How to Change Network Category Between Public and Private in Windows 11 Using PowerShell Set-NetConnectionProfile

When you connect a Windows 11 computer to a local area network or Wi-Fi hotspot, the operating system assigns a Network Category profile to the connection. This profile dictates how Windows Defender Firewall regulates inbound traffic, network discovery, printer sharing, and file access. While the Windows Settings interface provides toggles for changing network types, corporate IT administrators, remote support technicians, and automated setup scripts require command-line control. The PowerShell Get-NetConnectionProfile and Set-NetConnectionProfile cmdlets provide instantaneous inspection and configuration of active network security profiles.

Understanding Windows 11 Network Categories

Windows categorises active network adapters into three distinct operational profiles:

• Public: Designed for untrusted networks such as coffee shops, airports, and hotels. Network discovery is disabled, and Windows Defender Firewall blocks all unsolicited inbound connections, hiding your computer from other devices on the subnet.
• Private: Designed for trusted environments such as home and small office networks. Enables network discovery, allows local file and printer sharing, and permits incoming connections for services like Remote Desktop and media streaming.
• DomainAuthenticated: Automatically assigned when the PC authenticates against an Active Directory Domain Controller. Firewall rules are managed centrally by domain group policies.

If Windows misidentifies your home or office router as a “Public” network, local file shares and networked printers become inaccessible until the category is switched to “Private”.

Querying Active Profiles with Get-NetConnectionProfile

To audit your current network connection profiles in PowerShell:

1. Right-click the Start button on Windows 11 and select Terminal (Admin) or PowerShell (Admin).
2. Confirm the UAC prompt to ensure administrative privileges.
3. Run the profile listing cmdlet:

   Get-NetConnectionProfile

4. PowerShell outputs details for each active network interface, including:
   • Name: The network SSID or adapter connection name (e.g., “Home_WiFi” or “Network 1”).
   • InterfaceAlias: The hardware adapter label (such as “Wi-Fi” or “Ethernet”).
   • InterfaceIndex: The unique numerical identifier of the network adapter.
   • NetworkCategory: The active profile (Public, Private, or DomainAuthenticated).
   • IPv4Connectivity / IPv6Connectivity: The internet reachability state.

Changing a Network Category to Private via PowerShell

To switch an interface from Public to Private using its unique InterfaceIndex:

1. Identify the InterfaceIndex number from the previous command output (for example, index 12).
2. Execute the configuration cmdlet:

   Set-NetConnectionProfile -InterfaceIndex 12 -NetworkCategory Private

3. Alternatively, change the profile using the network name string directly:

   Set-NetConnectionProfile -Name "Network 1" -NetworkCategory Private

4. Rerun Get-NetConnectionProfile to confirm that NetworkCategory now displays Private.

Switching a Network Category Back to Public

When connecting to cellular tethering, shared co-working spaces, or unsecured public Wi-Fi, ensure your device remains fortified by switching the category to Public:

Set-NetConnectionProfile -InterfaceIndex 12 -NetworkCategory Public

Windows Defender Firewall immediately closes local sharing ports, stops responding to incoming ping (ICMP) requests, and hides your machine from other devices on the LAN.

Troubleshooting Networks Locked in Public Mode

On isolated test benches, virtual lab environments, or networks without a default IP gateway, Windows sometimes fails to assign a persistent Private category and reverts to Public upon reboot. To resolve this:

• Check Gateway Configuration: Windows requires a valid default gateway IP to identify and remember a network profile. Verify your adapter has an assigned gateway via Get-NetIPConfiguration.
• Apply to All Active Connections: If you are running an automated lab setup script and wish to set all active interfaces to Private simultaneously:

  Get-NetConnectionProfile | Set-NetConnectionProfile -NetworkCategory Private