How to Configure and Manage IP-HTTPS Transition Interfaces in Windows 11 Using PowerShell

In enterprise Windows remote access architectures, DirectAccess and modern Always On VPN solutions allow domain-joined endpoints to seamlessly establish bidirectional corporate connectivity whenever an active internet connection is detected. To ensure that remote clients can communicate with corporate resources even when operating behind restrictive public Wi-Fi networks, hotel captive portals, or corporate proxy firewalls that block standard IPsec UDP ports (500 and 4500) and native IPv6 traffic, Microsoft developed IP-HTTPS.

The IP-HTTPS protocol encapsulates IPv6 packets inside an encrypted TLS/HTTPS connection (TCP port 443). Because port 443 is universally permitted across commercial networks, IP-HTTPS acts as the ultimate reliable fallback transport for enterprise connectivity. In Windows 11, systems administrators and network engineers can audit connection health, configure server URLs, enforce strict certificate validation, and disable IP-HTTPS interfaces on non-remote systems using the NetTCPIP PowerShell module.

Architecture and Security Requirements of IP-HTTPS

IP-HTTPS creates a virtual point-to-point network interface that terminates at the corporate DirectAccess or VPN gateway server. Operating requirements include:

• TLS/HTTPS Encapsulation: All encapsulated IPv6 packets travel inside an encrypted TLS session, guaranteeing packet integrity and encryption across untrusted public networks.
• Certificate Authentication and Validation: The gateway presents a trusted public or enterprise PKI SSL/TLS certificate. The client workstation validates the server certificate against its local trusted root certification authorities.
• Certificate Revocation List (CRL) Checking: By default, Windows verifies that the gateway certificate has not been revoked. If a client operates behind a captive portal that prevents reaching the CRL distribution point, the IP-HTTPS connection fails to establish.
• Authentication Overhead: While highly resilient against network firewalls, encapsulation introduces small latency and packet header overhead compared to native IPsec or WireGuard tunnels.

Auditing Active IP-HTTPS Configuration in PowerShell

To inspect the current IP-HTTPS configuration on Windows 11, open an elevated PowerShell prompt and execute Get-NetIPHttpsConfiguration:

# Query the active IP-HTTPS transition configuration
Get-NetIPHttpsConfiguration

The cmdlet returns the active parameters governing the interface:

PolicyStore             : ActiveStore
ServerURL               : https://vpn.corp.contoso.com:443/IPHTTPS
State                   : Default
AuthMode                : Certificates
CertRevocationCheck     : Enabled
StateCode               : 0x0 (Success)

Key properties include:

• ServerURL: The destination FQDN and path of the corporate gateway.
• State: The operational mode (Default, Enabled, or Disabled). When set to Default, Windows activates the interface only when standard DirectAccess protocols fail to reach corporate resources.
• CertRevocationCheck: Indicates whether CRL verification is strictly enforced before connecting.
• StateCode: The internal error or diagnostic status code (0x0 indicates a healthy, active tunnel).

To verify whether the virtual IP-HTTPS network adapter is actively instantiated in the operating system:

# Check for active IP-HTTPS network adapters
Get-NetAdapter -IncludeHidden | Where-Object { $_.InterfaceDescription -like "*IP-HTTPS*" }

Configuring Gateway Server URLs and Connection Modes

When provisioning remote workstations or updating gateway domain endpoints following infrastructure migrations, configure the destination gateway URL using Set-NetIPHttpsConfiguration:

# Configure the corporate IP-HTTPS gateway endpoint
Set-NetIPHttpsConfiguration `
    -ServerURL "https://remoteaccess.contoso.com:443/IPHTTPS" `
    -State Enabled

To ensure robust security against man-in-the-middle attacks, verify that certificate revocation verification is explicitly enabled:

# Enforce strict Certificate Revocation List checking
Set-NetIPHttpsConfiguration -CertRevocationCheck Enabled

Troubleshooting IP-HTTPS Error Codes

If an IP-HTTPS connection fails to establish, the StateCode property reveals the underlying network failure:

# Retrieve the current error code and gateway URL
Get-NetIPHttpsConfiguration | Select-Object ServerURL, StateCode, CertRevocationCheck

Common state codes include:

• 0x0: Successful connection. The tunnel is established and passing traffic.
• 0x800B0109: Certificate Trust Error. The client does not trust the Root Certification Authority that issued the gateway’s SSL certificate. Install the issuing CA certificate into the workstation’s Trusted Root store.
• 0x800B010E: Revocation Offline. The client cannot reach the CRL distribution point or OCSP responder. Ensure that public CRL endpoints are accessible from external networks.
• 0x80072EE7: DNS Name Resolution Failure. The client cannot resolve the gateway FQDN in public DNS.

Disabling IP-HTTPS on Fixed Workstations

On physical desktop computers and servers that reside permanently inside the corporate local network and never leave the building, IP-HTTPS is unnecessary and can be disabled to eliminate background gateway probing:

# Disable the IP-HTTPS transition interface globally
Set-NetIPHttpsConfiguration -State Disabled

To enforce this policy across multiple domain-joined computers using PowerShell registry management:

# Enforce IP-HTTPS disabling via local machine policy registry keys
$regPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\TCPIP\v6Transition"
if (-not (Test-Path $regPath)) {
    New-Item -Path $regPath -Force | Out-Null
}
Set-ItemProperty -Path $regPath -Name "IPHTTPS_State" -Value "Disabled"

Configuring and monitoring IP-HTTPS through PowerShell provides network administrators with complete visibility over remote access tunnel stability, certificate verification, and endpoint security on Windows 11.