=] HostName

Required. For a connection using a VPN device, specifies the host name or IP of the remote computer. For a connection using a physical device, such as a modem, specifies a comma-separated list of phone numbers (primary, alternate1, alternate2, and so on).

[device=] DeviceName

Required. For a connection using a VPN device, specifies the type of VPN connection. For a connection using a physical device, such as a modem, specifies the name of the dial-up device.

[conntype=] {dd | persistent}

Required. Specifies the connection type: Demand-dial or Persistent.

[idletime=] Time

Required. Specifies the idle time, in minutes, before hanging up. Allowed values, in minutes: 0 (Never), 1, 5, 20, 30, 60 (1 hour), 120 (2 hours), 240 (4 hours), 480 (8 hours), 720 (12 hours).

[redialatt=] Number

Required. Specifies the number of redial attempts.

[redialinterval=] Interval

Required. Specifies the interval, in minutes, between redial attempts. Allowed values, in seconds: 1, 3, 5, 10, 30, 60 (1 minute), 120 (2 minutes), 300 (5 minutes), 600 (10 minutes).

[callback=] {enabled | disabled}

Required. Specifies whether dial-up callback is enabled or disabled. Callback can reduce phone charges and increase security. The default is disabled.

[restrictions=] Times

Specifies the times during which dial-out is restricted. Format is a comma-separated string where day of the week is specified by a number (Sunday = 0, Monday = 1,… Saturday = 6). Restricted time is specified as follows: <day1><space><time range><space><time range>.

Example

In the following example, a demand-dial interface named VPN1 is added with a connection to host 10.0.0.201, a demand-dial connection type, an idle time of 5 minutes, 3 redial attempts, a redial interval of 10 minutes, and callback disabled. Dial-out is restricted all Saturday and Sunday from midnight to noon and 3:00 P.M. to midnight.

set interface name=VPN1 host=10.0.0.201 device=auto conntype=dd idletime=5 redialatt=3 redialinterval=10 callback=disabled restriction = “6 00:00-24:00, 0 00:00-12:00 15:00-24:00”

show interface

Shows the settings for the specified demand-dial interface. Used without parameters, show interface displays demand-dial configuration information for all interfaces.

Syntax

show

interface [name= ] InterfaceName

Parameters

[name=] InterfaceName

Specifies, by name, the interface for which you want to display information. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

set callbackdevice

Sets the callback number of the callback device for the specified demand-dial interface.

Syntax

set callbackdevice

[name= ] CallbackDevice

[number= ] Number

Parameters

[name=] CallbackDevice

Required. Specifies the callback device.

[number=] Number

Required. Specifies the callback phone number.

Example

The following sets the callback number of device Standard 56000 bps Modem to (425) 555-0110.

set callbackdevice name="standard 56000 bps modem (com1)" number=4255550110

show callbackdevice

Shows the callback number of the callback device for the specified demand-dial interface.

Syntax

show callbackdevice

[[name=] CallbackDevice]

Parameters

[[name=] CallbackDevice]

Specifies the callback device. If you do not specify a device, all the callback devices are listed.

set credentials

Sets the dial-out credentials for the specified demand-dial interface.

Syntax

set credentials

[name= ] InterfaceName

[user= ] UserName

[password= ] Password

Parameters

[name=] InterfaceName

Required. Specifies the name of the demand-dial interface.

[user=] UserName

Required. Specifies the user name dial-out credential in the format domain\username.

[password=] Password

Required. Specifies the password dial-out credential.

Example

The following sets the dial-out credentials for the VPN1 demand-dial interface to: user name Dialin1 and password P@ssword.

set credentials name=vpn1 user=Dialin1 password=P@ssword

set ppp

Sets the PPP options for the specified demand-dial interface.

Syntax

set ppp

[name=] InterfaceName

[lcp=] {enabled | disabled}

[swc=] {enabled | disabled}

[multi=] {enabled | disabled}

Parameters

[name=] InterfaceName

Required. Specifies the name of the demand-dial interface.

[lcp=] {enabled | disabled}

Required. Specifies whether LCP extensions are enabled or disabled. The default is enabled.

[swc=] {enabled | disabled}

Required. Specifies whether software compression is enabled or disabled. The default is enabled.

[multi=] {enabled | disabled}

Required. Specifies whether Multilink negotiation is enabled for a single link connection. The default is disabled.

Example

The following sets the PPP settings for VPN1 demand-dial interface.

set ppp name=vpn1 lcp=disabled swc=enabled multi=disabled

show ppp

Shows the PPP settings for the specified demand-dial interface.

Syntax

show ppp

[name= ] InterfaceName

Parameters

[name=] InterfaceName

Required. Specifies the demand-dial interface.

Example

The following shows the PPP settings for VPN1 demand-dial interface.

show ppp name=vpn1

set security

Sets the security options for the specified demand-dial interface.

Syntax

set security

[name=] InterfaceName

[encryption=] {none | opt | req | max}

[pap=] {enabled | disabled}

[chap=] {enabled | disabled}

[mschapv2=] {enabled | disabled}

[psk=] {enabled | disabled}

[secret=] SharedSecret

Parameters

[name=] InterfaceName

Required. Specifies the name of the demand-dial interface.

[encryption=] {none | opt | req | max}

Required. Specifies the data encryption level to be enforced. None: no encryption allowed. Disconnect if server requests encryption. Opt: encryption is optional. Connect whether or not there is encryption. Req: encryption is required. Disconnect if server does not support encryption. This is the default setting. Max: maximum strength encryption required. Disconnect if server does not support maximum strength encryption.

[pap=] {enabled | disabled}

Required. Specifies Password Authentication Protocol (PAP) authentication is supported. Enable only with encryption=none. Default is disabled.

[chap=] {enabled | disabled}

Required. Specifies MS Challenge Password Authentication Protocol (CHAP) authentication is supported. Enable only with encryption=none. Default is disabled.

[mschapv2=] {enabled | disabled}

Required. Specifies MS Challenge Password Authentication Protocol version 2 (MS-CHAP v2) authentication is supported. Default is enabled.

[psk=] {enabled | disabled}

Required. Specifies preshared key authentication is supported for Internet Key Exchange (IKE). For use with L2TP IPsec VPN VPN type. Default is disabled.

[secret=] SharedSecret

Specifies the preshared key. Use when psk authentication is enabled.

Example

The following sets the security settings for VPN1 demand-dial interface.

set security name=vpn1 encryption=opt pap=disabled chap=disabled mschapv2=enabled psk=disabled

show security

Shows the security settings for the specified demand-dial interface.

Syntax

show security

[name=] InterfaceName

Parameters

[name=] InterfaceName

Required. Specifies the demand-dial interface.

Example

Following shows the security settings for VPN1 demand-dial interface.

show security name=vpn1


Netsh Routing IP Context Commands

The following commands are specific to the routing context within the Netsh environment.

To view the command syntax, click a command:

  • dump

  • reset

  • update

Add commands

  • add boundary

  • add filter

  • add interface

  • add persistentroute

  • add preferenceforprotocol

  • add rtmroute

  • add scope

Delete commands

  • delete boundary

  • delete filter

  • delete interface

  • delete persistentroute

  • delete preferenceforprotocol

  • delete rtmroute

  • delete scope

Set commands

  • set filter

  • set interface

  • set loglevel

  • set persistentroute

  • set preferenceforprotocol

  • set rtmroute

  • set scope

  • set updateroutes

Show commands

  • show boundary

  • show boundarystats

  • show filter

  • show interface

  • show loglevel

  • show mfe

  • show mfestats

  • show persistentroutes

  • show preferenceforprotocol

  • show protocol

  • show rtmdestinations

  • show rtmroutes

  • show scope

Netsh commands for routing IP

The following entries provide details for each command.

dump

Displays the configuration of the remote access server in script form.

Syntax

dump

Remarks

  • You can dump the contents of the current configuration to a file that can be used to restore altered configuration settings.

Example

The following command saves the current configuration as a script in the routingipcfg.dmp file.

dump > routingipcfg.dmp

reset

Resets IP routing to a clean state.

Syntax

reset

update

Updates autostatic routes on the specified interface.

Syntax

update

[name=] InterfaceName

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface on which you want to update autostatic routes.

add boundary

Adds a multicast scope boundary on an interface.

Syntax

add boundary

[name=] InterfaceName

[grpaddr=] IPAddress

[grpmask=] SubnetMask

or

add boundary

[name=] Name

[scopename=] ScopeName

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface on which you want to add the boundary.

[grpaddr=] IPAddress

Specifies the multicast group address of the boundary to add.

[grpmask=] SubnetMask

Specifies the subnet mask of the boundary address to add.

[scopename=] ScopeName

Specifies the name of the multicast scope to bound.

Examples

The following shows two different examples of adding a multicast scope boundary.

add boundary name=Internal grpaddr=239.0.0.1 grpmask=255.255.255.255

add boundary name="Local Area Connection" scopename="My Mcast Scope"

add filter

Adds a packet filter to the specified interface.

Syntax

add filter

[name=] InterfaceName

[filtertype=] {input | output | dial}

[srcaddr=] IPAddress

[srcmask=] SubnetMask

[dstaddr=] IPAddress

[dstmask=] SubnetMask

{[proto=] any | [proto=] {tcp | tcp-est | udp} [srcport=] Port [dstport=] Port [proto=] icmp [type=] ICMPTypeField [code=] ICMPCodeField}

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface on which you want to add the filter.

[filtertype=] {input | output | dial}

Required. Specifies the type of packet filter. The input parameter specifies the filter being modified filters input. The output parameter specifies the filter being modified filters output. The dial parameter specifies the filter being modified filters a dial-up interface connection.

[srcaddr=] IPAddress

Required. Specifies the source address field of the packet to be filtered.

[srcmask=] SubnetMask

Required. Specifies the source subnet mask of the packet to be filtered. An address and mask of all zeros means ANY.

[dstaddr=] IPAddress

Required. Specifies the destination address field of the packet to be filtered.

[dstmask=] SubnetMask

Required. Specifies the destination subnet mask of the packet to be filtered.

[proto=] any | [proto=] {tcp | tcp-est | udp}

Required. Specifies the protocol type for the packet to be filtered.

[srcport=] Port

Specifies the source port field of the packet to be filtered. A value of zero means ANY.

[dstport=] Port

Specifies the destination port field of the packet to be filtered. A value of zero means ANY.

[type=] ICMPTypeField

Specifies the ICMP type field of the packet to be filtered. A value of 255 means ANY.

[code=] ICMPCodeField

Specifies the ICMP code field of the packet to be filtered. A value of 255 means ANY.

Examples

The following shows two different examples of adding a packet filter.

add filter name="Virtual Private Connection" filtertype=input

srcaddr=0.0.0.0 srcmask=255.255.255.255 dstaddr=169.254.0.0

dstmask=255.255.0.0 proto=any

add filter "Virtual Private Connection" input 0.0.0.0 0.0.0.0

169.254.0.0 255.255.0.0 any

add interface

Adds IP forwarding on an interface and enables or disables IP forwarding.

Syntax

add interface

[name=] InterfaceName

[[state=] enable | disable]

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface on which you want to set IP forwarding.

[[state=] enable | disable]

The enable parameter enables the IP interface as you add it. The disable parameter disables the IP interface as you add it.

Example

The following adds and enables IP forwarding on an interface.

add interface name="Local Area Connection" state=enable

add persistentroute

Adds a persistent static route on the specified interface.

Syntax

add persistentroute

[dest=] IPAddress

[mask=] SubnetMask

[name=] InterfaceName

[[nhop]=IPAddress]

[[proto=] static | nondod]

[[metric=] RouteMetric]

[[view=] unicast | multicast | both]

Parameters

[dest=] IPAddress

Required. Specifies the destination address for the specified route.

[mask=] SubnetMask

Required. Specifies the subnet mask for the destination address.

[name=] InterfaceName

Required. Specifies, by name, the interface where the route is to be added.

[[nhop]=IPAddress]

Specifies the next hop address for the route. For routes over point-to-point interface, this value should not be specified.

[[proto=] static | nondod]

Specifies the demand-dial connection state. The static parameter specifies demand-dial connections are triggered. The nondod parameter specifies demand-dial connections are not triggered.

[[metric=] RouteMetric]

Specifies the route metric.

[[view=] unicast | multicast | both]

Specifies valid traffic for the route. The unicast parameter specifies the route is valid for unicast traffic only. The multicast parameter specifies the route is valid for multicast traffic only. The both parameter specifies the route is valid for both unicast and multicast traffic. The default value is both.

Example

The following adds a persistent static route on the specified interface.

add persistentroute 192.168.1.0 255.255.255.0 "Virtual Private Connection"

add preferenceforprotocol

Adds a preference level to a specified routing protocol.

Syntax

add preferenceforprotocol

[proto=] autostatic | local | netmgmt | nondod | ospf | rip | static

[preflevel=] PreferenceLevel

Parameters

[proto=] autostatic | local | netmgmt | nondod | ospf | rip | static

Required. Specifies the routing protocol for which a preference level is set. The autostatic parameter adds an autostatic routing preference. The local parameter adds a local routing preference. The netmgmt parameter adds a routing preference for a network management protocol. The nondod parameter adds a preference for a routing protocol not able to use demand-dial. The ospf parameter adds a routing protocol preference for Open Shortest Path First (OSPF). The rip parameter adds a routing preference for Routing Information Protocol (RIP). The static parameter adds a static routing preference.

[preflevel=] PreferenceLevel

Required. Specifies the preference level.

Example

The following adds a preference level of 10 for the RIP routing protocol.

add preferenceforprotocol proto=rip preflevel=10

add rtmroute

Adds a non-persistent network management route for the specified interface or next hop count.

Syntax

add rtmroute [dest=] IPAddress

[mask=] SubnetMask

[name=] InterfaceName

[[nhop]=IPAddress]

[[proto=] static | nondod]

[[metric=] RouteMetric]

[[view=] unicast | multicast | both]

Parameters

[dest=] IPAddress

Required. Specifies the destination address for the specified route.

[mask=] SubnetMask

Required. Specifies the subnet mask for the destination address.

[nameorindex=] InterfaceName

Required. Specifies, by name, the interface where the route is to be added.

[[nhop]=IPAddress]

Specifies the next hop address for the route. For routes over point-to-point interface, this value should not be specified.

[[metric=] RouteMetric]

Specifies the route metric.

[[view=] unicast | multicast | both]

Specifies valid traffic for the route. The unicast parameter specifies the route is valid for unicast traffic only. The multicast parameter specifies the route is valid for multicast traffic only. The both parameter specifies the route is valid for both unicast and multicast traffic. The default value is both.

Example

The following adds a non-persistent network management route to the specified interface.

add rtmroute 192.168.1.0 255.255.255.0 "Virtual Private Connection"

add scope

Adds a multicast scope to the IP routing configuration.

Syntax

add scope

[grpaddr=] IPAddress

[grpmask=] SubnetMask

[scopename=] ScopeName

Parameters

[grpaddr=] IPAddress

Required. Specifies the multicast scope or group IP address.

[grpmask=] SubnetMask

Required. Specifies the subnet mask of the multicast scope address.

[scopename=] ScopeName

Required. Specifies the name of the multicast scope to be added.

Example

The following adds the specified multicast scope.

add scope 239.1.1.1 255.255.255.224 "My Multicast Scope"

delete boundary

Deletes a multicast scope boundary from an interface.

Syntax

delete boundary

[name=] InterfaceName

[grpaddr=] IPAddress

[grpmask=] SubnetMask

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface on which you want to delete the boundary.

[grpaddr=] IPAddress

Specifies the multicast group address of the boundary to delete.

[grpmask=] SubnetMask

Specifies the subnet mask of the boundary address to delete.

[scopename=] ScopeName

Specifies the name of the bounded multicast scope.

Examples

The following shows two different examples of deleting a multicast scope boundary.

delete boundary "Local Area Connection" 239.2.2.2 255.255.255.255

delete boundary "Local Area Connection" "My Mcast Scope"

delete filter

Deletes a packet filter from the specified interface.

Syntax

delete filter

[name=] InterfaceName

[filtertype=] {input | output | dial}

[srcaddr=] IPAddress

[srcmask=] SubnetMask

[dstaddr=] IPAddress

[dstmask=] SubnetMask

{[proto=] any | [proto=] {tcp | tcp-est | udp}

[srcport=] Port

[dstport=] Port

[proto=] icmp

[type=] ICMPTypeField

[code=] ICMPCodeField}

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface from which you want to delete the filter.

[filtertype=] {input | output | dial}

Required. Specifies the type of packet filter. The input parameter specifies the filter being modified filters input. The output parameter specifies the filter being modified filters output. The dial parameter specifies the filter being modified filters a dial-up interface connection.

[srcaddr=] IPAddress

Required. Specifies the source address field of the packet to be filtered.

[srcmask=] SubnetMask

Required. Specifies the source subnet mask of the packet to be filtered. An address and mask of all zeros means ANY.

[dstaddr=] IPAddress

Required. Specifies the destination address field of the packet to be filtered.

[dstmask=] SubnetMask

Required. Specifies the destination subnet mask of the packet to be filtered.

[proto=] any | [proto=] {tcp | tcp-est | udp}

Required. Specifies the protocol type for the packet to be filtered.

[srcport=] Port

Specifies the source port field of the packet to be filtered. A value of zero means ANY.

[dstport=] Port

Specifies the destination port field of the packet to be filtered. A value of zero means ANY.

[type=] ICMPTypeField

Specifies the ICMP type field of the packet to be filtered. A value of 255 means ANY.

[code=] ICMPCodeField

Specifies the Internet Control Message Protocol (ICMP) code field of the packet to be filtered. A value of 255 means ANY.

Examples

The following shows two different examples of adding a packet filter.

delete filter name="Virtual Private Connection" filtertype=input

srcaddr=0.0.0.0 srcmask=255.255.255.255 dstaddr=169.254.0.0

dstmask=255.255.0.0 proto=any

delete filter "Virtual Private Connection" input 0.0.0.0 0.0.0.0

169.254.0.0 255.255.0.0 any

delete interface

Removes IP forwarding from an interface.

Syntax

delete interface

[name=] InterfaceName

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface from which you want to delete IP forwarding.

Example

The following removes IP forwarding from the specified interface.

delete interface name="Local Area Connection"

delete persistentroute

Deletes a persistent static route from the specified interface.

Syntax

delete persistentroute

[dest=] IPAddress

[mask=] SubnetMask

[name=] InterfaceName

[[nhop]=IPAddress]

Parameters

[dest=] IPAddress

Required. Specifies the destination address for the specified route.

[mask=] SubnetMask

Required. Specifies the subnet mask for the destination address.

[name=] InterfaceName

Required. Specifies, by name, the interface from which the route is to be deleted.

[[nhop]=IPAddress]

Specifies the next hop address for the route. For routes over point-to-point interface, this value should not be specified.

Example

The following removes a persistent static route from the specified interface.

delete persistentroute 192.168.1.0 255.255.255.0 "Dial-up Connection"

delete preferenceforprotocol

Deletes a preference level from a specified routing protocol.

Syntax

delete preferenceforprotocol

[proto=] autostatic | local | netmgmt | nondod | ospf | rip | static

Parameters

[proto=] autostatic | local | netmgmt | nondod | ospf | rip | static

Required. Specifies the routing protocol for which a preference level is set. The autostatic parameter deletes an autostatic routing preference. The local parameter deletes a local routing preference. The netmgmt parameter deletes a routing preference for a network management protocol. The nondod parameter deletes a preference for a routing protocol not able to use demand-dial. The ospf parameter deletes a routing protocol preference for OSPF. The rip parameter deletes a routing preference for RIP. The static parameter deletes a static routing preference.

Example

The following removes the preference level from the RIP routing protocol.

delete preferenceforprotocol proto=rip

delete rtmroute

Deletes a non-persistent network management route from the specified interface or next hop count.

Syntax

delete rtmroute

[dest=] IPAddress

[mask=] SubnetMask

[name=] InterfaceName

[[nhop]=IPAddress]

Parameters

[dest=] IPAddress

Required. Specifies the destination address for the specified route.

[mask=] SubnetMask

Required. Specifies the subnet mask for the destination address.

[nameorindex=] InterfaceName

Required. Specifies, by name, the interface from which the route is to be removed.

[[nhop]=IPAddress]

Specifies the next hop address for the route. For routes over point-to-point interface, this value should not be specified.

Example

The following deletes a non-persistent static route from the specified interface and next hop address.

delete rtmroute 192.168.1.0 255.255.255.0 "Virtual Private Connection" nhop=10.0.0.1

delete scope

Deletes a multicast scope from the IP routing configuration.

Syntax

delete scope

[grpaddr=] IPAddress

[grpmask=] SubnetMask

or

delete scope

[scopename=] ScopeName

Parameters

[grpaddr=] IPAddress

Required. Specifies the multicast scope or group IP address.

[grpmask=] SubnetMask

Required. Specifies the subnet mask of the multicast scope address.

[scopename=] ScopeName

Required. Specifies the name of the multicast scope to be added.

Example

The following deletes the specified multicast scope.

delete scope 239.1.1.1 255.255.255.224 "My Multicast Scope"

set filter

Changes the default action for the filter type or fragment check setting for the specified interface.

Syntax

set filter

[name=] InterfaceName

[[filtertype=] {input | output | dial}

[action=] {drop | forward}]

[[fragcheck=] {enable | disable}]

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface for which you want to set the filter.

[[filtertype=] {input | output | dial} [action=] {drop | forward}]

Required. Specifies the type of packet filter. The input parameter specifies the filter being modified filters input. The output parameter specifies the filter being modified filters output. The dial parameter specifies the filter being modified filters a dial-up interface connection. The action parameter specifies the action to be taken when a packet does not match any filter.

[[fragcheck=] {enable | disable}]

Required. Specifies the source subnet mask of the packet to be filtered. An address and mask of all zeros means ANY.

Examples

The following shows two different examples of setting filter action.

set filter name="Dial-up Connection" filtertype=dial action =forward

set filter name="Virtual Private Connection" fragcheck=disable

set interface

Sets IP forwarding on the specified interface.

Syntax

set interface

[name=] InterfaceName

[[state=] {enable | disable}]

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface from which you want to set IP forwarding.

[[state=] {enable | disable}]

The enable parameter enables the IP interface. The disable parameter disables the IP interface.

Example

The following sets IP forwarding on the specified interface.

set interface "Local Area Connection"

set loglevel

Sets the global logging level.

Syntax

set loglevel

[loglevel=] {none | error | warn | info}

Parameters

[loglevel=] {none | error | warn | info}

Required. The none parameter turns off logging. The error parameter sets the logging level to log errors only. The warn parameter sets the logging level to include warning messages. The info parameter sets the logging level to include informational messages.

Example

The following sets global logging to log errors only.

set loglevel loglevel=error

set persistentroute

Modifies a persistent static route on the specified interface.

Syntax

set persistentroute

[dest=] IPAddress

[mask=] SubnetMask

[name=] InterfaceName

[[nhop]=IPAddress]

[[proto=] static | nondod]

[[metric=] RouteMetric]

[[view=] unicast | multicast | both]

Parameters

[dest=] IPAddress

Required. Specifies the destination address for the specified route.

[mask=] SubnetMask

Required. Specifies the subnet mask for the destination address.

[name=] InterfaceName

Required. Specifies, by name, the interface where the route is to be added.

[[nhop]=IPAddress]

Specifies the next hop address for the route. For routes over point-to-point interface, this value should not be specified.

[[proto=] static | nondod]

Specifies the demand-dial connection state. The static parameter specifies demand-dial connections are triggered. The nondod parameter specifies demand-dial connections are not triggered.

[[metric=] RouteMetric]

Specifies the route metric.

[[view=] unicast | multicast | both]

Specifies valid traffic for the route. The unicast parameter specifies the route is valid for unicast traffic only. The multicast parameter specifies the route is valid for multicast traffic only. The both parameter specifies the route is valid for both unicast and multicast traffic. The default value is both.

Example

The following modifies a persistent static route on the specified interface.

set persistentroute 192.168.1.0 255.255.255.0 "Virtual Private Connection"

set preferenceforprotocol

Sets a new preference level to a specified routing protocol.

Syntax

set preferenceforprotocol

[proto=] autostatic | local | netmgmt | nondod | ospf | rip | static [preflevel=] PreferenceLevel

Parameters

[proto=] autostatic | local | netmgmt | nondod | ospf | rip | static

Required. Specifies the routing protocol for which a preference level is set. The autostatic parameter adds an autostatic routing preference. The local parameter adds a local routing preference. The netmgmt parameter adds a routing preference for a network management protocol. The nondod parameter adds a preference for a routing protocol not able to use demand-dial. The ospf parameter adds a routing protocol preference for OSPF. The rip parameter adds a routing preference for RIP. The static parameter adds a static routing preference.

[preflevel=] PreferenceLevel

Required. Specifies the preference level.

Example

The following sets a preference level of 20 for the RIP routing protocol.

set preferenceforprotocol proto=rip preflevel=20

set rtmroute

Modifies a non-persistent network management route for the specified interface or next hop count.

Syntax

add rtmroute

[dest=] IPAddress

[mask=] SubnetMask

[name=] InterfaceName

[[nhop]=IPAddress]

[[proto=] static | nondod]

[[metric=] RouteMetric]

[[view=] unicast | multicast | both]

Parameters

[dest=] IPAddress

Required. Specifies the destination address for the specified route.

[mask=] SubnetMask

Required. Specifies the subnet mask for the destination address.

[nameorindex=] InterfaceName

Required. Specifies, by name, the interface where the route is to be added.

[[nhop]=IPAddress]

Specifies the next hop address for the route. For routes over point-to-point interface, this value should not be specified.

[[metric=] RouteMetric]

Specifies the route metric.

[[view=] unicast | multicast | both]

Specifies valid traffic for the route. The unicast parameter specifies the route is valid for unicast traffic only. The multicast parameter specifies the route is valid for multicast traffic only. The both parameter specifies the route is valid for both unicast and multicast traffic. The default value is both.

Example

The following sets a non-persistent network management route for the specified interface.

set rtmroute 192.168.1.0 255.255.255.0 "Virtual Private Connection"

set scope

Sets the name of a multicast scope.

Syntax

set scope

[grpaddr=] IPAddress

[grpmask=] SubnetMask

[scopename=] ScopeName

Parameters

[grpaddr=] IPAddress

Required. Specifies the multicast scope or group IP address.

[grpmask=] SubnetMask

Required. Specifies the subnet mask of the multicast scope address.

[scopename=] ScopeName

Required. Specifies the name of the multicast scope.

Example

The following sets the multicast scope to the specified name.

set scope 239.1.1.1 255.255.255.224 "My Multicast Scope"

set updateroutes

Updates the routing information for the specified interface.

Syntax

set updateroutes

[name=] InterfaceName

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface for which to update routing information. If no interface is specified, all interfaces are updated.

Example

The following updates routing information for all interfaces.

set updateroutes

show boundary

Displays the configured multicast scope boundaries.

Syntax

show boundary

show boundarystats

Displays the current IP multicast boundaries.

Syntax

show boundarystats

[rr=] RefreshRate

Parameters

[rr=] RefreshRate

Specifies the refresh rate time, in seconds.

Example

The following shows the current IP multicast boundary statistics and refreshes the display every 3 seconds until CTRL+C is entered to exit the display cycle.

show boundarystats rr=3

show filter

Displays packet filter information for the specified interface.

Syntax

show filter

[name=] InterfaceName

Parameters

[name=] InterfaceName

Specifies, by name, the interface for which to display filter information. If no interface is specified, filter information for all interfaces is displayed.

Examples

The following shows two different examples of displaying filter information.

show filter

show filter name="Local Area Connection"

show interface

Displays interface information for the specified interface. Used without parameters, show interface displays configuration information for all interfaces.

Syntax

show interface

[name=] InterfaceName

Parameters

[name=] InterfaceName

Specifies, by name, the interface for which you want to display information. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

Examples

The following shows two different examples of displaying interface information.

show interface

show interface name="Local Area Connection"

show loglevel

Displays global logging level information such as whether logging is turned off and whether errors, warnings, and informational messages are being logged.

Syntax

show loglevel

show mfe

Displays multicast forwarding entries (MFE).

Syntax

show mfe

[[grpaddr=] IPAddress

[grpmask=] SubnetMask]

[[srcaddr=] IPAddress

[srcmask=] SubnetMask]

[[type=] {active | negative | both}]

[[rr=] RefreshRate]

Parameters

[[grpaddr=] IPAddress

Specifies the group IP address for the start of the range.

[grpmask=] SubnetMask]

Specifies the subnet mask associated with the group IP address.

[[srcaddr=] IPAddress

Specifies the source IP address of the start of the range.

[srcmask=] SubnetMask]

Specifies the subnet mask associated with the source IP address.

[[type=] {active | negative | both}]

Specifies the type of multicast forwarding entry. The active parameter specifies displaying active MFE only. The negative parameter specifies displaying negative MFE only. The both parameter specifies displaying both active and negative MFE. The default value is both.

[[rr=] RefreshRate]

Specifies the refresh rate in seconds.

Examples

The following shows two different examples of displaying multicast forwarding entries.

show mfe

show mfe grpaddr=239.0.0.1 mask=255.255.255.255

show mfestats

Displays multicast forwarding entry (MFE) statistics.

Syntax

show mfe

[[grpaddr=] IPAddress

[grpmask=] SubnetMask]

[[srcaddr=] IPAddress

[srcmask=] SubnetMask]

[[type=] {active | negative | both}]

[[stats=] all]

[[rr=] RefreshRate]

Parameters

[[grpaddr=] IPAddress

Specifies the group IP address for the start of the range.

[grpmask=] SubnetMask]

Specifies the subnet mask associated with the group IP address.

[[srcaddr=] IPAddress

Specifies the source IP address of the start of the range.

[srcmask=] SubnetMask]

Specifies the subnet mask associated with the source IP address.

[[type=] {active | negative | both}]

Specifies the type of multicast forwarding entry. The active parameter specifies displaying active MFE only. The negative parameter specifies displaying negative MFE only. The both parameter specifies displaying both active and negative MFE. The default value is both.

[[stats=] all]

Specify all to show all detailed MFE statistics.

[[rr=] RefreshRate]

Specifies the refresh rate for MFE statistics in seconds.

Examples

The following shows two different examples of displaying multicast forwarding entry statistics.

show mfestats

show mfestats grpaddr=239.0.0.1 mask=255.255.255.255

show persistentroutes

Displays information about persistent static routes for the specified interface.

Syntax

show persistentroutes

[name=] InterfaceName

Parameters

[name=] InterfaceName

Specifies, by name, the interface for which to display persistent static route information. If no interface is specified, information for all interfaces is displayed.

Examples

The following shows two different examples of displaying interface information.

show persistentroutes

show persistentroutes name="Local Area Connection"

show preferenceforprotocol

Displays preference levels for all protocols.

Syntax

show preferenceforprotocol

show protocol

Displays all configured IP protocols.

Syntax

show protocol

show rtmdestinations

Displays destinations in the routing table.

Syntax

show rtmdestinations

[[operator=] {matching | shorterthan | longerthan}]

[[dest=] IPAddress

[mask=] SubnetMask]

[[view=] unicast | multicast | both]

[[proto=] autostatic | local | netmgmt | nondod | rip | static]

Parameters

[[operator=] {matching | shorterthan | longerthan}]

Specifies the operator for the destination address. The matching parameter specifies displaying routes matching the specified destination. The shorterthan parameter specifies displaying routes less than the destination. The longerthan parameter specifies displaying routes longer than the destination.

[[dest=] IPAddress

Specifies the address of the destination.

[mask=] SubnetMask]

Specifies the subnet mask for the destination address.

[[view=] unicast | multicast | both]

Specifies the type of traffic viewed. The unicast parameter specifies displaying only routes used for unicast traffic. The multicast parameter specifies displaying only routes used for multicast traffic. The both parameter specifies displaying routes used for both unicast and multicast traffic. The default value is both.

[proto=] autostatic | local | netmgmt | nondod | rip | static]

Specifies displaying routes added by a specific routing protocol. The autostatic parameter displays only autostatic protocol routes. The local parameter displays only local protocol routes. The netmgmt parameter displays only network management protocol routes. The nondod parameter displays only routes not able to use demand-dial. The rip parameter displays only RIP protocol routes. The static parameter displays only static protocol routes.

Examples

The following displays all prefixes in the routing table.

show rtmdestinations

The following displays all prefixes shorter than 10.0.0.1.

show rtmdestinations sh 10.0.0.1

The following displays all prefixes in the 172.0.0.0/8 subtree.

show rtmdestinations lo 172/8

show rtmroutes

Displays routes in the routing table.

Syntax

show rtmroutes

[[operator=] {matching | shorterthan | longerthan}]

[[dest=] IPAddress

[mask=] SubnetMask]

[[view=] unicast | multicast | both]

[[proto=] autostatic | local | netmgmt | nondod | rip | static]

Parameters

[[operator=] {matching | shorterthan | longerthan}]

Specifies the operator for the destination address. The matching parameter specifies displaying routes matching the specified destination. The shorterthan parameter specifies displaying routes less than the destination. The longerthan parameter specifies displaying routes longer than the destination.

[[dest=] IPAddress

Specifies the address of the destination.

[mask=] SubnetMask]

Specifies the subnet mask for the destination address.

[[view=] unicast | multicast | both]

Specifies the type of traffic viewed. The unicast parameter specifies displaying only routes used for unicast traffic. The multicast parameter specifies displaying only routes used for multicast traffic. The both parameter specifies displaying routes used for both unicast and multicast traffic. The default value is both.

[proto=] autostatic | local | netmgmt | nondod | rip | static]

Specifies displaying routes added by a specific routing protocol. The autostatic parameter displays only autostatic protocol routes. The local parameter displays only local protocol routes. The netmgmt parameter displays only network management protocol routes. The nondod parameter displays only routes not able to use demand-dial. The rip parameter displays only RIP protocol routes. The static parameter displays only static protocol routes.

Examples

The following displays all routes in the routing table.

show rtmroutes

The following displays all routes shorter than 10.0.0.1.

show rtmroutes sh 10.0.0.1

The following displays all routes in the 172.0.0.0/8 subtree.

show rtmroutes lo 172/8

show scope

Displays the multicast scopes configured on the router.

Syntax

show scope


Netsh Routing IP Autodhcp Context Commands

The following commands are specific to the routing IP autodhcp context within the Netsh environment.

To view the command syntax, click a command:

  • dump

  • install

  • uninstall

Add commands

  • add exclusion

Delete commands

  • delete exclusion

Set commands

  • set global

  • set interface

Show commands

  • show global

  • show interface

Netsh commands for routing IP autodhcp

The following entries provide details for each command.

dump

Displays the DHCP allocator configuration of a remote access server in script form.

Syntax

dump

Remarks

  • You can dump the contents of the current configuration to a file that can be used to restore altered configuration settings.

Example

The following is the command to save the current configuration as a script in the routingipautodhcp.dmp file.

dump > routingipautodhcp.dmp

add exclusion

Adds an IP address exclusion to the DHCP allocator scope.

Syntax

add exclusion IPAddress

Parameters

IPAddress

Required. Specifies an IP address to exclude from the DHCP allocator scope.

Example

To exclude 10.0.0.1 from the addresses that can be allocated dynamically, type:

add exclusion exclusion=10.0.0.1

delete exclusion

Deletes an IP address previously excluded from the DHCP allocator scope.

Syntax

delete exclusion IPAddress

Parameters

IPAddress

Required. Specifies an IP address already excluded from the DHCP allocator scope.

Example

To delete 10.0.0.1 from the list of excluded addresses that cannot be allocated dynamically, type:

delete exclusion exclusion=10.0.0.1

install

Installs the routing protocol under IP.

Syntax

install

set global

Sets global parameters used to support DHCP allocation.

Syntax

set global

{[[scopenetwork=] IPAddress] | [[scopemask=] SubnetMask] | [[leasetime=] Minutes] | [[loglevel=] {none | error | warn | info}]}

Parameters

[scopenetwork=] IPAddress

Specifies the IP network address for the DHCP allocator scope.

[scopemask=] SubnetMask

Specifies the subnet mask associated with the IP network address for the scope.

[leasetime=] Minutes

Specifies the lease duration time, in minutes.

[loglevel=] {none | error | warn | info}

Specifies which events should be logged. The none parameter specifies that no events related to DHCP allocation should be logged. The error parameter specifies that only errors related to DHCP allocation should be logged. The warn parameter specifies that only warnings related to DHCP allocation should be logged. The info parameter specifies that all events related to DHCP allocation should be logged.

Examples

To set the IP network for DHCP allocation to 10.10.10.0, with an associated scope subnet mask of 255.255.255.0, a lease time of 11520 minutes (8 days), and logging of information for all related events, type:

set global 10.10.10.0 255.255.255.0 11520 info

To adjust only the lease time globally for all scopes on all interfaces to a value of 4320 minutes (3 days), type:

set global leasetime=4320

set interface

Configures DHCP allocator parameters for the specified interface.

Syntax

set interface

[name=] InterfaceName

[mode=] {enable | disable}

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface on which to configure parameters. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[mode=] {enable | disable}

Required. Specifies whether DHCP allocation is enabled or disabled for the interface.

Example

To enable DHCP allocation for interface Local Area Connection, type:

set interface name="Local Area Connection" mode=enable

show global

Displays the DHCP allocator global configuration.

Syntax

show global

The information displayed for this command consists of:

Scope Address

Shows IP address configured for the DHCP allocator scope.

Scope Mask

Shows subnet mask associated with the network IP address.

Lease Time

Shows DHCP lease duration time, in minutes.

Logging Level

Shows the level of logging for events related to DHCP allocation.

show interface

Displays the DHCP allocator configuration for the specified interface.

Syntax

show interface

[name=] InterfaceName

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface for which you want to display information. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

Example

To display the DHCP allocator configuration for interface Local Area Connection, type:

show interface name="Local Area Connection"

uninstall

Removes the routing protocol under IP.

Syntax

uninstall


Netsh Routing IP Dnsproxy Context Commands

The following commands are specific to the routing IP dnsproxy context within the Netsh environment.

To view the command syntax, click a command:

  • dump

  • install

  • uninstall

Set commands

  • set global

  • set interface

Show commands

  • show global

  • show interface

Netsh commands for routing IP dnsproxy

The following entries provide details for each command.

dump

Displays the DNS proxy configuration of a remote access server in script form.

Syntax

dump

Remarks

  • You can dump the contents of the current configuration to a file that can be used to restore altered configuration settings.

Example

The following command saves the current configuration as a script in the routingipdnsproxy.dmp file.

dump > routingipdnsproxy.dmp

set global

Sets global DNS proxy parameters for all routed interfaces.

