How to Configure TCP Memory Pressure Protection in Windows 11 Using PowerShell

Modern operating systems allocate non-paged pool memory within the kernel space to service incoming TCP connections, socket buffers, Transmission Control Blocks (TCBs), and network interface driver queues. Under normal operational loads, the Windows 11 TCP/IP stack scales memory dynamically to accommodate connection volume. However, during high-volume network transfers, micro-bursts of incoming traffic, or malicious Denial of Service (DoS) and SYN flood attacks, non-paged kernel pool memory can deplete rapidly. When pool memory runs out, the entire operating system experiences severe degradation, network stack stalls, or Blue Screen of Death (BSOD) stop errors.

To defend against system resource starvation, Windows 11 provides a built-in protective mechanism named TCP Memory Pressure Protection. Managed through PowerShell’s NetTCPIP module, this setting instructs the kernel network stack to monitor memory saturation and automatically take defensive measures when memory pressure thresholds are breached.

Understanding TCP Memory Pressure Protection Modes

When TCP Memory Pressure Protection is active, the Windows kernel continuously evaluates the availability of non-paged pool memory allocated to network descriptors. When physical memory consumption crosses predefined critical thresholds, the operating system enters an algorithmic memory pressure protection state:

• Aggressive TCB Reclaiming: The kernel accelerates the teardown of connections sitting in transient or closing states such as TIME_WAIT, FIN_WAIT_1, and FIN_WAIT_2.
• Early Termination of Idle Connections: Inactive TCP connections that have remained dormant without traffic exchange are pruned to reclaim buffer allocations.
• SYN Attack Mitigation: The stack reduces embryonic connection timeouts (the duration half-open connections wait for the final ACK in the three-way handshake), preventing socket exhaustion.
• Window Size Adjustments: Limits dynamic receive window growth to prevent excessive buffering on incoming data streams.

The parameter MemoryPressureProtection can be configured across three operational states:

• Disabled: The TCP stack does not monitor memory pressure or accelerate connection teardowns. (Default on some client profiles, prioritizing connection persistence over defensive memory management).
• Enabled: The stack dynamically monitors non-paged pool usage and triggers defensive mitigations whenever memory allocation reaches critical thresholds.
• Default: Reverts the setting to the operating system’s internal heuristics based on system architecture, RAM capacity, and server vs client edition.

Inspecting Current Memory Pressure Protection Settings

To inspect the active TCP memory pressure protection status across all network templates in Windows 11, launch PowerShell as an Administrator and execute Get-NetTCPSetting:

Get-NetTCPSetting | Select-Object SettingName, MemoryPressureProtection, AutoTuningLevelLocal, CongestionProvider | Format-Table -AutoSize

To view detailed attributes of the primary Internet and Datacenter templates:

Get-NetTCPSetting -SettingName "Internet" | Select-Object SettingName, MemoryPressureProtection, MinRtoMs, MaxSynRetransmissions

You can also check the current kernel non-paged pool memory utilisation using PowerShell to assess baseline memory consumption:

Get-CimInstance Win32_OperatingSystem | Select-Object @{Name="FreePhysicalMemory_MB";Expression={[math]::Round($_.FreePhysicalMemory/1KB,2)}}, @{Name="TotalVisibleMemory_MB";Expression={[math]::Round($_.TotalVisibleMemorySize/1KB,2)}}

Enabling TCP Memory Pressure Protection in Windows 11

In Windows 11, standard templates like Internet can be modified directly, or customized settings can be applied to the InternetCustom profile.

To enable Memory Pressure Protection on the default Internet profile:

Set-NetTCPSetting -SettingName "Internet" -MemoryPressureProtection Enabled

If you run high-throughput local network workloads, Hyper-V virtual switches, or WSL2 containers that utilize the Datacenter or Compat profiles, enable protection across those templates as well:

Set-NetTCPSetting -SettingName "Datacenter" -MemoryPressureProtection Enabled
Set-NetTCPSetting -SettingName "Compat" -MemoryPressureProtection Enabled

To enable memory pressure protection across all configured TCP templates in a single pipeline command:

Get-NetTCPSetting | Set-NetTCPSetting -MemoryPressureProtection Enabled

Verify that the configuration has been updated across the profiles:

Get-NetTCPSetting | Select-Object SettingName, MemoryPressureProtection

Configuring Associated Low-Memory Thresholds via Registry

For enterprise environments and specialized low-latency servers requiring fine-tuned control over when memory protection activates, Windows provides underlying TCP/IP registry parameters.

Open an elevated PowerShell session and inspect the TCP/IP parameters key:

$RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters"
Get-ItemProperty -Path $RegPath -Name "SynAttackProtect", "TcpMaxHalfOpen", "TcpMaxHalfOpenRetried" -ErrorAction SilentlyContinue

To complement Memory Pressure Protection with hardened SYN attack protection (which triggers SYN cookie generation when half-open socket memory is constrained):

# Enable SYN attack protection (Value 2 enables maximum defense)
Set-ItemProperty -Path $RegPath -Name "SynAttackProtect" -Value 2 -Type DWord

# Set threshold for half-open TCP connections before defense activates
Set-ItemProperty -Path $RegPath -Name "TcpMaxHalfOpen" -Value 1024 -Type DWord

Confirm the registry keys are set:

Get-ItemProperty -Path $RegPath | Select-Object SynAttackProtect, TcpMaxHalfOpen

Validating Protection and Monitoring Kernel Memory Pools

After enabling protection, monitor system responsiveness under heavy network loads using Performance Monitor (perfmon) counters via PowerShell.

To monitor active TCP connections, failed connection attempts, and connection resets in real time:

Get-Counter -Counter "\TCPv4\Connections Established", "\TCPv4\Connection Failures", "\TCPv4\Connections Reset" -Continuous

To monitor non-paged kernel pool bytes:

Get-Counter -Counter "\Memory\Pool Nonpaged Bytes", "\Memory\Available MBytes" -SampleInterval 2 -MaxSamples 5

Under heavy connection spikes, you will observe Pool Nonpaged Bytes stabilize as memory pressure protection prevents unbounded buffer allocations.

Reverting to Default Windows 11 Configuration

If legitimate long-lived idle connections (such as persistent database sessions or SSH tunnels) are being terminated prematurely during background file transfers, revert the parameter back to its default state.

Execute the following command to restore default heuristics:

Get-NetTCPSetting | Set-NetTCPSetting -MemoryPressureProtection Disabled

To clear the custom registry parameters:

Remove-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" -Name "SynAttackProtect" -ErrorAction SilentlyContinue
Remove-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" -Name "TcpMaxHalfOpen" -ErrorAction SilentlyContinue

Restart the network adapter or reboot the machine to ensure all TCP kernel buffers return to baseline operation.