How to Configure IPv6 Privacy Extensions in Windows 11 Using PowerShell

In modern Internet Protocol version 6 (IPv6) networks, address auto-configuration traditionally relied on Stateless Address Autoconfiguration (SLAAC) using the IEEE EUI-64 standard. Under EUI-64, a client machine constructs its 64-bit interface identifier directly from its hardware Media Access Control (MAC) address. While functionally effective, embedding physical hardware addresses into global IPv6 addresses introduces severe privacy risks: external web servers, tracking networks, and content delivery networks can track user movement across different networks based solely on their static MAC identifier.

To eliminate this surveillance vector, the Internet Engineering Task Force (IETF) ratified RFC 4941, introducing IPv6 Privacy Extensions. When Privacy Extensions are enabled in Windows 11, the operating system generates temporary, pseudorandom IPv6 addresses for outbound internet connections. These temporary addresses are rotated periodically, preventing third-party tracking. Using PowerShell, administrators can inspect, enforce, and tune IPv6 temporary address lifetimes to protect endpoint privacy.

Understanding How IPv6 Privacy Extensions Function

In Windows 11, the TCP/IP stack implements a dual-address approach when connected to an IPv6 network:

• Permanent / Public IPv6 Address: Derived from a cryptographic hash of the network interface and machine secret (RFC 7217 Stable Privacy Address). This stable address is used primarily for inbound services (e.g., peer-to-peer applications, remote desktop, local file shares).
• Temporary IPv6 Address (Privacy Extensions): A pseudorandom, ephemeral address generated strictly for outbound client connections (e.g., browsing the web, streaming media, accessing cloud APIs). Because this address changes at regular intervals, external servers cannot correlate traffic over extended time horizons.

When Privacy Extensions are active, Windows uses the temporary address as the source IP for all outbound requests, while maintaining the stable address for inbound connectivity.

Inspecting Current IPv6 Privacy Settings in PowerShell

To audit your current IPv6 configuration, open an elevated PowerShell prompt on Windows 11 by right-clicking Start and selecting Terminal (Admin).

Execute the Get-NetIPv6Protocol cmdlet:

Get-NetIPv6Protocol | Select-Object RandomizeIdentifiers, UseTemporaryAddresses, MaxTemporaryValidLifetime, MaxTemporaryPreferredLifetime

The command returns the foundational privacy protocol settings:

RandomizeIdentifiers        : Enabled
UseTemporaryAddresses       : Enabled
MaxTemporaryValidLifetime   : 7.00:00:00
MaxTemporaryPreferredLifetime: 1.00:00:00

By default in Windows 11, both RandomizeIdentifiers and UseTemporaryAddresses are enabled. The default preferred lifetime for temporary addresses is 24 hours (1.00:00:00), after which Windows deprecates the address and generates a fresh pseudorandom address.

Querying Active Temporary IPv6 Addresses on Network Adapters

To verify which IPv6 addresses are currently bound to your physical network adapters, query the Get-NetIPAddress cmdlet filtered for IPv6 unicast addresses:

Get-NetIPAddress -AddressFamily IPv6 -Type Unicast | Select-Object InterfaceAlias, IPAddress, SuffixOrigin, ValidLifetime, PreferredLifetime

Examine the SuffixOrigin column:

• Link: Link-local addresses (fe80::...).
• RouterAdvertisement with Random: A temporary privacy address actively used for outbound traffic.
• Manual: Static addresses manually assigned by an administrator.

You can filter specifically for active temporary privacy addresses:

Get-NetIPAddress -AddressFamily IPv6 | Where-Object { $_.SuffixOrigin -eq "Random" } | Format-Table InterfaceAlias, IPAddress, ValidLifetime, PreferredLifetime

Enabling and Enforcing IPv6 Privacy Extensions

If IPv6 Privacy Extensions were disabled due to legacy corporate group policies or network troubleshooting, you can re-enable them globally across Windows 11:

Set-NetIPv6Protocol -RandomizeIdentifiers Enabled -UseTemporaryAddresses Enabled

To ensure that outbound traffic strictly prefers temporary addresses over permanent addresses, verify that the UseTemporaryAddresses parameter reflects Enabled.

Customising Temporary Address Rotation Lifetimes

In high-security environments or corporate compliance testbeds, administrators may wish to shorten the temporary address rotation window to rotate outbound IPs more frequently (e.g., rotating every 6 hours instead of every 24 hours).

To configure a 6-hour preferred lifetime and a 1-day valid lifetime, pass a TimeSpan object to Set-NetIPv6Protocol:

Set-NetIPv6Protocol -MaxTemporaryPreferredLifetime (New-TimeSpan -Hours 6) -MaxTemporaryValidLifetime (New-TimeSpan -Days 1)

Confirm the new lifetime thresholds:

Get-NetIPv6Protocol | Select-Object UseTemporaryAddresses, MaxTemporaryPreferredLifetime, MaxTemporaryValidLifetime

Disabling Privacy Extensions for Static Inbound Server Roles

While Privacy Extensions are ideal for client workstations, hosting inbound server roles (such as a local web server, internal DNS forwarder, or development host) on Windows 11 can be complicated if client applications attempt to bind to ephemeral temporary addresses.

To disable temporary IPv6 address generation on a dedicated host:

Set-NetIPv6Protocol -UseTemporaryAddresses Disabled

Once disabled, Windows will utilize only its permanent stable address for both inbound and outbound traffic.

Verifying Outbound Address Privacy on the Web

To verify that external web destinations observe your randomized temporary address rather than your hardware MAC identifier:

1. Open a web browser on Windows 11 and visit an IPv6 diagnostic service (such as test-ipv6.com or ipv6-test.com).
2. Note the reported public IPv6 address.
3. In PowerShell, compare the reported address against your local temporary IP:

   Get-NetIPAddress -AddressFamily IPv6 | Where-Object { $_.SuffixOrigin -eq "Random" } | Select-Object IPAddress

4. Observe that the public address matches your local temporary address, confirming that your physical MAC address remains completely hidden from external surveillance.

By managing IPv6 Privacy Extensions via PowerShell, Windows 11 administrators protect user privacy against tracking without disrupting local network discoverability or enterprise security controls.