Syntax

set global

[querytimeout=] Integer

[[dnsmode=] {enable | disable}]

[[loglevel=] {none | error | warn | info}]

Parameters

[querytimeout=] Integer

Required. Specifies a timeout, in seconds, for proxied DNS queries.

[[dnsmode=] {enable | disable}]

Specifies whether DNS proxy operation is enabled or disabled.

[[loglevel=] {none | error| warn| info}]

Specifies which events should be logged. The none parameter specifies that no events related to DNS proxy should be logged. The error parameter specifies that only errors related to DNS proxy should be logged. The warn parameter specifies that only warnings related to DNS proxy should be logged. The info parameter specifies that all events related to DNS proxy should be logged.

Example

To specify that queries should time out after 10 seconds, to enable DNS proxy operation, and to prevent logging of DNS proxy events, type:

set global 10 enable none

install

Installs the routing protocol under IP.

Syntax

install

set interface

Configures DNS proxy parameters for an interface.

Syntax

set interface

[name=] InterfaceName

[[mode=] {enable | disable | default}]

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface for which to configure parameters. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[[mode=] {enable | disable | default}]

Specifies whether DNS proxy is enabled, disabled, or set to use the default for the specified interface. The enable parameter specifies that DNS proxy is enabled. The disable parameter specifies that DNS proxy is disabled. The default parameter specifies that DNS proxy is set according to the default for the interface.

Example

To enable DNS proxy for interface Local Area Connection, type:

set interface name="Local Area Connection" mode=enable

show global

Displays the DNS proxy global configuration.

Syntax

show global

show interface

Displays the DNS proxy configuration for the specified interface.

Syntax

show interface

[name=] InterfaceName

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface for which you want to display information. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

uninstall

Removes the routing protocol under IP.

Syntax

uninstall


Netsh Routing IP IGMP Context Commands

The following commands are specific to the routing IP IGMP context within the Netsh environment.

To view the command syntax, click a command:

  • dump

  • install

  • uninstall

Add commands

  • add interface

Delete commands

  • delete interface

Set commands

  • set interface

  • set global

Show commands

  • show global

  • show grouptable

  • show ifstats

  • show iftable

  • show interface

  • show proxygrouptable

  • show rasgrouptable

Netsh commands for routing IP IGMP

The following entries provide details for each command.

dump

Displays the Internet Group Management Protocol (IGMP) configuration of a remote access server in script form.

Syntax

dump

Remarks

  • You can dump the contents of the current configuration to a file that can be used to restore altered configuration settings.

Example

The following is the command to save the current configuration as a script in the routingipigmp.dmp file.

dump > routingipigmp.dmp

add interface

Configures IGMP on the specified interface.

Syntax

add interface

[name=] InterfaceName

[[igmpprototype=] {igmprtrv1 | igmprtrv2 | igmprtrv3 | igmpproxy}]

[[ifenabled=] {enable | disable}]

[[robustvar=] Integer]

[[genqueryinterval=] Integer]

[[genqueryresptime=] Integer]

[[startupquerycount=] Integer]

[[startupqueryinterval=] Integer]

[[lastmemquerycount=] Integer]

[[lastmemqueryinterval= Integer]

[[accnonrtralertpkts=] {yes | no}]

Parameters

[name=] InterfaceName

Required. Specifies the name of the interface on which you want to configure IGMP. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[[igmpprototype=] {igmprtrv1 | igmprtrv2 | igmprtrv3| igmpproxy}]

Specifies the type of protocol to be configured on the interface. The default type is igmprtrv2.

[[ifenabled=] {enable | disable}]

Specifies whether the protocol you are configuring should be enabled or disabled. The default is enabled.

[[robustvar=]= Integer]

Specifies the robustness variable. The value should be greater than zero (0). The default value is 2.

[[genqueryinterval=] Integer]

Specifies the interval, in seconds, at which general queries should be sent on the interface. The default value is 125 seconds.

[[genqueryresptime=] Integer]

Specifies the maximum response time, in seconds, by which hosts should respond to a general query. The default value is 10 seconds.

[[startupquerycount=] Integer]

Specifies the number of general queries that will be sent during startup. The default value is 2.

[[startupqueryinterval=] Integer]

Specifies the interval, in seconds, between general queries sent during startup. The default value is 31 seconds.

[[lastmemquerycount=] Integer]

Specifies the number of group-specific queries sent when notice of a host leaving the group is received. The default value is 2.

[[lastmemqueryinterval=] Integer]

Specifies the interval, in milliseconds, between group-specific queries. The default value is 1000 milliseconds.

[[accnonrtralertpkts=] {yes | no}]

Specifies whether to accept IGMP packets that might not have the router alert option set. The default is yes.

Example

To modify the default startup query interval to 21 seconds for use with IGMP configuration of the interface named Local Area Connection, type:

add interface "Local Area Connection" startupqueryinterval=21

install

Installs an IGMP router/proxy and sets global logging. Used without parameters, install installs the IGMP router/proxy and specifies that errors related to IGMP are logged but that no other IGMP-related events are logged.

Syntax

install

[[loglevel=] {none | error | warn | info}]

Parameters

[loglevel=] {none | error | warn| info}

Specifies which events should be logged. The none parameter specifies no events related to IGMP should be logged. The error parameter specifies that only errors related to IGMP should be logged. The warn parameter specifies that only warnings related to IGMP should be logged. The info parameter specifies that all events related to IGMP should be logged.

delete interface

Removes an IGMP router or proxy from the specified interface.

Syntax

delete interface

[name=] InterfaceName

Parameters

[name=] InterfaceName

Required. Specifies, by name, an interface from which you want to remove an IGMP router or proxy. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

Example

To remove an IGMP proxy or router from an interface named Local Area connection, type:

delete interface "Local Area Connection"

uninstall

Removes IGMP router/proxy from all interfaces.

Syntax

uninstall

set interface

Changes interface configuration parameters.

Syntax

set interface

[name=] InterfaceName

[[igmpprototype=] {igmprtrv1 | igmprtrv2 | igmprtrv3 | igmpproxy}] [[ifenabled=] {enable | disable}]

[[robustvar=] Integer]

[[genqueryinterval=] Integer]

[[genqueryresptime=] Integer]

[[startupquerycount=] Integer]

[[startupqueryinterval=] Integer]

[[lastmemquerycount=] Integer]

[[lastmemqueryinterval=] Integer]

[[accnonrtralertpkts=] {yes | no}]

Parameters

[name=] InterfaceName

Required. Specifies the name of the interface on which you want to configure IGMP. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[[igmpprototype=] {igmprtrv1 | igmprtrv2 | igmprtrv3 | igmpproxy}]

Specifies the type of protocol to be configured on the interface. The default type is igmprtrv2.

[[ifenabled=] {enable | disable}]

Specifies whether the protocol you are configuring should be enabled or disabled. The default is enabled.

[[robustvar=] Integer]

Specifies the robustness variable. The value should be greater than zero (0). The default value is 2.

[[genqueryinterval=] Integer]

Specifies the interval, in seconds, at which general queries should be sent on the interface. The default value is 125 seconds.

[[genqueryresptime=] Integer]

Specifies the maximum response time, in seconds, by which hosts should respond to a general query. The default value is 10 seconds.

[[startupquerycount=] Integer]

Specifies the number of general queries that will be sent during startup. The default value is 2.

[[startupqueryinterval=] Integer]

Specifies the interval, in seconds, between general queries sent during startup. The default value is 31 seconds.

[[lastmemquerycount=] Integer]

Specifies the number of group-specific queries sent when notice of a host leaving the group is received. The default value is 2.

[[lastmemqueryinterval=] Integer]

Specifies the interval, in milliseconds, between group-specific queries. The default value is 1,000 milliseconds.

[[accnonrtralertpkts=] {yes | no}]

Specifies whether to accept IGMP packets that do not have the router alert option set. The default is to accept those packets.

Example

To modify the default startup query interval to 21 seconds for use with IGMP configuration of an interface named Local Area Connection, type:

set interface "Local Area Connection" startupqueryinterval=21

set global

Sets IGMP global parameters. Used without parameters, set global specifies that warnings are logged but that no other events related to IGMP are logged.

Syntax

set global

[loglevel=] {none | error | warn | info}

Parameters

[loglevel=] {none | error | warn | info}

Required. Specifies which events should be logged. The none parameter specifies that no events related to IGMP should be logged. The error parameter specifies that only errors related to IGMP should be logged. The warn parameter specifies that only warnings related to IGMP should be logged. The info parameter specifies that all events related to IGMP should be logged.

Example

To specify that no events related to IGMP should be logged, type:

set global loglevel=none

show interface

Displays the IGMP configuration of the specified interface. Used without parameters, show interface displays IGMP configuration information for all interfaces.

Syntax

show interface

[name=] InterfaceName

Parameters

[name=] InterfaceName

Specifies, by name, the interface for which you want to display information. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

show global

Displays the global IGMP parameters.

Syntax

show global

show ifstats

Displays IGMP statistics for the specified interface. Used without parameters, show ifstats shows IGMP statistics once for all interfaces.

Syntax

show ifstats

[[index=] Integer]

[[rr=] Integer]

Parameters

[[index=] Integer]

Specifies a number identifying the interface for which you want to display information.

[[rr=] Integer]

Specifies, in seconds, how often you want the information to be refreshed.

Example

To show IGMP statistics every 5 seconds for an interface with an index value of 1001, type:

show ifstats index=1001 rr=5

show iftable

Shows IGMP host groups for a specified interface. Used without parameters, show iftable shows IGMP host groups for all interfaces once.

Syntax

show iftable

[[index=] Integer]

[[rr=] Integer]

Parameters

[[index=] Integer]

Specifies, by index number, the interface for which you want to display information.

[[rr=] Integer]

Specifies, in seconds, how often you want the information to be refreshed.

Example

To show IGMP host groups every 5 seconds for an interface with an index value of 1001, type:

show iftable index=1001 rr=5

show grouptable

Shows the IGMP hosts group table for a multicast group. Used without parameters, show grouptable shows the IGMP hosts group tables once for all multicast groups on all interfaces associated with the router.

Syntax

show grouptable

[[index=] Integer]

[[rr=] Integer]

Parameters

[[index=] Integer]

Specifies, by IP address, the multicast group for which you want to display information.

[[rr=] Integer]

Specifies, in seconds, how often you want the information to be refreshed.

Example

To display the IGMP hosts group table every 5 seconds for an IGMP multicast group identified by the IP address of 192.168.100.239, type:

show grouptable index=192.168.100.239 rr=5

show rasgrouptable

Displays the hosts group table for a remote access client interface. Used without parameters, show rasgrouptable displays the hosts group tables once for all remote access client interfaces.

Syntax

show rasgrouptable

[[index=] IPAddress]

[[rr=] Integer]

Parameters

[[index=] IPAddress]

Specifies, by IP address, the remote access client interface for which you want to display information.

[[rr=] Integer]

Specifies, in seconds, how often you want the information to be refreshed.

Example

To display the hosts group table for a remote access client interface with an IP address of 10.10.1.100 and to refresh the information every five seconds, type:

show rasgrouptable index=10.10.1.100 rr=5

show proxygrouptable

Displays the IGMP hosts group table for an IGMP proxy interface. Used without parameters, show proxygrouptable displays information for all interfaces one time.

Syntax

show proxygrouptable

[[name=] InterfaceName]

[[rr=] Integer]

Parameters

[[name=] InterfaceName]

Specifies, by name, the interface for which you want to display information.

[[rr=] Integer]

Specifies, in seconds, how often you want the information to be refreshed.

Example

To display IGMP hosts group tables for all IGMP proxy interfaces and to refresh the information every five seconds, type:

show proxygrouptable rr=5


Netsh Routing IP NAT Context Commands

The following commands are specific to the routing IP NAT context within the Netsh environment.

To view the command syntax, click a command:

  • dump

  • install

  • uninstall

Add commands

  • add addressmapping

  • add addressrange

  • add ftp

  • add interface

  • add portmapping

Delete commands

  • delete addressmapping

  • delete addressrange

  • delete ftp

  • delete interface

  • delete portmapping

Set commands

  • set global

  • set interface

Show commands

  • show global

  • show interface

Netsh commands for routing IP NAT

The following entries provide details for each command.

dump

Displays the Network Address Translation (NAT) configuration of a remote access server in script form.

Syntax

dump

Remarks

  • You can dump the contents of the current configuration to a file that can be used to restore altered configuration settings.

Example

The following is the command to save the current configuration as a script in the routingipnat.dmp file.

dump > routingipnat.dmp

add addressmapping

Adds an IP address mapping to the Network Address Translation (NAT) address pool for the specified interface.

Syntax

add addressmapping

[name=] InterfaceName

[public=] IPAddress

[private=] IPAddress

[inboundsessions=] {enable | disable}

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface on which you want to use network address translation. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[public=] IPAddress

Required. Specifies the IP address used on a public network.

[private=] IPAddress

Required. Specifies the IP address in the pooled range of addresses available for use on the private network.

[inboundsessions=] {enable | disable}

Required. Specifies whether inbound sessions are enabled or disabled. The enable parameter specifies that inbound sessions are enabled. The disable parameter specifies that inbound sessions are disabled.

Example

To map the public IP address 11.11.11.1 to the private IP address 10.10.10.1 and to disable inbound sessions for this NAT table mapping, type:

add addressmapping name="Local Area Connection" 11.11.11.1 10.10.10.1 disable

add addressrange

Adds an address range to the Network Address Translation (NAT) address pool for the specified interface.

Syntax

add addressrange

[name=] InterfaceName

[start=] IPAddress

[end=] IPAddress

[mask=] SubnetMask

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface to whose address pool you want to add an address range.

[start=] IPAddress

Required. Specifies the starting IP address for the address range.

[end=] IPAddress

Required. Specifies the ending IP address for the address range.

[mask=] SubnetMask

Required. Specifies the IP subnet mask associated with the network range bounded by the start and end IP addresses.

Example

To add an address range to the NAT address pool with addresses 10.10.10.1 to 10.10.10.254 and a subnet mask of 255.255.255.0, type:

add addressrange name="Local Area Connection" 10.10.10.1 10.10.10.254 255.255.255.0

add ftp

Enables the FTP proxy on the Network Address Translation (NAT) server.

Syntax

add ftp

add interface

Configures Network Address Translation (NAT) on the specified interface.

Syntax

add interface

[name=] InterfaceName

[[mode=] {full | addressonly | private}]

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface on which you want to configure NAT. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[[mode=] {full | addressonly | private}]

Specifies whether the interface uses full, addressonly, or private mode. The full parameter specifies full (address and port) translation mode is enabled. The addressonly parameter specifies address-only translation mode is enabled. The private parameter specifies private mode is enabled.

Example

To add NAT with address and port translation enabled on the Local Area Connection interface, type:

add interface "Local Area Connection" full

add portmapping

Adds a protocol port mapping on the Network Address Translation (NAT)-enabled interface.

Syntax

add portmapping

[name=] InterfaceName

[proto=] {tcp | udp}

[publicip=] {IPAddress | 0.0.0.0}

[publicport=] Integer

[privateip=] IPAddress

[privateport=] Integer

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface for which you want to add a port mapping. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[proto=] {tcp | udp}

Required. Specifies whether the protocol type is set to TCP or UDP.

[publicip=] {IPAddress | 0.0.0.0}

Required. Specifies an external IP address on the public network or 0.0.0.0 to indicate any IP address not specified within the private network address range.

[publicport=] Integer

Required. Specifies the public protocol port by using a number from zero to 9999.

[privateip=] IPAddress

Required. Specifies an IP address within the private network range.

[privateport=] Integer

Required. Specifies the private protocol port by using a number from zero to 9999.

Example

To add a port mapping of protocol type tcp, public port 80, private ip 10.0.0.1, private port 80, to any public IP address not specified within the private network address range, type:

add portmapping name="Local Area Connection" tcp 0.0.0.0 80 10.0.0.1 80

delete addressmapping

Deletes an address mapping from the Network Address Translation (NAT) address pool for the specified interface.

Syntax

delete addressmapping

[name=] InterfaceName

[[public=] IPAddress]

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface for which you want to delete an address mapping. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[[public=] IPAddress]

Specifies the IP address to be deleted. If you do not specify an address, all address mappings from the NAT address pool are deleted from the interface.

Example

To delete 11.11.11.1 from the NAT interface address pool, type:

delete addressmapping "Local Area Connection" 11.11.11.1

delete addressrange

Deletes an address range from the Network Address Translation (NAT) address pool for the specified interface.

Syntax

delete addressrange

[InterfaceName=] InterfaceName

[start=] IPAddress

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface from which you want to delete an address range. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[start=] IPAddress

Required. Specifies the starting IP address of the range you want to delete.

Example

To delete an address range from the NAT address pool with address 10.10.10.1, type:

delete addressrange name="Local Area Connection" 10.10.10.1

delete ftp

Disables the FTP proxy on the Network Address Translation (NAT) server.

Syntax

delete ftp

delete interface

Removes Network Address Translation (NAT) from the specified interface.

Syntax

delete interface

[name=] InterfaceName

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface for which you want to remove the use of NAT. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

Example

To remove NAT from the Local Area Connection interface, type:

delete interface "Local Area Connection"

delete portmapping

Deletes a protocol port mapping from the specified Network Address Translation (NAT)-enabled interface.

Syntax

delete portmapping

[name=] InterfaceName

[[proto=] {tcp | udp}]

[publicip=] {IPAddress | 0.0.0.0}]

[[publicport=] Integer]

[[privateip=] IPAddress]

[privateport=] Integer]

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface for which you want to delete a port mapping. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[[proto=] {tcp | udp}]

Specifies the protocol type. The tcp parameter specifies that the protocol type is Transmission Control Protocol. The udp parameter specifies that the protocol type is User Datagram Protocol.

[[publicip=] {IPAddress | 0.0.0.0}]

Specifies an external IP address on the public network or 0.0.0.0 to indicate any IP address not specified within the private network address range.

[[publicport=] Integer]

Specifies the public protocol port by using a number from zero to 9999.

[[privateip=] IPAddress]

Specifies an IP address within the private network range.

[[privateport=] Integer]

Specifies the private protocol port by using a number from zero to 9999.

Example

To remove a port mapping from a NAT-enabled interface, type:

delete portmapping name="Local Area Connection" tcp 0.0.0.0 80

set global

Sets global parameters for Network Address Translation (NAT).

Syntax

set global

{[[tcptimeoutmins=] Integer] | [[udptimeoutmins=] Integer] | [[loglevel=] {none | error | warn | info}]}

Parameters

{[[tcptimeoutmins=] Integer]

Specifies, in minutes, the timeout value for TCP mappings.

[[udptimeoutmins=] Integer]

Specifies, in minutes, the timeout value for UDP mappings.

[[loglevel=] {none | error | warn | info}]}

Specifies which events should be logged. The none parameter specifies that no events related to NAT should be logged. The error parameter specifies that only errors related to NAT should be logged. The warn parameter specifies that only warnings related to NAT should be logged. The info parameter specifies that all events related to NAT should be logged.

Example

To set global NAT parameters to be 1 day (1440 minutes) for TCP mappings timeout, 1 minute for UDP mappings timeout, and NAT error logging, type:

set global tcptimeoutmins=1440 udptimeoutmins=1 loglevel=error

set interface

Configure Network Address Translation (NAT) parameters for the specified interface.

Syntax

set interface

[name=] InterfaceName

[mode=] {full | addressonly | private}

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface for which you want to configure parameters. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[mode=] {full | addressonly | private}

Required. Specifies whether the interface should be enabled for full, addressonly, or private mode. The full parameter specifies full (address and port) translation mode is enabled. The addressonly parameter specifies address-only translation mode is enabled. The private parameter specifies private mode is enabled.

Example

To configure NAT with address and port translation enabled on the Local Area Connection interface, type:

set interface "Local Area Connection" full

show global

Displays Network Address Translation (NAT) global configuration.

Syntax

show global

show interface

Displays Network Address Translation (NAT) configuration for the specified interface. Used without parameters, show interface displays NAT configuration information for all interfaces.

Syntax

show interface

[name=] InterfaceName

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface for which you want to display information. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

install

Installs the routing protocol under IP.

Syntax

install

uninstall

Removes the routing protocol corresponding to the current context.

Syntax

uninstall


Netsh Routing IP Relay Context Commands

The following commands are specific to the routing IP relay context within the Netsh environment.

To view the command syntax, click a command:

  • dump

  • install

  • uninstall

Add commands

  • add dhcpserver

  • add interface

Delete commands

  • delete interface

  • delete dhcpserver

Set commands

  • set global

  • set interface

Show commands

  • show ifbinding

  • show ifconfig

  • show ifstats

  • show interface

  • show global

Netsh commands for routing IP relay

  • The following entries provide details for each command.

dump

Displays the Dynamic Host Configuration Protocol (DHCP) Relay Agent configuration of a remote access server in script form.

Syntax

dump

Remarks

  • You can dump the contents of the current configuration to a file that can be used to restore altered configuration settings.

Example

The following is the command to save the current configuration as a script in the routingiprelay.dmp file.

dump > routingiprelay.dmp

add dhcpserver

Adds a DHCP server to the list of DHCP servers whose messages will be forwarded by DHCP Relay Agent.

Syntax

add dhcpserver

[server=] IPAddress

Parameters

[server=] IPAddress

Required. Specifies, by IP address, the DHCP server you want to add.

Example

To add a DHCP server with the IP address of 10.0.0.1 to the global list of DHCP servers, type:

add dhcpserver 10.0.0.1

add interface

Enables DHCP Relay Agent on the specified interface.

Syntax

add interface

[name=] InterfaceName

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface on which you want to enable DHCP Relay Agent. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

Example

To enable DHCP Relay Agent on the Local Area Connection interface, type:

add interface "Local Area Connection"

delete interface

Disables DHCP Relay Agent on the specified interface.

Syntax

delete interface

[name=] InterfaceName

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface on which you want to disable DHCP Relay Agent. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

Example

To disable DHCP Relay Agent on the Local Area Connection interface, type:

delete interface "Local Area Connection"

delete dhcpserver

Removes a DHCP server from the list of DHCP servers whose messages will be forwarded by DHCP Relay Agent.

Syntax

delete dhcpserver

[server=] IPAddress

Parameters

[server=] IPAddress

Required. Specifies, by IP address, the DHCP server to be deleted.

Example

To delete a DHCP server with the IP address of 10.0.0.1 from the global list of DHCP servers, type:

delete dhcpserver 10.0.0.1

set global

Sets global parameters for DHCP Relay Agent configuration.

Syntax

set global

[loglevel=] {none | error | warn | info}

Parameters

[loglevel=] {none | error | warn | info}

Required. Specifies which DHCP Relay Agent events should be logged. The none parameter specifies that no events related to DHCP Relay Agent should be logged. The error parameter specifies that only errors related to DHCP Relay Agent should be logged. The warn parameter specifies that only warnings related to DHCP Relay Agent should be logged. The info parameter specifies that all events related to DHCP Relay Agent should be logged.

Example

To configure global parameters for DHCP Relay Agent to not log events, type:

set global loglevel=none

set interface

Updates the DHCP Relay Agent configuration on an interface.

Syntax

set interface

[name=] InterfaceName

[relaymode=] {enable | disable}

[[maxhop=] Integer]

[[minsecs=] Integer]

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface on which you want to update the configuration of DHCP Relay Agent. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[relaymode=] {enable | disable}

Required. Specifies whether the DHCP Relay Agent is enabled or disabled. The enable parameter specifies that DHCP Relay Agent should be enabled for this interface. The disable parameter disables DHCP Relay Agent for this interface.

[[maxhop=] Integer]

Specifies the number of hops a DHCP packet can make before it should be dropped and should no longer be relayed.

[[minsecs=] Integer]

Specifies the minimum number of seconds from boot time that must appear in a DHCP packet before it should be sent to a DHCP server in the list of servers whose messages will be forwarded by DHCP Relay Agent.

Example

To update the DHCP Relay Agent configuration on the interface named Local Area Connection with a maximum hop count of 16 and a value of 4 seconds for the minimum seconds from boot time, type:

set interface name="Local Area Connection" enable 16 4

show interface

Displays configuration information for DHCP Relay Agent on the specified interface. Used without parameters, show interface displays DHCP Relay Agent configuration information for all interfaces.

Syntax

show interface

[name=] InterfaceName

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface for which you want to display information. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

show global

Displays DHCP Relay Agent global configuration.

Syntax

show global

The information displayed for this command consists of:

Logging Level

Shows the level of logging for events related to DHCP Relay Agent service.

Max Receive Queue Size

The maximum number of DHCP packets the router can have queued at one time (for all interfaces).

Server Count

The number of DHCP servers in the global list.

show ifconfig

Displays DHCP Relay Agent configuration information for the specified interface. Used without parameters, show ifconfig displays information once for all interfaces where DHCP Relay Agent is enabled.

Syntax

show ifconfig

[[index=] Integer]

[[rr=] Integer]

Parameters

[[index=] Integer]

Specifies, by index value, the interface for which you want to display information.

[[rr=] Integer]

Specifies, in seconds, how often you want the information to be refreshed.

Example

To display the DHCP Relay Agent configuration with a 5-second refresh interval, type:

show ifconfig rr=5

show ifbinding

Displays IP address bindings for the specified interface. Used without parameters, show ifbinding displays information once for all interfaces where DHCP relay is enabled for use.

Syntax

show ifbinding

[[index=] Integer]

[[rr=] Integer]

Parameters

[[index=] Integer]

Specifies, by index value, the interface for which you want to display information.

[[rr=] Integer]

Specifies, in seconds, how often you want the information to be refreshed.

Example

To display the IP address bindings for all interfaces, type:

show ifbinding

show ifstats

Displays DHCP Relay Agent statistics for the specified interface. Used without parameters, show ifstats displays information one time for all interfaces where DHCP relay is enabled for use.

Syntax

show ifstats

[[index=] Integer]

[[rr=] Integer]

Parameters

[[index=] Integer]

Specifies, by index value, the interface for which you want to display information.

[[rr=] Integer]

Specifies, in seconds, how often you want the information to be refreshed.

Example

To display DHCP Relay Agent statistics for all interfaces, type:

show ifstats

install

Installs the routing protocol under IP.

Syntax

install

uninstall

Removes the routing protocol corresponding to the current context.

Syntax

uninstall


Netsh Routing IP RIP Context Commands

The following commands are specific to the routing IP rip context within the Netsh environment.

  • dump

Add commands

  • add acceptfilter

  • add announcefilter

  • add interface

  • add neighbor

  • add peerfilter

Delete commands

  • delete acceptfilter

  • delete announcefilter

  • delete interface

  • delete neighbor

  • delete peerfilter

Set commands

  • set flags

  • set global

  • set interface

Show commands

  • show flags

  • show global

  • show globalstats

  • show ifbinding

  • show ifstats

  • show interface

  • show neighbor

Netsh commands for routing IP RIP

The following entries provide details for each command.

dump

Displays the Routing Information Protocol (RIP) configuration of a remote access server in script form.

Syntax

dump

Remarks

  • You can dump the contents of the current configuration to a file that can be used to restore altered configuration settings.

Example

The following command saves the current configuration as a script in the routingiprip.dmp file.

dump > routingiprip.dmp

add peerfilter

Adds a filter for servers that can be accepted as peers.

Syntax

add peerfilter

[server=] IPAddress

Parameters

[server=] IPAddress

Required. Specifies, by IP address, the peer server whose traffic you want to filter.

Example

To add a server with IP 10.0.0.2 to the list of RIP routers from which announcements will be processed, type:

add peerfilter server=10.0.0.2

add acceptfilter

Adds an acceptance filter for routes received on an interface.

Syntax

add acceptfilter

[name=] InterfaceName

[addr=] IPAddress1IPAddress2

Parameters

[name=] InterfaceName

Required. Specifies, by name, an interface where RIP is available for use. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[addr=] IPAddress1IPAddress2

Required. Specifies an IP address pairing. The first address is for the low IP address; the second address is for the high IP address, which will be used to build the filter.

Example

To add an acceptance filter for an interface named Local Area Connection for an IP range of 10.0.0.2 to 11.1.1.2, type:

add acceptfilter name="Local Area Connection" 10.0.0.2 11.1.1.2

add announcefilter

Adds a filter for routes announced on an interface.

Syntax

add announcefilter

[name=] InterfaceName

[addr=] IPAddress1IPAddress2

Parameters

[name=] InterfaceName

Required. Specifies the name of an interface where RIP is available for use. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[addr=] IPAddress1IPAddress2

Required. Specifies an IP address pairing. The first address is for the low IP address; the second address is for the high IP address, which will be used to build the filter.

Example

To add a filter for routes announced on an interface named Local Area Connection for a range of IP addresses from 10.0.0.2 to 11.1.1.2, type:

add announcefilter name="Local Area Connection" 10.0.0.2 11.1.1.2

add neighbor

Adds a RIP neighbor on an interface.

Syntax

add neighbor

[name=] InterfaceName

[addr=] IPAddress

Parameters

[name=] InterfaceName

Required. Specifies, by name, an interface where RIP is available for use. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[addr=] IPAddress

Required. Specifies the IP address of the RIP neighbor you want to add.

Example

To add a RIP neighbor located at an IP address of 10.0.0.2 for an interface named Local Area Connection, type:

add neighbor "Local Area Connection" 10.0.0.2

add interface

Adds RIP to a specified interface.

Syntax

add interface

[name=] InterfaceName

[[metric=] Integer]

[[updatemode=] {demand | periodic}]

[[announce=] {none | rip1 | rip1compat | rip2}]

[[accept=] {none | rip1 | rip1compat | rip2}]

[[expire=] Integer] [[remove=] Integer]

[[update=] Integer]

[[authmode=] {authnone | authsimplepassword}]

[[tag=] Integer]

[[unicast=] {also | only | disable}]

[[accfiltmode=] {include | exclude | disable}]

[[annfiltmode=] {include | exclude | disable}]

[[password=] Password]

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface on which to add RIP. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[[metric=] Integer]

Specifies a metric value for routes based on this interface.

[[updatemode=] {demand | periodic}]

Specifies when updates will occur. The demand parameter specifies that updates should occur on demand. The periodic parameter specifies that updates should occur at regular intervals.

[[announce=] {none | rip1| rip1compat | rip2}]

Specifies which routes should be announced. The none parameter specifies that all routes should be announced. The rip1 parameter specifies that only RIP version 1 routes should be announced. The rip1compat parameter specifies that announcements should be made in RIP version-compatible mode. The rip2 parameter specifies that only RIP version 2 routes should be announced.

[[accept=] {none | rip1 | rip1compat | rip2}]

Specifies which routes should be accepted. The none parameter specifies that all routes should be accepted. The rip1 parameter specifies that only RIP version 1 routes should be accepted. The rip1compat parameter specifies that routes should be accepted in RIP version-compatible mode. The rip2 parameter specifies that only RIP version 2 routes should be accepted.

[[expire=] Integer]

Specifies, in seconds, the route expiration interval.

[[remove=] Integer]

Specifies, in seconds, the route removal interval.

[[update=] Integer]

Specifies, in seconds, the full update interval.

[[authMode=] {authnone | authsimplepassword}]

Specifies whether authorization should be required. The authnone parameter specifies that no authorization should be required. The authsimplepassword parameter specifies that password authorization should be required.

[[tag=] Integer

Specifies the route tag.

[[unicast=] {also | only | disable}]

Specifies the unicast mode. The also parameter specifies use also unicast mode. The only parameter specifies use only unicast mode. The disable parameter specifies that unicast mode should be disabled.

[[accfiltmode=] {include | exclude | disable}]

Specifies whether acceptance filters should be included or disabled. The include parameter specifies that acceptance filters should be included. The exclude parameter specifies that acceptance filters should not be included. The disable parameter specifies that acceptance filters should be disabled.

[[annfiltmode=] {include | exclude | disable}]

Specifies whether announcement filters should be included or disabled. The include parameter specifies that announcement filters should be included. The exclude parameter specifies that announcement filters should not be included. The disable parameter specifies that announcement filters should be disabled.

[[password=] Password]

Specifies a plaintext password no longer than 16 characters.

Example

To enable and configure RIP on the interface named Local Area Connection using RIP configuration default settings, type:

add interface "Local Area Connection"

delete peerfilter

Deletes a filter for an accepted peer server.

Syntax

delete peerfilter

[server=] IPAddress

Parameters

[server=] IPAddress

Required. Specifies, by IP address, the peer server whose traffic you do not want to filter.

Example

To remove a server with IP 10.0.0.2 from the list of RIP routers from which announcements will be processed, type:

delete peerfilter server=10.0.0.2

delete acceptfilter

Deletes an acceptance filter for routes received on a specified interface.

Syntax

delete acceptfilter

[name=] InterfaceName

[addr=] IPAddress1IPAddress2

Parameters

[name=] InterfaceName

Required. Specifies, by name, an interface where RIP is available for use. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[addr=] IPAddress1IPAddress2

Required. Specifies an IP address pairing. The first address is for the low IP address; the second address is for the high IP address, which will be used to build the filter.

Example

To delete an acceptance filter for the IP ranges of 10.0.0.2 to 11.1.1.2 on an interface named Local Area Connection, type:

delete acceptfilter "Local Area Connection" 10.0.0.2 11.1.1.2

delete announcefilter

Deletes an announcement filter set for an interface.

Syntax

delete announcefilter

[name=] InterfaceName

[addr=] IPAddress1IPAddress2

Parameters

[name=] InterfaceName

Required. Specifies the name of an interface where RIP is available for use. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[addr=] IPAddress1IPAddress2

Required. Specifies an IP address pairing. The first address specifies the low IP address; the second address specifies the high IP address, which will be used to build the filter.

Example

To delete an announcement filter for the IP range 10.0.0.2 to 11.1.1.2 for an interface named Local Area Connection, type:

delete announcefilter "Local Area Connection" 10.0.0.2 11.1.1.2

delete neighbor

Deletes a RIP neighbor from an interface.

Syntax

delete neighbor

[name=] InterfaceNameIPAddress

Parameters

[name=] InterfaceName

Required. Specifies, by name, an interface where RIP is available for use. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

IPAddress

Required. Specifies, by IP address, the RIP neighbor to delete.

Example

To delete a RIP neighbor located at 10.0.0.2 for an interface named Local Area Connection, type:

delete neighbor name="Local Area Connection" 10.0.0.2

delete interface

Removes RIP from the specified interface.

Syntax

delete interface

[name=] InterfaceName

Parameters

[name=] InterfaceName

Required. Specifies, by name, an interface from which you want to remove RIP. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

Example

To remove RIP from the interface named Local Area Connection, type:

delete interface "Local Area Connection"

set interface

Configures RIP on a specified interface.

Syntax

set interface

[name=] InterfaceName

[[metric=] Integer]

[[updatemode=] {demand | periodic}]

[[announce=] {none | rip1 | rip1compat | rip2}]

[[accept=] {none | rip1 | rip1compat | rip2}]

[[expire=] Integer]

[[remove=] Integer]

[[update=] Integer]

[[authmode=] {authnone | authsimplepassword}]

[[tag=] Integer] [[unicast=] {also | only | disable}]

[[accfiltmode=] {include | exclude | disable}]

[[annfiltmode=] {include | exclude | disable}]

[[password=] Password]

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface on which to configure RIP. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[[metric=] Integer]

Specifies a metric value for routes based on this interface.

[[updatemode=] {demand | periodic}]

Specifies when updates should occur. The demand parameter specifies that updates should occur on demand. The periodic parameter specifies that updates should occur at regular intervals.

[[announce=] { none | rip1 | rip1compat | rip2}]

Specifies which routes should be announced. The none parameter specifies that all routes should be announced. The rip1 parameter specifies that only RIP version 1 routes should be announced. The rip1compat parameter specifies that announcements should be made in RIP version-compatible mode. The rip2 parameter specifies that only RIP version 2 routes should be announced.

[[accept=] {none | rip1 | rip1compat| rip2}]

Specifies which routes should be accepted. The none parameter specifies that all routes should be accepted. The rip1 parameter specifies that only RIP version 1 routes should be accepted. The rip1compat parameter specifies that acceptance should occur by using the RIP version-compatible mode. The rip2 parameter specifies that only RIP version 2 routes should be accepted.

[[expire=] Integer]

Specifies, in seconds, how much time should elapse before the route expires.

[[remove=] Integer]

Specifies, in seconds, how much time should elapse before the route is removed.

[[update=] Integer]

Specifies, in seconds, how often full updates occur.

[[authmode=] {authnone | authsimplepassword}]

Specifies whether authorization should be required. The authnone parameter specifies that no authorization should be required. The authsimplepassword parameter specifies that password authorization should be required.

[[tag=] Integer]

Specifies the route tag.

[[unicast=] {also | only | disable}]

Specifies the unicast mode. The also parameter specifies use also unicast mode. The only parameter specifies use only unicast mode. The disable parameter specifies that unicast mode should be disabled.

[[accfiltmode=] {include | exclude | disable}]

Specifies whether acceptance filters should be included. The include parameter specifies that acceptance filters should be included. The exclude parameter specifies that acceptance filters should not be included. The disable parameter specifies that acceptance filters should be disabled.

[[annfiltmode=] {include | exclude | disable}]

Specifies whether announcement filters should be included or disabled. The include parameter specifies that announcement filters should be included. The exclude parameter specifies that announcement filters should not be included. The disable parameter specifies that announcement filters should be disabled.

[[password=] String]

Specifies a plaintext password no longer than 16 characters long.

Example

To modify the RIP configuration on the interface named Local Area Connection, specifying a metric value of 2 and that updates should occur on demand, type:

set interface name="Local Area Connection" metric=2 updatemode=periodic

set flags

Sets RIP-related flags for a specified interface.

Syntax

set flags

[name=] InterfaceName

[flag=]

[clear]

[splithorizon]

[poisonreverse]

[triggeredupdates]

[cleanupupdates]

[accepthostroutes]

[acceptdefaultroutes]

[senddefaultroutes]

[nosubnetsummary]

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface on which to set flags. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[flag=] [clear] [splithorizon] [poisonreverse] [triggeredupdates] [cleanupupdates] [accepthostroutes] [acceptdefaultroutes] [senddefaultroutes] [nosubnetsummary]

Specifies policies for RIP-related flags. The clear parameter specifies that all set RIP flags should be cleared. The splithorizon parameter specifies that RIP for split horizon should be enabled. The poisonreverse parameter specifies that RIP for poison reverse should be enabled. The triggeredupdates parameter specifies that RIP triggered updates should occur. The cleanupupdates parameter specifies that cleanup updates for RIP should occur. The accepthostroutes parameter specifies that host routes should be accepted. The acceptdefaultroutes parameter specifies that default routes should be accepted. The senddefaultroutes parameter specifies that default routes should be sent. The nosubnetsummary parameter specifies that subnet summarization should not occur.

