How to Configure Network Adapter IPsec Task Offload in Windows 11 Using PowerShell

Internet Protocol Security (IPsec) encrypts and authenticates network packets at the IP layer, providing robust end-to-end transport protection. However, calculating cryptographic checksums, AES payload encryption, and HMAC authentication hashes in software imposes a measurable processing load on host CPU cores. When high-volume IPsec traffic passes through your system, delegating these intensive cryptographic tasks to hardware-capable network interface cards (NICs) dramatically reduces processor utilisation and enhances network throughput. In Windows 11, PowerShell provides direct cmdlets to audit, enable, and tune IPsec Task Offload v2 (IPsecTOv2) across all compatible adapters.

Understanding IPsec Task Offload v2 (IPsecTOv2)

IPsec Task Offload offloads security association (SA) encryption, decryption, and hash validation routines from the Windows TCP/IP driver stack directly onto the network adapter hardware processor. With offload enabled, the network card performs cryptographic encryption during packet transmission and validates integrity digests during packet reception without engaging host CPU cycles.

This capability operates in conjunction with wider network hardware acceleration mechanisms, such as TCP/IP offload settings and encapsulated packet task offload. When running corporate VPNs, branch office tunnels, or server-to-client IPsec policies, hardware offload ensures low latency and sustained wire-speed transfer rates.

Verifying Administrator Privileges in Windows 11

Modifying hardware adapter configurations requires elevated system permissions. To launch an administrative PowerShell session:

1. Right-click the Start button on the taskbar or press Windows Key + X.
2. Select Terminal (Admin) or PowerShell (Admin).
3. When prompted by User Account Control (UAC), click Yes to elevate the session.

Auditing Current IPsec Offload Capabilities and Status

Before making changes, inspect the current offload capabilities reported by your physical network adapters using Get-NetAdapterIPsecOffload:

Get-NetAdapterIPsecOffload

To inspect specific offload properties and cryptographic algorithm support in detail, pipe the output into Format-List:

Get-NetAdapterIPsecOffload -Name "Ethernet" | Format-List *

The command returns several key configuration parameters:

• Enabled: A boolean indicator (True or False) reflecting whether offload processing is currently active on the interface.
• IPv4AhEspOffload: Confirms whether both Authentication Header (AH) and Encapsulating Security Payload (ESP) offloading are supported over IPv4.
• IPv6AhEspOffload: Reports AH and ESP offload capabilities across IPv6 network streams.
• IkeValidationOffload: Identifies whether key management validation handshakes can be parsed in hardware alongside configured IPsec quick mode cryptographic sets.

Enabling IPsec Task Offload on an Adapter

If your network card supports IPsec offloading but the feature is disabled, activate it using Enable-NetAdapterIPsecOffload:

Enable-NetAdapterIPsecOffload -Name "Ethernet"

The network adapter driver briefly re-initialises its hardware offload registers. To activate IPsec offload across all physical Ethernet and Wi-Fi adapters in one operation, execute:

Get-NetAdapter -Physical | Enable-NetAdapterIPsecOffload

Re-running Get-NetAdapterIPsecOffload will now show Enabled: True, verifying that subsequent cryptographic workloads will be handled directly by your network controller.

Disabling IPsec Task Offload for Troubleshooting

In select scenarios—such as debugging intermittent packet loss, identifying outdated NIC firmware anomalies, or testing custom software cipher suites—you may need to temporarily revert cryptographic processing back to the Windows kernel. Disable offloading with Disable-NetAdapterIPsecOffload:

Disable-NetAdapterIPsecOffload -Name "Ethernet"

This instantly forces the operating system to process IPsec transforms within the software TCP/IP stack. If you previously configured specific security algorithms with IPsec main mode cryptographic sets, the Windows kernel continues processing tunnels seamlessly without interrupting active sessions.

Verifying System-Wide IPsec Statistics

To confirm that packets are actively taking advantage of offloaded hardware security associations, query the TCP/IP network statistics via Netsh or PowerShell diagnostic counters:

netsh ipsec dynamic show stats

Examine the Offloaded SAs counter in the output summary. A non-zero, increasing value confirms that inbound and outbound encrypted datagrams are successfully routed through your network adapter hardware, delivering optimal throughput and preserving vital processor resources in Windows 11.