Pages

▼

Tuesday, February 10, 2009

How to Configure IPv6 Using Group Policy

Update: I have updated the IPv6Configuration.zip file mentioned below with the new recommendations documented in the article, A 5 Second Boot Optimization If You’ve Disabled IPv6 on Windows Client and Server by setting DisabledComponents to 0xFF.

By default, all modern versions of  Windows and Windows Server enable and use IPv6 as the default networking protocol. These versions of Windows will normally use IPv6 for all network communication and will step down to IPv4 as necessary.

You may decide to disable Windows IPv6 for several reasons. Perhaps your IPv4 network doesn't support it, and you want to disable unnecessary protocols. You may have also read that IPv6 breaks Outlook Anywhere on Exchange 2007 Client Access servers.

Most people think that you disable IPv6 by simply unchecking the Internet Protocol Version 6 (TCP/IPv6) checkbox, as shown above. This method disables IPv6 on the particular LAN interface and connection. For other network adapters or connections, users have to repeat the steps to disable IPv6. However, disabling IPv6 this way does not disable IPv6 on tunnel interfaces or the IPv6 loopback interface. It also must be done manually and cannot be instrumented or enforced using Group Policy.

In order to truly disable IPv6, you must disable it in the registry in the following key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\DisabledComponents
Normally, the DisabledComponents value does not exist. If the value does not exist or the value data is 0, IPv6 is enabled on all interfaces.

Microsoft wrote KB article 929852 to document how to disable certain Internet Protocol version 6 (IPv6) components in Windows Vista (and later) manually using the registry. At the end of the article, Microsoft helpfully wrote, "Note: Administrators must create an ADMX file in order to expose the settings in step 5 in a Group Policy setting." Nice. So, I decided to do just that.

I wrote the attached ADMX and ADML files to enable the configuration of IPv6 using Group Policy. Copy each file to the computer you will use to configure the policy.

IPv6Configuration.zip - This ZIP file contains both the ADMX and ADML files:
  • IPv6Configuration.admx - Copy this file to %SYSTEMROOT%\PolicyDefinitions
  • IPv6Configuration.adml - Copy this file to %SYSTEMROOT&\PolicyDefinitions\en-US (Replace en-US with your country's language, if necessary)
Now log into the computer and use the Group Policy Management Console (GPMC) to configure the IPv6 settings. The new policy will be located under Computer Configuration > Policies > Administrative Templates > Network > IPv6 Configuration, as shown below:

Group Policy Management Console
Here, you can configure the following IPv6 settings:
  • Enable all IPv6 components (Windows default)
  • Disable all IPv6 components (the setting you probably want)
  • Disable 6to4
  • Disable ISATAP
  • Disable Teredo
  • Disable Teredo and 6to4
  • Disable all tunnel interfaces
  • Disable all LAN and PPP interfaces
  • Disable all LAN, PPP and tunnel interfaces
  • Prefer IPv4 over IPv6
Note that you must restart the computer for the configuration to go into effect.
Please to enjoy!

at

29 comments:

  1. dpJuly 23, 2009 at 4:40 AM

    Thanks for this. Nice and easy!

    ReplyDelete
  2. CrusSeptember 5, 2009 at 1:18 AM

    Hi,

    thanks for this!

    But I got one question:
    After I had applied this to my domain all my clients got the registry entry successfully, but the IPv6 Protocol on the network interface properties is already checked?

    Have I to disable this manually on each client? Because it seems that it is not enough to only add this registry-key to disable it!

    regards,
    Crus

    ReplyDelete
  3. Joe MorrisSeptember 20, 2009 at 9:25 AM

    I'll add my thanks for the posting, and a followup to the question from Crus:

    The references I've found to disabling IPv6 consistently indicate that setting the Registry value above to 0xFF (or 0xFFFFFFFF) is sufficient to block the use of all of the IPv6 components (protocol, Teredo, 6to4 etc.). Are there any exceptions that require additional actions?