Remarks

  • Multiple flag values can be specified in a comma separated list.

Example

To set RIP-related flags for an interface named Local Area Connection, type:

set flags name="Local Area Connection" splithorizon,accepthostroutes

set global

Sets global RIP parameters.

Syntax

set global

{[[loglevel=] {none | error | warn | info}] | [[mintrig=] Integer] | [[peermode=] {include | exclude | disable}]}

Parameters

{[[loglevel=] {none | error | warn | info}]

Specifies which RIP events should be logged. The none parameter specifies that no RIP events should be logged. The error parameter specifies that only errors related to RIP should be logged. The warn parameter specifies that only warnings related to RIP should be logged. The info parameter specifies that all events related to RIP should be logged.

[[mintrig=] Integer]

Specifies, in minutes, the minimum amount of time that should elapse between triggers.

[[peermode=] { include | exclude | disable}]}

Specifies whether peers should be included and whether peer mode should be disabled. The include parameter specifies that peers should be included. The exclude parameter specifies that peers should not be included. The disable parameter specifies that peer mode should be disabled.

Example

To configure global RIP parameters to specify no RIP event logging, 10 minutes between triggers, and with peer mode disabled, type:

set global none 10 disable

show interface

Shows RIP configuration for the specified interface. Used without parameters, show interface displays configuration information for all interfaces.

Syntax

show interface

[[name=] InterfaceName]

Parameters

[[name=] InterfaceName]

Specifies, by name, the interface whose information you want to display. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

show flags

Displays RIP flags set for a specified interface. Used without parameters, show flags displays information for all interfaces.

Syntax

show flags

[[name=] InterfaceName]

Parameters

[[name=] InterfaceName]

Specifies, by name, the interface for which you want to display information. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

show global

Shows RIP global parameters.

Syntax

show global

show ifstats

Displays RIP statistics for a specified interface. Used without parameters, show ifstats displays information once for all interfaces.

Syntax

show ifstats

[[index=] Integer]

[[rr=] Integer]

Parameters

[[index=] Integer]

Specifies, by index number, the interface for which you want to display information.

[[rr=] Integer]

Specifies, in seconds, how often you want the information to be refreshed.

Remarks

  • To list the index value for each interface, use the show interface command in the Netsh Interface IP context.

Example

To display RIP statistics every 5 seconds for an interface with an index value of 1, type:

show ifstats index=1 rr=5

show ifbinding

Displays RIP interface IP address binding. Used without parameters, show ifbinding displays information once for all interfaces.

Syntax

show ifbinding

[[index=] Integer]

[[rr=] Integer]

Parameters

[[index=] Integer]

Specifies, by index number, the interface for which you want to display information.

[[rr=] Integer]

Specifies, in seconds, how often you want the information to be refreshed.

Remarks

  • To list the index value for each interface, use the show interface command in the Netsh Interface IP context.

Example

To display the bindings every 5 seconds for an interface with an index value of 1, type:

show ifbinding index=1 rr=5

show globalstats

Displays RIP global statistics.

Syntax

show globalstats

[[rr=] Integer]

Parameters

[[rr=] Integer]

Specifies, in seconds, how often you want the information to be refreshed.

Example

To display RIP global statistics which refreshes at the rate of every 5 seconds, type:

show globalstats rr=5

show neighbor

Displays RIP peer statistics.

Syntax

show neighbor

[[index=] Integer]

[[rr=] Integer]

Parameters

[[index=] Integer]

Specifies, by index number, the interface for which you want to display information.

[[rr=] Integer]

Specifies, in seconds, how often you want the information to be refreshed.

Example

To display the bindings for IP address 10.0.0.1 at a refresh rate of every 5 seconds, type:

show neighbor index=10.0.0.1 rr=5


Netsh Routing IP Routerdiscovery Context Commands

The following commands are specific to the routing IP routerdiscovery context within the Netsh environment.

To view the command syntax, click a command:

  • dump

  • uninstall

Add commands

  • add interface

Delete commands

  • delete interface

Set commands

  • set interface

Show commands

  • show interface

Netsh commands for routing IP routerdiscovery

The following entries provide details for each command.

dump

Displays the router discovery configuration of a remote access server in script form.

Syntax

dump

Remarks

  • You can dump the contents of the current configuration to a file that can be used to restore altered configuration settings.

Example

The following is the command to save the current configuration as a script in the routingipdiscovery.dmp file.

dump > routingipdiscovery.dmp

add interface

Configures router discovery for the specified interface.

Syntax

add interface

[name=] InterfaceName

[[disc=] {enable | disable}]

[[minint=] Integer]

[[maxint=] Integer]

[[life=] Integer]

[[level=] Integer]

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface for which you want to configure router discovery. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[[disc=] {enable | disable}]

Specifies whether router discovery should occur on this interface. The enable parameter specifies that router discovery should occur, and the disable parameter specifies that router discovery should not occur.

[[minint=] Integer]

Specifies a minimum interval, in minutes, between when router discovery packets are sent.

[[maxint=] Integer]

Specifies a maximum interval, in minutes, between when router discovery packets are sent.

[[life=] Integer]

Specifies the number of minutes for which a router discovery packet sent from this router or server is valid.

[[level=] Integer]

Specifies a number indicating preference for using this interface as the default gateway. Where multiple interfaces are enabled for router discovery, a higher number used here indicates a higher level of preference.

Remarks

  • When added, router discovery advertisements are sent at random times bounded by the set minimum and maximum intervals.

Example

To enable router discovery for the Local Area Connection interface, specifying a minimum interval of 7 minutes, a maximum interval of 10 minutes, a life of 30 minutes for router discovery packets, and a zero (0) or no preference level, type:

add interface "Local Area Connection" enable 7 10 30 0

set interface

Configures router discovery for the specified interface.

Syntax

set interface

[name=] InterfaceName

[[disc=] {enable | disable}]

[[minint=] Integer]

[[maxint=] Integer]

[[life=] Integer]

[[level=] Integer]

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface for which you want to configure router discovery. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[[disc=] {enable | disable}]

Specifies whether router discovery should occur on this interface. The enable parameter specifies that router discovery should occur, and the disable parameter specifies that router discovery should not occur.

[[minint=] Integer]

Specifies, in minutes, a minimum interval between when router discovery packets are sent.

[[maxint=] Integer]

Specifies, in minutes, a maximum interval between when router discovery packets are sent.

[[life=] Integer]

Specifies, in minutes, how long a router discovery packet sent from this router or server is valid.

[[level=] Integer]

Specifies a number indicating preference for using this interface as the default gateway. A higher number used here specifies a higher level of preference.

Example

To enable router discovery for the Local Area Connection interface, specifying a minimum interval of 7 minutes, a maximum interval of 10 minutes, a life of 30 minutes for router discovery packets, and a zero (0) or no preference level, type:

set interface name="Local Area Connection" enable 7 10 30 0

delete interface

Deletes router discovery configuration for the specified interface.

Syntax

delete interface

[name=] InterfaceName

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface for which you want to delete router-discovery configuration. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

Example

To delete the router-discovery configuration for an interface named Local Area Connection, type:

delete interface name="Local Area Connection"

show interface

Displays the router discovery configuration. Used without parameters, show interface displays information for all interfaces.

Syntax

show interface

[[name=] InterfaceName]

Parameters

[[name=] InterfaceName]

Specifies, by name, the interface for which you want to display information. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

Example

To display router discovery information for an interface named Local Area Connection, type:

show interface name="Local Area Connection"

uninstall

Removes the routing protocol corresponding to the current context.

Syntax

uninstall


Netsh Routing IPv6 Context Commands

The following commands are specific to the routing IPv6 context within the Netsh environment.

To view the command syntax, click a command:

  • dump

Add commands

  • add filter

  • add persistentroute

Delete commands

  • delete filter

  • delete persistentroute

Set commands

  • set filter

  • set persistentroute

Show commands

  • show filter

  • show persistentroute

Netsh commands for routing IPv6

The following entries provide details for each command.

dump

Displays the IPv6 configuration of a remote access server in script form.

Syntax

dump

Remarks

  • You can dump the contents of the current configuration to a file that can be used to restore altered configuration settings.

Example

The following command saves the current configuration as a script in the routingipv6cfg.dmp file.

dump > routingipv6cfg.dmp

add filter

Adds an IPv6 packet filter to a specified interface.

Syntax

add filter

[name=] InterfaceName

[filtertype=] {input | output | dial}

[srcaddr=] IPv6Address

[srcprefixlen=] IPv6PrefixLength

[dstaddr=] IPv6Address

[dstprefixlen=] IPv6PrefixLength

{[proto=] any | [proto=] {tcp | tcp-est | udp} [srcport=] Integer [dstport=] Integer | [proto=] icmp [type=] Integer [code=] Integer}

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface on which to add the filter. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[filtertype=] {input | output | dial}

Specifies the filter type. The input parameter specifies that the filter being modified filters input. The output parameter specifies that the filter being modified filters output. The dial parameter specifies that the filter being modified filters a dial-up connection.

[srcaddr=] IPv6Address

Specifies the source address field of the packet to be filtered.

[srcprefixlen=] IPv6PrefixLength

Specifies the source prefix length of the packet to be filtered. An address and a prefix length of zero (0) means ANY.

[dstaddr=] IPv6Address

Specifies the destination address field of packet to be filtered.

[dstprefixlen=] IPv6PrefixLength

Specifies the destination prefix length of packet to be filtered.

{[proto=] any | [proto=] {tcp | tcp-est | udp}

Specifies the protocol type for the packet to be filtered.

[srcport=] Integer

Specifies the source port field of the packet to be filtered. A value of zero (0) means ANY.

[dstport=] Integer | [proto=] icmp

Specifies the destination port field of packet to be filtered. A value of zero (0) means ANY.

[type=] Integer

Specifies the ICMP type field of the packet to be filtered. A value of 255 means ANY.

[code=] Integer}

Specifies the ICMP code field of the packet to be filtered. A value of 255 means ANY.

Examples

To add an IPv6 packet filter to the interface named Virtual Private Connection, type:

add filter name="Virtual Private Connection" filtertype=input srcaddr=3000:1234:1234:1234::1 srcprefixlen=64 dstaddr=3000:1234:1234:1235::1 dstprefixlen=64 proto=any

add filter "Virtual Private Connection" input 3000:1234:1234:1234::1 64 3000:1234:1234:1235::1 64 any

delete filter

Deletes an IPv6 packet filter from a specified interface.

Syntax

delete filter

[name=] InterfaceName

[filtertype=] {input | output | dial}

[srcaddr=] IPv6Address

[srcprefixlen=] IPv6PrefixLength

[dstaddr=] IPv6Address

[dstprefixlen=] IPv6PrefixLength

{[proto=] any | [proto=] {tcp | tcp-est | udp} [srcport=] Integer [dstport=] Integer | [proto=] icmp [type=] Integer [code=] Integer}

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface on which to add the filter. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[filtertype=] {input | output | dial}

Specifies the filter type. The input parameter specifies that the filter being modified filters input. The output parameter specifies that the filter being modified filters output. The dial parameter specifies that the filter being modified filters a dial-up connection.

[srcaddr=] IPv6Address

Specifies the source address field of the packet to be filtered.

[srcprefixlen=] IPv6PrefixLength

Specifies the source prefix length of the packet to be filtered. An address and a prefix length of zero (0) means ANY.

[dstaddr=] IPv6Address

Specifies the destination address field of packet to be filtered.

[dstprefixlen=] IPv6PrefixLength

Specifies the destination prefix length of packet to be filtered.

{[proto=] any | [proto=] {tcp | tcp-est | udp}

Specifies the protocol type for the packet to be filtered.

[srcport=] Integer

Specifies the source port field of the packet to be filtered. A value of zero (0) means ANY.

[dstport=] Integer | [proto=] icmp

Specifies the destination port field of packet to be filtered. A value of zero (0) means ANY.

[type=] Integer

Specifies the ICMP type field of the packet to be filtered. A value of 255 means ANY.

[code=] Integer}

Specifies the ICMP code field of the packet to be filtered. A value of 255 means ANY.

Example

To add an IPv6 packet filter to the interface named Virtual Private Connection, type:

delete filter name="Virtual Private Connection" filtertype=input srcaddr=3000:1234:1234:1234::1 srcprefixlen=64 dstaddr=3000:1234:1234:1235::1 dstprefixlen=64 proto=any

delete filter "Virtual Private Connection" input 3000:1234:1234:1234::1 64 3000:1234:1234:1235::1 64 any

set filter

Configures the IPv6 packet filter settings for the specified interface.

Syntax

set filter

[name=] InterfaceName

[filtertype=] {input | output | dial}

[action=] IPv6Address

[fragcheck=] IPv6PrefixLength

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface on which to add the filter. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[filtertype=] {input | output | dial}

Specifies the filter type. The input parameter specifies that the filter being modified filters input. The output parameter specifies that the filter being modified filters output. The dial parameter specifies that the filter being modified filters a dial-up connection.

[action=] {drop | forward}

Specifies the action to be taken when a packet does not match any filter. The drop parameter specifies that unmatched packets are dropped. The forward parameter specifies that unmatched packets are forwarded.

[fragcheck=] {enable | disable}

Specifies whether fragment checking is enabled or disabled for input packets.

Example

To set the IPv6 packet filter action for the dial-up connection for the interface named Dial-up Connection, type:

set filter name="Dial-up Connection" filtertype=dial action=forward

show filter

Displays IPv6 packet filter information for the specified interface. Used without parameters, show filter displays configuration information for all interfaces.

Syntax

show filter

[name=] InterfaceName

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface for which you want to remove the use of NAT. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

The information displayed for this command consists of:

Input

Shows information about input filters.

Output

Show information about output filters.

Demand-dial

Shows information about demand-dial filters.

Frag. Check

Shows if fragment checking is enabled or disabled.

Interface

Displays the name of the interface.

add persistentroute

Adds a persistent static route to the specified interface.

Syntax

add persistentroute

[dest=] IPv6Address

[prefixlength=] IPv6PrefixLength

[name=] InterfaceName

[[nhop=] IPv6Address]

[[proto=] static | nondod]

[[metric=] Integer]

Parameters

[dest=] IPv6Address

Required. Specifies the destination IPv6 address for the specified route.

[prefixlength=] IPv6PrefixLength

Specifies the prefix length for the destination address.

[name=] InterfaceName

Required. Specifies the interface where the route is to be added.

[[nhop=] IPv6Address]

Specifies the next hop IPv6 address for the route. For routes over point-to-point interfaces, this value is not needed.

[[proto=] static | nondod]

Specifies one of the following values:

  • static: trigger demand-dial connection (default)

  • nondod: do not trigger demand-dial connection

[[metric=] Integer]

Specifies the metric for the route.

Example

To add a persistent static route to the interface named Local Area Connection, type:

add persistentroute dest=3000:1234:5678::1 prefixlength=48 name="Local Area Connection" proto=static metric=1

delete persistentroute

Deletes a persistent static route from the specified interface.

Syntax

delete persistentroute

[dest=] IPv6Address

[prefixlength=] IPv6PrefixLength

[name=] InterfaceName

[[nhop=] IPv6Address]

Parameters

[dest=] IPv6Address

Required. Specifies the destination IPv6 address for the specified route.

[prefixlength=] IPv6PrefixLength

Specifies the prefix length for the destination address.

[name=] InterfaceName

Required. Specifies the interface where the route is to be added.

[[nhop=] IPv6Address]

Specifies the next hop IPv6 address for the route. For routes over point-to-point interfaces, this value is not required.

Example

To delete a persistent static route from the interface named Local Area Connection, type:

delete persistentroute dest=3000:1234:5678::1 prefixlen=48 name="Local Area Connection"

set persistentroute

Modifies a persistent static route on the specified interface.

Syntax

set persistentroute

[dest=] IPv6Address

[prefixlength=] IPv6PrefixLength

[name=] InterfaceName

[[nhop=] IPv6Address]

[[proto=] static | nondod]

[[metric=] Integer]

Parameters

[dest=] IPv6Address

Required. Specifies the destination IPv6 address for the specified route.

[prefixlength=] IPv6PrefixLength

Specifies the prefix length for the destination address.

[name=] InterfaceName

Required. Specifies the interface where the route is to be added.

[[nhop=] IPv6Address]

Specifies the next hop IPv6 address for the route. For routes over point-to-point interfaces, this value is not required.

[[proto=] static | nondod]

Specifies one of the following values:

  • static: trigger demand-dial connection (default)

  • nondod: do not trigger demand-dial connection

[[metric=] Integer]

Specifies the metric for the route.

Example

To modify a persistent static route on the interface named Local Area Connection, type:

set persistentroute dest=3000:1234:5678::1 prefixlen=48 name="Local Area Connection" proto=static metric=2

show persistentroutes

Displays persistent static routes.

Syntax

show persistentroutes

[name=] InterfaceName

Parameters

[name=] InterfaceName

Specifies the interface where persistent routes are used.

The information displayed for this command consists of:

Prefix

Displays the address prefix and prefix length.

Protocol

Displays the protocol that added the route.

Met

Displays the metric value of the route.

Gateway

Displays the IPv6 address of the next hop used in forwarding.

Interface

Displays the interface that the route points to and uses.

Examples

To display persistent routes for all interfaces, type:

show persistentroutes

To display persistent routes for the interface named Local Area Connection, type:

show persistentroutes name="Local Area Connection"


Netsh Routing IPv6 Relayv6 Context Commands

The following commands are specific to the routing IPv6 relayv6 context within the Netsh environment.

To view the command syntax, click a command:

  • dump

  • install

  • uninstall

Add commands

  • add dhcpserver

  • add interface

Delete commands

  • delete dhcpserver

  • delete interface

Set commands

  • set global

  • set interface

Show commands

  • show global

  • show interface

Netsh commands for routing IPv6 relayv6

  • The following entries provide details for each command.

dump

Displays the Dynamic Host Configuration Protocol (DHCP) Relay Agent configuration of a remote access server in script form.

Syntax

dump

Remarks

  • You can dump the contents of the current configuration to a file that can be used to restore altered configuration settings.

Example

The following command saves the current configuration as a script in the routingipv6relay.dmp file.

dump > routingipv6relay.dmp

add dhcpserver

Adds a DHCPv6 server to the list of DHCP servers whose messages will be forwarded by DHCPv6 Relay Agent.

Syntax

add dhcpserver

[server=] IPv6Address

Parameters

[server=] IPv6Address

Required. Specifies the global IPv6 address of a DHCPv6 server to add to the global list.

Example

To add a DHCPv6 server with the IPv6 address of 3000:1234:1234:1234::1 to the global list of DHCPv6 servers, type:

add dhcpserver 3000:1234:1234:1234::1

add interface

Enables DHCPv6 Relay Agent on the specified interface.

Syntax

add interface

[name=] InterfaceName

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface on which you want to enable DHCPv6 Relay Agent. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

Example

To enable DHCPv6 Relay Agent on the Local Area Connection interface, type:

add interface "Local Area Connection"

delete interface

Disables DHCPv6 Relay Agent on the specified interface.

Syntax

delete interface

[name=] InterfaceName

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface on which you want to disable DHCPv6 Relay Agent. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

Example

To disable DHCPv6 Relay Agent on the Local Area ConnectionVi interface, type:

delete interface "Local Area Connection"

delete dhcpserver

Removes a DHCPv6 server from the list of DHCPv6 servers whose messages will be forwarded by DHCPv6 Relay Agent.

Syntax

delete dhcpserver

[server=] IPv6Address

Parameters

[server=] IPv6Address

Required. Specifies, by IPv6 address, the DHCPv6 server to be removed from the global list.

Example

To delete a DHCPv6 server with the IPv6 address of 3000:1234:1234:1234::1 from the global list of DHCPv6 servers, type:

delete dhcpserver 3000:1234:1234:1234::1

set global

Sets global parameters for DHCPv6 Relay Agent configuration.

Syntax

set global

[loglevel=] {none | error | warn | info}

Parameters

[loglevel=] {none | error | warn | info}

Required. Specifies which DHCPv6 Relay Agent events should be logged. The none parameter specifies that no events related to DHCPv6 Relay Agent should be logged. The error parameter specifies that only errors related to DHCPv6 Relay Agent should be logged. The warn parameter specifies that only warnings related to DHCPv6 Relay Agent should be logged. The info parameter specifies that all events related to DHCPv6 Relay Agent should be logged.

Example

To configure global parameters for DHCPv6 Relay Agent to not log events, type:

set global loglevel=none

set interface

Updates the DHCPv6 Relay Agent configuration on an interface.

Syntax

set interface

[name=] InterfaceName

[relaymode=] {enable | disable}

[[maxhop=] Integer]

[[minsecs=] Integer]

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface on which you want to update the configuration of DHCPv6 Relay Agent. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

[relaymode=] {enable | disable}

Required. Specifies whether the DHCPv6 Relay Agent is enabled or disabled. The enable parameter specifies that DHCPv6 Relay Agent should be enabled for this interface. The disable parameter disables DHCPv6 Relay Agent for this interface.

[[maxhop=] Integer]

Specifies the number of hops a DHCPv6 packet can make before it should be dropped and should no longer be relayed.

[[minsecs=] Integer]

Specifies the minimum number of seconds from boot time that must appear in a DHCPv6 packet before it should be sent to a DHCPv6 server in the list of servers whose messages will be forwarded by DHCPv6 Relay Agent.

Example

To update the DHCPv6 Relay Agent configuration on the interface named Local Area Connection with a maximum hop count of 16 and a value of 3200 seconds for the minimum seconds from boot time, type:

set interface name="Local Area Connection" enable 16 3200

show interface

Displays configuration information for DHCPv6 Relay Agent on the specified interface. Used without parameters, show interface displays DHCPv6 Relay Agent configuration information for all interfaces.

Syntax

show interface

[name=] InterfaceName

Parameters

[name=] InterfaceName

Required. Specifies, by name, the interface for which you want to display information. The InterfaceName parameter must match the name of the interface as specified in Network Connections. If InterfaceName contains spaces, use quotation marks around the text (for example, "Interface Name").

show global

Displays DHCPv6 Relay Agent global configuration.

Syntax

show global

The information displayed for this command consists of:

Logging Level

Shows the level of logging for events related to DHCPv6 Relay Agent service.

Max Receive Queue Size

The maximum number of DHCPv6 packets the router can have queued at one time (for all interfaces).

Server Count

The number of DHCPv6 servers in the global list.

install

Installs the routing protocol corresponding to the current context.

Syntax

install

uninstall

Removes the routing protocol corresponding to the current context.

Syntax

uninstall


Netsh Commands for Windows Firewall

The Netsh commands for Windows Firewall provide a command-line alternative to the capabilities of the Windows Firewall Control Panel utility. By using the Netsh firewall commands, you can configure and view Windows Firewall exceptions and configuration settings.

Important
The firewall context of the netsh command-line tool is provided only for backwards-compatibility with earlier versions of Windows. The firewall context works on computers that are running Microsoft® Windows Vista® and Windows Server® 2008, but it does not allow you to manage or interact with any of the firewall features that are new to Windows Vista or Windows Server 2008. This context does not allow you to work remotely on a computer to directly configure its firewall.

Microsoft recommends that you use the advfirewall context unless you are using this tool in a mixed environment and must maintain backwards-compatibility with earlier versions of Windows. To use the new firewall features included with Windows Vista and Windows Server 2008, you must use the advfirewall context instead. For more information, see Netsh Commands for Windows Firewall with Advanced Security.

We recommend that you do not use this context on a computer that is running Windows Vista or Windows Server 2008, because by using it you can create and modify firewall rules only for the domain and private profiles. Earlier versions of Windows only supported a domain and standard profile. On Windows Vista or Windows Server 2008, standard maps to the private profile and domain continues to map to the domain profile. Rules for the public profile can only be manipulated when the computer is actually attached to a public network and the command is run against the "current" profile.

You can run these commands from within the netsh tool at the netsh firewall> prompt.

For these commands to work at a standard Windows command prompt, you must preface each command with netsh firewall, followed by the specific command and parameters as they appear in the syntax below.

Note
If User Account Control is enabled on your computer and you want to run any netsh firewall command that changes the firewall configuration, you must run the command from a command prompt that was started with the Run as administrator option. If you try to change the firewall state without having administrator permissions available to the command-line tool, it fails with the message "The requested operation requires elevation."

For more information about netsh, see Netsh Overview and Enter a Netsh Context.

Netsh firewall

The following sections describe each command and its syntax.

  • add allowedprogram

  • set allowedprogram

  • delete allowedprogram

  • set icmpsetting

  • set multicastbroadcastresponse

  • set notifications

  • set logging

  • set opmode

  • add portopening

  • set portopening

  • delete portopening

  • set service

  • show commands

  • reset

Note
In earlier versions of Windows, many of these command accepted a parameter called interface. This parameter is not supported in the firewall context in Windows Vista or Windows Server 2008.

add allowedprogram

Adds a program-based exception to the firewall.

Syntax

add allowedprogram [ program = ] PathAndFileName [ name = ] ProgramName [ [ mode = ] { enable | disable } ] [ [ scope = ] { all | subnet | custom } ] [ [ addresses = ] { IPAddress | IPRange | Subnet | localsubnet }[,…] ] [ [ profile = ] { current | domain | standard | all } ]

Parameters

[ program = ] PathAndFileName

Required. The path and file name of the program to be added to the firewall exception list. If the path or file name includes spaces, then you must use quotation marks around the path and file name.

[ name = ] ProgramName

Required. Friendly name of the program to be added to the list. This value is displayed in the Firewall control panel exception list.

[ [ mode = ] { enable | disable } ]

Specifies whether this exception is currently applied and active on the local computer. The default value is enable.

[ [ scope = ] { all | subnet | custom } ]

Specifies the scope of the allowed network traffic from remote computers. all indicates that traffic is allowed from any computer, including those on the Internet. subnet indicates that traffic is allowed from computers on the local computer's subnet only. custom indicates that traffic is allowed from only those computers whose IP address matches the addresses parameter. The default value is all.

[ [ addresses = ] { IPAddress | IPRange | Subnet | localsubnet }[,…] ]

Specifies a custom list of addresses for the scope=custom parameter. Each entry can be:

  • An IPv4 or IPv6 address. For example, 192.168.0.15.

  • An IPv4 or IPv6 range with start and end addresses separated by a '-'. For example, 192.168.0.1-192.168.0.50.

  • A subnet indicated by the subnet address and subnet mask separated by a '/'. For example, 192.168.0.0/255.255.255.0.

  • A subnet indicated by the subnet address and a subnet prefix separated by a '/'. For example, 10.1.0.0/16.

  • The keyword localsubnet, which includes all addresses that are on the local computer's current subnet.

Multiple entry types can be combined on a command line by separating them with commas: 172.16.0.0/16, 10.0.0.0/255.0.0.0, 12AB:0000:0000:CD30::/60, localsubnet

[ [ profile = ] { current | domain | standard | all } ]

Specifies the firewall profile to which the command applies. The firewall profile is determined by the detected network location types accessible through the computer's network adapters.

  • current specifies that the command applies to the profile that is currently active on the computer.

  • domain specifies that the command applies only to the domain profile.

  • standard specifies that the command applies only to the private profile.

  • all specifies that the command applies to all profiles except the private profile.

Remarks

  • You must specify scope=custom to specify addresses. If scope=custom is used, then addresses cannot be blank.

  • To specify the profile associated with the public network location type, you must specify profile=current when the computer is attached to a public network.

  • The addresses parameter cannot contain an unspecified IPv6 address, a loopback address, or a multicast address.

Examples

Each example must be entered as a single command line. The examples may be displayed on multiple lines below for space reasons.

add allowedprogram "C:\My App\MyApp.exe" "My Application" enable

add allowedprogram "C:\My App\MyApp.exe" "My Application" enable custom 157.60.0.1,172.16.0.0/16,12AB:0000:0000:CD30::/60,localsubnet

set allowedprogram

Modifies the settings of an existing program-based exception.

Syntax

set allowedprogram [ program = ] PathAndFileName [ [ name = ] ProgramName ] ] [ [ mode = ] { enable | disable } ] [ [ scope = ] { all | subnet | custom } ] [ [ addresses = ] { IPAddress | IPRange | Subnet | localsubnet }[,…] ] [ [ profile = ] { current | domain | standard | all } ]

Parameters

[ program = ] PathAndFileName ]

Required. The path and file name of the program whose exception you want to modify. If the path or file name includes spaces, then you must use quotation marks around the path and file name.

[ [ name = ] ProgramName ]

Friendly name of the program to be added to the list. This value is displayed in the Firewall control panel exception list.

[ [ mode = ] { enable | disable } ]

Specifies whether this exception is currently applied and active on the local computer.

[ [ scope = ] { all | subnet | custom } ]

Specifies the scope of the allowed network traffic from remote computers. all indicates that traffic is allowed from any computer, including those on the Internet. subnet indicates that traffic is allowed from computers on the local computer's subnet only. custom indicates that traffic is allowed from only those computers whose IP address matches the addresses parameter.

[ [ addresses = ] { IPAddress | IPRange | Subnet | localsubnet }[,…] ]

Specifies a custom list of addresses for the scope=custom parameter. Each entry can be:

  • An IPv4 or IPv6 address. For example, 192.168.0.15.

  • An IPv4 or IPv6 range with start and end addresses separated by a '-'. For example, 192.168.0.1-192.168.0.50.

  • A subnet indicated by the subnet address and subnet mask separated by a '/'. For example, 192.168.0.0/255.255.255.0.

  • A subnet indicated by the subnet address and a subnet prefix separated by a '/'. For example, 10.1.0.0/16.

  • The keyword localsubnet, which includes all addresses that are on the local computer's current subnet.

Multiple entry types can be combined on a command line by separating them with commas: 172.16.0.0/16, 10.0.0.0/255.0.0.0, 12AB:0000:0000:CD30::/60, localsubnet

[ [ profile = ] { current | domain | standard | all } ]

Specifies the firewall profile to which the command applies. The profile is determined by the detected network location types accessible through the computer's network adapters.

  • current specifies that the command applies to the profile that is currently active on the computer.

  • domain specifies that the command applies only to the domain profile.

  • standard specifies that the command applies only to the private profile.

  • all specifies that the command applies to all profiles except the private profile.

The default value is current.

Remarks

  • You must specify at least one parameter other than program.

  • You must specify scope=custom to specify addresses. If scope=custom is used, then addresses cannot be blank.

  • To specify the profile associated with the public network location type, you must specify profile=current when the computer is attached to a public network.

  • The addresses parameter cannot contain an unspecified IPv6 address, a loopback address, or a multicast address.

Examples

Each example must be entered as a single command line. The examples may be displayed on multiple lines below for space reasons.

set allowedprogram "C:\My App\MyApp.exe" "My Application" enable

set allowedprogram "C:\My App\MyApp.exe" "My Application" enable custom 157.60.0.1,172.16.0.0/16,10.0.0.0/255.0.0.0,localsubnet

set allowedprogram program="C:\My App\MyApp.exe" name=MyApp mode=enable scope=custom addresses=157.60.0.1,172.16.0.0/16,10.0.0.0/255.0.0.0,localsubnet

delete allowedprogram

Deletes an existing program-based exception.

Syntax

delete allowedprogram [ program = ] PathAndFileName [ [ profile = ] { current | domain | standard | all } ]

Parameters

[ program = ] PathAndFileName

Required. The path and file name of the program to be deleted from the firewall exception list.

[ [ profile = ] { current | domain | standard | all } ]

Specifies the firewall profile to which the command applies. The profile is determined by the detected network location types accessible through the computer's network adapters.

  • current specifies that the command applies to the profile that is currently active on the computer.

  • domain specifies that the command applies only to the domain profile.

  • standard specifies that the command applies only to the private profile.

  • all specifies that the command applies to all profiles except the private profile.

The default value is current.

Remarks

  • To specify the profile associated with the public network location type, you must specify profile=current when the computer is attached to a public network.

Examples

Each example must be entered as a single command line. The examples may be displayed on multiple lines below for space reasons.

delete allowedprogram C:\MyApp\MyApp.exe

delete allowedprogram program = C:\MyApp\MyApp.exe profile=all

set icmpsetting

Specifies the types of ICMP traffic that are permitted through the firewall.

Syntax

set icmpsetting [ type = ] { 2-5 | 8-9 | 11-13 | 17 | all } [ [ mode = ] { enable | disable} ] [ [ profile = ] { current | domain | standard | all } ]

Parameters

[ type = ] { 2-5 | 8-9 | 11-13 | 17 | all }

Required. The type of ICMP traffic to allow. The value must be one of the following ICMP message types:

  • 2 - Outbound packet too big.

  • 3 - Outbound destination unreachable.

  • 4 - Outbound source quench.

  • 5 - Redirect.

  • 8 - Inbound echo request (ping).

  • 9 - Inbound router request.

  • 11 - Outbound time exceeded.

  • 12 - Outbound parameter problem.

  • 13 - Inbound timestamp request.

  • 17 - Inbound mask request.

  • all - All of the above types.

[ [ mode = ] { enable | disable} ]

Specifies whether this exception is currently applied and active on the local computer. The default value is enable.

[ [ profile = ] { current | domain | standard | all } ]

Specifies the firewall profile to which the command applies. The profile is determined by the detected network location types accessible through the computer's network adapters.

  • current specifies that the command applies to the profile that is currently active on the computer.

  • domain specifies that the command applies only to the domain profile.

  • standard specifies that the command applies only to the private profile.

  • all specifies that the command applies to all profiles except the private profile.

The default value is current.

Remarks

  • To specify the profile associated with the public network location type, you must specify profile=current when the computer is attached to a public network.

Examples

Each example must be entered as a single command line. The examples may be displayed on multiple lines below for space reasons.

set icmpsetting 8 enable all

set icmpsetting type=all mode=disable

set multicastbroadcastresponse

Specifies whether or not responses to a multicast or broadcast request are allowed through the firewall.

Syntax

set multicastbroadcastresponse [ mode = ] { enable | disable} [ [ profile = ] { current | domain | standard | all } ]

Parameters

[ mode = ] { enable | disable}

Required. Specifies whether to enable or disable responses to multicast or broadcast traffic. The default value is enable.

[ [ profile = ] { current | domain | standard | all } ]

Specifies the firewall profile to which the command applies. The profile is determined by the detected network location types accessible through the computer's network adapters.

  • current specifies that the command applies to the profile that is currently active on the computer.

  • domain specifies that the command applies only to the domain profile.

  • standard specifies that the command applies only to the private profile.

  • all specifies that the command applies to all profiles except the private profile.

The default value is current.

Remarks

  • To specify the profile associated with the public network location type, you must specify profile=current when the computer is attached to a public network.

Examples

Each example must be entered as a single command line. The examples may be displayed on multiple lines below for space reasons.

set multicastbroadcastresponse enable

set multicastbroadcastresponse mode=enable profile=all

set notifications

Specifies whether the firewall displays a pop-up notification to the user when a program attempts to listen on a port.

Syntax

set notifications [ mode = ] { enable | disable} [ [ profile = ] { current | domain | standard | all } ]

Parameters

[ mode = ] { enable | disable}

Required. Specifies whether to enable or disable responses to multicast or broadcast traffic.

[ [ profile = ] { current | domain | standard | all } ]

Specifies the firewall profile to which the command applies. The profile is determined by the detected network location types accessible through the computer's network adapters.

  • current specifies that the command applies to the profile that is currently active on the computer.

  • domain specifies that the command applies only to the domain profile.

  • standard specifies that the command applies only to the private profile.

  • all specifies that the command applies to all profiles except the private profile.

The default value is current.

Remarks

  • To specify the profile associated with the public network location type, you must specify profile=current when the computer is attached to a public network.

Examples

Each example must be entered as a single command line. The examples may be displayed on multiple lines below for space reasons.

set notifications enable

set notifications disable

set notifications mode=enable profile=current

set logging

Specifies whether the firewall writes information to a log file, and what details are included. This command only affects the currently active profile.

Syntax

set logging [ [ filelocation = ] PathAndFileName ] [ [ maxfilesize = ] Integer ] [ [ droppedpackets = ] { enable | disable } ] [ [ connections = ] { enable | disable } ]

Parameters

[ [ filelocation = ] PathAndFileName ]

Specifies the path and file name of the file to which the firewall writes its log. The default value is %windir%\pfirewall.log.

[ [ maxfilesize = ] Integer ]

Specifies the maximum file size in kilobytes. Must be an integer value from 1 to 32767. The default value is 4096.

[ [ droppedpackets = ] { enable | disable } ]

Specifies whether to include an entry for each packet dropped by the firewall. The default value is disable.

[ [ connections = ] { enable | disable } ] ]

Specifies whether to include an entry for each successful connection. The default value is disable.

Remarks

  • At least one parameter must be specified.

Examples

Each example must be entered as a single command line. The examples may be displayed on multiple lines below for space reasons.

set logging enable enable

set logging 4096 enable disable

set logging c:\mylogs\mylog.log 4096 enable enable

set opmode

Specifies the operating mode of Windows Firewall.

Syntax

set opmode [ mode = ] { enable | disable } [ [ exceptions = ] { enable | disable } ] [ [ profile = ] { current | domain | standard | all } ]

Parameters

[ mode = ] { enable | disable}

Required. Specifies whether to turn the firewall on or off.

[ [ exceptions = ] { enable | disable } ]

Specifies whether the firewall uses any currently defined port and program exceptions that are enabled. If exceptions=disable, then all enabled port and program exceptions are ignored. Default is enable.

[ [ profile = ] { current | domain | standard | all } ]

Specifies the firewall profile to which the command applies. The profile is determined by the detected network location types accessible through the computer's network adapters.

  • current specifies that the command applies to the profile that is currently active on the computer.

  • domain specifies that the command applies only to the domain profile.

  • standard specifies that the command applies only to the private profile.

  • all specifies that the command applies to all profiles except the private profile.

The default value is current.

Remarks

  • To specify the profile associated with the public network location type, you must specify profile=current when the computer is attached to a public network.

Examples

Each example must be entered as a single command line. The examples may be displayed on multiple lines below for space reasons.

set opmode enable

set opmode mode=enable exceptions=enable

add portopening

Creates a port-based exception.

Syntax

add portopening [ protocol = ] { tcp | udp | all } [ port = ] Integer [ name = ] ExceptionName [ [ mode = ] { enable | disable } ] [ [ scope = ] all | subnet | custom } ] [ [ addresses = ] addresses ] [ [ profile = ] current | domain | standard | all } ]

Parameters

[ protocol = ] { tcp | udp | all }

Required. Specifies whether the port number refers to TCP, UDP, or both.

