How to Create and Manage Hyper-V Virtual Switches in Windows 11 Using PowerShell

Hyper-V is a core enterprise-grade hypervisor built directly into Windows 11 Pro, Enterprise, and Education editions. When building virtualized lab environments, running development containers, or configuring software testing rigs, virtual machines require robust network connectivity. In Hyper-V, all networking is mediated by Virtual Switches (vSwitches)—software-based Layer 2 Ethernet switches that govern how virtual network adapters communicate with the host operating system, local network peers, and the wider internet.

While the graphical Hyper-V Manager interface provides basic switch creation wizards, administering virtual networks via PowerShell is vastly faster, scriptable, and less prone to configuration oversights. Using the native Hyper-V PowerShell module, administrators can provision External, Internal, and Private switches, bind specific physical network adapters, and configure management OS sharing. In this tutorial, we examine how to audit physical adapters, provision each switch type using PowerShell, and connect virtual machines to their designated network segments.

Understanding Hyper-V Virtual Switch Types

Before executing configuration cmdlets, selecting the proper switch architecture is critical for both security and network isolation:

Switch Type	Connectivity Scope	Host OS Access	Primary Use Case
External	Binds to a physical network adapter (Ethernet or Wi-Fi). VMs appear on the physical LAN with their own IP addresses.	Yes (Optional, via -AllowManagementOS $true)	Production virtual machines requiring direct internet, local LAN, and active directory domain access.
Internal	Restricted strictly to virtual machines running on the host and the host operating system itself.	Yes (Host receives a dedicated virtual network adapter)	Secure sandbox testing where the host must communicate with VMs (e.g., via SSH or RDP) without external internet risk.
Private	Connects virtual machines exclusively to one another on an isolated virtual broadcast domain.	No (Host OS has zero network interface on this switch)	Malware analysis, isolated penetration testing, and zero-trust multi-VM cluster simulation.

Step 1: Identifying Available Physical Network Adapters

When provisioning an External virtual switch, PowerShell must bind the virtual switch to an active physical network interface controller (NIC). Before running switch cmdlets, list your system’s network adapters:

1. Right-click the Start button on the taskbar and select Terminal (Admin) or PowerShell (Admin).
2. Execute the Get-NetAdapter cmdlet:

   Get-NetAdapter | Select-Object Name, InterfaceDescription, Status, LinkSpeed

3. Identify the exact Name of the physical Ethernet or Wi-Fi adapter you intend to dedicate to external virtual switching (for example, Ethernet or Wi-Fi).

Step 2: Auditing Existing Virtual Switches

To inspect virtual switches that may already exist on your Windows 11 host (such as the default NAT switch):

Get-VMSwitch | Select-Object Name, SwitchType, NetAdapterInterfaceDescription, AllowManagementOS

Step 3: Creating Virtual Switches via PowerShell

1. Provisioning an External Virtual Switch

To create an External switch bound to your physical network adapter named Ethernet, while permitting the host Windows 11 operating system to share the physical connection:

New-VMSwitch -Name "External-Switch" -NetAdapterName "Ethernet" -AllowManagementOS $true

Configuration Note: When this command executes, your host network connection will briefly disconnect for a few seconds as the physical NIC is bound to the Hyper-V Extensible Virtual Switch protocol, after which a virtual NIC is created for the host OS.

2. Provisioning an Internal Virtual Switch

To create an isolated internal network for host-to-VM communication without routing to the external LAN:

New-VMSwitch -Name "Internal-Lab-Switch" -SwitchType Internal

Upon execution, Windows 11 will automatically create a new virtual adapter named vEthernet (Internal-Lab-Switch) in the host OS. You can assign a static IP address to this adapter to communicate directly with your virtual machines.

3. Provisioning a Private Virtual Switch

For fully isolated environments where virtual machines must never communicate with the host operating system or outside network:

New-VMSwitch -Name "Private-Isolated-Switch" -SwitchType Private

Step 4: Connecting Virtual Machines to Virtual Switches

Once your switches are provisioned, assign virtual machine network adapters to their respective switch targets using the Connect-VMNetworkAdapter cmdlet:

Connect-VMNetworkAdapter -VMName "Win11-TestLab" -SwitchName "External-Switch"

To verify which virtual switch is currently attached to a virtual machine:

Get-VMNetworkAdapter -VMName "Win11-TestLab" | Select-Object VMName, SwitchName, IPAddresses, Status

If you need to disconnect a virtual machine from a switch completely (simulating an unplugged Ethernet cable):

Disconnect-VMNetworkAdapter -VMName "Win11-TestLab"

Step 5: Managing and Modifying Switch Properties

You can adjust the parameters of existing virtual switches without recreating them. For example, to prevent the host operating system from sharing an external adapter (dedicating the physical NIC exclusively to virtual machines):

Set-VMSwitch -Name "External-Switch" -AllowManagementOS $false

Deleting Virtual Switches Cleanly

When a virtual network configuration is no longer required, tear down the switch using Remove-VMSwitch:

Remove-VMSwitch -Name "Internal-Lab-Switch" -Force

If an external switch is removed, PowerShell automatically re-establishes native TCP/IP bindings directly on the underlying physical network adapter, restoring standard networking defaults to the host.