How to Configure IPsec Phase 2 User Authentication Sets in Windows 11 Using PowerShell

In secure enterprise computing environments, defending against unauthorized internal access requires policies that restrict network traffic based not only on which computer sent the packets, but also on which specific human user initiated the network session. In Windows 11 and Windows Server networks, Windows Defender Firewall with Advanced Security provides this dual-layer protection through IPsec connection security rules.

While Phase 1 (Main Mode) authenticates the physical computer identity using Machine Kerberos or computer certificates, Phase 2 (Quick Mode) authentication enables user identity verification. By embedding user authentication into Phase 2 security associations, administrators can enforce granular firewall rules that restrict access to sensitive financial servers, healthcare databases, or management endpoints to authorized Active Directory users—even when non-privileged users share the same workstation. Using PowerShell and the NetSecurity module, administrators can construct declarative Phase 2 user authentication sets and bind them to connection rules.

Understanding Phase 2 User Authentication Mechanics

IPsec Phase 2 authentication operates within the secure channel established during Phase 1. Key operational requirements include:

• Prerequisite Phase 1 Tunnel: Phase 2 user authentication cannot negotiate in isolation; it requires an established Phase 1 Main Mode security association that authenticates the physical workstation.
• User Credentials: Authentication proposals specify whether user identity is verified via User Kerberos v5 (standard for domain accounts) or User Certificates (X.509 PKI certificates issued to the user’s personal certificate store).
• Firewall Rule Enforcement: Once Phase 2 user authentication is validated, standard inbound Windows Firewall rules can evaluate the authenticated user SID against authorized security groups (using -RemoteUser parameters).
• Multi-User Isolation: On shared engineering workstations or multi-user terminal jump hosts, different users establish distinct Phase 2 cryptographic security associations, isolating their traffic and permissions.

Auditing Existing Phase 2 Authentication Sets in PowerShell

To inspect currently configured Phase 2 authentication sets on Windows 11, open an elevated PowerShell prompt and execute Get-NetIPsecPhase2AuthSet:

# Query all configured IPsec Phase 2 authentication sets
Get-NetIPsecPhase2AuthSet

To view detailed proposal hierarchies and authentication types:

# Format Phase 2 authentication properties as a detailed list
Get-NetIPsecPhase2AuthSet | Format-List DisplayName, Name, Proposal

If only machine authentication has been configured, this cmdlet returns an empty list or default system placeholders.

Creating a Phase 2 User Authentication Set with Kerberos

To construct a Phase 2 authentication set that requires User Kerberos v5 authentication, assemble the authentication proposal using New-NetIPsecAuthProposal with the -User flag:

# Define proposal for User Kerberos v5 authentication
$userKerbProposal = New-NetIPsecAuthProposal -User -Kerberos

# Create the Phase 2 user authentication set
New-NetIPsecPhase2AuthSet `
    -DisplayName "Corporate-User-Kerberos-Phase2" `
    -Description "Enforces Active Directory User Kerberos authentication for database traffic" `
    -Proposal $userKerbProposal

For hybrid environments where users might authenticate via personal user certificates issued by an internal corporate PKI, add a secondary certificate proposal to the set:

# Define proposal for User Certificate authentication
$userCertProposal = New-NetIPsecAuthProposal `
    -User `
    -Cert `
    -Authority "CN=Contoso User Issuing CA, DC=corp, DC=contoso, DC=com" `
    -AuthorityType Root

# Create combined Phase 2 authentication set with Kerberos and Certificate fallback
New-NetIPsecPhase2AuthSet `
    -DisplayName "Corporate-User-Hybrid-Phase2" `
    -Proposal $userKerbProposal, $userCertProposal

Binding Phase 2 Authentication Sets to Connection Security Rules

To enforce Phase 2 user authentication across network connections, link the authentication set to an active IPsec Connection Security Rule using New-NetIPsecRule or Set-NetIPsecRule:

# Create a connection security rule requiring Phase 1 machine and Phase 2 user authentication
New-NetIPsecRule `
    -DisplayName "Require-User-Auth-To-Finance-Subnet" `
    -RemoteAddress 10.150.30.0/24 `
    -InboundSecurity Require `
    -OutboundSecurity Require `
    -Phase1AuthSet "Default" `
    -Phase2AuthSet "Corporate-User-Kerberos-Phase2"

Outbound traffic destined for the 10.150.30.0/24 financial server network will now require both machine-level and user-level identity validation before packets are permitted to egress.

Restricting Inbound Firewall Rules Based on User Identity

Once Phase 2 user authentication is enforced on the connection security rule, standard inbound firewall rules on destination servers can restrict access to authorized user groups using New-NetFirewallRule:

# Restrict SQL Server port access to members of the Finance Analysts AD group
New-NetFirewallRule `
    -DisplayName "Allow-SQL-Finance-Users-Only" `
    -Direction Inbound `
    -Protocol TCP `
    -LocalPort 1433 `
    -Action Allow `
    -Authentication Required `
    -RemoteUser "CORP\Finance-Analysts"

Because Phase 2 authenticated the user’s Active Directory token, the firewall inspects the user SID and drops connection attempts from unauthorized users, even if they connect from an authorized company laptop.

Modifying and Removing Phase 2 Authentication Sets

To update authentication proposals on an existing Phase 2 set:

# Update proposals on an existing Phase 2 authentication set
$updatedProposal = New-NetIPsecAuthProposal -User -Kerberos
Set-NetIPsecPhase2AuthSet `
    -DisplayName "Corporate-User-Kerberos-Phase2" `
    -Proposal $updatedProposal

To delete an obsolete Phase 2 set after unbinding it from active rules:

# Remove an unused Phase 2 authentication set
Remove-NetIPsecPhase2AuthSet -DisplayName "Corporate-User-Kerberos-Phase2" -Confirm:$false

Configuring IPsec Phase 2 user authentication via PowerShell allows Windows 11 administrators to enforce true identity-aware zero-trust network boundaries, safeguarding sensitive enterprise services against lateral unauthorized access.