[ port = ] Integer

Required. Specifies the port number to be excepted. Must be an integer value from 1 to 65535. Only a single value can be specified and port ranges are not supported.

[ name = ] ExceptionName

Required. Specifies the name of the exception. This value is displayed in the Firewall control panel exception list.

[ [ mode = ] { enable | disable } ]

Specifies whether this exception is currently applied and active on the local computer.

[ scope = ] { all | subnet | custom }

Specifies the scope of the allowed network traffic from remote computers. all indicates that traffic is allowed from any computer, including those on the Internet. subnet indicates that traffic is allowed from computers on the local computer's subnet only. custom indicates that traffic is allowed from only those computers whose IP address matches the addresses parameter. The default value is all.

[ addresses = ] { IPAddress | IPRange | Subnet | localsubnet }[,…]

Specifies a custom list of addresses for the scope=custom parameter. Each entry can be:

  • An IPv4 or IPv6 address. For example, 192.168.0.15.

  • An IPv4 or IPv6 range with start and end addresses separated by a '-'. For example, 192.168.0.1-192.168.0.50.

  • A subnet indicated by the subnet address and subnet mask separated by a '/'. For example, 192.168.0.0/255.255.255.0.

  • A subnet indicated by the subnet address and a subnet prefix separated by a '/'. For example, 10.1.0.0/16.

  • The keyword localsubnet, which includes all addresses that are on the local computer's current subnet.

Multiple entry types can be combined on a command line by separating them with commas: 172.16.0.0/16, 10.0.0.0/255.0.0.0, 12AB:0000:0000:CD30::/60, localsubnet

[ profile = ] { current | domain | standard | all }

Specifies the firewall profile to which the command applies. The profile is determined by the detected network location types accessible through the computer's network adapters.

  • current specifies that the command applies to the profile that is currently active on the computer.

  • domain specifies that the command applies only to the domain profile.

  • standard specifies that the command applies only to the private profile.

  • all specifies that the command applies to all profiles except the private profile.

The default value is current.

Remarks

  • You must specify scope=custom to specify addresses. If scope=custom is used, then addresses cannot be blank.

  • To specify the profile associated with the public network location type, you must specify profile=current when the computer is attached to a public network.

  • The addresses parameter cannot contain an unspecified IPv6 address, a loopback address, or a multicast address.

Examples

Each example must be entered as a single command line. The examples may be displayed on multiple lines below for space reasons.

add portopening tcp 80 MyWebPort

add portopening udp 500 "IKE Exception" enable all

add portopening all 53 DNS enable custom 157.60.0.1,172.16.0.0/16,10.0.0.0/255.0.0.0,localsubnet

set portopening

Modifies the settings of an existing port-based exception.

Syntax

set portopening [ protocol = ] { tcp | udp | all } [ port = ] Integer [ [ name = ] ExceptionName ] ] [ [ mode = ] { enable | disable } ] [ [ scope = ] all | subnet | custom } ] [ [ addresses = ] addresses ] [ [ profile = ] current | domain | standard | all } ]

Parameters

[ protocol = ] { tcp | udp | all }

Required. Specifies whether the port number refers to TCP, UDP, or both.

[ port = ] Integer

Required. Specifies the port number of the exception to be modified. Must be an integer value from 1 to 65535. Only a single value can be specified and port ranges are not supported.

[ [ name = ] ExceptionName ]

Specifies the name of the exception. This value is displayed in the Firewall control panel exception list.

[ [ mode = ] { enable | disable } ]

Specifies whether this exception is currently applied and active on the local computer.

[ scope = ] { all | subnet | custom }

Specifies the scope of the allowed network traffic from remote computers. all indicates that traffic is allowed from any computer, including those on the Internet. subnet indicates that traffic is allowed from computers on the local computer's subnet only. custom indicates that traffic is allowed from only those computers whose IP address matches the addresses parameter.

[ addresses = ] { IPAddress | IPRange | Subnet | localsubnet }[,…]

Specifies a custom list of addresses for the scope=custom parameter. Each entry can be:

  • An IPv4 or IPv6 address. For example, 192.168.0.15.

  • An IPv4 or IPv6 range with start and end addresses separated by a '-'. For example, 192.168.0.1-192.168.0.50.

  • A subnet indicated by the subnet address and subnet mask separated by a '/'. For example, 192.168.0.0/255.255.255.0.

  • A subnet indicated by the subnet address and a subnet prefix separated by a '/'. For example, 10.1.0.0/16.

  • The keyword localsubnet, which includes all addresses that are on the local computer's current subnet.

Multiple entry types can be combined on a command line by separating them with commas: 172.16.0.0/16, 10.0.0.0/255.0.0.0, 12AB:0000:0000:CD30::/60, localsubnet

[ profile = ] { current | domain | standard | all }

Specifies the firewall profile to which the command applies. The profile is determined by the detected network location types accessible through the computer's network adapters.

  • current specifies that the command applies to the profile that is currently active on the computer.

  • domain specifies that the command applies only to the domain profile.

  • standard specifies that the command applies only to the private profile.

  • all specifies that the command applies to all profiles except the private profile.

Remarks

  • You must specify at least one parameter other than port and protocol.

  • You must specify scope=custom to specify addresses. If scope=custom is used, then addresses cannot be blank.

  • To specify the profile associated with the public network location type, you must specify profile=current when the computer is attached to a public network.

  • The addresses parameter cannot contain an unspecified IPv6 address, a loopback address, or a multicast address.

Examples

Each example must be entered as a single command line. The examples may be displayed on multiple lines below for space reasons.

set portopening tcp 80 "My Web Port"

set portopening udp 500 "IKE Exception" enable all

set portopening all 53 "DNS Exception" enable custom 157.60.0.1,172.16.0.0/16,10.0.0.0/255.0.0.0,localsubnet

delete portopening

Deletes an existing port-based exception.

Syntax

delete portopening

[ protocol = ] { tcp | udp | all } [ port = ] Integer [ [ profile = ] current | domain | standard | all } ]

Parameters

[ protocol = ] { tcp | udp | all }

Required. Specifies whether the port number refers to TCP, UDP, or both.

[ port = ] Integer

Required. Specifies the port number to be excepted. Must be an integer value from 1 to 65535.

[ profile = ] { current | domain | standard | all }

Specifies the firewall profile to which the command applies. The profile is determined by the detected network location types accessible through the computer's network adapters.

  • current specifies that the command applies to the profile that is currently active on the computer.

  • domain specifies that the command applies only to the domain profile.

  • standard specifies that the command applies only to the private profile.

  • all specifies that the command applies to all profiles except the private profile.

The default value is current.

Remarks

  • To specify the profile associated with the public network location type, you must specify profile=current when the computer is attached to a public network.

Examples

Each example must be entered as a single command line. The examples may be displayed on multiple lines below for space reasons.

delete portopening tcp 80

delete portopening protocol=all port=25

set service

Enables or disables the pre-defined file and printer sharing, remote administration, remote desktop, and UPnP exceptions.

Syntax

set service [ type = ] { fileandprint | remoteadmin | remotedesktop | upnp | all } [ [ mode = ] { enable | disable } ] [ [ scope = ] { all | subnet | custom } ] [ [ addresses = ] { IPAddress | IPRange | Subnet | localsubnet }[,…] ] [ [ profile = ] { current | domain | standard | all } ]

Parameters

[ type = ] { fileandprint | remoteadmin | remotedesktop | upnp | all }

Required. Specifies the service whose pre-defined rules are enabled or disabled. The value must be one of the following:

  • fileandprint. The file and printer sharing service.

  • remoteadmin. The ability to remotely administer a computer running Windows.

  • remotedesktop. The ability to use a Terminal Services client such as Remote Desktop.

  • upnp. Universal Plug-and-Play protocol for networked devices.

  • all. All of the above services.

[ [ mode = ] { enable | disable } ]

Specifies whether this exception is currently applied and active on the local computer. The default value is enable.

[ [ scope = ] { all | subnet | custom } ]

Specifies the scope of the allowed network traffic from remote computers. all indicates that traffic is allowed from any computer, including those on the Internet. subnet indicates that traffic is allowed from computers on the local computer's subnet only. custom indicates that traffic is allowed from only those computers whose IP address matches the addresses parameter.

[ [ addresses = ] { IPAddress | IPRange | Subnet | localsubnet }[,…] ]

Specifies a custom list of addresses for the scope=custom parameter. Each entry can be:

  • An IPv4 or IPv6 address. For example, 192.168.0.15.

  • An IPv4 or IPv6 range with start and end addresses separated by a '-'. For example, 192.168.0.1-192.168.0.50.

  • A subnet indicated by the subnet address and subnet mask separated by a '/'. For example, 192.168.0.0/255.255.255.0.

  • A subnet indicated by the subnet address and a subnet prefix separated by a '/'. For example, 10.1.0.0/16.

  • The keyword localsubnet, which includes all addresses that are on the local computer's current subnet.

Multiple entry types can be combined on a command line by separating them with commas: 172.16.0.0/16, 10.0.0.0/255.0.0.0, 12AB:0000:0000:CD30::/60, localsubnet

[ [ profile = ] { current | domain | standard | all } ]

Specifies the firewall profile to which the command applies. The profile is determined by the detected network location types accessible through the computer's network adapters.

  • current specifies that the command applies to the profile that is currently active on the computer.

  • domain specifies that the command applies only to the domain profile.

  • standard specifies that the command applies only to the private profile.

  • all specifies that the command applies to all profiles except the private profile.

The default value is current.

Remarks

  • You must specify scope=custom to specify addresses. If scope=custom is used, then addresses cannot be blank.

  • To specify the profile associated with the public network location type, you must specify profile=current when the computer is attached to a public network.

  • The addresses parameter cannot contain an unspecified IPv6 address, a loopback address, or a multicast address.

Examples

Each example must be entered as a single command line. The examples may be displayed on multiple lines below for space reasons.

set service fileandprint

set service remoteadmin enable subnet

set service type=remotedesktop mode=enable scope=custom addresses=157.60.0.1,172.16.0.0/16,10.0.0.0/255.0.0.0,localsubnet

show commands

The following show commands are used to display the current configuration:

Note
The show command cannot be used to see the list of exceptions for the public profile, even if the public profile is the current profile. To see the list of exceptions for the public profile, use the Windows Firewall with Advanced Security MMC snap-in, and use the Filter by Profile option in the Actions pane.

  • show allowedprogram [ [ verbose = ] { enable | disable } ]

    Displays the current list of program exceptions for the domain and standard profiles. Use the parameter verbose=enable to see additional details.

  • show config [ [ verbose = ] { enable | disable } ]

    Displays the local configuration information for the domain and standard profiles, including the output of all other show commands. Use parameter verbose=enable to see additional details.

  • show currentprofile

    Displays the current profile in use for the network location type.

    Note
    If the current profile is the public profile, then this command shows the standard profile.

  • show icmpsetting [ [ verbose = ] { enable | disable } ]

    Displays the ICMP settings. Use parameter verbose=enable to see additional details.

  • show logging

    Displays the current logging settings.

    Note
    If the current profile is the public profile, then this command shows the standard profile.

  • show multicastbroadcastresponse

    Displays multicast/broadcast response settings for each profile.

  • show notifications

    Displays whether the firewall displays pop-up notifications for each profile.

  • show opmode

    Displays the operational mode for the firewall for each profile.

  • show portopening

    Displays the current list of port exceptions for each profile. Use parameter verbose=enable to see additional details.

  • show service

    Displays the service configuration for each profile. Use parameter verbose=enable to see additional details.

  • show state

    Displays the current state information for the firewall. Use parameter verbose=enable to see additional details.

reset

Resets the configuration of Windows Firewall to default settings. All manually configured changes are lost. There are no parameters for the reset command.


Netsh Commands for Windows Firewall with Advanced Security

Netsh advfirewall is a command-line tool for Windows Firewall with Advanced Security that helps with the creation, administration, and monitoring of Windows Firewall and IPsec settings and provides an alternative to console-based management. This can be useful in the following situations:

  • When deploying Windows Firewall with Advanced Security settings to computers on a wide area network (WAN), commands can be used interactively at the Netsh command prompt to provide better performance than graphical utilities when used across slow-speed network links.

  • When deploying Windows Firewall with Advanced Security settings to a large number of computers, commands can be used in batch mode at the Netsh command prompt to help script and automate recurring administrative tasks that must be performed.

You must have the required permissions to run the netsh advfirewall commands:

  • If you are a member of the Administrators group, and User Account Control is enabled on your computer, then run the commands from a command prompt with elevated permissions. To start a command prompt with elevated permissions, find the icon or Start menu entry that you use to start a command prompt session, right-click it, and then click Run as administrator.

  • If you are a member of the Network Operators group then you can run the commands from any command prompt.

  • If you are a not a member of Administrators or Network Operators, and have not been delegated any other permissions to run this command, then you can run only those commands that display, but do not change settings.

Note
The netsh advfirewall context is only available on computers that are running Microsoft® Windows Vista® or Windows Server® 2008. IPsec or firewall policies created by using this context cannot be used to configure computers that are running earlier versions of Windows.

To use a command line to configure Windows Firewall or IPsec on computers that are running earlier versions of Windows, you must use a utility that is designed for the appropriate operating system. For example, to use the command line to configure IPsec policies on computers that are running Windows XP, use IPsecCmd.exe, which is provided on the Windows XP CD, in the \Support\Tools folder. To use the command line to configure IPsec policies on computers that are running Windows 2000, use IPsecPol.exe, which is provided with the Windows 2000 Server Resource Kit. Run these commands only on the operating systems for which they were designed. Running them on Windows Vista or Windows Server 2008 is not supported.

Important
The netsh firewall context is supplied only for backward compatibility. We recommend that you do not use this context on a computer that is running Windows Vista or Windows Server 2008, because by using it you can create and modify firewall rules only for the domain and private profiles. Earlier versions of Windows only supported a domain and standard profile. On Windows Vista or Windows Server 2008, standard maps to the private profile and domain continues to map to the domain profile. Rules for the public profile can only be manipulated when the computer is actually attached to a public network and the command is run against the "current" profile.

For general information about netsh, see Netsh Overview and Enter a Netsh Context.

For information on how to interpret netsh command syntax, see Formatting Legend.

The available contexts for managing Windows Firewall with Advanced Security are:

  • Netsh AdvFirewall

  • Netsh AdvFirewall ConSec

  • Netsh AdvFirewall Firewall

  • Netsh AdvFirewall Monitor

Netsh AdvFirewall context

The following commands are available at the netsh advfirewall> prompt.

To start the advfirewall context at an elevated command prompt, type netsh, press ENTER, then type advfirewall and press ENTER.

To view the command syntax, click a command:

  • dump

  • export

  • import

  • reset

  • set

  • show

The following commands change to subcontexts of the netsh advfirewall context. To see the list of commands available in each context, click a command:

  • conSec

  • firewall

  • monitor

Important
The commands in the various contexts can be used to modify Windows Firewall and IPsec policy in several different storage locations, such as the local policy store, or a Group Policy object (GPO) stored in Active Directory®. To ensure that you are modifying the policy you intend, use the set store command. For more information, see set store.

dump

This command is available for some netsh contexts, but is not implemented for the netsh advfirewall context or any of its three subcontexts. It produces no output, but also generates no error. When the dump command is used from the root context, no Windows Firewall or IPsec configuration information is included in the output.

export

Exports the Windows Firewall with Advanced Security configuration in the current store to a file. This file can be used with the import command to restore the Windows Firewall with Advanced Security service configuration to a store on the same or to a different computer. The Windows Firewall with Advanced Security configuration on which the export command works is determined by the set store command. This command is the equivalent to the Export Policy command in the Windows Firewall with Advanced Security MMC snap-in.

Syntax

export [Path]FileName

Parameters

[Path]FileName

Required. Specifies, by name, the file where the Windows Firewall with Advanced Security configuration will be written. If the path, file name, or both contain spaces, quotation marks must be used. If you do specify Path then the command places the file in your current folder. The recommended file name extension is .wfw.

Examples

In the following example, the command exports the complete Windows Firewall with Advanced Security service configuration to the file C:\temp\wfas.wfw.

export c:\temp\wfas.wfw

import

Imports a Windows Firewall with Advanced Security service configuration from a file to the local service. The configuration file is created by using export command. This command is equivalent to the Import Policy command in the Windows Firewall with Advanced Security Microsoft Management Console (MMC) snap-in.

Syntax

import [Path]FileName

Parameters

[Path]FileName

Required. Specifies, by name, the file from which the Windows Firewall with Advanced Security configuration will be imported. If the path, the file name, or both contain spaces, quotation marks must be used. If you do not specify Path, then the command looks in the current folder for the file.

Remarks

Caution
Importing to the current store overwrites the existing contents of the store. The utility does not ask for confirmation before proceeding. Before you import a file into the current store, we recommend that you export the existing contents of the store to a different file.

Examples

In the following example, the command imports the complete Windows Firewall with Advanced Security service configuration from the file c:\temp\wfas.wfw.

import c:\temp\wfas.wfw

reset

Restores Windows Firewall with Advanced Security to all of its default settings and rules. Optionally, it first backs up the current settings by using the export command to a configuration file. This command is equivalent to the Restore Defaults command in the Windows Firewall with Advanced Security MMC snap-in.

  • If the current focus of your commands is the local computer object, then the default settings and rules immediately take effect on the computer.

  • If the current focus of your commands is a GPO, then this command resets all policy settings in that object to Not Configured, and deletes all connection security and firewall rules from the object. Changes do not take place until that policy is refreshed on those computers to which the policy applies. To use the Netsh tool to modify a GPO rather than the local computer's configuration store, see set store.

Syntax

reset [export [Path]FileName]

Parameters

[Export [Path]FileName]

Specifies that the current configuration is backed up to the specified file before Windows Firewall with Advanced Security is reset to all default configuration settings and rules. If you do specify Path, then the command places the file in your current folder. The recommended file name extension is .wfw.

Examples

In the following example, the command exports the complete Windows Firewall with Advanced Security configuration to the file c:\Temp\wfas.wfw, and then resets the Windows Firewall with Advanced Security configuration to its default configuration settings and rules.

reset export c:\Temp\wfas.wfw

set

Configures settings that apply globally, or to the per-profile configurations of Windows Firewall with Advanced Security.

The Set commands available at the netsh advfirewall> prompt are:

  • set {ProfileType}

  • set global

  • set store

set {ProfileType}

Configures options for the profile associated with the specified network location type. Windows only uses one profile at a time, regardless of the number and types of networks to which you are connected. To see which profile is currently active on your computer, use the netsh advfirewall show currentprofile command. The set {ProfileType} command is equivalent to using the Windows Firewall with Advanced Security Properties page, with the tabs for Domain, Private, and Public profiles.

When your computer is connected to multiple networks, the profile type that Windows Firewall with Advanced Security uses is the one that is expected to be more protective of your computer. For example, if your computer is connected to both a Public network and a Domain network, then Windows Firewall with Advanced Security will use the profile associated with the Public network location type, because it is expected to contain more restrictive and protective settings than the Domain profile. The list of network location types in order of expected increasing restrictiveness is domain, private, and then public. We recommend that you maintain that expected order when you modify the profiles so that you do not unexpectedly use a less protective profile when you are connected to less secure network location type.

Syntax

set ProfileType Parameter Value

Parameters

ProfileType

Required. Can be any one of the following:

  • allprofiles

  • currentprofile

  • domainprofile

  • privateprofile

  • publicprofile

Parameter Value

Required. Parameter can be one of the following:

  • state

  • firewallpolicy

  • settings

  • logging

See the details for each command for syntax and valid values.

set {ProfileType} state

Configures the overall operational state of Windows Firewall with Advanced Security.

Syntax

set ProfileType state {on|off|notconfigured}

Parameters

on

Enable Windows Firewall with Advanced Security when the specified profile is active.

off

Disable Windows Firewall with Advanced Security when the specified profile is active.

notconfigured

Valid only when netsh is configuring a GPO by using the set store command. Removes the setting from the policy, which results in the policy not changing the value on the computer when the policy is applied.

Remarks

  • The default state for all profiles on computers that are running Windows Vista is on, for both new installations and upgrades.

  • The default state for all profiles on computers that are running a new installation of Windows Server 2008 is on. For computers that were upgraded to Windows Server 2008 from an earlier version of Windows Server, the state of Windows Firewall with Advanced Security is preserved from the state of Windows Firewall on the previously installed operating system. If Windows Firewall was enabled when the upgrade was started, then Windows Firewall with Advanced Security is enabled for all profiles when the upgrade is completed. If Windows Firewall was disabled when the upgrade was started, then Windows Firewall with Advanced Security is disabled for all profiles when the upgrade is completed.

Examples

To turn Windows Firewall with Advanced Security on for all profiles:

set allprofiles state on

set {ProfileType} firewallpolicy

Configures the inbound and outbound firewall filtering behavior that is used when traffic does not match any firewall rule currently enabled on the computer.

Syntax

set ProfileType firewallpolicy InboundPolicy,OutboundPolicy

Parameters

InboundPolicy

Required. Must be one of the following values:

  • blockinbound. Blocks inbound network traffic that does not match an inbound rule.

  • blockinboundalways. Blocks all inbound network traffic, including traffic that matches an inbound rule. This effectively blocks all unsolicited inbound network traffic into the computer. Only traffic that is sent in response to an outbound request is allowed.

  • allowinbound. Allows all inbound network traffic, whether or not it matches an inbound rule.

  • notconfigured. Valid only when netsh is configuring a GPO by using the set store command. Removes the setting from the policy, which results in the policy not changing the value on the computer when the policy is applied.

OutboundPolicy

Required. Must be one of the following values:

  • blockoutbound. Block outbound network traffic that does not match an outbound rule.

  • allowoutbound. Allow all outbound network traffic, whether or not it matches an outbound rule.

  • notconfigured. Valid only when netsh is configuring a Group Policy object by using the set store command. Removes the setting from the policy, which results in the policy not changing the value on the computer when the policy is applied.

Remarks

  • The default value for firewallpolicy is blockinbound,allowoutbound.

Examples

To set the behavior for the current network profile to block unsolicited inbound traffic, but allow outbound traffic:

set currentprofile firewallpolicy blockinbound, allowoutbound

set {ProfileType} settings

Configures general settings related to Windows Firewall and IPsec that are specific for each profile.

Syntax

set ProfileType settings SettingName {enable|disable|notconfigured}

Parameters

SettingName is one of the items in the following table:

localfirewallrules

  • enable. Firewall rules defined by the local administrator are merged with firewall rules from GPOs and are applied to the computer.

  • disable. Rules defined by the local administrator are ignored, and only firewall rules from GPOs are applied to the computer.

  • notconfigured. Valid only when netsh is configuring a Group Policy object by using the set store command. Removes the setting from the policy, which results in the policy not changing the value on the computer when the policy is applied.

The default setting when managing a computer is enable. When managing a GPO, the default setting is notconfigured.

localconsecrules

  • enable. IPsec connection security rules defined by the local administrator are merged with connection security rules from GPOs and are applied to the computer.

  • disable. Rules defined by the local administrator are ignored, and only connection security rules from GPOs are applied to the computer.

  • notconfigured. Valid only when netsh is configuring a Group Policy object by using the set store command. Removes the setting from the policy, which results in the policy not changing the value on the computer when the policy is applied.

The default setting for managing a computer is enable. When managing a GPO, the default setting is notconfigured.

inboundusernotification

  • enable. Windows notifies the user whenever a program or service starts listening for inbound connections.

  • disable. Windows does not notify the user whenever a program or service starts listening for inbound connections.

  • notconfigured. Valid only when netsh is configuring a GPO by using the set store command. Removes the setting from the policy, which results in the policy not changing the value on the computer when the policy is applied.

On Windows Vista, the default value when managing a computer is enable.

On Windows Server 2008, the default value when managing a computer is disable.

When managing a GPO, the default setting for both operating systems is notconfigured.

remotemanagement

  • enable. Users with appropriate permissions on remote computers can manage the Windows Firewall with Advanced Security settings on this computer. This is equivalent to enabling the "Windows Firewall Remote Management" rule group for the profile.

  • disable. The Windows Firewall with Advanced Security settings on this computer cannot be managed from a remote computer.

  • notconfigured. Valid only when netsh is configuring a GPO by using the set store command. Removes the setting from the policy, which results in the policy not changing the value on the computer when the policy is applied.

To use netsh to manage a remote computer, use the set machine command. For more information, see Netsh Commands for All Contexts.

The default setting for managing a computer is disable. When managing a GPO, the default setting is notconfigured.

unicastresponsetomulticast

  • enable. The computer can receive unicast responses to outgoing multicast or broadcast messages.

  • disable. The computer discards unicast responses to outgoing multicast or broadcast messages.

  • notconfigured. Valid only when netsh is configuring a GPO by using the set store command. Removes the setting from the policy, which results in the policy not changing the value on the computer when the policy is applied.

The default setting for managing a computer is enable. When managing a GPO, the default setting is notconfigured.

Examples

To enable the local computer to be managed by another computer when the local computer is connected using the Private profile:

set privateprofile settings remotemanagement enable

To prevent the computer from accepting inbound unicast responses to outbound multicast traffic in the currently active profile:

set currentprofile settings unicastresponsetomulticast disable

set {ProfileType} logging

Configures firewall logging settings related to Windows Firewall with Advanced Security.

Syntax

set ProfileType logging SettingName Value

Paramaters

SettingName is one of the items in the following table:

allowedconnections

Value can be one of the following:

  • enable. Causes Windows to write an entry to the log whenever an incoming or outgoing connection is allowed.

  • disable. No logging for allowed connections.

  • notconfigured. Valid only when netsh is configuring a GPO by using the set store command. Removes the setting from the policy, which results in the policy not changing the value on the computer when the policy is applied.

The default setting for managing a computer is disable. When managing a GPO, the default setting is notconfigured.

droppedconnections

Value can be one of the following:

  • enable. Causes Windows to write an entry to the log whenever an incoming or outgoing connection is prevented by policy.

  • disable. No logging for dropped connections.

  • notconfigured. Valid only when netsh is configuring a GPO by using the set store command. Removes the setting from the policy, which results in the policy not changing the value on the computer when the policy is applied.

The default setting for managing a computer is disable. When managing a GPO, the default setting is notconfigured.

filename

Value is the path and filename of the file to which Windows writes log entries.

notconfigured. Valid only when netsh is configuring a GPO by using the set store command. Removes the setting from the policy, which results in the policy not changing the value on the computer when the policy is applied.

The default setting for managing a computer is %windir%\system32\logfiles\firewall\pfirewall.log. When managing a GPO, the default setting is notconfigured.

maxfilesize

Value is a number from 1 to 32767 that specifies in kilobytes the maximum file size of the log.

notconfigured. Valid only when netsh is configuring a GPO by using the set store command. Removes the setting from the policy, which results in the policy not changing the value on the computer when the policy is applied.

The default setting for managing a computer is 4096. When managing a GPO, the default setting is notconfigured.

Remarks

  • No IPsec related information is collected in the packet log. The log collects firewall related information only.

  • When you use the MMC snap-in or this netsh command to specify the log location directly on the local computer, the folder is automatically given the required permissions for the service to successfully write the log files. However, when you use Group Policy to configure a log somewhere other than the default location, the permissions are not automatically configured. You must ensure that the account NT SERVICE\mpssvc is given Write access to the folder where you want the logs placed. For more information see article 929455 in the Microsoft Knowledge Base (fwlink to http://support.microsoft.com/kb/929455).

Examples

To configure a Windows Firewall with Advanced Security log file at c:\logs\firewall.log that can grow to a maximum size of approximately 1 megabyte:

set currentprofile logging filename c:\logs\firewall.log

set currentprofile logging maxfilesize 1024

To log all dropped connections for all network profiles:

set allprofiles logging droppedconnections enable

set global

Configures properties that apply to the firewall and IPsec settings, no matter which network profile is currently in use.

The set global command supports the following options:

  • statefulftp

  • ipsec

  • mainmode

set global statefulftp

Configures how Windows Firewall with Advanced Security handles FTP traffic that uses an initial connection on one port to request a data connection on a different port. This affects both active and passive FTP.

  • With active FTP, the client initiates a connection to the server on TCP port 21 and includes a PORT command that indicates to the FTP server the port number on which it should respond. A typical firewall on the client would block this new connection as unsolicited inbound traffic since the packets to the new port are not in response to a request from that port.

  • With passive FTP, the client initiates a connection to the server on TCP port 21 and includes the PASV command. The server responds on TCP port 21 with a port number that the client must use for subsequent data transfer. The client then initiates a connection to the server on the specified port. A typical firewall on the FTP server would block this new incoming data connection as unsolicited inbound traffic since the packets received at the new port are not in response to a request from that port.

When statefulftp is enabled, the firewall examines the PORT and PASV requests for these other port numbers and then allows the corresponding data connection to the port number that was requested.

Syntax

set global statefulftp {enable|disable|notconfigured}

Parameters

statefulftp can be set to one of the following values:

enable

The firewall tracks the port numbers specified in PORT command requests and in the responses to PASV requests, and then allows the incoming FTP data traffic entering on the requested port number.

disable

This is the default value. The firewall does not track outgoing PORT commands or PASV responses, and so incoming data connections on the PORT or PASV requested port is blocked as an unsolicited incoming connection.

notconfigured

Valid only when netsh is configuring a GPO by using the set store command. Removes the setting from the policy, which results in the policy not changing the value on the computer when the policy is applied.

Remarks

  • The default setting when managing a computer running Windows Vista is enable. The default setting when managing a computer running Windows Server 2008 is disable. When managing a GPO, the default setting is notconfigured.

Examples

  • To configure Windows Firewall with Advanced Security to allow FTP data traffic through Windows Firewall when using either PORT or PASV commands:

    set global statefulftp enable

set global ipsec

Configures global IPsec options.

Syntax

set global ipsec SettingName Value

Parameters

SettingName is one of the items in the following table:

strongcrlcheck

Specifies whether IPsec checks certificates used in authentication against a certificate revocation list (CRL), and how it reacts to a certificate that is found to be on a CRL.

Value can be one of the following:

  • 0. Specifies that IPsec does not perform any CRL checking.

  • 1. Specifies that IPsec authentication fails only if the certificate is found to be revoked.

  • 2. Specifies that IPsec authentication fails if there is any error during CRL checking, including a failure to retrieve the CRL.

  • notconfigured. Valid only when netsh is configuring a Group Policy object by using the set store command. Removes the setting from the policy, which results in the policy not changing the value on the computer when the policy is applied.

The default setting when managing a local computer is 1. When managing aGPO, the default value is notconfigured.

saidletimemin

An integer from 5 to 60 that specifies the number of minutes than a security association (SA) can stay idle before it is deleted. Once deleted, a new SA must be established before computers under the scope of the original SA can communicate again.

notconfigured. Valid only when netsh is configuring a GPO by using the set store command. Removes the setting from the policy, which results in the policy not changing the value on the computer when the policy is applied.

The default setting when managing a local computer is 5 (minutes). When managing a GPO, the default value is notconfigured.

defaultexemptions

Specifies the protocols to be exempted from IPsec traffic. Value can be one of:

  • none. No protocols are exempted.

  • neighbordiscovery. Exempt only IPv6 Neighbor Discovery protocol traffic.

  • notconfigured. Valid only when netsh is configuring a GPO by using the set store command. Removes the setting from the policy, which results in the policy not changing the value on the computer when the policy is applied.

The default setting when managing a local computer is neighbordiscovery. When managing a GPO, the default value is notconfigured.

ipsecthroughnat

Specifies whether IPsec can configure a security association (SA) when one or both computers involved are behind a network address translation (NAT) device. Value can be one of:

  • never. Specifies that an SA cannot be negotiated if either computer is behind a NAT device.

  • serverbehindnat. Specifies that an SA can be negotiated if only the server is on a private subnet behind a NAT device.

  • serverandclientbehindnat. Specifies that an SA can be negotiated if either or both of the computers are on private subnets behind NAT devices.

  • notconfigured. Valid only when netsh is configuring a GPO by using the set store command. Removes the setting from the policy, which results in the policy not changing the value on the computer when the policy is applied.

The default setting when managing a local computer is Never. When managing a GPO, the default value is notconfigured.

Examples

  • To configure IPsec to reject a connection attempt when certificate-based authentication fails, or if the CRL check encounters any error:

    set global ipsec strongcrlcheck 2

  • To configure IPsec to delete an SA after 15 minutes:

    set global ipsec saidletimemin 15

set global mainmode

Configures global options that control how IPsec performs Main Mode negotiations.

Syntax

set global mainmode SettingName Value

Parameters

SettingName is one of the items in the following table:

mmkeylifetime

Specifies the number of minutes and number of sessions established for a Main Mode SA before it expires and must be renegotiated. The format is:

num min,num sess

A value of 0 for either means that the SA does not expire based on the type specified. For example, the values 480min,0sess indicate that the SA expires every eight hours, but does not expire because of a certain number of sessions established.

notconfigured. Valid only when netsh is configuring a Group Policy object by using the set store command. Removes the setting from the policy, which results in the policy not changing the value on the computer when the policy is applied.

The default value is 480min,0sess.

mmsecmethods

Specifies the Diffie-Hellman key exchange group, integrity, and encryption protocols that are offered in IPsec negotiations with other computers. The format is either:

  • keyexch : enc - integrity[,enc-integrity][,…]

    Where:

    keyexch is one of:

    dhgroup1|dhgroup2|dhgroup14|ecdhp256|ecdhp384

    enc is one of:

    des|3des|aes128|aes192|aes256

    integrity is one of:

    md5|sha1

    You can enter multiple combinations of enc-integrity algorithms that use the same keyexch algorithm, by following the keyexch entry with the first enc-integrity pair, followed by additional pairs that are separated by commas.

  • default. When managing the local computer policy store, this entry is equivalent to entering the following entry:

    dhgroup2:aes128-sha1,3des-sha1

    When you are managing a GPO, this option behaves similarly to the notconfigured option, allowing the highest precedence policy that applies to the computer, and that does specify an mmsecmethods value to control the setting. If none of the GPOs or the local computer policy store sets the value, then the computer uses the value string displayed above.

  • notconfigured. Valid only when netsh is configuring a GPO by using the set store command. Removes the setting from the policy, which results in the policy not changing the value on the computer when the policy is applied.

The default value is dhgroup2:aes128-sha1, 3des-sha1.

Note
We recommend that you do not use DHGroup1, DES, or MD5. They are no longer considered secure, and are provided for backward compatibility purposes only.

Examples

To configure IPsec to expire a Main Mode SA after four hours or 1000 sessions:

set global mainmode mmkeylifetime 240min,1000sess

To configure IPsec to use a specific Main Mode set:

set global mainmode mmsecmethods dhgroup2:des-md5,3des-sha1

To configure IPsec to use the default Main Mode set:

set global mainmode mmsecmethods default

set store

Specifies where changes made by subsequent netsh advfirewall commands are stored. When you first start the netsh comand, you are by default working with the local computer's policy store (set store=local).

To configure the policy store on a remote machine, you must use the set machine command. For more information, see the topic "Set Machine" in Netsh Commands for All Contexts.

Syntax

set store {local|gpo=ComputerName|gpo=Domain\GPOName|gpo=domain\GPOUniqueID}

Parameters

local

Specifies that changes from subsequent commands are applied to the policy store on the local computer.

gpo= ComputerName

Specifies that changes from subsequent commands are applied to the computer with the indicated name in its local Group Policy object.

Note
The local GPO is separate from the local computer's policy store. It is stored on the local computer, not in Active Directory, and is merged with the Active Directory applied Group Policy objects when they are applied to the computer.

gpo= Domain \ GPOName

Specifies that changes from subsequent commands are applied to the Group Policy object stored on domain Domain, and named GPOName.

gpo= domain \ GPOUniqueID

Specifies that changes from subsequent commands are applied to the Group Policy object stored on domain Domain, and identified by the GUID GPOUniqueID.

Remarks

  • You must stay in the same interactive netsh session otherwise the store setting is lost.

  • A domain name needs to be fully specified, including its Domain Name System (DNS) zone.

Examples

Set the policy store to the GPO on computer1:

set store gpo=computer1

Set the policy store to the GPO called laptops in the office.example.com domain:

set store gpo=office.example.com\laptops

Set the policy store to the GPO with a specific GUID in the office domain:

set store gpo=office.example.com\{842082DD-7501-40D9-9103-FE3A31AFDC9B}

show

Displays settings that apply globally, or to the per-profile configurations of Windows Firewall with Advanced Security.

The show commands available at the netsh advfirewall> prompt are:

  • show {profileType}

  • show global

  • show store

show {ProfileType}

Displays the currently configured options for a specified profile. This command displays information that is presented on the Windows Firewall with Advanced Security Properties page, with the tabs for Domain, Private, and Public profiles. For more information about network location types and profiles, see the introduction to set {ProfileType}.

Syntax

Show ProfileType [Parameter]

Parameters

ProfileType

Required. The value can be one of the following:

  • allprofiles

  • currentprofile

  • domainprofile

  • privateprofile

  • publicprofile

[ Parameter ]

If not specified, then all of the following information is displayed:

  • state. Displays whether the Windows Firewall is enabled or not for the specified profile. See set state.

  • firewallpolicy. Displays the handling rules configured in the specified profile for inbound and outbound network traffic that does not match a separately defined firewall rule. See set firewallpolicy.

  • settings. Displays the general settings configured in the specified profile. See set settings.

  • logging. Displays the logging settings configured in the specified profile. See set logging.

Examples

To display all settings for all profiles:

show allprofiles

To display the firewall state for the current profile:

show currentprofile state

To display the current profile, and all of its settings:

show currentprofile

show global

Displays the configuration of the current policy store for properties that apply to the firewall and IPsec settings, no matter which profile is currently in use.

Syntax

show global [{ipsec|mainmode|statefulftp}]

Parameters

[{ipsec|mainmode|statefulftp}]

The value can be one of the following. If not specified, then all of the following information is displayed:

  • ipsec. Displays the current configuration of global IPsec options.

  • mainmode. Displays the current configuration of options that control how IPsec performs Main Mode negotiations.

  • statefulftp. Displays the current configuration of the option which controls how Windows Firewall with Advanced Security handles FTP network traffic. For more information, see set global statefulftp.

Examples

To display global IPsec configuration options:

show global ipsec

To display all global configuration options:

show global

show store

Displays where changes made by subsequent netsh advfirewall commands are stored.

Syntax

show store

Parameters

None.

Examples

To display the policy store currently being used by netsh advfirewall:

show store

Netsh AdvFirewall Consec context

Typing the command consec at the netsh advfirewall context changes to the netsh advfirewall consec context, where you can view, create, and modify connection security rules that specify how connections are protected by using IPsec. This context is the command-line equivalent to the Connection Security Rules node of the Windows Firewall with Advanced Security MMC snap-in.

