How to Configure TCP Keepalive Parameters in Windows 11 Using PowerShell

Long-lived TCP connections—such as secure database sessions, SSH terminals, remote management tunnels, and cloud microservice streams—frequently pass through intermediate stateful firewalls and NAT routers. When an idle connection transmits no data for an extended period, firewall translation tables often drop the silent connection state without notifying either endpoint. Furthermore, if a remote host crashes or disconnects abruptly, the local host can remain tied up in an open socket state indefinitely. TCP Keepalive packets solve this by periodically transmitting empty ACK probes to verify peer reachability and keep firewall state tables active. In Windows 11, PowerShell allows administrators to inspect and tune kernel TCP keepalive parameters to maintain dependable network sessions.

Understanding TCP Keepalive Mechanics

TCP keepalives operate at the transport layer of the TCP/IP stack. When keepalive probes are enabled on a socket, the Windows kernel monitors socket idle time. If no data packets or acknowledgements have been exchanged within a specified threshold, Windows transmits a keepalive probe (a TCP segment with a sequence number one less than the current sequence number and an empty payload).

Three primary parameters govern this behaviour:

• KeepAliveTime: The duration of inactivity in milliseconds before the operating system sends the very first keepalive probe. The Windows default is traditionally 7,200,000 ms (2 hours).
• KeepAliveInterval: The interval in milliseconds between subsequent unacknowledged keepalive retransmissions if the remote peer fails to respond. The default is 1,000 ms (1 second).
• TcpMaxDataRetransmissions: The total number of unacknowledged probes sent before Windows forcibly terminates the dead socket and informs the invoking application.

Tuning these parameters prevents firewalls with aggressive idle timeouts (such as Azure or AWS gateways that drop states after 4 minutes) from terminating active sessions. When combined with monitoring tools like auditing active TCP socket states and configuring TCP delayed ACK timeouts, keepalive tuning ensures resilient network communication.

Launching Elevated PowerShell in Windows 11

Adjusting global TCP/IP transport stack parameters requires administrative rights:

1. Right-click the Start button on the taskbar or press Windows Key + X.
2. Select Terminal (Admin) or PowerShell (Admin).
3. Click Yes when prompted by the User Account Control (UAC) security dialogue.

Auditing Current TCP Keepalive Settings via PowerShell

Global TCP transport settings are maintained within the Windows registry under the TCP/IP parameters key. To query active keepalive parameters using PowerShell, execute:

Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" | Select-Object -Property KeepAliveTime, KeepAliveInterval -ErrorAction SilentlyContinue

If these properties return blank or empty values, Windows is utilizing built-in default values (7,200,000 ms for KeepAliveTime and 1,000 ms for KeepAliveInterval). You can also inspect general TCP stack parameters using Get-NetTCPSetting:

Get-NetTCPSetting -SettingName "Internet" | Select-Object SettingName, MinRtoMs, InitialCongestionWindowMss

This confirms the active TCP template governing your standard internet and local area network adapters.

Configuring KeepAliveTime to Prevent Firewall State Drops

To prevent intermediate NAT gateways or enterprise firewalls from dropping idle sessions, reduce the initial keepalive delay to 5 minutes (300,000 milliseconds) or 3 minutes (180,000 milliseconds):

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" -Name "KeepAliveTime" -Value 300000 -Type DWord

This instructs Windows to transmit a probe after 5 minutes of total inactivity, refreshing the firewall connection tracking entry and keeping the tunnel open without generating excessive bandwidth overhead.

Configuring KeepAliveInterval for Faster Dead-Peer Detection

To control how frequently Windows repeats keepalive probes when a remote server fails to respond, adjust KeepAliveInterval:

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" -Name "KeepAliveInterval" -Value 2000 -Type DWord

Setting the interval to 2,000 ms (2 seconds) ensures the system quickly identifies broken connections, allowing applications to initiate reconnection routines instead of freezing in hung I/O states.

Verifying Registry Modifications and Applying Changes

To confirm that your custom values have been successfully written to the kernel TCP/IP stack:

Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" | Select-Object KeepAliveTime, KeepAliveInterval

While some socket applications detect registry updates dynamically upon creating new connections, restarting the computer or restarting the network interface via PowerShell ensures that all operating system transport drivers initialize with the new parameters.

Pairing optimized keepalive intervals with hardware tuning such as Ethernet flow control and minimum retransmission timeouts establishes a robust network baseline in Windows 11.