    And (even if the Registry change really does block IPv6) is there any scripting mechanism that would allow me to cause the IPv6 components to show as unchecked in the network adapter interface definitions? I support a research organization where some of the project laboratories may have a legitimate need to use IPv6 even if the internal network does not yet support it. While it's not a showstopper to the use of Windows 7 I would like to be able to build a distribution image that at sysprep OOBE time automagically unchecks the various IPv6 components in every network interface to visibly show that IPv6 has been disabled. Any suggestions on how to do this?

    ReplyDelete
  4. Marc-Andre LabelleOctober 27, 2009 at 7:52 AM

    Hi,

    I copied the fils in my local folders.
    when I open the Local Group Policy Editor and I navigate to the IPv6 Configuration folder, it is empty.
    I tried on another Vista Computer, same thing. Any Ideas?

    ReplyDelete
  5. JeffOctober 27, 2009 at 7:57 AM

    Make sure that your GPO filters are turned off when viewing Administrative Templates. Click View > Filter Options. Managed, Configured and Commented should be set to ANY.

    ReplyDelete
  6. Marc-Andre LabelleOctober 28, 2009 at 5:19 AM

    ok :-) Thanks a lot :-)

    ReplyDelete
  7. MuraliFebruary 22, 2010 at 9:34 AM

    Hi,

    Thank you Mr. JEFF for your useful article. I am getting the same issue like Mr. Crus said, after applying this policy in my win 2008 DC. How can disable this permanently from all the systems, when i connect the windows systems in domain.

    ReplyDelete
  8. Jeff Guillet - @exptaFebruary 22, 2010 at 10:38 AM

    You must manually clear the checkbox for IPv6 on each network adapter. Unfortunately, there is no way to do this via Group Policy (mainly because each NIC has a unique GUID in the registry).

    ReplyDelete
  9. Jeff Guillet - @exptaFebruary 22, 2010 at 10:43 AM

    As a follow up to my earlier comment, if you don't clear the IPv6 setting in the properties of the NIC, an IPv6 address will be assigned to that NIC.

    But if you disable IPv6 using the registry or GPO options listed in this article, the computer won't use IPv6 for communication even though it has an IPv6 address.

    ReplyDelete
  10. AnonymousMarch 30, 2010 at 10:43 AM

    This has been an extremely helpful article. I bookmarked it!

    ReplyDelete
  11. Misha HaninAugust 20, 2010 at 8:27 AM

    Back in days I've published a script

    http://www.curuit.com/disable-ipv6-over-all-interfaces-and-prefer-ipv4-to-ipv6-20090129195/

    that does this, and I've been using this script everywhere, but GPO is much better;). Thanks.

    P.S.
    I've republished this post on my website, and if you want to save a website traffic, everybody welcome to download a .ZIP file from my web site as well.

    ReplyDelete
  12. D@rLin|{September 15, 2010 at 7:59 AM

    Thanks!

    ReplyDelete
  13. AnonymousMarch 18, 2011 at 10:29 AM

    Hi,
    First, thank you for the effort you put into this settings.
    However, I did as described above, but when I open the GPMC and go to Computer Configuration > Policies > Administrative Templates > Network ... the IPv6 Configuration folder does not show up at all.
    Any idea, and thank you in advance.

    ReplyDelete
  14. AnonymousMarch 18, 2011 at 10:54 AM

    Found it.
    Had to move the file directly into the domain folder
    your-domain-controller\SYSVOL\your-domain\Policies\PolicyDefinitions for the ADMX file, and
    your-domain-controller\SYSVOL\your-domain\Policies\PolicyDefinitions\en-US for the ADML file

    ReplyDelete
  15. AnonymousJune 17, 2011 at 12:09 PM

    just for grins, i used group policy preferences couldn't we just write the registry entry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\DisabledComponents. i had to put in the value ffffffff for it to show up in the registry as 0xffffffff. so the registry shows up that way but i still see IPv6 checked in the local area connection properties and i get an ipv6 address in ipconfig /all.