To view the syntax of commands available in the Consec context, click a command:

  • add

  • delete

  • set

  • show

add

In the netsh advfirewall consec context, the add command only has one variation, the add rule command.

add rule

Adds a connection security rule that defines IPsec requirements for network connections that matches the specified criteria.

Syntax

add rule name= RuleName endpoint1= Addresses endpoint2= Addresses action={requireinrequestout| requestinrequestout| requireinrequireout| noauthentication} [description=DescriptionOfRule] [mode={transport| tunnel}] [enable={yes|no}] [profile={public| private| domain| any}[,...]] [type={dynamic| static}] [localtunnelendpoint=IPAddress] [remotetunnelendpoint=IPAddress] [port1={any| Integer}] [port2={any| Integer}] [protocol={any| tcp| udp| icmpv4| icmpv6| Integer}] [interfacetype={any| wiresless| lan| ras}] [auth1={computerkerb| computercert| computerpsk| computerntlm| anonymous|[,...]}] [auth1psk=PreSharedKey] [auth1ca="CAName [certmapping:{yes|no}] [excludecaname:{yes|no}][|...]"] [auth1healthcert={yes|no}] [auth2={userkerb| userntlm| usercert| computercert | anonymous|[,...]}] [auth2ca="CAName [certmapping:{yes|no}][|...]"] [auth2healthcert={yes|no}] [qmpfs={dhgroup1| dhgroup2| dhgroup14| ecdhp256| ecdhp384| mainmode| none}] [qmsecmethods=ah:Integrity+esp:Integrity-Encryption+[Life min]+[Data kb]| default]

Parameters

name= RuleName

Required. Specifies the name of this connection security rule. The name should be unique, and cannot be "all."

endpoint1= Addresses endpoint2= Addresses

Required. Specifies the computers that are subject to the requirements of this rule. Computers that match endpoint1 can communicate with computers that match endpoint2 only when the requirements of this rule are satisfied. Endpoint1 and endpoint2 can be any of the following values:

  • any. Matches a computer with any IP address.

  • localsubnet. Matches any computer that is on the same IP subnet as the local computer.

  • dns|dhcp|wins|defaultgateway. Matches any computer that is configured as the identified server type on the local computer.

  • IPAddress. Specifies an IPv4 or IPv6 address that matches only the computer currently communicating by using that address.

  • IPSubnet. Specifies an IPv4 or IPv6 subnet that matches any computer that is using an IP address that is part of the subnet. The format is the subnet address, followed by '/' and then either the number of bits in the subnet mask or the subnet mask itself.

  • IPRange. Specifies a range of IPv4 or IPv6 addresses that matches any computer that is using an IP address that falls within the range. The format is the starting and ending IP addresses of the range separated by a '-'.

Multiple entries can be specified for either endpoint1 or endpoint2 by separating them with a comma. Do not include any spaces in the completed comma separated text.

action={requireinrequestout| requestinrequestout| requireinrequireout| noauthentication}

Required. Specifies whether authentication is requested or required for connections that match the rule. Action can be one of the following values:

  • requireinrequestout. Specifies that the local computer must successfully authenticate all inbound network connections that match this rule. If the authentication is not successful, then the inbound network traffic is discarded. The local computer attempts to authenticate any outbound network connections that match this rule, but allows the connection if the authentication attempt fails.

  • requestinrequestout. Specifies that the local computer attempts to authenticate any inbound or outbound network connection that matches this rule, but allows the connection if the authentication attempt fail.

  • requireinrequireout. Specifies that the local computer requires successful IPsec negotiation for all inbound and outbound network connections that match this rule. If an authentication attempt fails, then the network connection is prevented, and any related network traffic is discarded.

  • noauthentication. Specifies that the local computer does not attempt authentication for any network connections that match this rule. This option is typically used to grant IPsec exemptions for network connections that do not need to be protected by IPsec, but would otherwise match other rules that could cause the connection to be dropped.

[description=DescriptionOfRule]

Provides information about the connection security rule.

[mode={transport|tunnel}]

Specifies whether this connection security rule defines an IPsec transport mode connection, or an IPsec tunnel mode connection.

If mode is not specified, the default is transport.

[enable={yes|no}]

Specifies whether the rule is currently enabled.

If enable is not specified, the default is yes.

[profile={public| private| domain| any|[,...]}]

Specifies the profile(s) to which the connection security rule is assigned. The rule is only active on the local computer when the specified profile is the currently active profile.

If profile is not specified, the default is any.

[type={dynamic|static}]

Specifies how the rule is applied to the current session and whether the rule is stored. The value can be one of the following:

  • dynamic. The rule is immediately applied to the current Windows Firewall with Advanced Security operational state. It is not stored in any policy container and will not be reapplied if the Windows Firewall with Advanced Security service is stopped and started, such as when you restart the computer.

  • static. The rule is stored in the policy container currently specified by the advfirewall set store command. The rule is not activated until the policy in which it is stored is applied to the computer. If the computer's local policy store is the active store, then the rule is immediately applied.

If type is not specified, the default is static.

[localtunnelendpoint=IPAddress]

Required and valid only if mode=tunnel. Specifies the IP address of the computer or gateway device that sends traffic from computers that match endpoint1 to computers that match endpoint2. The traffic is sent from this IP address to the device identified as the remotetunnelendpoint. This value must use the same type of IP address as the remotetunnelendpoint, either IPv4 or IPv6.

[remotetunnelendpoint=IPAddress]

Required and valid only if mode=tunnel. Specifies the IP address of the computer or gateway device that sends traffic from computers that match endpoint2 to computers that match endpoint1. The traffic is sent from this remote IP address to the local gateway identified as the localtunnelendpoint. This value must use the same type of IP address as the localtunnelendpoint, either IPv4 or IPv6

[port1={any|Integer}]

Specifies the port number of network traffic coming from endpoint1 computers that is subject to the requirements of this rule. Only traffic matching the specified port1, port2, and protocol values are subject to the requirements of this rule. If port1 is set to a value other than any, then the protocol value must be set to tcp or udp.

If port1 is not specified, the default is any.

Note
This is an advanced setting and is not displayed in the Windows Firewall with Advanced Security MMC snap-in.

[port2={any|Integer}]

Specifies the port number of network traffic arriving at endpoint2 computers that is subject to the requirements of this rule. Only traffic matching the specified port1, port2, and protocol values are subject to the requirements of this rule. If port2 is set to a value other than any, then the protocol value must be set to tcp or udp.

If port2 is not specified, the default is any.

Note
This is an advanced setting and is not displayed in the Windows Firewall with Advanced Security MMC snap-in.

[protocol={any| tcp| udp| icmpv4| icmpv6| Integer}

Specifies the protocol of network traffic that is subject to the requirements of this rule. If a port number is identified by using port1 or port2, then protocol must be set to tcp or udp. The values icmpv4 and icmpv6 are typically used to create a rule that exempts ICMP network traffic from the IPsec requirements of another rule.

If protocol is not specified, the default is any.

Note
This is an advanced setting and is not displayed in the Windows Firewall with Advanced Security MMC snap-in.

[interfacetype={any| wireless| lan| ras}]

Specifies that only network connections made through the indicated interface types are subject to the requirements of this rule. Using this parameter allows you to specify different authentication requirements for each of the three main network types. The value must be one of the following:

  • any. This rule is applied to network connections made through any of the interface types.

  • wireless. This rule is applied only when the network connection is through a wireless network.

  • lan. This rule is applied only when the network connection is through a wired LAN adapter.

  • ras. This rule is applied only when the network connection is through a RAS interface, such as a VPN or dial-up network connection.

If interfacetype is not specified, the default is any.

[auth1={computerkerb| computercert| computerpsk| computerntlm| anonymous|[,...]}]

Specifies the methods offered for Main Mode first authentication during IPsec negotiations. Multiple values can be included by separating them with commas. Do not include any spaces. If the negotiation uses IKE, the first match between the two computers is attempted. If it fails, the negotiation fails. If the negotiation uses AuthIP, then each match is tried in order, until one succeeds. If they all fail, then the negotiation fails. Windows uses IKE when it can, and uses AuthIP if you specify any options that are not supported by IKE.

For computers to communicate by using this rule, one of the specified authentication methods must be successful unless anonymous is specified, indicating that first authentication is optional.

The value can be any of the following:

  • computerkerb. This method uses the Kerberos v5 protocol to authenticate the computer account.

  • computercert. This method uses a computer certificate issued by a Certification Authority (CA).

  • computerpsk. This method uses a manually entered shared key that must be the same on both computers for them to communicate successfully. The use of a preshared key is not recommended, and is provided for interoperability and for conformance to IPsec standards. The preshared key is stored in plaintext. We strongly recommend the use of a more secure authentication method.

  • computerntlm. This method uses the Windows Challenge/Response NTLMv2 protocol to authenticate the computer account. You cannot include both computerntlm and computerpsk.

  • anonymous. Including this keyword as one of the choices has the effect of making this authentication optional. If included, it should be last. You cannot include both anonymous and computerpsk.

[auth1psk=PreSharedKey]

Required only if computerpsk is included in the auth1 parameter. Specifies the preshared key value that is used for authentication if the computerpsk option is negotiated. The value is stored in plaintext, and we recommend that you do not use preshared key authentication.

[auth1ca="CAName [certmapping:{yes|no}] [excludecaname:{yes|no}][|...]"]

Specifies certificate authentication options for Main Mode first authentication, and is valid only if auth1 includes computercert. Multiple certificates can be referenced by separating each entry by using the '|' character. The completed value must be enclosed with double quotation marks ("). Each entry in the value is a text string that contains the following elements:

CAName

Specifies the distinguished name of the certificate to be used for authentication. The format must conform to the standards for certificate fields, such as including the qualifiers CN=, OU=, and so on, as required.

certmapping:{yes|no}

Specifies whether to enable certificate-to-account mapping.

excludecaname:{yes|no}

Specifies whether to exclude from the certificate request the list of trusted root CA names from which a certificate is accepted.

[auth1healthcert={yes|no}]

Specifies that the computer certificate specified in auth1ca must be a computer health certificate provided by a Network Access Protection (NAP) server on the domain. You can use this value only if auth1 includes computercert.

If auth1healthcert is not specified, the default is no.

[auth2={userkerb| userntlm| usercert| computercert| anonymous|[,...]}]

Specifies the methods for Main Mode second authentication offered during IPsec negotiations. Use of a second authentication causes the negotiation to use AuthIP instead of IKE. Multiple values can be included by separating them with commas. They are attempted in the order displayed. The first successful method is the one used.

If auth1 contains computerpsk, then you cannot use auth2.

For computers to communicate by using this rule one of the specified authentication methods must be successful, unless anonymous is specified, indicating that second authentication is optional.

The value can be any of the following:

  • userkerb. This method uses the Kerberos v5 protocol to authenticate the user against an account in an Active Directory domain.

  • userntlm. This method uses the Windows Challenge/Response NTLMv2 protocol to authenticate the user against an account in an Active Directory domain.

  • usercert. This method uses a user certificate issued by a Certification Authority (CA).

  • computercert. This method uses a computer health certificate issued by a Network Access Protection (NAP) server on the domain. You must specify auth2healthcert=yes to use this value.

  • anonymous. Including this keyword as one of the choices has the effect of making this authentication optional. If included, it should be last.

Note
auth2 cannot be used if auth1 contains computerpsk.

Credentials used in auth2 must be all user-based, or all computer-based. You cannot mix them.

[auth2ca="CAName [certmapping:{yes|no}][|...]"]

Specifies certificate authentication options for Main Mode second authentication, and is valid only if auth2 contains usercert or computercert. Multiple certificates can be referenced by separating each entry by a '|' character. The completed value must be enclosed with double quotation marks ("). Each entry in the value is a text string that contains the following elements:

CAName

Specifies the distinguished name of the certificate to be used for authentication. The format must conform to the standards for certificate fields, such as including the qualifiers CN=, OU=, and so on, as required.

certmapping:{yes|no}

Specifies whether to enable certificate-to-account mapping.

[auth2healthcert={yes|no}]

Specifies that the computer certificate specified in auth2ca is a computer health certificate provided by a Network Access Protection (NAP) server on the domain. If auth2 includes computercert, then auth2healthcert must be yes. For all other cases, auth2healthcert must be no.

If auth2healthcert is not specified, the default is no.

[qmpfs={dhgroup1| dhgroup2| dhgroup14| ecdhp256| ecdhp384| mainmode| none}]

Specifies the method used to establish Quick Mode perfect forward secrecy. If mainmode is specified, then the key exchange specified for Main Mode is used.

If qmpfs is not specified, the default is none.

[qmsecmethods={ah:Integrity+esp:Integrity-Encryption+[Life min]+[Data kb][,...]| default}]

Specifies one or more Quick Mode security suites, separated by commas. There must be no spaces included. The value is defined by one of the following formats:

  • ah: AHIntegrity +esp: EspIntegrity - Encryption[+Life min][+Data kb][,…]

Where:

AHIntegrity

Specifies an integrity algorithm for the AH protocol. Integrity can be MD5, SHA1. To specify that you do not want to use AH, do not include the ah:AHIntegrity portion of the parameter.

EspIntegrity

Specifies an integrity algorithm for the ESP protocol. Integrity can be MD5, SHA1, or none.

Encryption

Specifies the encryption algorithm used. Encryption can be des, 3des, aes128, aes192, aes256, or none.

Life

Specifies the session key lifetime in minutes. The default value is 60 minutes.

Data

Specifies the session key lifetime in kilobytes. After the specified number of kilobytes of data is transferred, a new session key for the Quick Mode SA is generated. The default value is 100,000 kilobytes.

  • Default. When managing the local computer policy store, this entry is equivalent to entering the following entry (line breaks are included only for clarity):

    AH:SHA1+60min+100000kb,

    ESP:SHA1-None+60min+100000kb,

    ESP:SHA1-AES128+60min+100000kb,

    ESP:SHA1-3DES+60min+100000kb

    When you are managing a Group Policy object, this option behaves similarly to the notconfigured option, allowing the highest precedence policy that applies to the computer, and that does specify a qmsecmethods value to control the setting. If none of the Group Policy objects or the local computer policy store sets the value, then the computer uses the value displayed above.

Remarks

  • Do not create a connection security rule with the name all. Doing this creates a conflict with the netsh option to select all connection security rules (for example, delete rule name=all).

  • When mode=tunnel, you must specify both tunnel endpoints and you must specify action=requireinrequireout.

  • At least one Main Mode authentication method must be specified, unless action=noauthentication.

  • Do not make Main Mode first and second authentication methods both optional as this is equivalent to disabling authentication.

  • Any embedded double-quote characters (") in the CA name must be replaced with a backslash and single quote (\')

  • The ability to set Quick Mode integrity and encryption offerings on a per-rule basic is available only by using the netsh add rule and set rule commands. The Windows Firewall with Advanced Security MMC snap-in allows you to set the per-machine default Quick Mode integrity and encryption settings, but provides no means to configure them on a per-rule basis.

  • We recommend that you do not use the options DES, MD5, or DHGroup1. They are no longer considered secure, and are included for backward compatibility only.

Examples

  • The following command creates a rule that could be used in a domain isolation scenario, where incoming traffic is only permitted from other domain member computers.

    add rule name="Domain Isolation Rule" endpoint1=any endpoint2=any action=requireinrequestout

  • The following command creates a similar domain isolation rule, but uses a custom Quick Mode proposal that includes multiple Quick Mode suites, separated by commas. The first Quick Mode suite illustrates how to include both AH and ESP protocols in a single suite. The second suite illustrates how to specify the use of the AH protocol only. The third suite illustrates how to specify the use of the ESP protocol only, and uses the none keyword to specify not to include an encryption option. The final suite illustrates how to use the none keyword to specify that ESP is used with an encryption protocol, but with no integrity protocol. The last suite also illustrates how to set a custom SA timeout using both time and data amount values.

    add rule name="Domain Isolation Custom QM Rule" endpoint1=any endpoint2=any action=requireinrequestout qmsecmethods=ah:sha1+esp:sha1-3des,ah:sha1,esp:sha1-none,esp:none-aes256+30min+50000kb

  • The following command creates an IPsec tunnel that routes traffic from a private network (192.168.0.0/16) through an interface on the local computer (1.1.1.1) attached to a public network to a second computer through its public interface (2.2.2.2) to another private network (192.157.0.0/16). All traffic through the tunnel is integrity checked using ESP/SHA1, and encrypted using ESP/3DES.

    add rule name="My Tunnel" mode=tunnel endpoint1=192.168.0.0/16 endpoint2=192.157.0.0/16 localtunnelendpoint=1.1.1.1 remotetunnelendpoint=2.2.2.2 action=requireinrequireout qmsecmethods=esp:sha1-3des

  • The following command creates a rule that requires that incoming connections are authenticated by using either of two computer certificates. The computer also requests authentication for outbound connections, but allows an outbound connection if authentication is not successful. Note that multiple certificates are separated by a vertical bar (|) character, and that the single quotes around the certificate names must be prefaced with the backslash (\) character to be interpreted correctly.

    add rule name="Authenticate with Certificates Rule" endpoint1=any endpoint2=any action=requireinrequestout auth1=computercert auth1ca="C=US,O=MSFT,CN=\'Microsoft Root Authority\'|C=US,O=MYORG,CN=\'My Organizations Root Certificate\'"

  • The following command creates a rule that requires a first (computer) authentication and attempts an optional second (user) authentication:

    Add rule name="Authenticate Both Computer and User" endpoint1=any endpoint2=any action=requireinrequireout auth1=computerkerb,computerntlm auth2=userkerb,userntlm,anonymous

delete

In the netsh advfirewall consec context, the Delete command only has one variation, the Delete Rule command.

delete rule

Deletes all connection security rules that match the specified criteria.

Syntax

delete rule name={all|RuleName} [type={dynamic|static}] [profile={public|private|domain|any|[,...]}] [endpoint1=Addresses] [endpoint2=Addresses] [port1={any|Integer}] [port2={any|Integer}] [protocol={any|tcp|udp|icmpv4|icmpv6|Integer}]

Parameters

name={all|RuleName}

Required. You can specify one of the following values:

  • The rule name of the connection security rule you want deleted. Only the rule with the specified name is deleted.

  • all. Specifies that all rules matching the criteria in the other parameters are deleted. If no other parameters are included in the command then all connection security rules are deleted.

[type={dynamic|static}]

Specifies that only rules of the selected type are deleted. The value can be either dynamic or static.

[profile={public| private| domain| any|[,...]}]

Specifies that only rules assigned to the specified profile(s) are deleted.

If profile is not specified, the default is any.

[endpoint1=Addresses] [endpoint2=Addresses]

Specifies that only rules that match the IP addresses, ranges, subnets, or server types are deleted.

Endpoint1 and endpoint2 can be any of the following values:

  • IPAddress. Specifies an IPv4 or IPv6 address.

  • IPSubnet. Specifies an IPv4 or IPv6 subnet. The format is the subnet address, followed by '/' and then either the number of bits in the subnet mask or the subnet mask itself.

  • IPRange. Specifies a range of IPv4 or IPv6 addresses. The format is the starting and ending IP addresses of the range separated by a '-'.

  • One of the keywords any, localsubnet, dns, dhcp, wins, defaultgateway.

You can specify multiple entries for either endpoint1 or endpoint2 by separating them with a comma.

[port1={any|Integer}] [port2={any|Integer}]

Specifies that only rules that match the port numbers indicated are deleted.

[protocol={any| tcp| udp| icmpv4| icmpv6| Integer}]

Specifies that only rules that match the indicated protocol values are deleted.

Remarks

  • If multiple rules are found that match the specified criteria, then they are all deleted.

Examples

  • The following example deletes a rule based on its exact name:

    Delete rule name="rule1"

  • The following example deletes all dynamic rules from all profiles:

    delete rule name=all type=dynamic

set

In the netsh advfirewall consec context, the set command only has one variation, the Set Rule command.

set rule

Modifies an existing connection security rule identified by name, or found by matching the specified criteria. Criteria that precede the keyword new identify the rule(s) to be modified. Criteria that follow the keyword new indicate properties that are modified or added.

Syntax

set rule name={all|RuleName} [type={dynamic|static}] [profile={public|private|domain|any|[,...]}] [endpoint1=Addresses] [endpoint2=Addresses] [port1={any|Integer}] [port2={any|Integer}] [protocol={any| tcp| udp| icmpv4| icmpv6| Integer}] new [name=NewRuleName] [profile={public| private| domain| any|[,...]}] [description=NewRuleDescription] [mode={transport|tunnel}] [endpoint1=Addresses] [endpoint2=Addresses] [action={requireinrequestout| requestinrequestout| requireinrequireout| noauthentication}] [enable={yes|no}] [type={dynamic|static}] [localtunnelendpoint=IPAddress] [remotetunnelendpoint=IPAddress] [port1={any|Integer}] [port2={any|Integer}] [protocol={any| tcp| udp| icmpv4| icmpv6| Integer}] [interfacetype={any| wiresless| lan| ras}] [auth1={computerkerb| computercert| computerpsk| computerntlm| anonymous|[,...]}] [auth1psk=PreSharedKey] [auth1ca="CAName [certmapping:{yes|no}] [excludecaname:{yes|no}][|...]"] [auth1healthcert={yes|no}] [auth2={userkerb| userntlm| usercert| computercert| anonymous|[,...]}] [auth2ca="CAName [certmapping:{yes|no}][|...]"] [auth2healthcert={yes|no}] [qmpfs={dhgroup1| dhgroup2| dhgroup14| ecdhp256| ecdhp384| mainmode| none}] [qmsecmethods=ah:Integrity+esp:Integrity-Encryption+[Life min]+[Data kb]| default]

Parameters

name={all|RuleName}

Required. Specifies the rule name assigned to an existing rule that you want to modify. If name=all, then all rules that match all other criteria listed before the new keyword are modified.

If name=all, and no other parameters are included before the new keyword, then all rules are modified as indicated.

[type={dynamic|static}]

Specifies that only matching rules of the indicated type are modified. The value of type can be either dynamic or static.

[profile={public| private| domain| any|[,...]}]

Specifies that only matching rules that are assigned to the indicated profile are modified. If you specify more than one profile, then only rules that include the exact same list of profiles match.

[endpoint1=Addresses] [endpoint2=Addresses]

Specifies that only rules that match the IP addresses, ranges, subnets, or server types are modified.

Endpoint1 and endpoint2 can be any of the following values:

  • any. Matches a computer with any IP address.

  • localsubnet. Matches any computer that is on the same IP subnet as the local computer.

  • dns|dhcp|wins|defaultgateway. Matches any computer that is configured as the identified server type on the local computer.

  • IPAddress. Specifies an IPv4 or IPv6 address that matches only the computer currently communicating by using that address.

  • IPSubnet. Specifies an IPv4 or IPv6 subnet that matches any computer that is using an IP address that is part of the subnet. The format is the subnet address, followed by '/' and then either the number of bits in the subnet mask or the subnet mask itself.

  • IPRange. Specifies a range of IPv4 or IPv6 addresses that matches any computer that is using an IP address that falls within the range. The format is the starting and ending IP addresses of the range separated by a '-'.

Multiple entries can be specified for either endpoint1 or endpoint2 by separating them with a comma. Do not include any spaces in the completed comma separated text.

[port1={any|Integer}] [port2={any|Integer}]

Specifies that only rules that match the port numbers indicated are modified.

[protocol={any| tcp| udp| icmpv4| icmpv6| Integer}

Specifies that only rules that match the indicated protocol values are modified.

new

Any parameter that precedes this keyword is used to find a match for the rules that are modified. Any parameter that follows this keyword indicates a value that is modified in the rules that match the specified criteria.

[name=NewRuleName]

Specifies a new name for the connection security rule. The name should be unique, and cannot be "all".

[profile={public| private| domain| any|[,...]}]

Specifies the profile(s) to which the connection security rule is assigned. The rule is only applied when the specified profile is the currently active profile.

[description=DescriptionOfRule]

Provides information about the connection security rule.

[mode={transport|tunnel}]

Specifies whether this connection security rule defines an IPsec transport mode connection, or an IPsec tunnel mode connection.

[endpoint1=Addresses] [endpoint2=Addresses]

Specifies the computers that are subject to the requirements of this rule. Computers that match endpoint1 can communicate with computers that match endpoint2 only when the requirements of this rule are satisfied.

Endpoint1 or endpoint2 can be any of the keywords, addresses, subnets, ranges, or server types described in the endpoint1 and endpoint2 description that precede the new keyword above.

action={requireinrequestout| requestinrequestout| requireinrequireout| noauthentication}

Specifies whether authentication is requested or required for connections that matches the rule. Action can be one of the following values:

  • requireinrequestout. Specifies that the local computer requires successful authentication for all inbound network connections that match this rule. If the authentication is not successful, then the inbound network traffic is discarded. The local computer attempts to authenticate any outbound network connections that match this rule, but still allows the connection if the authentication attempt fails.

  • requestinrequestout. Specifies that the local computer attempts to authenticate any inbound or outbound network connection that matches this rule, but still allows the connection if the authentication attempt fail.

  • requireinrequireout. Specifies that the local computer requires successful IPsec negotiation for all inbound and outbound network connections that match this rule. If an authentication attempt fails, then the network connection is prevented, and any related network traffic is discarded.

  • noauthentication. Specifies that the local computer does not attempt authentication for any network connections that match this rule. This option is typically used to grant IPsec exemptions for network connections that do not need to be protected by IPsec, but would otherwise match other rules that could cause the connection to be dropped.

[enable={yes|no}]

Specifies whether the rule is currently enabled.

[type={dynamic|static}]

Specifies how the rule is applied to the current session and whether the rule is stored. The value can be one of the following:

  • dynamic. The rule is immediately applied to the current Windows Firewall with Advanced Security operational state. It is not saved in any store and will not be reapplied if the Windows Firewall with Advanced Security service is stopped and started, such as when you restart the computer.

  • static. The rule is saved in the store currently specified by the advfirewall set store command. The rule is not activated until the policy in which it is stored is applied to the computer.

[localtunnelendpoint=IPAddress]

Required and valid only if mode=tunnel. Specifies the IP address of the computer gateway device that sends traffic from computers that match endpoint1 to computers that match endpoint2. The traffic is sent from this IP address to the gateway identified as the remotetunnelendpoint. This value must use the same type of IP address as the remotetunnelendpoint, either IPv4 or IPv6.

[remotetunnelendpoint=IPAddress]

Required and valid only if mode=tunnel. Specifies the IP address of the computer or gateway device that sends traffic from computers that match endpoint2 to computers that match endpoint1. The traffic is sent from this remote IP address to the local gateway identified as the localtunnelendpoint. This value must use the same type of IP address as the localtunnelendpoint, either IPv4 or IPv6.

[port1={any|Integer}]

Specifies the port number of network traffic coming from endpoint1 computers that is subject to the requirements of this rule. Only traffic matching the specified port1, port2, and protocol values are subject to the requirements of this rule. If port1 is set to a value other than any, then the protocol value must be set to tcp or udp.

Note
This is an advanced setting and is not displayed on the Windows Firewall with Advanced Security MMC snap-in.

[port2={any|Integer}]

Specifies the port number of network traffic arriving at endpoint2 computers that is subject to the requirements of this rule. Only traffic matching the specified port1, port2, and protocol values are subject to the requirements of this rule. If port2 is set to a value other than any, then the protocol value must be set to tcp or udp.

Note
This is an advanced setting and is not displayed on the Windows Firewall with Advanced Security MMC snap-in.

[protocol={any| tcp| udp| icmpv4| icmpv6| Integer}

Specifies the protocol of network traffic that is subject to the requirements of this rule. If a port number is identified by using port1 or port2, then protocol must be set to tcp or udp.

[interfacetype={any| wireless| lan| ras}]

Specifies that only network connections made through the indicated interface types are subject to the requirements of this rule. Using this parameter allows you to specify different authentication requirements for each of the three main network types. The value can be one of the following:

  • any. The requirements of this rule are applied to network connections made through any of the interface types.

  • wireless. The requirements of this rule are applied only when the network connection is through a wireless network.

  • lan. The requirements of this rule are applied only when the network connection is through a wired LAN adapter.

  • ras. The requirements of this rule are applied only when the network connection is through a RAS interface, such as a VPN or dial-up network connection.

[auth1={computerkerb| computercert| computerpsk| computerntlm| anonymous|[,...]}]

Specifies the methods offered for Main Mode first authentication during IPsec negotiations. Multiple values can be included by separating them with commas. Do not include any spaces. If the negotiation uses IKE, the first match between the two computers is attempted. If it fails, the negotiation fails. If the negotiation uses AuthIP, then each match is tried in order, until one succeeds. If they all fail, then the negotiation fails. Windows uses IKE when it can, and uses AuthIP if you specify any options that are not supported by IKE.

For computers to communicate by using this rule, one of the specified authentication methods must be successful unless anonymous is specified, indicating that first authentication is optional.

The value can be any of the following:

  • computerkerb. This method uses the Kerberos v5 protocol to authenticate the computer account.

  • computercert. This method uses a computer certificate issued by a Certification Authority (CA).

  • computerpsk. This method uses a manually entered shared key that must be the same on both computers for them to communicate successfully. The use of a preshared key is not recommended, and is provided for interoperability and for conformance to IPsec standards. We strongly recommend the use of a more secure authentication method.

  • computerntlm. This method uses the Windows Challenge/Response NTLMv2 protocol to authenticate the computer account. You cannot include both computerntlm and computerpsk.

  • anonymous. Including this keyword as one of the choices has the effect of making this authentication optional. If included, it should be last. You cannot include both anonymous and computerpsk

[auth1psk=PreSharedKey]

Required and valid only if computerpsk is included in the auth1 parameter. Specifies the preshared key value that is used for authentication if the computerpsk option is negotiated.

[auth1ca="CAName [certmapping:{yes|no}] [excludecaname:{yes|no}][|...]"]

Specifies certificate authentication options for Main Mode first authentication, and is valid only if auth1 includes computercert. Multiple certificates can be referenced by separating each entry by using the vertical bar (|) character. The completed value must be enclosed with double quotation marks ("). Each entry in the value is a text string that contains the following elements:

CAName

Specifies the distinguished name of the certificate to be used for authentication. The format must conform to the standards for certificate fields, such as including the qualifiers CN=, OU=, and so on as required.

certmapping:{yes|no}

Specifies whether to enable certificate-to-account mapping.

excludecaname:{yes|no}

Specifies whether to exclude from the certificate request the list of trusted root CA names from which a certificate is accepted.

[auth1healthcert={yes|no}]

Specifies that the computer certificate specified in auth1ca must be a computer health certificate provided by a Network Access Protection (NAP) server on the domain. You can use this value only if auth1 includes computercert.

[auth2={userkerb| userntlm| usercert| computercert| anonymous|[,...]}]

Specifies the methods for Main Mode second authentication offered during IPsec negotiations. Using auth2 results in the negotiating being performed by using the AuthIP protocol instead of the IKE protocol. Multiple values can be included by separating them with commas. They are attempted in the order displayed. The first successful method is the one used.

If auth1 contains computerpsk, then you cannot use auth2.

For computers to communicate by using this rule one of the specified authentication methods must be successful unless anonymous is specified, indicating that second authentication is optional.

The value can be any of the following:

  • userkerb. This method uses the Kerberos v5 protocol to authenticate the user account.

  • userntlm. This method uses the Windows Challenge/Response NTLMv2 protocol to authenticate the user account.

  • usercert. This method uses a user certificate issued by a Certification Authority (CA).

  • computercert. This method uses a computer health certificate issued by a Network Access Protection (NAP) server on the domain. You must specify auth2healthcert=yes to use this value.

  • anonymous. Including this keyword as one of the choices has the effect of making this authentication optional. If included, it should be last.

[auth2ca="CAName [certmapping:{yes|no}][|...]"]

Specifies certificate authentication options for Main Mode second authentication. Valid only if auth2 contains usercert or computercert. Multiple certificates can be referenced by separating each entry by a vertical bar (|) character. The completed value must be enclosed with double quotation marks ("). Each entry in the value is a text string that contains the following elements:

CAName

Specifies the distinguished name of the certificate to be used for authentication. The format must conform to the standards for certificate fields, such as including the qualifiers CN=, OU=, and so on, as required.

certmapping:{ yes | no }

Specifies whether to enable certificate-to-account mapping.

[auth2healthcert={yes|no}]

Specifies that the computer certificate specified in auth2ca must be a computer health certificate provided by a Network Access Protection (NAP) server on the domain. If auth2 includes computercert, then auth2healthcert must be yes. For all other cases, auth2healthcert must be no.

[qmpfs={dhgroup1| dhgroup2| dhgroup14| ecdhp256| ecdhp384| mainmode| none}]

Specifies the method used to establish Main Mode perfect forward secrecy. If mainmode is specified, then the Main Mode key exchange settings are used.

[qmsecmethods={ah:Integrity+esp:Integrity-Encryption[+Life min][+Data kb][,...] |default}]

Specifies one or more Quick Mode security suites, separated by commas. There must be no spaces included. The value is defined by one of the following formats:

  • ah: AHIntegrity +esp: EspIntegrity - Encryption[+Life min][+Data kb][,…]

Where:

AHIntegrity

Specifies an integrity algorithm for the AH protocol. Integrity can be MD5, SHA1. To specify that you do not want to use AH, do not include the ah:AHIntegrity portion of the parameter.

EspIntegrity

Specifies an integrity algorithm for the ESP protocol. Integrity can be MD5, SHA1, or none.

Encryption

Specifies the encryption algorithm used. Encryption can be des, 3des, aes128, aes192, aes256, or none.

Life

Specifies the session key lifetime in minutes. The default value is 60 minutes.

Data

Specifies the session key lifetime in kilobytes. After the specified number of kilobytes of data is transferred, a new session key for the Quick Mode SA is generated. The default value is 100,000 kilobytes.

  • Default. When managing the local computer policy store, this entry is equivalent to entering the following entry (line breaks are included only for clarity):

    AH:SHA1 +60min+100000kb,

    ESP:SHA1-None+60min+100000kb,

    ESP:SHA1-AES128+60min+100000kb,

    ESP:SHA1-3DES+60min+100000kb

    When you are managing a Group Policy object, this option behaves similarly to the notconfigured option, allowing the highest precedence policy that applies to the computer, and that does specify an qmsecmethods value to control the setting. If none of the Group Policy objects or the local computer policy store sets the value, then the computer uses the value string displayed above.

Remarks

  • If multiple rules match the criteria you specify, then all matching rules are updated with the changes included in the command.

  • Any parameters available after the new keyword that you do not include are not modified by the command.

  • Do not modify a connection security rule to use the name all. Doing this creates a conflict with the netsh option to select all connection security rules (for example, delete rule name=all).

  • If you change mode to tunnel, you must specify both tunnel endpoints and you must specify action=requireinrequireout.

  • In auth1, computerpsk and computerntlm cannot be used together.

  • In auth1, computerpsk and anonymous cannot be used together.

  • At least one Main Mode first authentication method must be specified, unless action=noauthentication.

  • Do not make Main Mode first and second authentication methods both optional as this is equivalent to disabling authentication.

  • The ability to set Quick Mode integrity and encryption offerings on a per-rule basic is available only by using the netsh add rule and set rule commands. The Windows Firewall with Advanced Security MMC snap-in allows you to set the per-machine default Quick Mode authentication and encryption settings, but provides no means to configure them on a per-rule basis.

  • We recommend that you do not use the options DES, MD5, or DHGroup1. They are no longer considered secure, and are included for backwards compatibility only.

  • Any embedded double-quote characters (") in the CA name must be replaced with a backslash and single quote ( \' )

Examples

  • The following command renames "Rule1" to "Rule2":

    set rule name="Rule1" new name="Rule2"

  • The following command changes a rule to use a different action, and assumes that the other parameters required by the new action value were already set:

    set rule name="Rule3" new action=requestinrequestout

show

In the netsh advfirewall consec context, the show command only has one variation, the Show Rule command.

show rule

Displays existing connection security rules.

Syntax

show rule name={all|RuleName} [profile={public| private| domain| any}[,...]] [type={dynamic|static}] [verbose]

Parameters

name={all|RuleName}

Required. Specifies the rule name assigned to an existing rule that you want to display. If name=all, then all rules that match the other criteria are displayed.

If name=all, and no other parameters are included, then all rules are displayed.

[profile={public| private| domain| any|[,...]}]

Specifies that you only want those rules that match the specified profile(s) displayed. If you specify more than one profile, then only rules that include the exact same list of profiles match.

If you do not specify profile, the default is any.

[type={dynamic|static}]

Specifies that you only want those rules of the selected type displayed.

  • If you select dynamic, the rules displayed are from the currently active configuration.

  • If you select static, the rules displayed are from the current store, as determined by the set store command.

If you do not specify type, the default is static.

[verbose]

Specifies that you want additional details for each rule displayed.

Examples

  • The following command displays all currently defined rules in the current store:

    show rule name=all

  • The following command displays all static rules in the current store:

    show rule name=all type=static

Netsh AdvFirewall Firewall context

Typing the command firewall at the netsh advfirewall context changes to the Netsh AdvFirewall Firewall context, where you can view, create, and modify firewall rules. This context is the command-line equivalent to the Inbound Rules and Outbound Rules nodes of the Windows Firewall with Advanced Security MMC snap-in.

Note
This context is different from the netsh firewall context. You can only run the command netsh advfirewall firewall, or apply policies created with that command on computers that are running Windows Vista or Windows Server 2008.

The netsh firewall context is backwards compatible with Windows XP and Windows Server 2003, but only enables you to configure a subset of what the advfirewall firewall context supports. For more information about the netsh firewall context, see Netsh Commands for Windows Firewall.

To view the syntax of commands available in the Firewall context, click a command:

  • add

  • delete

  • set

  • show

add

In the netsh advfirewall firewall context, the add command only has one variation, the add rule command.

add rule

Adds a new inbound or outbound firewall rule that filters traffic by allowing or blocking network packets that match the specified criteria.

Syntax

add rule name= RuleName dir={in|out} action={allow|block|bypass} [program=ProgramPath\FileName] [service={ServiceShortName|any}] [description=RuleDescription] [enable={yes|no}] [profile={public|private|domain|any|[,...]}] [localip={Addresses}] [remoteip={Addresses}] [localport={any| Integer| rpc| rpc-epmap| teredo|[,...]}] [remoteport={any|Integer|[,...]}] [protocol={any| Integer| icmpv4| icmpv6| icmpv4:type,code| icmpv6:type,code| tcp| udp}] [interfacetype={any|wireless|lan|ras}] [rmtcomputergrp=SDDLString] [rmtusrgrp=SDDLString] [edge={yes|no}] [security={authenticate| authenc| notrequired}]

Parameters

name = RuleName

Required. Specifies the name of this firewall rule. The name should be unique, and must not be "all".

dir={in|out}

Required. Specifies whether this rule matches inbound or outbound network traffic.

dir can be any of the following values:

  • in. The rule matches only inbound network traffic that is arriving at the computer. This rule appears in the Windows Firewall with Advanced Security MMC snap-in under Inbound Rules.

