How to Configure and Disable ISATAP IPv6 Transition Interfaces in Windows 11 Using PowerShell

The Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) was designed during the early adoption phases of IPv6 as an automated transition technology. Its primary purpose was to connect dual-stack IPv6/IPv4 nodes across an IPv4-only enterprise intranet without requiring global IPv6 routers at every subnet. ISATAP generates link-local and global IPv6 addresses by embedding a 32-bit IPv4 address into the lower 64 bits of an IPv6 address using the modified EUI-64 format (with an interface identifier containing 0000:5EFE).

While historically useful for legacy network migrations, ISATAP is now considered deprecated and poses measurable security risks in modern corporate environments. By default, Windows systems attempt to discover an ISATAP router by querying the hostname isatap or isatap.<domain> using DNS, Link-Local Multicast Name Resolution (LLMNR), and NetBIOS over TCP/IP (NBT). Unauthenticated attackers on the local network can spoof these queries, establishing rogue tunnel gateways and capturing or tampering with internal traffic. In Windows 11, administrators can audit, configure router parameters, and disable ISATAP using the NetTCPIP PowerShell module.

Understanding ISATAP Security Risks and Operation

ISATAP operates as an overlay virtual network interface that encapsulates IPv6 traffic inside IPv4 packets using IP protocol number 41. Key operational and security concerns include:

• Name Resolution Poisoning: If an organization does not configure an explicit ISATAP router entry in internal DNS, Windows clients broadcast LLMNR and NBNS queries. Adversaries using tools like Responder can answer these queries, appointing themselves as the default IPv6 router for the victim machine.
• Perimeter Firewall Evasion: Protocol 41 packets often bypass internal stateful firewall rules that are configured only for standard TCP/UDP traffic, allowing unauthorized lateral movement between isolated network segments.
• Routing Asymmetry: Intra-site tunneling introduces routing loops and unexpected MTU fragmentation issues (reducing effective path MTU from 1500 to 1280 bytes).
• Modern Redundancy: Enterprise networks now overwhelmingly support native dual-stack IPv6 routing or modern encrypted overlay protocols (such as WireGuard or IPsec), rendering ISATAP completely obsolete.

Auditing Active ISATAP Configuration with PowerShell

To inspect the current ISATAP configuration on Windows 11, launch an elevated PowerShell prompt and execute Get-NetIsatapConfiguration:

# Query the active ISATAP configuration
Get-NetIsatapConfiguration

The cmdlet returns key operational parameters governing the transition interface:

PolicyStore      : ActiveStore
ResolutionState  : Default
ResolutionInterval: 1440
Router           : 
State            : Default

Parameters include:

• State: Reflects the operational mode (Default, Enabled, or Disabled). When set to Default, Windows automatically enables ISATAP if the host has an active IPv4 address and cannot discover native IPv6 routers.
• Router: Specifies the FQDN or IP address of the ISATAP router used as the default gateway. If blank, Windows attempts automated discovery using the hostname isatap.
• ResolutionInterval: The time interval (in minutes) at which the host re-queries DNS to discover ISATAP routers.

To check whether Windows 11 has currently instantiated any virtual ISATAP adapters:

# Inspect network adapters for hidden ISATAP interfaces
Get-NetAdapter -IncludeHidden | Where-Object { $_.InterfaceDescription -like "*ISATAP*" }

Disabling ISATAP Globally in Windows 11

In enterprise networks where native IPv6 or IPv4-only operations are established, ISATAP should be explicitly disabled to eliminate name-spoofing vectors and unneeded tunnel processing:

# Completely disable the ISATAP transition interface
Set-NetIsatapConfiguration -State Disabled

To ensure that the resolution daemon does not continue polling DNS or local multicast for router names in the background, set the resolution state to disabled as well:

# Disable router name resolution
Set-NetIsatapConfiguration -ResolutionState Disabled

Verify that the configuration is locked down by querying the active settings:

# Confirm ISATAP is disabled
Get-NetIsatapConfiguration | Select-Object State, ResolutionState, Router

The output will display both State and ResolutionState as Disabled.

Enforcing ISATAP Disabling via Registry and Group Policy

To enforce ISATAP disabling across all workstations in an Active Directory domain or automated provisioning image, apply the corresponding policy registry keys via PowerShell:

# Configure local machine policy registry keys to disable ISATAP
$regPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\TCPIP\v6Transition"
if (-not (Test-Path $regPath)) {
    New-Item -Path $regPath -Force | Out-Null
}
Set-ItemProperty -Path $regPath -Name "ISATAP_State" -Value "Disabled"

To configure this setting using the Local Group Policy Editor (gpedit.msc):

1. Navigate to Computer Configuration > Administrative Templates > Network > TCPIP Settings > IPv6 Transition Technologies.
2. Double-click the policy setting titled ISATAP State.
3. Select Enabled, and from the Options dropdown menu, choose Disabled State.
4. Click Apply and OK.

Configuring an Explicit ISATAP Router for Isolated Labs

If you are operating an isolated legacy testing laboratory where ISATAP is intentionally deployed, avoid multicast discovery by explicitly assigning the router FQDN or IP address:

# Explicitly define the trusted ISATAP router
Set-NetIsatapConfiguration -State Enabled -Router "isatap-router.corp.contoso.com"

Disabling unneeded transition mechanisms such as ISATAP reduces attack surfaces, prevents LLMNR spoofing vulnerabilities, and ensures that Windows 11 maintains clean, direct networking paths.