How to Create and Manage Network QoS Policies in Windows 11 Using PowerShell

When multiple network-intensive applications compete for internet bandwidth on a single Windows 11 workstation, unmanaged congestion can degrade critical operations. A large background software update or file upload can trigger severe latency spikes, causing dropped video frames in Microsoft Teams meetings, audio stuttering in VoIP calls, or jitter in real-time developer terminal sessions. In enterprise networks and home offices alike, managing bandwidth contention requires Network Quality of Service (QoS) policies.

In Windows 11, the native PowerShell NetQoS module empowers administrators to create granular traffic management rules. Using QoS policies, you can tag outgoing network packets with Differentiated Services Code Point (DSCP) priority headers—instructing local routers and network switches to prioritize vital packets—while capping or throttling high-bandwidth background processes. In this tutorial, we examine how to audit existing QoS rules, construct DSCP tagging and throttling policies with PowerShell, and configure registry parameters to enforce QoS on standalone Windows machines.

Core Mechanisms of Windows Network QoS

Windows 11 implements QoS policies through two primary traffic management controls:

QoS Mechanism	Technical Execution	Primary Practical Benefit
DSCP Value Tagging	Inserts a 6-bit priority mark into the IP packet header’s Type of Service (ToS) field.	Informs enterprise managed switches and upstream routers to give packets expedited forwarding during network congestion.
Bandwidth Throttling	Enforces a strict maximum transmission rate limit (in bits per second) at the Windows network kernel layer.	Restricts bandwidth-heavy applications (such as large cloud sync daemons or bulk downloaders) from starving real-time tasks.

Standard DSCP Priority Values Reference

When configuring DSCP priority tags in PowerShell, using established industry standards ensures managed network equipment interprets your priorities accurately:

• DSCP 46 (Expedited Forwarding – EF): Highest priority. Reserved for mission-critical voice over IP (VoIP) audio streams.
• DSCP 34 (Assured Forwarding – AF41): High priority. Ideal for interactive video conferencing (e.g., Microsoft Teams, Zoom).
• DSCP 26 (Assured Forwarding – AF31): Medium priority. Best for transactional database lookups, SSH, and remote desktop (RDP) sessions.
• DSCP 0 (Best Effort): Default unclassified traffic with no special routing preference.

Step 1: Enabling QoS on Standalone Windows 11 Workstations

By default, Windows restricts DSCP tagging to domain-joined computers via Network Location Awareness (NLA). To enable DSCP packet tagging on standalone Windows 11 Pro or Enterprise systems connected to standard workgroup or home networks, configure the following registry override:

1. Right-click the Start button on your taskbar and select Terminal (Admin) or PowerShell (Admin).
2. Execute the following command to create the QoS registry key and bypass domain enforcement:

   reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\QoS" /v "Do not use NLA" /t REG_SZ /d "1" /f

3. A system reboot or network adapter restart is recommended for this registry flag to engage.

Step 2: Auditing Existing Network QoS Policies

To inspect active QoS policies on your system:

Get-NetQosPolicy

If no custom policies have been deployed, PowerShell will return a blank line, indicating all outbound traffic is handled in standard Best Effort mode.

Step 3: Creating QoS Policies with New-NetQosPolicy

The New-NetQosPolicy cmdlet allows matching traffic based on executable application filenames, port numbers, destination IP addresses, or network categories (Domain, Private, Public).

1. Prioritising Video Conferencing Applications

To tag all outgoing traffic from Microsoft Teams with Expedited Forwarding (DSCP 46) across all network profiles:

New-NetQosPolicy -Name "Teams-Priority" `
    -AppPathNameMatchCondition "ms-teams.exe" `
    -DSCPAction 46 `
    -NetworkProfile All

2. Prioritising Remote Desktop (RDP) and SSH Traffic

To prioritize administrative management traffic based on destination TCP port numbers:

New-NetQosPolicy -Name "RDP-Admin-Priority" `
    -IPProtocol TCP `
    -IPPortMatchCondition 3389 `
    -DSCPAction 26 `
    -NetworkProfile All

3. Throttling Bandwidth-Intensive Background Sync

To prevent background backup or file synchronization software from saturating an entire home or branch office uplink, apply a maximum transmission rate cap (for instance, capping an application at 10 Mbps = 10,000,000 bits per second):

New-NetQosPolicy -Name "CloudSync-Throttle" `
    -AppPathNameMatchCondition "onedrive.exe" `
    -ThrottleRateActionBitsPerSecond 10000000 `
    -NetworkProfile All

Step 4: Modifying Existing QoS Policies

To update the parameters of an existing policy without deleting and rebuilding it, use Set-NetQosPolicy. For example, to adjust the CloudSync bandwidth cap down to 5 Mbps:

Set-NetQosPolicy -Name "CloudSync-Throttle" -ThrottleRateActionBitsPerSecond 5000000

Step 5: Removing QoS Policies

When a QoS rule is obsolete, remove it using Remove-NetQosPolicy:

Remove-NetQosPolicy -Name "CloudSync-Throttle" -Confirm:$false

To remove all configured QoS rules simultaneously and restore standard unmanaged network throughput:

Get-NetQosPolicy | Remove-NetQosPolicy -Confirm:$false

Verifying QoS Packet Tagging in Action

To verify that Windows 11 is actively injecting DSCP values into outgoing network packets, capture traffic using Wireshark while running the targeted application. In Wireshark, expand the Internet Protocol Version 4 header on outgoing packets and inspect the Differentiated Services Field. The DSCP line will display the exact numeric tag assigned by your policy (e.g., DSCP: CS5 (40) or DSCP: EF (46)), confirming that hardware routers receive prioritized QoS markers.