  • out. The rule matches only outbound network traffic that is sent by the computer. This rule appears in the Windows Firewall with Advanced Security MMC snap-in under Outbound Rules.

action={allow|block|bypass}

Required. Specifies what Windows Firewall with Advanced Security does to filter network packets that match the criteria specified in this rule.

action can be one of the following:

  • allow. Network packets that match all criteria specified in this rule are permitted through the firewall.

  • block. Network packets that match all criteria specified in this rule are dropped by the firewall.

  • bypass. Valid only for rules that include dir=in and that have one or more accounts listed in rmtcomputergrp and optionally rmtusrgrp. Network packets that match this rule and that are successfully authenticated against a computer account specified in rmtcomputergrp and against a user account identified in rmtusrgrp are permitted through the firewall. If you specify this option, then you cannot set security=notrequired. This option is the equivalent to the Override block rules checkbox in the Windows Firewall with Advanced Security MMC snap-in.

[program=ProgramPath\FileName]

Specifies that network traffic generated by the identified executable program matches this rule.

Caution
Creating firewall rules for hosting processes such as svchost.exe can lead to unpredictable behavior in Windows Firewall with Advanced Security. Starting in Windows Vista, the security of Windows network services was increased by using predefined, built-in firewall rules. Creating new rules referencing services that are already protected by the built-in rules might result in conflicts or undesired side-effects.

If program is not specified, then network traffic generated by any program matches this rule.

[service={ServiceShortName|any}]

Specifies that traffic generated by the identified service matches this rule. The ServiceShortName for a service can be found in Services MMC snap-in, by right-clicking the service, selecting Properties, and examining Service Name.

If service is not specified then network traffic generated by any program or service matches this rule.

[description=RuleDescription]

Provides information about the firewall rule.

[enable={yes|no}]

Specifies whether the rule is currently enabled.

If enable is not specified, the default is yes.

[profile={public| private| domain| any|[,...]}]

Specifies the profile(s) to which the firewall rule is assigned. The rule is only active on the local computer when the specified profile is the currently active profile.

You can include multiple entries for profile by separating them with a comma. Do not include any spaces.

If profile is not specified, the default is any.

[localip={Addresses}]

Specifies that network packets with matching IP addresses match this rule. localip is compared to the Destination IP address field of an inbound network packet. It is compared to the Source IP address field of an outbound network packet.

localip can be any of the following values:

  • any. Matches any IP address.

  • IPAddress. Matches only the exact IPv4 or IPv6 address.

  • IPSubnet. Matches any IPv4 or IPv6 address that is part of the specified subnet. The format is the subnet address, followed by '/' and then either the number of bits in the subnet mask or the subnet mask itself.

  • IPRange. Matches any IPv4 or IPv6 addresses that fall within the specified range. The format is the starting and ending IP addresses of the range separated by a '-'.

Multiple entries can be specified for localip by separating them with a comma. Do not include any spaces.

If localip is not specified, the default is any.

[remoteip={Addresses}]

Specifies that network packets with matching IP addresses match this rule. remoteip is compared to the Destination IP address field of an outbound network packet. It is compared to the Source IP address field of an inbound network packet.

remoteip can be any of the following values:

  • any. Matches any IP address.

  • localsubnet. Matches any IP address that is on the same IP subnet as the local computer.

  • dns|dhcp|wins|defaultgateway. Matches the IP address of any computer that is configured as the identified server type on the local computer.

  • IPAddress. Matches only the exact IPv4 or IPv6 address specified.

  • IPSubnet. Matches any an IPv4 or IPv6 subnet that is part of the specified subnet. The format is the subnet address, followed by '/' and then either the number of bits in the subnet mask or the subnet mask itself.

  • IPRange. Matches any IPv4 or IPv6 addresses that fall within the specified range. The format is the starting and ending IP addresses of the range separated by a '-'.

Multiple entries can be specified for remoteip by separating them with a comma.

If remoteip is not specified, the default is any.

[localport={any| Integer| rpc| rpc-epmap| teredo|[,...]}]

Specifies that network packets with matching IP port numbers matched by this rule. localport is compared to the Source Port field of an outbound network packet. It is compared to the Destination Port field of an inbound network packet.

localport can be any of the following values:

  • any. Matches any value in the port field of the IP packet.

  • Integer. Specifies the exact port number that must be present for the packet to match the rule.

  • rpc. Matches inbound TCP packets that are addressed to the listening socket of an application that correctly registers the port as an RPC listening port. A rule with this option must also specify protocol=tcp, and dir=in. We recommend that you also specify the appropriate program=ProgramName and/or service=ServiceName options to ensure that only the correct service can send or receive traffic by using this rule. This option eliminates the need to know the specific port numbers assigned to the application at when it starts.

  • rpc-epmap. Matches inbound TCP packets that are addressed to the dynamic RPC endpoint mapper service. A rule with this option must also specify protocol=tcp, and dir=in. We recommend that you also specify program=%windir%\system32\svchost.exe, and service=rpcss to ensure that only the RPC service can send or receive network traffic by using this rule. This option eliminates the need to know the specific port numbers assigned to the service when it starts. If you have one or more rules that specify localport=rpc, then you must also create a rule with localport=rpc-epmap enabled. This allows both the incoming request to the mapper, and the subsequent packets to the ephemeral ports assigned by the RPC service.

  • teredo. Matches inbound UDP packets that are addressed to the dynamic ports used by the Teredo service to support edge traversal tunneling of IPv6 traffic over IPv4 networks. A rule with this option must also specify protocol=udp, and dir=in. We recommend that you also specify program="%windir%\system32\svchost.exe", and service=iphlpsvc to ensure that only the Teredo service can send or receive network traffic by using this rule. This option eliminates the need to know the specific port numbers assigned to the service.

Multiple entries can be specified for localport by separating them with a comma. Do not include any spaces.

If localport is not specified, the default is any.

[remoteport={any|Integer|[,...]}]

Specifies that network packets with matching IP port numbers match this rule. remoteport is compared to the Destination Port field of an outbound network packet. It is compared to the Source Port field of an inbound network packet.

remoteport can be any of the following values:

  • any. Matches any value in the port field of the IP packet.

  • Integer. Specifies the exact port number that must be present for the packet to match the rule.

Multiple entries can be specified for remoteport by separating them with a comma. Do not include any spaces.

If remoteport is not specified, the default is any.

[protocol={any| Integer| icmpv4| icmpv6| icmpv4:type,code| icmpv6:type,code| tcp| udp}]

Specifies that network packets with a matching IP protocol match this rule.

protocol can be any of the following values:

  • any. Matches any value in the Protocol field of the IP packet.

  • Integer. Specifies the protocol by number that must be present for the packet to match the rule.

  • icmpv4. Specifies that all ICMP v4 packets match this rule.

  • icmpv6. Specifies that all ICMP v6 packets match this rule.

  • icmpv4: type , code. Specifies that only ICMP v4 network packets with the specified type and code match this rule. type and code can each be either the keyword any, or an integer ranging from 0 to 255.

  • icmpv6: type , code. Specifies that only ICMP v6 network packets with the specified type and code match this rule. type and code can each be either the keyword any, or an integer ranging from 0 to 255.

  • tcp. Specifies that only TCP traffic addressed to or from the ports identified by localport and remoteport matches this rule.

  • udp. Specifies that only UDP traffic addressed to or from the ports identified by localport and remoteport matches this rule.

Multiple entries can be specified for protocol by separating them with a comma. Do not include any spaces.

If protocol is not specified, the default is any.

[interfacetype={any| wireless| lan| ras}]

Specifies that only network packets passing through the indicated interface types match this rule. Using this parameter allows you to specify different firewall requirements for each of the three main network types. The value must be one of the following:

  • any. Network packets passing through any of the interface types match this rule.

  • wireless. Network packets that pass through a wireless network adapter match this rule.

  • lan. Network packets that pass through a wired LAN adapter match this rule.

  • ras. Network packets that pass through a RAS interface, such as a VPN or dial-up network connection match this rule.

If interfacetype is not specified, the default is any.

[rmtcomputergrp=SDDLString]

Specifies that only network packets that are authenticated as coming from or going to a computer identified in the list of computer and group accounts match this rule.

If rmtcomputergrp is specified, then security must be set to either authenticate or authenc.

If action=bypass, then at least one computer or computer group account must be specified in rmtcomputergrp.

For rmtcomputergrp to match, the network traffic must be authenticated using a credential that carries computer account information.

[rmtusrgrp=SDDLString]

Specifies that only network packets that are authenticated as coming from or going to a user identified in the list of user and group accounts match this rule.

If rmtusrgrp is specified, then security must be set to either authenticate or authenc.

For rmtusergrp to match, the network traffic must be authenticated using a credential that carries user account information.

[edge={yes|no}]

Valid only when dir=in. Specifies that traffic that traverses an edge device, such as a Network Address Translation (NAT) enabled router, between the local and remote computer matches this rule.

This option is the equivant of the Allow edge traversal checkbox in the Windows Firewall with Advanced Security MMC snap-in.

If edge is not specified, the default is no.

[security={authenticate | authenc | notrequired } ]

Specifies that only network packets protected with the specified type of IPsec options match this rule.

security can be one of the following values:

  • authenticate. Network packets that are authenticated by IPsec match this rule. You must create a separate connection security rule to authenticate the traffic. This option is the equivalent of the Allow only secure connections in the Windows Firewall with Advanced Security MMC snap-in.

  • authenc. Network packets that are authenticated and encrypted by IPsec match this rule. You must create a separate connection security rule to authenticate and encrypt the traffic. This option is the equivalent of the Require encryption option in the Windows Firewall with Advanced Security MMC snap-in.

  • notrequired. Any network packet matches this rule, whether or not it is protected by IPsec. This option is the equivalent of not selecting the Allow only secure connections option in the Windows Firewall with Advanced Security MMC snap-in.

If security is not specified, the default is notrequired.

Remarks

  • Do not create a firewall rule with the name all. Doing this creates a conflict with the netsh option to select all firewall rules (for example, delete rule name=all).

  • If rmtcomputergrp or rmtusergrp is specified, then the network traffic must also match a connection security rule that authenticates the connection. The authentication protocol used must include identification of a computer or user account, such as Kerberos v5, NTLM v2, or a computer certificate with account mapping enabled.

  • Do not set both edge=yes and remoteip=localsubnet. They are conflicting options and result in the firewall blocking all network traffic from outside the edge device.

  • For more information about SDDL strings and their format, see "Security Descriptor String Format" (http://go.microsoft.com/fwlink/?linkid=109950) on the Microsoft MSDN Web site.

  • One way to find the SDDL strings for computer, user, or group accounts is to use the Windows Firewall with Advanced Security MMC snap-in to create a temporary firewall rule. If the accounts of interest are domain accounts, you must run the snap-in on a computer that is joined to the domain with the accounts. Be sure to disable the rule so that it can not interfere with any network traffic. On the Users and Computers tab, select Only allow connections from these computers, and then click the Add button to find the computer or machine group account of interest. You can also select the Only allow connections from these users, and then click the Add button to find the user or group account of interest. After creating the rule, you can use the command netsh advfirewall firewall show rule name=rulename verbose to view the SDDL string for that computer or group. Be sure to delete the temporary rule when you are finished.

Examples

  • The following command creates an outbound rule to block all traffic from the local computer that originates on TCP port 80.

    add rule name="Block Outbound Port 80" dir=out localport=80 protocol=TCP action=block

  • The following command creates a rule that blocks all inbound traffic from all WINS servers:

    add rule name="Block WINS" dir=in action=block remoteip=wins

  • The following command creates an inbound rule that allows traffic for the Windows Messenger program only from computers on the same subnet as the local computer.

    add rule name="Allow Messenger" dir=in program="c:\program files\messenger\msmsgs.exe" remoteip=localsubnet action=allow

  • The following command creates a rule that permits inbound Windows Messenger network traffic only if the connection from the remote computer is authenticated by using a separate connection security rule.

    add rule name="Allow Authenticated Messenger" dir=in program="c:\program files\messenger\msmsgs.exe" security=authenticate action=allow

  • The following command creates a rule that allows all network traffic from computers that are members of a specific computer group, and only from users that are members of a specific user group. Both memberships must be confirmed by authentication using a separate connection security rule. The actual SDDL strings to use should be determined by referring to the SDDL documentation and steps identified in the Remarks section above.

    add rule name="Allow Only Specific Computers and Users" dir=in rmtcomputergrp=D:(A;;CC;;; SIDforMachineGroupAccount ) rmtusergrp= D:(A;;CC;;; SIDforUserGroupAccount ) action=bypass security=authenticate

  • The following two commands creates rules that prevent all wireless network traffic:

    add rule name="Block Wireless In" dir=in interface=wireless action=block

    add rule name="Block Wireless Out" dir=out interface=wireless action=block

  • The following command creates a rule to allow TCP traffic addressed to port 12345 to a specific application from computers on the remote side of an edge (NAT) device, using the Teredo IPv6 interface:

    add rule name="Allow TCP 12345" dir=in action=allow edge=yes remoteip=any protocol=TCP localport=12345 program="c:\program files\TestIPv6App.exe"

delete

In the netsh advfirewall firewall context, the Delete command only has one variation, the Delete Rule command.

delete rule

Deletes all connection security rules that match the specified criteria.

Syntax

delete rule name={all|RuleName} [dir={in|out}] [profile={public| private| domain| any|[,...]}] [program=ProgramPath\FileName] [service={ServiceShortName|any}] [localip={Addresses}] [remoteip={Addresses}] [localport={any| Integer| rpc| rpc-epmap|[,...]}] [remoteport={any|Integer|[,...]}] [protocol={any| Integer| icmpv4| icmpv6| icmpv4:type,code| icmpv6:type,code| tcp| udp}]

Parameters

name={all|RuleName}

Required. You can specify one of the following values:

  • The rule name of the connection security rule you want deleted.

  • all. Specifies that all rules matching the criteria in the other parameters are deleted. If no other parameters are included in the command then all connection security rules are deleted.

[dir={in|out}]

Specifies that only rules of the selected direction are deleted. The value can be either in or out.

[profile={public| private| domain| any|[,...]}]

Specifies that only rules assigned to the specified profile(s) are deleted. If you specify more than one profile, then only rules that include the exact same list of profiles match.

[program=ProgramPath\FileName]

Specifies that only rules that match the identified program are deleted.

[service={ServiceShortName| any}]

Specifies that only rules that match the identified service name are deleted.

[localip={Addresses}]

Specifies that only rules that match the IP addresses, ranges, or subnets are deleted. If your rule includes multiple entries, then the rule only matches if it contains the exact same list of entries.

localip can be any of the following values:

  • The keyword any.

  • IPAddress. Specifies an IPv4 or IPv6 address.

  • IPSubnet. Specifies an IPv4 or IPv6 subnet. The format is the subnet address, followed by '/' and then either the number of bits in the subnet mask or the subnet mask itself.

  • IPRange. Specifies a range of IPv4 or IPv6 addresses. The format is the starting and ending IP addresses of the range separated by a '-'.

You can specify multiple entries for localip by separating them with a comma. Do not include any spaces.

[remoteip={Addresses}]

Specifies that only rules that match the IP addresses, ranges, subnets, or server types are deleted. If your rule includes multiple entries, then the rule only matches if it contains the exact same list of entries.

remoteip can be any of the following values:

  • One of the keywords any, localsubnet, dns, dhcp, wins, defaultgateway.

  • IPAddress. Specifies an IPv4 or IPv6 address.

  • IPSubnet. Specifies an IPv4 or IPv6 subnet. The format is the subnet address, followed by '/' and then either the number of bits in the subnet mask or the subnet mask itself.

  • IPRange. Specifies a range of IPv4 or IPv6 addresses. The format is the starting and ending IP addresses of the range separated by a '-'.

You can specify multiple entries for remoteip by separating them with a comma. Do not include any spaces.

[localport={any| Integer| rpc | rpc-epmap| teredo|[,...]}] [remoteport={any|Integer|[,...]}]

Specifies that only rules that match the port numbers or keywords indicated are deleted.

If specify localport or remoteport then you must specify protocol, and it must be set to either tcp or udp

[protocol={any| Integer| icmpv4| icmpv6| icmpv4:type,code| icmpv6:type,code| tcp| udp}]

Specifies that only rules that match the indicated protocol value are deleted.

Remarks

  • If multiple rules are found that match the specified criteria, then they are all deleted.

  • If you specify name=all and do not specify any other criteria, then all firewall rules are deleted.

Examples

  • The following example deletes a rule based on its exact name:

    Delete rule name="rule1"

  • The following example deletes all rules for TCP port 80:

    delete rule name=all protocol=tcp localport=80

set

In the netsh advfirewall firewall context, the Set command only has one variation, the Set Rule command.

set rule

Modifies an existing firewall rule identified by name, or found by matching the specified criteria. Criteria that precede the keyword new identify the rule(s) to be modified. Criteria that follow the keyword new indicate properties that are modified or added.

Syntax

set rule {group=GroupName| name={all|RuleName}} [dir={in|out}] [profile={public| private| domain| any}[,...]] [program=ProgramPath\FileName] [service={ServiceShortName|any}] [localip=Addresses] [remoteip=Addresses] [localport={any|rpc| rpc-epmap| Integer|[,...]}] [remoteport={any| Integer|[,...]}] [protocol={any| Integer| icmpv4| icmpv6| icmpv4:type,code| icmpv6:type,code| tcp| udp}] new [name=NewRuleName] [dir={in|out}] [program=ProgramPath\FileName] [service={ServiceShortName|any}] [action={allow|block|bypass}] [description=RuleDescription] [enable={yes|no}] [profile={public| private| domain| any|[,...]}] [localip=Addresses] [remoteip=Addresses] [localport={any| rpc| rpc-epmap| teredo| Integer|[,...]}] [remoteport={any|Integer|[,...]} [protocol={any| Integer| icmpv4| icmpv6| icmpv4:type,code| icmpv6:type,code| tcp| udp}] [interfacetype={any| wiresless| lan| ras}] [rmtcomputergrp=SDDLString] [rmtusrgrp=SDDLString] [edge={yes|no}] [security={authenticate| authenc| notrequired}]

Parameters

{group= GroupName| name={all|RuleName}}

Required. Specifies either the group name for a set of rules to modify together, or a rule name assigned to an existing rule that you want to modify. If you specify the group name for a set of rules, then all of the rules in that group receive the same set of modifications.

If name=all, then all rules that match the other criteria listed before the new keyword are modified.

If name=all, and no other parameters are included before the new keyword, then all rules are modified as indicated.

[dir={in|out}]

Specifies that only matching rules of the indicated direction are modified. The value of dir can be either in or out.

[profile={public| private| domain| any}[,...]]

Specifies that only matching rules that are assigned to the indicated profile are modified. If you specify a comma separated list, then only rules that contain the exact same list are modified.

program= ProgramPath \ FileName]

Specifies that only rules that match the identified program are modified.

[service={ServiceShortName| any}]

Specifies that only rules that match the identified service name are modified.

If service is not specified, then rules that specify any value, including no value, and that match all other criteria, are modified.

[localip={Addresses}]

Specifies that only rules that match the IP addresses, ranges, or subnets are modified. If you specify a comma separated list, then only rules that contain the exact same list are modified.

localip can be any of the following values:

  • The keyword any.

  • IPAddress. Specifies an IPv4 or IPv6 address.

  • IPSubnet. Specifies an IPv4 or IPv6 subnet. The format is the subnet address, followed by '/' and then either the number of bits in the subnet mask or the subnet mask itself.

  • IPRange. Specifies a range of IPv4 or IPv6 addresses. The format is the starting and ending IP addresses of the range separated by a '-'.

You can specify multiple entries for localip by separating them with a comma.

[remoteip={Addresses}]

Specifies that only rules that match the IP addresses, ranges, subnets, or server types are modified. If you specify a comma separated list, then only rules that contain the exact same list are modified.

remoteip can be any of the following values:

  • One of the keywords any, localsubnet, dns, dhcp, wins, defaultgateway.

  • IPAddress. Specifies an IPv4 or IPv6 address.

  • IPSubnet. Specifies an IPv4 or IPv6 subnet. The format is the subnet address, followed by '/' and then either the number of bits in the subnet mask or the subnet mask itself.

  • IPRange. Specifies a range of IPv4 or IPv6 addresses. The format is the starting and ending IP addresses of the range separated by a '-'.

You can specify multiple entries for remoteip by separating them with a comma.

[localport={any| Integer| rpc | rpc-epmap| teredo|[,...]}] [remoteport={any|Integer|[,...]}]

Specifies that only rules that match the port numbers or keywords indicated are deleted. If you specify a comma separated list, then only rules that contain the exact same list are modified.

[protocol={any| Integer| icmpv4| icmpv6| icmpv4:type,code| icmpv6:type,code| tcp| udp}]

Specifies that only rules that match the indicated protocol value are modified. If you specify a comma separated list, then only rules that contain the exact same list are modified.

new

Any parameter that precedes this keyword is used to find a match for the rules that are modified. Any parameter that follows this keyword indicates a value that is modified in the rules that match the specified criteria.

[name=NewRuleName]

Specifies a new name for the connection security rule. The name should be unique, and must not be "all".

[dir={in|out}]

Specifies whether this rule matches inbound or outbound network traffic.

Dir can be one of the following values:

  • in. The rule matches only inbound network traffic that is arriving at the computer. This rule appears in the Windows Firewall with Advanced Security MMC snap-in under Inbound Rules.

  • out. The rule matches only outbound network traffic that is sent by the computer. This rule appears in the Windows Firewall with Advanced Security MMC snap-in under Outbound Rules.

[action={allow|block|bypass}]

Specifies what Windows Firewall with Advanced Security does to filter network packets that match the criteria specified in this rule.

action can be one of the following:

  • allow. Network packets that match all criteria specified in this rule are permitted through the firewall.

  • block. Network packets that match all criteria specified in this rule are dropped by the firewall.

  • bypass. Valid only for rules that include dir=in and that have one or more accounts listed in rmtcomputergrp and optionally rmtusrgrp. Network packets that match this rule and that are successfully authenticated against a computer account specified in rmtcomputergrp and against a user account identified in rmtusrgrp are permitted through the firewall. If you specify this option, then you cannot set security=notrequired. This option is the equivalent to the Override block rules checkbox in the Windows Firewall with Advanced Security MMC snap-in.

[program=ProgramPath\FileName]

Specifies that network traffic generated by the identified executable program matches this rule.

Caution
Creating firewall rules for hosting processes such as svchost.exe can lead to unpredictable behavior in Windows Firewall with Advanced Security. Starting in Windows Vista, the security of Windows network services was increased by using predefined, built-in firewall rules. Creating new rules referencing services that are already protected by the built-in rules might result in conflicts or undesired side-effects.

[service={ServiceShortName|any}]

Specifies that traffic generated by the identified service matches this rule. The ServiceShortName for a service can be found in Services MMC snap-in, by right-clicking the service, selecting Properties, and examining Service Name.

[description=RuleDescription]

Provides information about the firewall rule.

[enable={yes|no}]

Specifies whether the rule is currently enabled.

[profile={public| private| domain| any|[,...]}]

Specifies the profile(s) to which the firewall rule is assigned. The rule is only active on the local computer when the specified profile is the currently active profile.

You can include multiple entries for profile by separating them with a comma. Do not include any spaces.

[localip={Addresses}]

Specifies that network packets with matching IP addresses match this rule. localip is compared to the Destination IP address field of an inbound network packet. It is compared to the Source IP address field of an outbound network packet.

localip can be any of the following values:

  • any. Matches any IP address.

  • IPAddress. Matches only the exact IPv4 or IPv6 address.

  • IPSubnet. Matches any an IPv4 or IPv6 subnet that is part of the specified subnet. The format is the subnet address, followed by '/' and then either the number of bits in the subnet mask or the subnet mask itself.

  • IPRange. Matches any IPv4 or IPv6 addresses that fall within the specified range. The format is the starting and ending IP addresses of the range separated by a '-'.

Multiple entries can be specified for localip by separating them with a comma. Do not include any spaces.

[remoteip={Addresses}]

Specifies that network packets with matching IP addresses match this rule. remoteip is compared to the Destination IP address field of an outbound network packet. It is compared to the Source IP address field of an inbound network packet.

remoteip can be any of the following values:

  • any. Matches any IP address.

  • localsubnet. Matches any IP address that is on the same IP subnet as the local computer.

  • dns|dhcp|wins|defaultgateway. Matches the IP address of any computer that is configured as the identified server type on the local computer.

  • IPAddress. Matches only the exact IPv4 or IPv6 address specified.

  • IPSubnet. Matches any an IPv4 or IPv6 subnet that is part of the specified subnet. The format is the subnet address, followed by '/' and then either the number of bits in the subnet mask or the subnet mask itself.

  • IPRange. Matches any IPv4 or IPv6 addresses that fall within the specified range. The format is the starting and ending IP addresses of the range separated by a '-'.

Multiple entries can be specified for remoteip by separating them with a comma. Do not include any spaces.

[localport={any| Integer| rpc| rpc-epmap| teredo|[,...]}]

Specifies that network packets with matching IP port numbers match this rule. localport is compared to the Source Port field of an outbound network packet. It is compared to the Destination Port field of an inbound network packet.

localport can be any of the following values:

  • any. Matches any value in the port field of the IP packet.

  • Integer. Specifies the exact port number that must be present for the packet to match the rule.

  • rpc. Matches inbound TCP packets that are addressed to the listening socket of an application that correctly registers the port as an RPC listening port. A rule with this option must also specify protocol=tcp, dir=in. We recommend that you also specify the appropriate program=ProgramName and/or service=ServiceName options to ensure that only the correct service can send or receive traffic by using this rule. This option eliminates the need to know the specific port numbers assigned to the application at when it starts.

  • rpc-epmap. Matches inbound TCP packets that are addressed to the dynamic RPC endpoint mapper service. A rule with this option must also specify protocol=tcp, dir=in. We recommend that you also specify program=%windir%\system32\svchost.exe, and service=rpcss to ensure that only the RPC service can send or receive network traffic by using this rule. This option eliminates the need to know the specific port numbers assigned to the service when it starts. . If you have one or more rules that specify localport=rpc, then you must also create a rule with localport=rpc-epmap enabled. This allows both the incoming request to the mapper, and the subsequent packets to the ephemeral ports assigned by the RPC service.

  • teredo. Matches inbound UDP packets that are addressed to the dynamic ports used by the Teredo service to support edge traversal tunneling of IPv6 traffic over IPv4 networks. A rule with this option must also specify protocol=udp, dir=in. We recommend that you also specify program="%windir%\system32\svchost.exe", and service=iphlpsvc to ensure that only the Teredo service can send or receive network traffic by using this rule. This option eliminates the need to know the specific port numbers assigned to the service.

Multiple entries can be specified for localport by separating them with a comma. Do not include any spaces.

[remoteport={any|Integer|[,...]}]

Specifies that network packets with matching IP port numbers match this rule. remoteport is compared to the Destination Port field of an outbound network packet. It is compared to the Source Port field of an inbound network packet.

remoteport can be any of the following values:

  • any. Matches any value in the port field of the IP packet.

  • Integer. Specifies the exact port number that must be present for the packet to match the rule.

Multiple entries can be specified for remoteport by separating them with a comma. Do not include any spaces.

[protocol={any |Integer| icmpv4| icmpv6| icmpv4:type,code| icmpv6:type,code| tcp| udp}]

Specifies that network packets with a matching IP protocol match this rule.

protocol can be one of the following values:

  • any. Matches any value in the Protocol field of the IP packet.

  • Integer. Specifies the protocol by number that must be present for the packet to match the rule.

  • icmpv4. Specifies that all ICMP v4 packets match this rule.

  • icmpv6. Specifies that all ICMP v6 packets match this rule.

  • icmpv4: type , code. Specifies that only ICMP v4 network packets with the specified type and code match this rule. type and code can each be either the keyword any, or an integer ranging from 0 to 255.

  • icmpv6: type , code. Specifies that only ICMP v6 network packets with the specified type and code match this rule. type and code can each be either the keyword any, or an integer ranging from 0 to 255.

  • tcp. Specifies that only TCP traffic addressed to or from the ports identified by localport and remoteport matches this rule.

  • udp. Specifies that only UDP traffic addressed to or from the ports identified by localport and remoteport matches this rule.

Multiple entries can be specified for protocol by separating them with a comma.

[interfacetype={any| wireless| lan| ras}]

Specifies that only network packets passing through the indicated interface types match this rule. Using this parameter allows you to specify different firewall requirements for each of the three main network types. The value must be one of the following:

  • any. Network packets passing through any of the interface types match this rule.

  • wireless. Network packets that pass through a wireless network adapter match this rule.

  • lan. Network packets that pass through a wired LAN adapter match this rule.

  • ras. Network packets that pass through a RAS interface, such as a VPN or dial-up network connection match this rule.

[rmtcomputergrp=SDDLString]

Specifies that only network packets that are authenticated as coming from or going to a computer identified in the list of computer and group accounts are filtered by this rule.

If rmtcomputergrp is specified, then security must be set to either authenticate or authenc.

If action=bypass, then at least one computer or computer group account must be specified in rmtcomputergrp.

For rmtcomputergrp to match, the network traffic must be authenticated using a credential that carries computer account information.

[rmtusrgrp=SDDLString]

Specifies that only network packets that are authenticated as coming from or going to a user identified in the list of user and group accounts are filtered this rule.

If rmtusrgrp is specified, then security must be set to either authenticate or authenc.

For rmtusergrp to match, the network traffic must be authenticated using a credential that carries user account information.

[edge={yes|no}]

Valid only when dir=in. Specifies that traffic that traverses an edge device, such as a Network Address Translation (NAT) enabled router, between the local and remote computer matches this rule.

This option is the equivant of the Allow edge traversal checkbox in the Windows Firewall with Advanced Security MMC snap-in.

[security={authenticate| authenc| notrequired}]

Specifies that only network packets protected with the specified type of IPsec options match this rule.

security can be one of the following values:

  • authenticate. Network packets that are authenticated by IPsec match this rule. You must create a separate connection security rule to authenticate the traffic. This option is the equivalent of the Allow only secure connections in the Windows Firewall with Advanced Security MMC snap-in.

  • authenc. Network packets that are authenticated and encrypted by IPsec match this rule. You must create a separate connection security rule to authenticate and encrypt the traffic. This option is the equivalent of the Require encryption option in the Windows Firewall with Advanced Security MMC snap-in.

  • notrequired. Any network packet matches this rule, whether or not it is protected by IPsec. This option is the equivalent of not selecting the Allow only secure connections option in the Windows Firewall with Advanced Security MMC snap-in.

Remarks

  • Do not modify a firewall rule to use the name all. Doing this creates a conflict with the netsh option to select all firewall rules (for example, set rule name=all).If multiple rules match the criteria you specify, then all matching rules are modified with the changes included in the command.

  • Any parameters that follow the new keyword that you do not include in the command are not modified, and maintain their previous value.

  • To see the group assignments for the predefined Windows Firewall rules, look in the Windows Firewall with Advanced Security MMC snap-in, under the Inbound Rules and Outbound Rules nodes. The Group column in the Details pane contains the group assignment for each rule. This version of Windows supports group names only for predefined rules included with Windows Firewall at installation. There is currently no supported way to create a group or assign your custom rules to a group.

  • If rmtcomputergrp or rmtusergrp is specified, then the network traffic must also match a connection security rule that authenticates the connection. The authentication protocol used must include identification of a computer or user account, such as Kerberos v5, NTLM v2, or a computer certificate with account mapping enabled.

  • Do not set both edge=yes and remoteip=localsubnet. They are conflicting options and result in the firewall blocking all network traffic from outside the edge device.

  • For more information about SDDL strings and their format, see "Security Descriptor String Format" (http://go.microsoft.com/fwlink/?linkid=109950) on the Microsoft MSDN Web site.

  • One way to find an SDDL string for a computer or group account is to use the Windows Firewall with Advanced Security MMC snap-in to create a temporary firewall rule. Be sure to disable the rule so that it can not interfere with any network traffic. On the Users and Computers tab, select Only allow connections from these computers, and then use the Add button to find the computer or group account(s) of interest. After creating the rule, you can use the command netsh advfirewall firewall show rule name=rulename verbose to view the SDDL string for that computer or group. Be sure to delete the temporary rule when you are finished.

Examples

  • The following command changes a rule to match a different remote IP address of a Web server whose traffic is allowed by a rule:

    set rule name="AllowWeb80" new remoteip=192.168.0.2

  • The following command enables all rules in a predefined group:

    set rule group="windows firewall remote management" new enable=yes

  • The following command changes a rule to require authentication. A separate connection security rule must exist to perform the authentication:

    set rule name="AllowMessenger" new security=authenticate

  • For more example of how to use the various parameters that can follow the new keyword, see the firewall add rule examples section.

show

In the netsh advfirewall firewall context, the show command only has one variation, the Show Rule command.

show rule

Displays an existing connection security rule.

Syntax

show rule name={all|RuleName} [profile={public| private| domain| any}[,...]] [type={dynamic|static}] [verbose]

Parameters

name={all|RuleName}

Required. Specifies the rule name assigned to the rule that you want to display. If name=all, then all rules that match the other criteria listed before the new keyword are displayed.

If name=all, and no other parameters are included before the new keyword, then all rules are displayed.

[profile={public| private| domain| any|[,...]}]

Specifies that only matching rules that are assigned to the indicated profile are modified. If you specify a comma separated list, then only rules that contain the exact same list are modified.

[type={dynamic|static}]

Specifies that you only want those rules of the selected type displayed.

Type can be one of the following values:

  • Dynamic. Displays the rules currently active on your local computer.

  • Static. Displays rules defined in the current store, as defined by the set store command.

If type is not specified, then both types of rules are displayed.

[verbose]

Specifies that you want additional details for each rule displayed.

Examples

  • The following command displays all currently defined firewall rules:

    show rule name=all

  • The following command displays all firewall rules that are for the domain profile:

    show rule name=all profile=domain

    This command does not show rules where profile=domain,public or profile=domain,private. It only shows rules that have the single entry domain included in the rule.

Netsh AdvFirewall Monitor context

Typing the command monitor at the netsh advfirewall context changes to the Netsh AdvFirewall Monitor context, where you can view the IPsec security associations (SAs) that exist on your computer. This context is the command-line equivalent to the Monitoring section of the Windows Firewall with Advanced Security MMC snap-in.

The following commands are available at the netsh advfirewall monitor> prompt.

To view the command syntax, click a command:

  • delete

  • show

delete

Deletes the specified Main Mode or Quick Mode security associations.

Syntax

Delete {mmsa|qmsa} {IPv4AddressPair|IPv6AddressPair|all}

Parameters

mmsa|qmsa

Required. Specifies the type of SA to delete.

  • mmsa specifies that Main Mode SAs matching the specified addresses are deleted.

  • qmsa specifies that Quick Mode SAs matching the specified addresses are deleted.

IPv4AddressPair|IPv6AddressPair|all

Specifies the SAs to delete by matching source and destination IP addresses. The address pairs are a single IP source address and a single IP destination address. The order does not matter. The IP version of both addresses must match.

You can specify a wildcard for either address to indicate a match for any address:

  • IPv4: 0.0.0.0

  • IPv6: ::0

If you use the keyword all, then all SAs of the specified type are deleted.

Examples

  • The following command deletes all Main Mode SAs active on the local computer:

    delete mmsa all

  • The following command deletes any existing Quick Mode SA between two specific IP addresses:

    delete qmsa 192.168.1.1 192.168.2.2

show

Displays the specified Main Mode or Quick Mode security associations.

Syntax

show {mmsa|qmsa} {IPv4AddressPair|IPv6AddressPair|all}

Parameters

mmsa|qmsa

Required. Specifies the type of SA to display.

  • mmsa displays Main Mode SAs that match the specified addresses.

  • qmsa displays Quick Mode SAs that match the specified addresses.

IPv4AddressPair | IPv6AddressPair | all

Specifies the SAs to display by matching source and destination IP addresses. The address pairs are a single IP source address and a single IP destination address. The order does not matter. The IP version of both addresses must match.

You can specify a wildcard for either address to indicate a match for any address:

  • IPv4: 0.0.0.0

  • IPv6: ::0

If you use the keyword all, then all SAs of the indicated type are displayed.

Examples

  • The following command displays all Main Mode SAs active on the local computer:

    show mmsa all

  • The following command displays any existing Quick Mode SA between two specific IP addresses:

    show qmsa 192.168.1.1 192.168.2.2

  • The following command displays any existing Main Mode SAs that exist between a certain IP address and any other:

    show mmsa 192.168.1.1 0.0.0.0


Netsh Commands for Windows Hypertext Transfer Protocol (WINHTTP)

You can use commands in the netsh winhttp context to configure proxy and tracing settings for Windows HTTP. The Netsh commands for winhttp can be run manually at the netsh prompt or in scripts and batch files.

To run these commands from the command prompt, you must either enter the netsh winhttp context or prepend the context to the command. For example, if you are at the command prompt but have not typed netsh and then winhttp to enter the netsh winhttp context, you must type:

netsh winhttp command

Where command is the command that you want to run, including all of the required parameters for the command.

For information on how to interpret netsh command syntax, see Formatting Legend.

This section contains the following commands:

  • flush logbuffer

  • import proxy

  • reset proxy

  • reset tracing

  • set proxy

  • set tracing

  • show proxy

  • show tracing

Netsh winhttp commands

The following entries provide details for each command.

flush logbuffer

Flushes the internal buffers for the log files.

Syntax

flush loggbuffer

import proxy

Imports the proxy settings in the Internet Explorer Web browser's Internet Options. Importing settings from IE is the only available option

Syntax

import proxy source =ie

reset proxy

Resets the WinHTTP proxy setting to DIRECT.

Syntax

reset proxy

reset tracing

Resets the WinHTTP trace parameters to the default settings.

Syntax

reset tracing

Remarks

Following are the default WinHTTP trace parameters:

Copy Code
Tracing State
Copy Code
Disabled
Copy Code
trace-file-prefix
Copy Code
None
Copy Code
output
Copy Code
File
Copy Code
level
Copy Code
Default
Copy Code
format
Copy Code
Ansi
Copy Code
max-trace-file-size
Copy Code
65535

set proxy

Configures the WinHTTP proxy setting.