    ReplyDelete
  16. David PageJuly 5, 2011 at 9:17 AM

    I don't have a Policies\PolicyDefinitions folder, just several GUID entries in brackets. Can I create those folders (I think not as they're obviously supposed to be autocreated)

    Any suggestions?

    ReplyDelete
  17. Jeff Guillet - @exptaJuly 5, 2011 at 10:14 AM

    Hi David,

    Those folders should be created by default on any Windows 2008 or better domain controller. Ensure that you've configured Windows Explorer to show hidden files and folders and to show protected Windows operating system files.

    ReplyDelete
  18. AnonymousJuly 14, 2011 at 4:24 AM

    Hi Jeff,

    I have followed your instruction and show hidden files and folders, and show protected windows operating system files, but still no luck. Is there anyway around it.

    ReplyDelete
  19. AnonymousAugust 23, 2011 at 8:20 AM

    yes you can create those folders: http://technet.microsoft.com/en-us/library/cc748955(WS.10).aspx

    ReplyDelete
  20. AnonymousSeptember 22, 2011 at 8:30 AM

    Great post, one quesiton. How do i disable multiple items. e.g. disable ISATAP, Teredo and also prefer V4 over V6?

    ReplyDelete
  21. Jeff Guillet - @exptaSeptember 22, 2011 at 10:47 AM

    If you set the DisabledComponents key to 0xFFFFFFFF, it will achieve what you want because all IPv6 components are disabled.

    See http://support.microsoft.com/kb/929852

    ReplyDelete
  22. AnonymousSeptember 23, 2011 at 8:55 AM

    Thanks that makes sense however i dont actually want to turn it all off. To start with if I can id like to just disable all the tunneling methods. And then if possible also prefer IPv4 over IPv6, the idea is to jsut have IPv6 stack and none of the extra junk.

    ReplyDelete
  23. AnonymousOctober 7, 2011 at 4:18 AM

    thanks a lot Jeff for creating and sharing these custom templates!
    how did you create these custom ADMX and ADML files? is there any tool for that?

    ReplyDelete
  24. Jeff Guillet - @exptaOctober 7, 2011 at 7:38 AM

    I created them using the ADMX Migrator tool. http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=15058

    ReplyDelete
  25. AnonymousOctober 10, 2011 at 7:21 AM

    After MUCH searching, I consider THIS post the authority. There must be NO way to programitacally remove the check in the adapters' properties for IPV6. Thats all there is to it, right? So, the reg edit or the policy will, in fact, disable the protocol but each adapter will still have the check. Is this correct? Thanks again all for a great post here. I appreciate everyones input.

    ReplyDelete
  26. AnonymousDecember 1, 2011 at 12:15 AM

    Awesome, thank you very much!!

    When disabling IPV6 via regedit or via the ADMX which is the same the tick will still appear in the IPV6 properties regardless of which setting you apply.

    ReplyDelete
  27. SMAndyFebruary 2, 2012 at 2:14 AM

    Has anyone discovered a way of turning off that tickbox? We've got an issue on our domain where PC's with this tickbox set are taking anywhere up to 3 hours to log in, but if you untick that box, it works fine. Looks like it's the act of getting an IPv6 address causes it. Would be great if there was a way to untick this via group policy...

    Thanks.

    ReplyDelete
  28. UnknownOctober 1, 2012 at 9:04 AM

    Simple as abc! Thanks!

    ReplyDelete
  29. AnonymousMarch 4, 2013 at 2:59 AM

    hi
    fantastic gpo. thanks a lot
    one question though regarding windows clustering in server 2008
    as the virtual failover adapter uses/prefers 1pv6 for node-node communication will this policy break that functionality?

    thanks

    ReplyDelete

Thank you for your comment! It is my hope that you find the information here useful. Let others know if this post helped you out, or if you have a comment or further information.