Syntax

set proxy [proxy-server=] ProxyServerName [bypass-list=] <HostsList>

Parameters

Proxy-Server

Required. Specifies the proxy server to use for http, secure http (https), or both http and https protocols.

Bypass-list

Optional. Specifies a list of Web sites that should be visited without utilizing the proxy server. Use "<local>" to bypass all short name hosts.

Examples

Following are three examples of how to use the set proxy command.

Copy Code
set proxy myproxy
set proxy myproxy:80 "<local>bar"
set proxy proxy-server="http=myproxy;https=sproxy:88" bypass-list="*.contoso.com"

set tracing

Configures the WinHTTP tracing parameters.

Syntax

set tracing [output=] file | debugger | both [trace-file-prefix=] FilePrefix [level=] default | verbose [format=] ansi | hex [max-trace-file-size=] FileSize [state=] enabled |disabled

Parameters:

Output

Optional. Specifies whether tracing data is exported to a file, a debugger, or both.

Trace-file-prefix

Optional. Specifies a string value that is a prefix for the log file. The file prefix can include a folder location/path. Type "*" to delete an existing prefix.

Level

Optional. Specifies the amount of information to log.

Format

Optional. Specifies the display format of network traffic (hexadecimal or ansi).

Max-trace-file-size

Optional. Specifies a numeric value that is the maximum size of the trace file in bytes.

State

Required. Specifies whether tracing is enabled or disabled.

Examples

Following are two examples of how to use the set tracing command.

Copy Code
set tracing trace-file-prefix="C:\Temp\Test3" level=verbose format=hex
set tracing output=debugger max-trace-file-size=512000 state=enabled

show proxy

Displays the current WinHTTP proxy setting.

Syntax

show proxy

show tracing

Displays the current WinHTTP tracing parameters.

Syntax

show tracing


Netsh Commands for Windows Internet Name Service (WINS)

The Netsh commands for Windows Internet Name Service (WINS) offer a command-line tool for administering WINS servers that can be used as an equivalent alternative to console-based management. This is useful in the following situations:

  • When managing WINS servers in wide area networks (WANs), commands can be used in interactive mode at the Netsh command prompt to better manage slow-speed network links.

  • When managing a large number of WINS servers, commands can be used in batch mode to script and automate recurring administrative tasks that need to be performed for all WINS servers.

You can run these commands from the Windows Server 2008 command prompt or from the command prompt for the Netsh wins context. For these commands to work at the Windows Server 2008 command prompt, you must type netsh wins before typing commands and parameters as they appear in the syntax below.

Notes

  • Unless otherwise specified, field tags (such as Name= and EndChar=) are optional. If tags are used, they must be applied to all of the parameters in the command. If tags are omitted, a value must be provided for each of the fields that are supported in this command.

  • The terms Persona Non Grata (PNG) and Persona Grata (PG) refer to the features Block records for these owners and Accept records only for these owners, respectively.

  • For more information about Netsh, see Netsh Overviewand Enter a Netsh Context.

  • For an example of how to use Netsh commands for WINS in batch files and scripts, see Netsh WINS Example.

The following commands are available at the wins> prompt, which is rooted within the netsh environment.

To view the command syntax, click a command:

  • server

  • add

  • add name

  • add partner

  • add pgserver

  • add pngserver

  • check

  • check database

  • check name

  • check version

  • delete

  • delete name

  • delete owners

  • delete partner

  • delete pgserver

  • delete pngserver

  • delete records

  • init

  • init backup

  • init import

  • init pull

  • init pullrange

  • init push

  • init replicate

  • init restore

  • init scavenge

  • init search

  • reset

  • reset statistics

  • set

  • set autopartnerconfig

  • set backuppath

  • set burstparam

  • set defaultparam

  • set logparam

  • set migrateflag

  • set namerecord

  • set periodicdbchecking

  • set pgmode

  • set pullparam

  • set pullpartnerconfig

  • set pushparam

  • set pushpartnerconfig

  • set replicateflag

  • set startversion

  • show

  • show browser

  • show database

  • show info

  • show name

  • show partner

  • show partnerproperties

  • show pullpartnerconfig

  • show pushpartnerconfig

  • show recbyversion

  • show reccount

  • show server

  • show serverstatistics

  • show version

  • show versionmap

For information on how to interpret netsh command syntax, see Formatting Legend.

Netsh WINS commands

The following entries provide details for each command.

server

Switches to the specified server context. Used without parameters, the local WINS server is assumed as the default.

Syntax

server [{\\ServerName | IPAddress}]

Parameters

{ \\ServerName| IPAddress}

Specifies the remote (non-local) WINS server to which to switch the Netsh WINS command-line context. Identifies the server by server name or IP address.

Examples

In the first example, this command changes the Netsh context to the local WINS server.

In the second example, this command changes the Netsh context to a remote server named \\WINS-SRV1.

In the third example, this command changes the Netsh context to a remote server with IP address 10.0.0.1.

server

server \\WINS-SRV1

server 10.0.0.1

Netsh WINS server

The following commands are available at the wins server> prompt, which is rooted within the netsh environment.

To view the command syntax, click a command:

add

add name

Adds a name record to the database on the specified WINS server.

Syntax

add name [Name=]ComputerName [[EndChar=]16thCharInHex] [[Scope=]ScopeName] [[RecType=]{0 | 1}] [[Group=]{0 | 1 | 2 | 3 | 4}] [[Node=]{0 | 1 | 3}] [IP=]{IPAddress1[,IPAddress2,IPAddress3... ]}

Parameters

[ Name=] ComputerName

Required. Specifies the name to add and register in the WINS server database.

[ EndChar=] 16thCharInHex

Indicates the 16th character of the name in hexadecimal. If unspecified, record types are added based on the value of Group=. For more information, see Remarks.

[ Scope=] ScopeName

Specifies the name of the NetBIOS scope.

[ RecType=]{ 0| 1}

Indicates the record type: 0-Static (default), 1-Dynamic.

[ Group=]{ 0| 1| 2| 3| 4}

Indicates the group type: 0-Unique (default), 1-Group, 2-Internet 3-Multihomed, 4-Domain Name.

[ Node=]{ 0| 1| 3}

Indicates the NetBIOS node type: 0-B Node, 1-P Node (default), 3-H Node.

[ IP=] {IPAddress1[ ,IPAddress2,IPAddress3...] }

Required. Specifies the IP address of the name record to add. If the computer is multihomed, more than one IP address can be specified. Use braces ({}) to enclose one or more IP addresses, and separate multiple IP addresses with commas.

Remarks

  • If EndChar= and Group= are both used, EndChar= overrides Group=.

  • When EndChar= is not specified, the following record types are added to the WINS database based on the value of Group=:

    Group parameter value Record type added

    Unique group (0)

    03h, 20h, 00h

    Normal group (1)

    1eh

    Special group/Internet (2)

    20h

    Multihomed group (3)

    03h, 20h, 00h

    Special group/domain (4)

    1ch

Examples

In the first example, this command adds a default NetBIOS record set of the 00h, 03h, and 20h records for a computer named HOSTA with a mapped IP address of 10.0.0.1.

In the second example, this command adds a 20h record for HOSTB, a multihomed computer with IP addresses 10.0.0.2 and 10.0.0.3, on SUBNETA, with a static record type and P-Node configuration.

add name Name=HOSTA IP={10.0.0.1}

add name HOSTB 20 SUBNETA 0 3 1{10.0.0.2,10.0.0.3}

add partner

Adds a replication partner to the list of replication partners on the specified WINS server.

Syntax

add partner [Server=]IPAddress [[NetBIOS=]ServerNetBIOSName] [[Type=]{0 | 1 | 2}]

Parameters

[ Server=] IPAddress

Required. Specifies the replication partner to add to the WINS server. Identifies the partner server by IP address.

[ NetBIOS=] ServerNetBIOSName

Specifies the replication partner to add to the WINS server. Identifies the partner server by NetBIOS name.

[ Type=]{ 0| 1| 2}

Indicates the type of partner to add: 0-Pull, 1-Push, 2-Both (default).

Remarks

  • If the IP address does not resolve, the NetBIOS name parameter is used to create the partner record. Otherwise, the NetBIOS parameter is not used.

Examples

In the following example, this command adds a push/pull replication partner with an IP address of 10.2.2.2 to the current WINS server.

add partner 10.2.2.2

add pgserver

Adds a list of Persona Grata (PG) servers to the specified WINS server.

Syntax

add pgserver [Servers=]{ListOfServerIPAddresses}

Parameters

[ Servers=] {ListOfServerIPAddresses}

Required. Specifies the Persona Grata server or servers to add. Identifies each server by its IP address, enclosed by braces ({}). If you provide a list, IP addresses must be separated by commas and enclosed by braces ({}).

Remarks

  • This command adds the new server or servers after checking for duplicates. The PG list is used to specify owners (other WINS servers) whose records are to be accepted during replication.

Examples

In the following example, this command adds the WINS servers 10.2.2.2 and 10.2.2.3 to the Persona Grata list for the current WINS server.

add pgserver {10.2.2.2,10.2.2.3}

add pngserver

Adds a list of Persona Non Grata (PNG) servers to the specified WINS server.

Syntax

add pngserver [Servers=]{ListOfServerIPAddresses}

Parameters

[ Servers=] {ListOfServerIPAddresses}

Required. Specifies the Persona Non Grata server or servers to add. Identifies each server by its IP address, enclosed by braces ({}). If you provide a list, IP addresses must be separated by commas and enclosed by braces ({}).

Remarks

  • This command adds the new server or servers after checking for duplicates. The PNG list is used to specify owners (other WINS servers) whose records are to be blocked during replication.

Examples

In the following example, this command adds the WINS servers 10.2.2.2 and 10.2.2.3 to the PNG list for the current WINS server.

add pngserver {10.2.2.2,10.2.2.3}

check

check database

Checks the consistency of the WINS database. Used without parameters, a consistency check is performed on all replicas whose verification interval has expired. The consistency check is not performed immediately if overload conditions exist, but occurs after the configured verification interval period has passed.

Syntax

check database [[All=]{1 | 0}] [[Force=]{1 | 0}]

Parameters

[ All=]{ 1| 0}

Indicates whether to perform a consistency check on all replicas or to perform a consistency check on the replicas whose verification interval has expired: 1-All, 0-Otherwise (default).

[ Force=]{ 1| 0}

Indicates whether to override the WINS consistency check under overload conditions: 1-Override, 0-Otherwise (default).

Remarks

  • It is a network and resource intensive operation to check all replicas for consistency.

  • Overload condition occurs when the consistency check command is repeated within the duration of one hour.

Examples

In the following example, this command does a consistency check for all replicas. If overload conditions exist, the consistency check is performed after the configured verification interval has passed.

check database 1

check name

Checks a list of name records against a specified set of WINS servers.

Syntax

check name {NameFile=FileName | NameList={NamesList}} {ServerFile=FileName | ServerList={ListOfServerIPAddresses}}[InclPartner={Y | y}]

Parameters

{ NameFile=FileName| NameList={NamesList}}

Required. Specifies the file that contains the list of names to check or specifies a list of names to check. If you provide a list, names must be separated by commas and enclosed by braces ({}).

{ ServerFile=FileName| ServerList={ListOfServerIPAddresses}}

Required. Specifies the file with the list of server IP addresses or specifies a list of the server IP addresses to check. If you provide a list, IP addresses must be separated by commas and enclosed by braces ({}).

InclPartner={ Y| y}

Specifies that all partners will be included in the list of servers. Partners are not included by default.

Remarks

  • Tags are required for this command. Whenever inconsistencies are found, repair is attempted.

  • The format for Name in both NameFile and NameList is Name*16thchar, where Name is the record name and 16thchar is the 16th character for the record.

  • In the file, name entries are separated by commas or carriage returns/line feeds.

Examples

In the first example, this command checks WINS data against the Names.txt and Servers.txt files, assuming those files to be located in the specified path location (the root of drive D).

In the second example, this command checks the names Name1 with 16th character 03, 00 and 20h respectively against the servers with IP addresses 10.2.2.2 and 10.2.2.3.

check name NameFile=D:\Names.txt ServerFile=D:\Servers.txt

check name NameList={Name1*03,Name1*00,Name1*20} ServerList={10.2.2.2,10.2.2.3}

check version

Checks the consistency of version ID numbers for WINS record owners in the WINS database.

Syntax

check version [Server=]IPAddress [[File=]FileName]

Parameters

[ Server=] IPAddress

Required. Specifies the IP address of the start WINS server.

[ File=] FileName

Specifies the file in which to store the index to IP address table. If omitted, check version creates the file Wins.rec in the current directory and stores the index to IP address table there.

Remarks

  • If you provide a file name that is not valid, FileName is set to Wins.rec in the current directory.

  • You might need to increase the width of the command window to make it wide enough to view the table correctly.

Examples

In the following example, this command verifies the version number consistency of the records for a WINS server with the IP address 10.2.2.2 at its replication partners.

check version 10.2.2.2

delete

delete name

Deletes a registered name from the WINS server database.

Syntax

delete name [Name=]RegisteredName [EndChar=]16thCharInHex [[Scope=]ScopeName]

Parameters

[ Name=] RegisteredName

Required. Specifies the registered name to be deleted.

[ EndChar=] 16thCharInHex

Required. Indicates the 16th character of the name of the record to be deleted in hexadecimal.

[ Scope=] ScopeName

Specifies the NetBIOS scope identifier for the record to be deleted.

Examples

In the following example, this command deletes the messenger (03h) records with the record name HOSTA from the WINS database.

delete name Name=HOSTA EndChar=03

delete owners

Deletes or tombstones a list of owners and their records from the database on the specified WINS server.

Syntax

delete owners [Servers=]{ListOfServerIPAddresses}[[Op=]{0 | 1}]

Parameters

[ Servers=] {ListOfServerIPAddresses}

Required. Specifies a list of the owner servers with records to delete. Identifies the servers by IP addresses that must be separated by commas and enclosed by braces ({}).

[ Op=]{ 0| 1}

Indicates your option: 0-Tombstone (default), 1-Delete.

Examples

In the following example, this command deletes all records owned by the WINS server with the IP address 10.0.0.1.

delete owners Servers={10.0.0.1} Op=1

delete partner

Deletes either all replication partners or a specified replication partner from the list of replication partners on the specified WINS server. When used without parameters, all replication partners are deleted from both the pull and the push partner lists without a confirmation prompt.

Syntax

delete partner [[Server=]IPAddress] [[Type=]{0 | 1 | 2}] [[Confirm=]{Y | y}]

Parameters

[ Server=] IPAddress

Specifies the partner to delete. Identifies the partner by IP address.

[ Type=]{ 0| 1| 2}

Indicates the type of partner list to delete: 0-Pull, 1-Push, 2-Both (default).

[ Confirm=]{ Y| y}

Initiates and completes the operation without prompting for confirmation.

Examples

In the following example, this command deletes a push/pull type partner with an IP address of 10.0.0.1 from the current WINS server without prompting for confirmation.

delete partner Server=10.0.0.1 Type=2 Confirm=Y

delete pgserver

Deletes all or specific Persona Grata servers from the list of PG servers on the specified WINS server.

Syntax

delete pgserver [Servers=]{ListOfServerIPAddresses}

Parameters

[ Servers=] {ListOfServerIPAddresses}

Required. Specifies a list of Persona Grata servers to delete. Identifies PG servers by IP addresses separated by commas and enclosed by braces ({}).

Remarks

  • The Persona Grata (PG) list specifies owners (other WINS servers) whose records are to be accepted during replication. If you use an empty set of braces ({}), delete pgserver deletes all of the servers on the PG server list.

Examples

In the following example, this command deletes the WINS servers 10.2.2.2 and 10.2.2.3 from the Persona Grata list for this WINS server.

delete pgserver Servers={10.2.2.2,10.2.2.3}

delete pngserver

Deletes all or specific Persona Non Grata servers servers from the list of PNG servers on the specified WINS server.

Syntax

delete pngserver [Servers=]{ListOfServerIPAddresses}

Parameters

[ Servers=] {ListOfServerIPAddresses}

Required. Specifies a list of Persona Non Grata servers to delete. Identifies PNG servers by IP addresses separated by commas and enclosed by braces ({}).

Remarks

  • The Persona Non Grata (PNG) list specifies owners (other WINS servers) whose records are to be blocked during replication. If you use an empty set of braces ({}), delete pngserver deletes all of the servers on the PNG server list.

Examples

In the following example, this command deletes the WINS servers 10.2.2.2 and 10.2.2.3 from the Persona Non Grata list for this WINS server.

delete pngserver Servers={10.2.2.2,10.2.2.3}

delete records

Deletes all records or a set of records from the current WINS server or marks records as tombstoned.

Syntax

delete records [MinVer=]{High,Low} [MaxVer=]{High,Low} [[Op=]{0 | 1}]

Parameters

[ MinVer=] {High,Low}

Required. Specifies the minimum high and low record versions from which to begin deletion. High and low values are separated by a comma and enclosed by braces ({}).

[ MaxVer=] {High,Low}

Required. Specifies the maximum high and low record versions at which to end deletion. High and low values are separated by a comma and enclosed by braces ({}).

[ Op=]{ 0| 1}

Indicates your option: 0-Delete (default), 1-Tombstone.

Remarks

  • If you set both MinVer= and MaxVer= to {0,0}, delete records deletes all records.

Examples

In the first example, this command marks all records on the WINS server as tombstoned.

In the second example, this command deletes all records between and including 2de2d and 2de3f.

delete records MinVer={0,0} MaxVer={0,0} Op=1

delete records MinVer={0,2de2d} MaxVer={0,2de3f}

init

init backup

Initiates backup of the WINS database to a specified directory. Used without parameters, this command provides a full backup to the default backup path that is currently set.

Syntax

init backup [[Dir=]BackupDir] [[Type=]{0 | 1}]

Parameters

[ Dir=] BackupDir

Specifies the directory in which backups are stored. If unspecified, the default backup path that is currently set is used.

[ Type=]{ 0| 1}

Indicates the type of backup: 0-Full backup (default), 1-Incremental backup.

Remarks

  • WINS backup can only be used for a local backup on the same server. Backup of remote WINS servers is not supported.

  • Backup files will automatically be created under the wins_bak subdirectory of the Dir= directory.

Examples

In the following example, this command initiates a full backup of the WINS database on the local WINS server to the folder C:\WINSfiles\wins_bak. WINS will create the wins_bak subdirectory.

init backup Dir=C:\WINSfiles Type=0

init import

Initiates the import of static mappings from an Lmhosts file.

Syntax

init import [File=]ImportFile

Parameters

[ File=] ImportFile

Required. Specifies the Lmhosts-formatted text file used for importing static mappings into the WINS database.

Examples

In the following example, this command imports the static mappings of the Fixedip.sam file, located at the C:\WINSfiles path, as new static mappings in the local WINS database.

init import File=C:\WINSfiles\Fixedip.sam

init pull

Initiates and sends a pull trigger to another WINS server.

Syntax

init pull [Server=]{PullServerName | IPAddress}

Parameters

[ Server=]{ \\PullServerName| IPAddress}

Required. Specifies the WINS server to which to send a pull trigger. Identifies the server by server name or IP address.

Remarks

  • If you provide a server name that cannot be resolved to an IP address, the operation fails.

Examples

In the following example, this command initiates and sends a pull trigger to WINS server 10.2.2.2.

init pull Server=10.2.2.2

init pullrange

Initiates and pulls a range of records from another WINS server.

Syntax

init pullrange [Owner=]OwnerServerIP [Server=]PullServerIP [MaxVer=]{High,Low} [MinVer=]{High,Low}

Parameters

[ Owner=] OwnerServerIP

Required. Specifies the WINS server with records to be pulled. Identifies the server by IP address.

[ Server=] PullServerIP

Required. Specifies the WINS server that pulls the range of records. Identifies the server by IP address.

[ MaxVer=] {High,Low}

Required. Specifies the maximum high and low version number of the records to be pulled. High and low values are separated by a comma and enclosed by braces ({}).

[ MinVer=] {High,Low}

Required. Specifies the minimum high and low version number of the records to be pulled. High and low values are separated by a comma and enclosed by braces ({}).

Remarks

  • If you set both MaxVer= and MinVer= to {0,0}, init pullrange pulls the entire range of records.

Examples

In the following example, this command initiates and sends a pull trigger to WINS server 10.2.2.3 for all records owned by WINS server 10.2.2.2.

init pullrange Owner=10.2.2.2 Server=10.2.2.3 MaxVer={0,0} MinVer={0,0}

init push

Initiates and sends a push trigger to another WINS server.

Syntax

init push [Server=]{\\PushServerName | IPAddress} [[PropReq=]{0 | 1}]

Parameters

[ Server=]{ \\PushServerName| IPAddress}

Required. Specifies the WINS server to which to send a push trigger. Identifies the server by name or IP address.

[ PropReq=]{ 0| 1}

Indicates your propagation request: 0-Push to the specified server only (default), 1-Have server propagate the push trigger to all of its partners.

Remarks

  • If you provide a server name that cannot be resolved to an IP address, the operation fails.

Examples

In the following example, this command initiates and sends a push trigger to WINS server 10.2.2.2 and has it propagate the trigger to all of its replication partners.

init push Server=10.2.2.2 PropReq=1

init replicate

Initiates and forces an immediate replication of the database with replication partners.

Syntax

init replicate

Parameters

none

Remarks

  • This command initiates the push/pull replication with all replication partners for this server.

init restore

Initiates the restoration of the WINS database from a directory and file at the specified WINS server.

Syntax

init restore [Dir=]RestoreDir

Parameters

[ Dir=] RestoreDir

Required. Specifies the directory from which to restore files.

Remarks

  • WINS backups can only be restored locally on the same server. You cannot restore the WINS database from a remote computer.

  • Dir= should contain a subdirectory wins_bak, which will contain the database file, but this subdirectory should not be included in the Dir= parameter.

Examples

In the following example, this command restores the WINS database from the backup database file location of C:\WINSfiles.

init restore Dir=C:\WINSfiles

init scavenge

Initiates the scavenging of the WINS database for the specified WINS server.

Syntax

init scavenge

Parameters

none

Remarks

  • This command removes outdated information from the WINS database.

init search

Initiates a search for the specified record name in the WINS database.

Syntax

init search [Name=]RecordName [[EndChar=]EndCharacter] [[Case=]{0 | 1}] [[File=]FileName]

Parameters

[ Name=] RecordName

Required. Specifies the name of the record for which to search.

[ EndChar=] EndCharacter

Indicates the 16th character of the NetBIOS name record. If unspecified, the search returns all records that match the string that you entered as a value for Name=. For more information, see Remarks.

[ Case=]{ 0| 1}

Indicates name case preference: 0-Ignore name case (default), 1-Use name case.

[ File=] FileName

Specifies the file in which to store ASCII plain text output. If unspecified, output is displayed in the Command Prompt window.

Remarks

  • If you do not supply a value for EndChar=, the search returns all records that match the string that is entered as a value for Name=. For example, if the database contains a record named MYPC-1, a search that uses MYPC as the value of the name parameter returns all records starting with this name pattern, regardless of record type:

    Record Name Record Type

    MYPC-1

    [00h]Workstation

    MYPC-1

    [01h]Other

    MYPC-1

    [03h]Messenger
    If you specify a value for EndChar=, only records that match the record name and record type are returned. For example, if the value for Name= is MYPC and the value for EndChar is 00, the following search results return:

    Record Name Record Type

    MYPC-1

    [00h]Workstation

Examples

In the following example, this command searches for records named dc1 with an end character of 1c, ignores name case, and outputs the information to the names.txt file located in C:\WINSfiles.

init search Name=dc1 EndChar=1c Case=0 File=C:\WINSfiles \names.txt

reset

reset statistics

Resets the statistics for the local WINS server.

Syntax

reset statistics

Parameters

none

set

set autopartnerconfig

Sets the automatic replication partner configuration information for the server. Used without parameters, automatic partner configuration is reset (disabled).

Syntax

set autopartnerconfig [[State=]{0 | 1}] [[Interval=]Value] [[TTL=]Value]

Parameters

[ State=]{ 0| 1}

Indicates the automatic replication partner configuration information setting: 0-Reset (default), 1-Set.

[ Interval=] Value

Specifies the multicast interval value, in seconds.

[ TTL=] Value

Specifies the Time-To-Live (TTL) value for multicast datagrams between partner WINS servers. The TTL value must be within the range of 1 to 32.

Examples

In the following example, this command sets the automatic configuration information for this WINS server for a multicast interval of 3,600 seconds and a TTL value of 20.

set autopartnerconfig State=0 Interval=3600 TTL=20

set backuppath

Sets the backup parameters for the specified WINS server.

Syntax

set backuppath [Dir=]NewPath [[Shutdown=]{0 | 1}]

Parameters

[ Dir=] NewPath

Required. Specifies the backup path for the server database. If unspecified, the default path is C:\.

[ Shutdown=]{ 0| 1}

Indicates the setting for backup during shutdown: 0-Disable backup of the WINS database during shutdown (default), 1-Enable backup of the WINS database during shutdown.

Examples

In the following example, this command sets the WINS server to automatically back up the WINS database to C:\WINSfiles each time that the server is shut down.

set backuppath Dir=C:\WINSfiles Shutdown=1

set burstparam

Sets burst handling parameters for the specified WINS server.

Syntax

set burstparam [State=]{0 | 1} [[Value=]QueueSize]

Parameters

[ State=]{ 0| 1}

Required. Indicates the setting for burst handling: 0-Reset or disable burst handling for the WINS server, 1-Set or enable burst handling for the WINS server.

[ Value=] QueueSize

Specifies the value of the burst queue size. The queue size must be within the range of 50 to 5,000.

Examples

In the following example, this command sets the size of the burst queue to permit 1,000 client registration and renewal requests before the WINS server uses burst handling.

set burstparam State=1 Value=1000

set defaultparam

Sets the default parameters for WINS server configuration.

Syntax

set defaultparam

Parameters

none

Remarks

  • This command sets all the configuration parameters for the WINS server to their default values. It is recommended that you run this command after WINS service installation to configure the server with default parameter settings.

set logparam

Sets or resets database and detailed event logging parameters. Used without parameters, the current values are maintained.

Syntax

set logparam [[DBChange=]{0 | 1}] [[Event=]{0 | 1}]

Parameters

[ DBChange=]{ 0| 1}

Indicates whether you want to log database changes: 1-Enable logging of database changes to JET log files (default), 0-Reset this option.

[ Event=]{ 0| 1}

Indicates the detail of events: 1-Log detailed events to the system event log, 0-Reset this option (default).

Remarks

  • The WINS database engine can log the database changes to separate files. Because this option improves the performance of database operations, it is turned on by default.

  • The WINS server can log detailed event information in the system event log. Because this option is resource-intensive, it is turned off by default.

Examples

In the following example, this command sets logging parameters for this WINS server to enable the logging of database changes to JET files and to log detailed events to the system event log.

set logparam Event=1

set migrateflag

Sets the migration flag for the specified WINS server.

Syntax

set migrateflag [State=]{0 | 1}

Parameters

[ State=]{ 0| 1}

Required. Indicates the setting of the migrate flag: 0-Disable (migrate off), 1-Enable (migrate on)

Remarks

  • The migrate flag determines if unique static mappings can be overwritten by dynamic records.

Examples

In the following example, this command sets the migrate flag to permit the overwriting of unique static mappings by dynamic records for the specified WINS server.

set migrateflag State=1

set namerecord

Sets the intervals that are used to determine when WINS name records are renewed, deleted, and verified at the specified WINS server. Used without parameters, current values are maintained.

Syntax

set namerecord [[Renew=]Value] [[Extinction=]Value] [[ExTimeout=]Value] [[Verification=]Value]

Parameters

[ Renew=] Value

Specifies the interval renewal rate, in seconds.

[ Extinction=] Value

Specifies the extinction interval, in seconds.

[ ExTimeout=] Value

Specifies the extinction time-out, in seconds.

[ Verification=] Value

Specifies the verification interval, in seconds.

Remarks

  • All parameters are optional. For parameters not used, previously set or default values are maintained.

Examples

In the following example, this command sets each of the values for name records on this WINS server.

set namerecord Renew=3600 Extinction=7200 ExTimeout=86400 Verification=2073600

set periodicdbchecking

Sets the periodic database consistency checking parameters for the specified WINS server. Used without parameters, current values are maintained.

Syntax

set periodicdbchecking [[State=]{0 | 1}] [[MaxRec=]Value] [[CheckAgainst=]{0 | 1}] [[CheckEvery=]Value] [[Start=]Value]

Parameters

[ State=]{ 0| 1}

Required. Indicates whether to check the state of the WINS database: 0-Disable, 1-Enable (default). If you set the value of this parameter to 0, all checks are disabled regardless of the values of other parameters.

[ MaxRec=] Value

Specifies the maximum number of records that are checked each period. If unspecified, the default is 30,000.

[ CheckAgainst=]{ 0| 1}

Indicates the server to check against: 0-Owner server (default), 1-Randomly selected server.

[ CheckEvery=] Value

Specifies how often the WINS database should be checked for consistency, in hours. If unspecified, the default is 24 hours.

[ Start=] Value

Specifies the time, in seconds, at which to start the consistency check.

Remarks

  • In order to set periodic consistency check intervals, it is recommended that you specify values for the CheckEvery and Start parameters. In order to adjust existing periodic consistency check settings, specify values only for State and the parameter or parameters that you want to change. Parameters for which you do not supply a value remain unchanged.

Examples

In the following example, this command checks the WINS database against a random replication partner every hour starting at 3,600 seconds.

set periodicdbchecking State=1 MaxRec=1000 CheckAgainst=1 CheckEvery=1 Start=3600

set pgmode

Sets the Persona Grata mode or the Persona Non Grata mode.

Syntax

set pgmode [Mode=]{0 | 1}

Parameters

[ Mode=]{ 0| 1}

Required. Specifies which mode to set: 0-Sets the Persona Non Grata (PNG) mode, 1-Sets the Persona Grata (PG) mode.

Remarks

  • Use the add pgserver and the delete pgserver commands to update the Persona Grata list.

Examples

In the following example, this command sets the PG mode. During replication, WINS will accept only the records that are owned by the servers that are specified in the PG list.

set pgmode Mode=1

set pullparam

Sets the default pull partner parameters for the specified WINS server. Used without parameters, previously set or default values are maintained.

Syntax

set pullparam [[State=]{0 | 1}] [[Strtup=]{0 | 1}] [[Start=]Value] [[Interval=]Value] [[Retry=]Value]

Parameters

[ State=]{ 0| 1}

Required. Indicates whether you want persistent connections to be used with pull partners: 0-Do not use persistent connections with pull partners, 1-Use persistent connections with pull partners.

[ Strtup=]{ 0| 1}

Indicates whether pull replication should start at startup: 0-Do not start pull replication at startup (default), 1-Start pull replication at startup.

[ Start=] Value

Specifies the start time for the pull trigger, in seconds.

[ Interval=] Value

Specifies the replication interval, in seconds.

[ Retry=] Value

Specifies the number of times to retry replication.

Remarks

  • If you do not specify a value for Interval=, only one replication occurs.

  • If you do not specify a value for Start=, running the command starts the pull trigger.

Examples

In the following example, this command sets the default pull partner parameters for this WINS server to use a persistent connection with its pull partners, begin replication at startup, start the pull trigger in 23,600 seconds at an interval of 259,200 seconds, and retry replication seven times.

set pullparam State=1 Strtup=1 Start=23600 Interval=259200 Retry=7

set pullpartnerconfig

Sets the configuration parameters for the specified pull partner.

Syntax

set pullpartnerconfig [[State=]{0 | 1}] [Server=]ServerName [[Start=]Value] [[Interval=]Value]

Parameters

[ State=]{ 0| 1}

Indicates the state of the persistent connection flag: 0-Disable, 1-Enable (default).

[ Server=] ServerName

Required. Specifies the pull replication partner by server name or IP address.

[ Start=] Value

Specifies the start time for replication, in seconds.

[ Interval=] Value

Specifies the interval between pull replications, in seconds.

Remarks

  • If you provide a server name for Server= that cannot be resolved to an IP address, the function fails.

Examples

In the following example, this command sets the pull partner configuration for the current WINS server for the partner WINS server 10.2.2.2. Pull replication starts in 3,600 seconds and runs every 4,320 seconds.

set pullpartnerconfig State=1 Server=10.2.2.2 Start=3600 Interval=4320

set pushparam

Sets the default push partner parameters for the specified WINS server.

Syntax

set pushparam [State=]{0 | 1} [[Strtup=]{0 | 1}] [[AddChange=]{0 | 1}] [[Update=]Value]

Parameters

[ State=]{ 0| 1}

Required. Indicates whether you want persistent connections to be used with push partners: 0-Do not use persistent connections with push partners, 1-Use persistent connections with push partners.

[ Strtup=]{ 0| 1}

Indicates whether you want push replication to start at startup: 0-Do not start push replication at startup (default), 1-Start push replication at startup.

[ AddChange=]{ 0| 1}

Indicates whether you want replication to be triggered upon address change: 0-Do not trigger replication upon address change (default), 1-Trigger replication upon address change.

[ Update=] Value

Specifies the number of changes in version ID that will occur before replication.

Examples

In the following example, this command sets the default push partner parameters for this WINS server to use persistent connections with its push partners, start push replication at startup and when addresses change, and push to partners after the version ID has been updated twice for records owned at this WINS server.

set pushparam State=1 Strtup=1 AddChange=1 Update=2

set pushpartnerconfig

Sets the configuration parameters for the specified push partner.

Syntax

set pushpartnerconfig [[State=]{0 | 1}] [Server=]\\ServerName [Update=]Value

Parameters

[ State=]{ 0| 1}

Indicates the state of the persistent connection flag: 0-Disable, 1-Enable (default).

[ Server=] \\ServerName

Required. Specifies the push partner server for which you want to set configuration parameters. Identifies the server by server name or IP address.

[ Update=] Value

Required. Specifies the threshold for updates.

Remarks

  • If you provide a name in the server parameter cannot be resolved to an IP address, the function fails.

Examples

In the following example, this command sets the push partner configuration for the current WINS server for a partner WINS server with IP address 10.2.2.2 and sets two as the limit of changes in version ID allowed before push partners are informed about them.

set pushpartnerconfig State=1 Server=10.2.2.2 Update=2

set replicateflag

Sets the replication flag for the specified WINS server.

Syntax

set replicateflag [State=]{0 | 1}

Parameters

[ State=]{ 0| 1}

Required. Indicates the setting of the replication flag: 0-Disable (replication flag off), 1-Enable (replication flag on).

Examples

In the following example, this command enables the replication flag for this server.

set replicateflag State=1

set startversion

Sets the value of the start version ID number for the database.

Syntax

set startversion [Version=]{High,Low}

Parameters

[ Version=] {High,Low}

Required. Specifies the start version ID number for the WINS database. High and low values are separated by a comma and enclosed by braces ({}).

Examples

In the following example, this command sets the beginning version ID number for the WINS database to 0.

set startversion Version={0,0}

show

show browser

Displays all active domain browser [1Bh] records for the specified WINS server.

Syntax

show browser

Parameters

none

show database

Displays the database and records for a partial or complete list of specified owner servers.

Syntax

show database [Servers=]{IPAddresses} [[RecType=]{0 | 1 | 2}] [[Count=]Count] [[Start=]{0 | 1}] [[EndChar=]16thCharInHex] [[File=]FileName]

Parameters

[ Servers=] {IPAddresses}

Required. Specifies a list of the owner servers whose records are to be displayed. Identifies owner servers by IP addresses, which must be separated by commas and enclosed in braces ({}).

[ RecType=]{ 0| 1| 2}

Indicates the type of record: 0-Both (default), 1-Static, 2-Dynamic.

[ Count=] Count

Specifies the number of records that you want to display. If unspecified, all records that match the query parameters are be returned.

[ Start=]{ 0| 1}

Indicates where to start sorting the display: 0-Start from the beginning of the database (default), 1-Start from the end of the database.

[ EndChar=] 16thCharInHex

Indicates the 16th character of the records, in hexadecimal. This number filters the records that are retrieved from the database. If unspecified, all record types are returned.

[ File=] FileName

Specifies the file in which formatted output is stored. If unspecified, output is displayed in the command prompt window.

Remarks

  • If you specify an empty set ({}) for Servers=, show database records are displayed for all owner servers.

Examples

In the following example, this command outputs the first 1000 dynamic records in the WINS database for the server 10.2.2.2 to the text file output.txt.

show database Servers={10.2.2.2} RecType=2 Count=1000 Start=0 Endchar=0 File=C:\WINSfiles\output.txt

show info

Displays configuration information for the specified WINS server.

Syntax

show info

Parameters

none

Remarks

  • If set, this command displays the following WINS configuration information for the current server:

    • Backup path

    • Name record setting

    • Periodic database consistency checking

    • Burst handling

    • Logging parameters

    • Start version count

show name

Queries and displays detailed information for a specified record in the current WINS server database.

Syntax

show name [Name=]RecordName [EndChar=]16thCharInHex [[Scope=]ScopeName]

Parameters

[ Name=] RecordName

Required. Specifies the record for which to query.

[ EndChar=] 16thCharInHex

Required for all queries except unique type records. Indicates the 16th character in hexadecimal.

[ Scope=] ScopeName]

Specifies the NetBIOS scope, if used.

Examples

In the following example, this command shows currently stored information for name record HOSTA, of File Server type, [20h] that exists in the WINS database on the specified WINS server.

show name Name=HOSTA EndChar=20

show partner

Displays all pull partners, push partners, or pull and push partners for the specified WINS server. When used without parameters, this command displays all push partners, pull partners, and push/pull partners for the specified WINS server.

Syntax

show partner [[Type=]{0 | 1 | 2 | 3}]

Parameters

[ Type=]{ 0| 1| 2| 3}

Indicates the type of partner to display: 0-All (default), 1-Pull, 2-Push, 3-Both push and pull.

Examples

In the following example, this command displays the server name, IP address, and replication type of each replication partner for this WINS server.

show partner

show partnerproperties

Displays default partner configuration information for the specified WINS server.

Syntax

show partnerproperties

Parameters

none

Remarks

  • This command displays the auto partner configuration and default push/pull parameters for the current WINS server.

show pullpartnerconfig

Displays configuration information for a pull partner.

Syntax

show pullpartnerconfig [Server=]{Name | IPAddress}

Parameters

[ Server=]{ Name| IPAddress}

Required. Specifies the pull partner for which you want to display configuration information. Identifies the partner by name or IP address.

Remarks

  • If you provide a name that cannot be resolved to an IP address, the function fails.

Examples

In the following example, this command displays the pull partner configuration information for WINS server 10.2.2.2.

show pullpartnerconfig Server=10.2.2.2

show pushpartnerconfig

Displays configuration information for a push partner.

Syntax

show pushpartnerconfig [Server=]{Name | IPAddress}

Parameters

[ Server=]{ Name| IPAddress}

Required. Specifies the push partner for which you want to display configuration information. Identifies the push partner by name or IP address.

Remarks

  • If you provide a name that cannot be resolved to an IP address, the function fails.

Examples

In the following example, this command displays the push partner configuration information for WINS server 10.2.2.2.

show pushpartnerconfig Server=10.2.2.2

show recbyversion

Displays a set of records for an owner, specified as a range of version IDs, and sorts the records by version.

Syntax

show recbyversion [Server=]IPAddress [MaxVer=]{High,Low} [MinVer=]{High,Low} [[Name=]RecordName] [[EndChar=]16thChar] [Case=]{0 | 1}

Parameters

[ Server=] IPAddress

Required. Specifies the owner server for which you want to display a set of records. Identifies the server by IP address.

[ MaxVer=] {High,Low}

Required. Specifies the range of records to return by the maximum high and low version number. High and low values are separated by a comma and enclosed by braces ({}).

[ MinVer=] {High,Low}

Required. Specifies the range of records to return by minimum high and the minimum low version number. High and low values are separated by a comma and enclosed by braces ({}).

[ Name=] RecordName

Specifies the records for which to look.

[ EndChar=] 16thChar

Indicates the character for which to look, in hexadecimal.

[ Case=]{ 0| 1}

Indicates whether to create a case-sensitive comparison: 0-Ignore case (default), 1-Create a case-sensitive comparison.

Remarks

  • If Name= is not specified, EndChar= and Case= are ignored.

  • If you set both MinVer= and MaxVer= to {0,0}, show recbyversion displays the entire range of records.

Examples

In the following example, this command displays the total number of records (by record version) owned by WINS server 10.2.2.2.

show recbyversion Server=10.2.2.2 MaxVer={0,0} MinVer={0,0} Name=dc1 EndChar=1c Case=0

show reccount

Displays the number of records owned by a specific WINS server.

Syntax

show reccount [Server=]IPAddress [MaxVer=]{High,Low} [MinVer=]{High,Low}

Parameters

[ Server=] IPAddress

Required. Specifies the owner server for which you want to display the number of records. Identifies the server by IP address.

[ MaxVer=] {High,Low}

Required. Specifies the maximum high and low version of records to show. High and low values are separated by a comma and enclosed by braces ({}).

[ MinVer=] {High,Low}

Required. Specifies the minimum high and low version of records to show. High and low values are separated by a comma and enclosed by braces ({}).

Remarks

  • If you set both MinVer= and MaxVer= to {0,0}, show reccount counts the entire range of records.

Examples

In the following example, this command shows the total record count for WINS server 10.2.2.2.

show reccount Server=10.2.2.2 MaxVer={0,0} MinVer={0,0}

show server

Displays information for the specified WINS server.

Syntax

show server

Parameters

none

Remarks

  • This command displays the name and IP address of the specified WINS server.

show serverstatistics

Displays statistics for the specified WINS server.

Syntax

show statistics

Parameters

none

show version

Displays the current maximum version counter value for the specified WINS server.

Syntax

show version

Parameters

none

show versionmap

Displays the owner ID to maximum version number mappings table for the specified WINS server.

Syntax

show versionmap

Parameters

none


Netsh Commands for Windows Sockets (WINSOCK)

You can use commands in the netsh winsock context to configure Windows Sockets. The Netsh commands for winsock can be run manually at the netsh prompt or in scripts and batch files.

To run these commands from the command prompt, you must either enter the netsh winsock context or prepend the context to the command. For example, if you are at the command prompt but have not typed netsh and then winsock to enter the netsh winsock context, you must type:

netsh winsock command

Where command is the command that you want to run, including all of the required parameters for the command.

This section contains the following commands.

  • audit trail

  • remove provider

  • reset

  • show catalog

For information on how to interpret netsh command syntax, see Formatting Legend.

Netsh winsock command reference

The following entries provide details for each command.

audit trail

Shows the audit trail of Layered Service Providers (LSPs) that have been installed and uninstalled.

Syntax

audit trail

remove provider

Removes a Winsock Layered Service Provider (LSP) from the system.

Syntax

remove provider catalog_id

Parameters

catalog_id

Required. Specifies the catalog identifier of the Layered Service Provider (LSP) that you want to remove from the system.

reset

Restores the Winsock Catalog to a clean state and uninstalls all Winsock Layered Service Providers.

Syntax

reset

Remarks

The reset command restores the Winsock Catalog to a clean state. After the command is run, all Winsock LSPs that were previously installed must be reinstalled. This command does not affect Winsock Name Space Provider entries.

show catalog

Displays the contents of the Winsock Catalog.

Syntax

show catalog

Remarks

Following is an example output of the show catalog command:

Copy Code
Winsock Catalog Provider Entry
------------------------------------------------------

Copy Code
Entry Type:
Copy Code
Base Service Provider
Copy Code
Description:
Copy Code
MSAFD Tcpip [UDP/IP]
Copy Code
Provider ID:
Copy Code
{E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Copy Code
Provider Path:
Copy Code
%SystemRoot%\system32\mswsock.dll
Copy Code
Catalog Entry ID:
Copy Code
1002
Copy Code
Version:
Copy Code
2
Copy Code
Address Family:
Copy Code
2
Copy Code
Max Address Length:
Copy Code
16
Copy Code
Min Address Length:
Copy Code
16
Copy Code
Socket Type:
Copy Code
2
Copy Code
Protocol:
Copy Code
17
Copy Code
Protocol Chain Length
Copy Code
1
Copy Code
Winsock Catalog Provider Entry
------------------------------------------------------

Copy Code
Entry Type:
Copy Code
Base Service Provider
Copy Code
Description:
Copy Code
MSAFD Tcpip [RAW/IP]
Copy Code
Provider ID:
Copy Code
{E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Copy Code
Provider Path:
Copy Code
%SystemRoot%\system32\mswsock.dll
Copy Code
Catalog Entry ID:
Copy Code
1003
Copy Code
Version:
Copy Code
2
Copy Code
Address Family:
Copy Code
2
Copy Code
Max Address Length:
Copy Code
16
Copy Code
Min Address Length:
Copy Code
16
Copy Code
Socket Type:
Copy Code
3
Copy Code
Protocol:
Copy Code
0
Copy Code
Protocol Chain Length:
Copy Code
1
Copy Code

Winsock Catalog Provider Entry
------------------------------------------------------

Copy Code
Entry Type:
Copy Code
Base Service Provider
Copy Code
Description:
Copy Code
MSAFD Tcpip [TCP/IPv6]
Copy Code
Provider ID:
Copy Code
{F9EAB0C0-26D4-11D0-BBBF-00AA006C34E4}
Copy Code
Provider Path:
Copy Code
%SystemRoot%\system32\mswsock.dll
Copy Code
Catalog Entry ID:
Copy Code
1004
Copy Code
Version:
Copy Code
2
Copy Code
Address Family:
Copy Code
23
Copy Code
Max Address Length:
Copy Code
28
Copy Code
Min Address Length:
Copy Code
28
Copy Code
Socket Type:
Copy Code
1
Copy Code
Protocol:
Copy Code
6
Copy Code
Protocol Chain Length:
Copy Code
1
Copy Code


Netsh Commands for Wired Local Area Network (LAN)
See Also

The Netsh commands for wired local area network (LAN) provide methods to configure connectivity and security settings for computers running Windows Vista® and Windows Server® 2008. You can use the Netsh LAN commands to configure the local computer or to configure multiple computers by using a logon script. You can also use the netsh LAN commands to view wired 802.1X Group Policy and to administer user wired 802.1X settings.

Wired Network (IEEE 802.3) Policies profiles are read-only, and cannot be modified or deleted by using Netsh LAN commands.

Netsh LAN commands

This section contains the following commands:

  • add profile

  • delete profile

  • export profile

  • reconnect

  • set autoconfig

  • set profileparameter

  • set tracing

  • show interfaces

  • show profiles

  • show settings

  • show tracing

The following entries provide details for each command.

add profile

Adds a LAN profile to the specified interface on the computer.

Syntax

add profile filename= PathAndProfileName [[interface=]InterfaceName]

Parameters

Filename

Required. Specifies the path and name of the XML file containing the profile data.

Interface

Optional. Specifies the name of the interface on which the profile will be set (where InterfaceName is the name of the interface as displayed in Network Connections or as rendered by the netsh lan show interfaces command).

Remarks

The interface parameter specifies one of the interface names shown by the netsh lan show interface command. If the interface is specified, the profile is added to the specified interface. There is wildcard support for this parameter. You can use the characters ? and * to replace a letter and letters of the interface name, respectively.

Example command

  • add profile filename=C:\Users\WiredUser\Documents\profile1.xml interface="Local Area Connection"

delete profile

Removes a LAN profile from one or multiple interfaces.

Syntax

delete profile interface= InterfaceName

Parameters

Interface

  • Required. Specifies the name of the interface on which the profile is to be deleted (where InterfaceName is the name of the interface as displayed in Network Connections, or as rendered by the netsh lan show interfaces command).

Remarks

There is wildcard support for the interface parameter. You can use the characters ? and * to replace a letter and letters of the interface name, respectively.

Example commands

  • delete profile interface="Local Area Connection"

  • delete profile interface=L*

export profile

Saves LAN profiles as XML files to a specified location.

Syntax

export profile folder= PathAndFileName [[interface=]InterfaceName]

Parameters

Folder

  • Required. Specifies the path and file name for the profile XML file.

Interface

Optional. Specifies the name of the interface on which the profile is configured (where InterfaceName is the name of the interface as displayed in Network Connections, or as rendered by the netsh lan show interfaces command).

Remarks

The folder parameter must specify an existing folder that is accessible from the local computer. It can be either an absolute path or relative path to the current working directory. In addition, "." refers to the current working directory, and ".." refers to the parent directory of the current working directory. The folder name cannot be a Universal Naming Convention (UNC) path.

If the interface parameter is specified, only the specified profile associated with that interface is saved. Otherwise, all profiles on the computer with the specified name are saved.

Profiles of specified interfaces are saved in the format "InterfaceName ProfileName.xml." Profiles at the computer level are saved in the file name format "ProfileName.xml."

There is wildcard support for this parameter. You can use the characters ? and * to replace a letter and letters of the interface name, respectively.

Example commands

  • export profile folder=c:\Users\user\Documents\ interface="Local Area Connection"

  • export profile folder=c:\Users\user\Documents\

reconnect

Attempts to reauthenticate to a wired network by using the specified interface.

Syntax

reconnect [[interface=]InterfaceName]

Parameters

Interface

Optional. Specifies the interface that is used for the connection attempt (where InterfaceName is the name of the interface as displayed in Network Connections, or as rendered by the netsh lan show interfaces command).

Remarks

If the interface parameter is specified, only the specified interface is used for the connection attempt. If the interface parameter is not specified, all interfaces attempt to reconnect. Wildcard (*) names cannot be used to specify the interface name.

Example command

  • reconnect interface="Local Area Connection "

set autoconfig

Enables or disables Wired AutoConfig Service on an interface.

Syntax

set autoconfig enabled={yes|no} interface=InterfaceName

Parameters

Enabled

Required. Specifies whether to set Wired AutoConfig Service to enabled or disabled.

Interface

Required. Specifies the name of the interface on which the service is enabled or disabled (where InterfaceName is the name of the interface as displayed in Network Connections, or as rendered by the netsh lan show interfaces command).

Remarks

When Wired AutoConfig is enabled, computers running Windows Vista and Windows Server 2008 automatically connect to the network by using the specified interface. By default, Wired AutoConfig is enabled.

If Wired AutoConfig is disabled, Windows will not automatically connect to any networks by using the specified interface.

There is wildcard support for the interface parameter. You can use the characters ? and * to replace a letter and letters of the interface name, respectively.

Example command

  • set autoconfig enabled=yes interface="Local Area Connection"

set profileparameter

Sets parameters in a wired network profile.

Note
The set profileparameter is only available on computers running Windows Vista with Service Pack 1, and Windows Server 2008.

Syntax

set profileparameter name= ProfileName [[interface=]InterfaceName] [[authMode=]{machineOrUser|machineOnly|userOnly|guest}] [[ssoMode=]{preLogon|postLogon|none}] [[maxDelay=]1-120] [[allowDialog={yes|no}] [[userVLAN=]{yes|no}]

Parameters

Name

Required. Specifies the name of the profile to set (where ProfileName is the name of the profile, as rendered by the netsh lan show profile command).

Interface

Optional. Specifies the name of the interface on which the profile is set (where InterfaceName is the name of the interface as displayed in Network Connections, or as rendered by the netsh lan show interfaces command).

AuthMode

Optional [conditional, see "Remarks"]. Specifies the type of credentials to be used for authentication.

SSOMode

Optional [conditional, see "Remarks"].Specifies the type of single sign on (SSO) to be attempted if any.

MaxDelay

Optional [conditional, see "Remarks"]. Specifies the timeout value allowed to establish the single sign-on connection.

AllowDialog

Optional [conditional, see "Remarks"].Specifies whether to allow or disallow a dialog to be shown for preLogon.

UserVLAN

  • Optional [conditional, see "Remarks"].Specifies if the network switches to a different VLAN on user authentication.

Remarks

Parameter name is required; all other parameters are optional, however, regardless of whether parameter interface is specified, at least one other parameter must be specified.

If the parameter interface is specified then only profiles associated with that interface are modified.

Example commands

  • set profileparameter name="Profile 1" authMode=userOnly ssoMode=preLogon

  • set profileparameter name=Profile2 interface="Local Area Connection" ssoMode=none

set tracing

Enables or disables wired tracing.

Syntax

set tracing [[mode=]{yes|no|persistent}]

Parameters

Mode

Required. Specifies whether wired tracing is disabled, enabled and persistent, or enabled and nonpersistent. See "Remarks" for additional information.

Remarks

  • If the mode parameter is set to yes, nonpersistent tracing is active until the mode is either set to no or the computer is restarted.

  • If the mode parameter is set to no, tracing is stopped for either persistent or nonpersistent tracing.

If the mode parameter is set to persistent, tracing is active even after the computer is restarted.

The default value for the mode parameter is nonpersistent.

Example command

  • set tracing mode=persistent

show interfaces

Displays a list of the current wired interfaces on the computer.

Syntax

show interfaces

Parameters

There are no parameters for this command.

Remarks

Shows the wired interfaces configured on the computer.

Displayed information includes:

  • The number of interfaces on the computer

  • Interface name

  • Description

  • GUID

  • Ethernet adapter IP address

  • State [network authentication support (yes or no)]

Example command

  • show interfaces

show profiles

Displays a list of wired profiles that are configured on the computer.

Syntax

show profiles [[interface=]InterfaceName]

Parameters

Interface

Optional. Specifies the name of the interface which has this profile configured (where InterfaceName is the name of the interface as displayed in Network Connections, or as rendered by the netsh lan show interfaces command). See "Remarks."

Remarks

If the interface parameter is specified, then only the contents of the wired profile for the specified interface are displayed. Otherwise all profiles will be displayed with their name and description.

Example commands

  • show profiles interface="Local Area Connection"

  • show profiles

show settings

Displays the current global settings of the wired LAN

Syntax

show settings

Parameters

There are no parameters for this command.

Remarks

Shows whether or not auto-configuration logic (Wired AutoConfig) is enabled on each interface.

Example command

  • show settings

show tracing

Displays whether wired tracing is enabled or disabled.

Syntax

show tracing

Parameters

There are no parameters for this command.

Remarks

Displayed information includes:

  • Wired tracing state (started or stopped)

  • Wired tracing persistence state (enabled or disabled)

  • Trace log file location (for example, "c:\Windows\system32\logfiles\WiredAutoLog\"

Example command

  • show tracing

See Also

Other Resources

Active Directory Schema Extensions for Windows Vista Wireless and Wired Group Policy Enhancements


Netsh Commands for Wireless Local Area Network (WLAN)
See Also

The Netsh commands for wireless local area network (WLAN) provide methods to configure 802.11 wireless connectivity and security settings for computers running Windows Vista® and Windows Server® 2008. You can use the Netsh WLAN commands to configure the local computer or to configure multiple computers by using a logon script. You can also use the netsh WLAN commands to view applied wireless Group Policy settings.

Wireless Network (IEEE 802.11) Policies profiles are read-only, and cannot be modified or deleted by using Netsh WLAN commands.

Running Netsh wlan commands on computers running Windows Server2008

To run Netsh WLAN commands on computers running Windows Server 2008, you must first install the Wireless LAN Service.

Note
On computers running Windows Server 2008, installing the Wireless LAN Service in Server Manager / Features, adds and starts the WLAN AutoConfig service. WLAN AutoConfig is located in Server Manager/Diagnostics/Services Microsoft Management Console (MMC). To remove the WLAN AutoConfig service from a Computer running Windows Server 2008, you must remove (uninstall) the Wireless LAN Service from Server Manager / Features.

To install Wireless LAN Service on computers running Windows Server 2008

  1. Do one of the following:

    1. In Initial Configuration Tasks, in Customize This Server, click Add Features. The Add Features Wizard opens.

    2. Click Start, and then click Server Manager. In the left pane of Server Manager, click Features, and in the details pane, in Features Summary, click Add Features. The Add Features Wizard opens.

  2. In Select Features, in Features, scroll down the list, select Wireless LAN Service, and then click Next.

  3. In Confirm installation selections, click Install.

  4. In Installation Results, review your installation results, and then click Close.

Netsh WLAN commands

This section contains the following Netsh WLAN commands:

  • add filter

  • add profile

  • connect

  • delete filter

  • delete profile

  • disconnect

  • export profile

  • set autoconfig

  • set blockednetworks

  • set createalluserprofile

  • set profileorder

  • set profileparameter

  • set tracing

  • show all

  • show autoconfig

  • show blockednetworks

  • show drivers

  • show filters

  • show interfaces

  • show networks

  • show profiles

  • show settings

  • show tracing

add filter

Adds a wireless network, by Service Set Identifier (SSID), to the wireless allowed or blocked list.

Syntax

add filter permission={allow|block|denyall} ssid=WirelessNetworkName networktype={infrastructure|adhoc}

Parameters

Permission

Required. Specifies the permission type of the filter.

SSID

Required [conditional, see "Remarks"]. SSID of the wireless network.

Networktype

Required. Specifies the wireless network type.

Remarks

The ssid parameter is required if permission is allow or block. If permission is denyall, then do not specify the ssid parameter.

Example commands

  • add filter permission=allow ssid=WiFiNetwork networktype=infrastructure

  • add filter permission=block ssid="Wireless Net" networktype=adhoc

  • add filter permission=denyall networktype=infrastructure

add profile

Adds a WLAN profile to the specified interface on the computer.

Syntax

add profile filename= PathAndFileName [[interface=]InterfaceName] [[user=]{all|current}]

Parameters

Filename

Required. Specifies both the path to, and name of the XML file containing the profile data.

Interface

Optional. Specifies the name of the wireless interface on which to add the profile (where InterfaceName is the name of the wireless interface, as listed in Network Connections, or as rendered by the netsh wlan show interfaces command)

User

Optional. Specifies whether the profile is applied only to the current user or to all users.

Remarks

The interface parameter is one of the interface names shown by the netsh wlan show interface command. If the interface parameter is specified, the profile is added to the specified interface. If the interface parameter is not specified, the profile is added on all wireless interfaces. There is wildcard support for this parameter. You can use the characters ? and * to replace a letter and letters of the interface name, respectively.

The user parameter, if unspecified, applies the profile to all users.

Example commands

  • add profile filename=C:\Users\WirelessUser\Documents\profile1.xml interface="Wireless Network Connection"

  • add profile filename="C:\Wireless Profiles\WiFi Profile.xml" interface=w*

connect

Connects to a wireless network by using the specified parameter.

Syntax

connect [[ssid=]WirelessNetworkName] name=ProfileName interface=InterfaceName

Parameters

SSID

Optional [conditional, see "Remarks"]. Specifies the SSID of the wireless network.

Name

Required. Specifies the name of the wireless profile to use for the connection attempt, (where ProfileName is the name of the wireless profile, as listed in Manage Wireless Networks, or as rendered by the netsh wlan show profiles command).

Interface

Required [conditional, see "Remarks"]. Specifies the wireless interface to use for the connection attempt, (where InterfaceName is the name of the wireless interface, as listed in Network Connections, or as rendered by the netsh wlan show interfaces command).

Remarks

If only one SSID is specified in the profile, then the specified SSID is used to connect, and the ssid parameter is not required. If the profile specifies multiple SSIDs, the ssid parameter is required.

The interface parameter is required only if there is more than one wireless interface on the computer. Wildcard (*) names cannot be used to specify the interface name.

If the specified interface is already connected to a wireless network, this command disconnects the interface from that network, and then attempts to connect to the new network. If the command attempts to connect to a network to which the interface is already connected, this command returns a message that the connection was successful, and does not change the state of the wireless adapter.

Examples

  • connect ssid=WiFiNetwork name=Profile1

  • connect ssid="Wireless Net" name=Profile2 interface="Wireless Network Connection"

delete filter

Removes a wireless network from the wireless allowed or blocked list.

Syntax

delete filter permission={allow|block|denyall} ssid=WirelessNetworkName networktype={infrastructure|adhoc}]

Parameters

Permission

Required. Specifies the permission type of the filter.

SSID

Required [conditional, see "Remarks"]. Specifies the SSID of the wireless network.

Networktype

Required. Specifies whether the wireless network type is adhoc or infrastructure.

Remarks

The ssid parameter is required, unless the value of the permission parameter is denyall. If the permission parameter is denyall, then the ssid parameter should not be given.

Example commands

  • delete filter permission=allow ssid=WiFiNetwork networktype=infrastructure

  • delete filter permission=block ssid="Wireless Net" networktype=adhoc

  • delete filter permission=denyall networktype=adhoc

delete profile

Removes a WLAN profile from one or multiple interfaces.

Syntax

delete profile name=ProfileName [[interface=]InterfaceName]

Parameters

Name

Required. Specifies the name of the wireless profile to delete, (where ProfileName is the name of the wireless profile, as listed in Manage Wireless Networks, or as rendered by the netsh wlan show profiles command).

Interface

Optional. Specifies the name of the wireless interface on which to delete the profile, (where InterfaceName is the name of the wireless interface, as listed in Network Connections, or as rendered by the netsh wlan show interfaces command).

Remarks

If the interface parameter is specified, then the profile is deleted only from the specified interface.

If the interface parameter is not specified, then the profile is deleted from all interfaces on the computer.

The name parameter can have wildcard characters; if multiple profiles having names that match wildcard characters, then all such profiles are deleted. You can use the characters ? and * to replace a letter and letters of the interface name, respectively.

Example commands

  • delete profile name="Profile 1" interface="Wireless Network Connection"

  • delete profile name=Profile2 interface=*

  • delete profile name="Profile 1" i=*

disconnect

Disconnects the specified interface from a wireless network.

Syntax

disconnect interface=InterfaceName

Parameters

Interface

Required [conditional, see "Remarks"]. Specifies which wireless interface is used for the disconnect attempt , (where InterfaceName is the name of the wireless interface, as listed in Network Connections, or as rendered by the netsh wlan show interfaces command).

Remarks

The interface parameter is required if there is more than one wireless interface on the computer. You can use Wildcard (*) characters in the interface name to specify multiple interfaces.

If the specified interface is not already connected to a wireless network, this command returns a message stating that the disconnection was successful; the state of the wireless adapter does not change.

Example commands

  • disconnect

  • disconnect interface="Wireless Network Connection"

export profile

Saves WLAN profiles as XML files to the specified location.

Syntax

export profile folder=PathAndFileName [[name=]ProfileName] [[interface=]InterfaceName]

Parameters

Folder

Optional. Specifies the path and file where the profile XML file is to be saved, and the name to use for the saved file.

Name

Optional. Specifies the name of the wireless profile to export. (the name of the wireless profile, (where ProfileName is the name of the wireless profile, as listed in Manage Wireless Networks, or as rendered by the netsh wlan show profiles command).

Interface

Optional. Specifies the name of the wireless interface on which the profile is configured, (where InterfaceName is the name of the wireless interface, as listed in Network Connections, or as rendered by the netsh wlan show interfaces command).

Remarks

The folder parameter must specify an existing folder that is accessible from the local computer. It can be either an absolute path or relative path to the current working directory. In addition, "." refers to the current working directory, and "." refers to the parent directory of the current working directory. The folder name cannot be a Universal Naming Convention (UNC) path.

If the name parameter is specified but the interface parameter is not, then only that profile is saved. Otherwise all profiles on the computer with the specified name are saved.

If both the interface parameter and name parameter are specified, only the specified profile for that interface is saved.

Profiles of specified interfaces are saved in the file name format "InterfaceName ProfileName.xml." Profiles at the computer level are saved in the file name format "ProfileName.xml."

Example commands

  • export profile folder=c:\profiles name="Profile 1" interface="Wireless Network Connection"

  • export profile folder="c:\wifi profiles" name=Profile2 interface=*

set autoconfig

Enables or disables WLAN Auto Config Service on an interface.

Syntax

set autoconfig enabled={yes|no} interface=InterfaceName

Parameters

enabled

Required. Specifies whether to set WLAN Auto Config Service to enabled or disabled.

Interface

Required. Specifies the name of the interface on which the service has been enabled or disabled, (where InterfaceName is the name of the wireless interface, as listed in Network Connections, or as rendered by the netsh wlan show interfaces command).

Remarks

When WLAN Auto Config Service is enabled, computers running Windows Vista and Windows Server 2008 automatically connect to wireless networks by using the specified interface. By default, autoconfig is enabled on computers running Windows Vista.

If autoconfig is disabled, Windows will not automatically connect to any wireless networks by using the specified interface.

There is wildcard support for the interface parameter. You can use the characters ? and * to replace a letter and letters of the interface name, respectively.

Example command

  • set autoconfig enabled=yes interface="Wireless Network Connection"

set blockednetworks

Shows or hides the blocked networks in the visible network list.

Syntax

set blockednetworks display={show|hide}

Parameters

Display

Required. Specifies whether to show or hide the blocked networks in the list of available wireless. See "Remarks."

Remarks

To view the list of available wireless networks, click Start, click Connect to, and the Connect to a network dialog opens. In Show, select Wireless to display only wireless networks.

Example command

  • set blockednetworks display=show

The example command specifies that blocked networks are shown in the list of available networks.

set createalluserprofile

Specifies whether users are allowed to create all-user profiles, regardless of whether they are members of the Administrators group. Users who have membership in the Administrators group can create all-user profiles no matter whether “set createalluserprofile enabled=” is set to “yes” or “no.”

Note
The set createalluserprofile is only available on computers running Windows Vista with Service Pack 1, and Windows Server 2008.

Syntax

set createalluserprofile enabled={yes|no}

Parameters

Enabled

Required. Specifies whether all computer users are allowed to create all user profiles.

Remarks

If enabled is set to yes, then every user is allowed to create all user profiles. If enabled is set to no, then only users with administrator permissions are allowed to create all user profiles.

Example command

  • set createalluserprofile enabled=yes

set profileorder

Sets the preference order of a wireless network profile on a wireless network interface.

Syntax

set profileorder name=ProfileName interface=InterfaceName priority=integer

Parameters

Name

Required. Specifies the name of the profile to set, (where ProfileName is the name of the wireless profile, as listed in Manage Wireless Networks, or as rendered by the netsh wlan show profiles command).

Interface

Required. Specifies the name of the interface that has this profile configured, (where InterfaceName is the name of the wireless interface, as listed in Network Connections, or as rendered by the netsh wlan show interfaces command).

Priority

Required. Specifies the new priority number for the profile. See "Remarks."

Remarks

If parameter priority is set to 0 or 1, the profile will move to the first position in the list, regardless of whether another profile was previously set to 0 or 1. A lower number means a higher priority. There is no practical limit on the number of profiles you can have on a computer.

Example command

  • set profileorder name="profile 1" interface="Wireless Network Connection" priority=1

set profileparameter

Sets parameters in a wireless network profile.

Note
The set profileparameter is only available on computers running Windows Vista with Service Pack 1, and Windows Server 2008.

Syntax

set profileparameter name=ProfileName [[interface=]InterfaceName] [[authMode=]{machineOrUser|machineOnly|userOnly|guest}] [[ssoMode=]{preLogon|postLogon|none}] [[maxDelay=]1-120] [[allowDialog={yes|no}] [[userVLAN=]{yes|no}] [[fips=]{yes|no}]

Parameters

Name

Required. Specifies the name of the profile to set, (where ProfileName is the name of the wireless profile, as listed in Manage Wireless Networks, or as rendered by the netsh wlan show profiles command).

Interface

  • Optional. Specifies the name of the interface on which the profile is set, (where InterfaceName is the name of the wireless interface, as listed in Network Connections, or as rendered by the netsh wlan show interfaces command).

AuthMode

Optional [conditional, see "Remarks"]. Specifies the type of credentials to use for authentication.

SSOMode

Optional [conditional, see "Remarks"]. Specifies the type of single sign on to be attempted, if any.

MaxDelay

Optional [conditional, see "Remarks"]. Specifies the timeout value to establish single sign-on connection.

AllowDialog

Optional [conditional, see "Remarks"]. Specifies whether to allow or disallow a dialog to be shown for prelogon.

UserVLAN

Optional [conditional, see "Remarks"]. Specifies if the network switches to a different VLAN upon user authentication.

FIPS

Optional [conditional, see "Remarks"]. Specifies whether to enable or disable Federal Information Processing Standards Publications (FIPS) mode.

Remarks

Parameter name is required; all other parameters are optional, however, regardless of whether parameter interface is specified, at least one other parameter must be specified.

If the parameter interface is specified then only profiles associated with that interface are modified.

Example commands

  • set profileparameter name="Profile 1" authMode=userOnly ssoMode=preLogon

  • set profileparameter name=Profile2 ssoMode=none fips=yes

set tracing

Enables or disables WLAN tracing.

Syntax

set tracing mode={yes|no|persistent}

Parameters

Mode

Required. Specifies whether tracing is disabled, enabled and persistent, or enabled and nonpersistent. See "Remarks" for additional information.

Remarks

If the mode parameter is set to yes, nonpersistent tracing is active until the mode is either set to no or the computer is restarted.

If the mode parameter is set to no, tracing is stopped for either persistent or nonpersistent tracing.

If the mode parameter is set to persistent, tracing will still be active even after the computer is restarted.

The default value for mode parameter is nonpersistent.

Example command

  • set tracing mode=persistent

show all

Displays the entire collection of information about wireless network adapters, wireless profiles and wireless networks.

Syntax

show all

Parameters

There are no parameters for this command.

Remarks

Displays the entire collection of 802.11 wireless interface information, network information, and wireless settings on the system, including:

  • Wireless adapter driver information

  • Wireless interface status

  • Wireless configuration settings

  • Wireless network filters

  • Wireless network profiles list and details

  • Visible wireless networks

Example command

  • show all

show autoconfig

Displays whether WLAN AutoConfig service is enabled or disabled

Syntax

show autoconfig

Parameters

There are no parameters for this command.

Remarks

Displays whether WLAN AutoConfig service is enabled or disabled on each wireless adapter interface.

Example command

  • show autoconfig

show blockednetworks

Displays the global setting whether to display or hide blocked networks in the visible network list

Syntax

show blockednetworks

Parameters

There are no parameters for this command.

Remarks

Displays the global setting whether to display or hide blocked networks in the visible network list.

Example command

  • show blockednetworks

show drivers

Displays the properties of the wireless adapter drivers on the computer.

Syntax

show drivers [[interface=]InterfaceName]

Parameters

Interface

Optional. Specifies the name of the interface for which driver information is displayed, (where InterfaceName is the name of the wireless interface, as listed in Network Connections, or as rendered by the netsh wlan show interfaces command).

Remarks

Shows the 802.11 wireless LAN interface driver information.

The following list summarizes the type of information presented by this command:

  • Interface name (Wireless Network Connection)

  • Driver (model and type)

  • Vendor (manufacturer name)

  • Provider (driver provider)

  • Date (the date the driver was written)

  • Version (driver version number)

  • INF file (location of driver INF file)

  • Type (Native Wi-Fi driver or Legacy Wi-Fi driver)

  • Radio types supported (Direct Sequence Spread Spectrum [DSSS], 802.11g, 802.11b)

  • Authentication and cipher supported in infrastructure mode (WPA2-Enterprise TKIP; CCMP, Wi-Fi Protected Access [WPA]-Enterprise Temporal Key Integrity Protocol [TKIP]; CCMP, WPA2-Personal TKIP; CCMP, WPA-Personal TKIP; CCMP, Open Wired Equivalent Privacy [WEP], Open None, Shared WEP, Shared None)

  • Authentication supported in ad-hoc mode (Open-WEP, Open-None, Shared WEP)

Example command

  • show drivers interface="Wireless Network Connection"

show filters

Displays the current list of allowed and blocked wireless networks.

Syntax

show filters [[permission=]{allow|block}]

Parameters

Permission

Optional. Specifies whether to show the list of allowed and blocked networks configured on the computer.

Remarks

If parameter permission is specified, the command displays the list of networks configured on the system that have the specified permission type (allow or block). Otherwise, both the allowed and blocked lists are shown.

Example commands

  • show filters

  • show filters permission=allow

  • show filters permission=block

show interfaces

Displays a list of the current wireless interfaces on a computer.

Syntax

show interfaces

Parameters

There are no parameters for this command.

Remarks

Shows the wireless interfaces configured on the computer.

Displayed information includes:

  • The number of interfaces on the computer

  • Name (for example, "Wireless Network Connection")

  • Description (for example, Broadcom 802.11g Network Adapter)

  • GUID (hexadecimal string)

  • Interface state (connected or disconnected)

Example command

  • show interfaces

show networks

Displays a list of wireless networks that are visible on the computer.

Syntax

show networks [[interface=]InterfaceName] [[mode=]{ssid|bssid}]

Parameters

Interface

Optional. Specifies for which interface the network information is returned, (where InterfaceName is the name of the wireless interface, as listed in Network Connections, or as rendered by the netsh wlan show interfaces command).

Mode

Optional. Specifies whether to display information for Basic Service Set Identifier (BSSID), or Service Set Identifier (SSID).

Remarks

Displays the wireless networks available to the computer.

If the interface parameter is specified, only the networks visible to the specified interface are listed. Otherwise, all networks visible to the computer are listed.

If the mode=ssid parameter is specified, then information about each visible SSID is listed.

Displayed SSID information includes:

  • Interface name

  • Number of visible networks

  • Network name, by SSID

  • Network type (infrastructure or ad hoc)

  • Authentication (Known as "Security type" in the properties of a wireless profile. Security types include WPA2-Enterprise, WPA2-Personal, WPA-Enterprise, WPA-Personal, WEP and Open.)

  • Encryption method (examples include Advanced Encryption Standard (AES) and Temporal Key Integrity Protocol (TKIP)).

  • Whether the mode parameter is not specified, only SSIDs are listed.

Displayed SSID information includes:

  • Interface name

  • Number of visible networks.

  • Network name, by SSID

  • Network type (infrastructure or ad hoc)

  • Authentication (access point - network authentication)

  • Encryption method

If the mode=bssid parameter is specified, then information for the visible BSSIDs for each visible SSID is listed.

Displayed BSSID information includes:

  • Interface name

  • Number of visible networks

  • Network name, by SSID

  • Network type (infrastructure or ad-hoc)

  • Authentication (Known as "Security type" in the properties of a wireless profile. Security types include WPA2-Enterprise, WPA2-Personal, WPA-Enterprise, WPA-Personal, WEP and Open.)

  • Encryption method (examples include AES and TKIP)

  • BSSID number (for example, 00:54:96:32:06)

    • Signal strength (by %)

    • Radio type (for example, 802.11b)

    • Channel (radio channel number)

Example commands

  • show networks interface="Wireless Network Connection"

  • show networks mode=bssid

  • show networks

show profiles

Displays a list of wireless profiles that are configured on the computer.

Syntax

show profiles [[name=]ProfileName] [[interface=]InterfaceName]

Parameters

Name

Optional. Specifies the name of the profile to display, (where ProfileName is the name of the wireless profile, as listed in Manage Wireless Networks, or as rendered by the netsh wlan show profiles command).

Interface

Optional. Specifies the name of the interface which has this profile configured, (where InterfaceName is the name of the wireless interface, as listed in Network Connections, or as rendered by the netsh wlan show interfaces command).

Remarks

Displays the profile data or lists the profiles on the computer.

If the name parameter is specified, then only the content for the specified profile is displayed. If the name parameter is not specified, only the profile name and description are displayed.

If the interface parameter is specified, only the profiles on the specified interface are displayed. If the interface parameter is not specified, all profiles with the specified name are displayed.

Displayed information includes:

  • All Users or Current User Profile

  • Profile name

  • Applied profile (Current User or All Users)

  • Control options

    • Connect automatically or connect manually

    • Visible SSID or hidden SSID

  • connectivity settings:

    • Number of SSIDs (listed by number and SSID)

    • Network type (infrastructure or ad hoc)

    • Radio type

    • Vendor extension

  • Security settings

    • Number of auth/cipher combinations (for example, auth: WPA2-Enterprise, cipher: TKIP)

    • Security key

    • 802.1X (enabled or disabled)

    • Extensible Authentication Protocol (EAP) type

    • 802.1X authentication credential

    • Cache user information

Example commands

  • show profiles name="profile 1" interface="Wireless Network Connection"

  • show profiles name=profile2

  • show profiles

show settings

Displays the current global settings of the wireless LAN.

Syntax

show settings

Parameters

There are no parameters for this command.

Remarks

Shows the global setting for wireless network service, including whether or not WLAN Auto Config Service is enabled on each interface and whether blocked networks are shown or hidden.

Allow and block filter lists are available by using the show filters command.

Example command

  • show settings

show tracing

Displays whether wireless tracing is enabled or disabled.

Syntax

show tracing

Parameters

There are no parameters for this command.

Remarks

Displayed information includes:

  • Tracing state (enabled or disabled)

  • Tracing persistence state (running or not running)

  • Trace log file location (for example "c:\Windows\system32\logfiles\WirelessAutoLog\")

Example command

  • show tracing

See Also

Other Resources

Active Directory Schema Extensions for Windows Vista Wireless and Wired Group Policy Enhancements
Microsoft TechNet Wireless Networking
Wi-Fi Protected Access 2 Data Encryption and Integrity: The Cable Guy, August 2005
Wi-Fi Protected Access 2 (WPA2) Overview: The Cable Guy, May 2005
Deployment of Secure 802.11 Networks Using Microsoft Windows