How to Disable IPv6 on All Domain Computers Using Group Policy

Internet Protocol version 6 (IPv6) is an important part of modern Windows networking. In an Active Directory environment, administrators may need to change IPv6 behavior for troubleshooting, application compatibility, network policy, or specific infrastructure requirements.

Windows Server 2025 and Windows client operating systems support centralized configuration through Group Policy. One method is to deploy the Windows registry value DisabledComponents using Group Policy Preferences.

This tutorial explains both approaches so administrators can choose the setting that matches their documented requirements. Test the configuration on a dedicated OU before applying it to every domain computer.

1. Understanding IPv6 and DisabledComponents

IPv6 is the successor to IPv4 and is integrated into modern Windows networking. Windows uses address-selection policies to determine which IP version to prefer when both IPv4 and IPv6 connectivity are available.

The registry value DisabledComponents controls specific IPv6 behaviors through a bitmask. It is located in the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters

Administrators can deploy this value centrally using Group Policy Preferences rather than manually modifying every computer.

2. Prerequisites

Before creating the policy, confirm that you have:

• A functioning Active Directory domain.
• Windows Server 2025 or a supported Windows Server management environment.
• Group Policy Management Console (GPMC).
• Permissions to create, edit, and link Group Policy Objects.
• A dedicated test OU containing representative domain computers.
• A maintenance plan for restarting computers after the registry change.
• A documented rollback procedure.

Back up important configurations and identify applications, network services, domain controllers, clustering workloads, and other systems that may depend on IPv6 before deployment.

3. Choose the Correct Registry Value

Choose the value that matches your requirement. Do not deploy a complete IPv6 disablement setting simply because you want Windows to prefer IPv4.

4. Open Group Policy Management

Sign in to your Windows Server management system using an account authorized to manage Group Policy.

Press Windows + R, enter the following command, and press Enter:

gpmc.msc

In Group Policy Management:

1. Expand Forest.
2. Expand your Active Directory domain.
3. Identify the OU containing the target computer accounts.

If GPMC is not installed, add the Group Policy Management feature or install the appropriate Remote Server Administration Tools.

5. Create a Dedicated Group Policy Object

1. In Group Policy Management, right-click Group Policy Objects.
2. Select New.
3. Enter a descriptive name, such as IPv6 Configuration – Domain Computers.
4. Click OK.
5. Right-click the new GPO and select Edit.

A dedicated GPO makes it easier to manage the configuration, review policy results, and reverse the change without affecting unrelated policies.

6. Configure the IPv6 Registry Preference

Group Policy Preferences can create or update the registry value on targeted computers. The following example uses the recommended IPv4-preference value of decimal 32. If you have a validated requirement for complete IPv6 component disablement, use decimal 255 instead.

6.1 Navigate to Registry Preferences

In Group Policy Management Editor, navigate to:

Computer Configuration
  > Preferences
    > Windows Settings
      > Registry

6.2 Create a new Registry Item

1. Right-click Registry.
2. Select New > Registry Item.
3. Configure the fields as shown below.

For the recommended IPv4-preference configuration, enter 32 in decimal mode. For the full IPv6 component disablement configuration, enter 255 in decimal mode.

1. Confirm that the value name and registry path are correct.
2. Click OK to save the Registry Item.
3. Close Group Policy Management Editor.

6.3 Alternative: Create the registry value with PowerShell

You can test the registry configuration on an individual computer before deploying it through Group Policy. Open PowerShell as an administrator.

Recommended alternative: prefer IPv4.

New-ItemProperty `
    -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" `
    -Name "DisabledComponents" `
    -PropertyType DWord `
    -Value 32 `
    -Force

Only when explicitly required: disable IPv6 components.

New-ItemProperty `
    -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" `
    -Name "DisabledComponents" `
    -PropertyType DWord `
    -Value 255 `
    -Force

These commands modify the local computer. They do not deploy the setting to other computers. For domain-wide management, use the GPO configured above.

7. Link the GPO to All Intended Domain Computers

The GPO must be linked where the target computer accounts are located. Linking it to an OU containing only user accounts will not automatically apply its Computer Configuration settings to every computer used by those users.

1. Return to Group Policy Management.
2. Locate the OU containing the target computer accounts.
3. Right-click the OU.
4. Select Link an Existing GPO.
5. Select IPv6 Configuration – Domain Computers.
6. Click OK.

Deploy to multiple OUs

If computer accounts are spread across several OUs, link the GPO to each appropriate OU or use a suitable common parent OU. Review inheritance, security filtering, and permissions to ensure that only the intended computers receive the setting.

Do not assume that linking a GPO at the domain root will override every existing policy or configuration. Conflicting GPOs, filtering, and inheritance can change the effective result.

8. Apply Group Policy and Restart the Computers

On a test domain computer, open Command Prompt as an administrator and execute:

gpupdate /force

Wait for Group Policy processing to finish. Then inspect the applied policies:

gpresult /r

To generate a detailed Group Policy report, run:

gpresult /h C:\Temp\IPv6-GroupPolicy.html

Ensure that C:\Temp exists before generating the report. Confirm that the IPv6 configuration GPO appears in the applied computer policies.

9. Verify the IPv6 Configuration

9.1 Check the registry value

Run the following PowerShell command on a target computer:

Get-ItemProperty `
    -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" `
    -Name DisabledComponents

Review the returned value. For the IPv4-preference configuration, the expected decimal value is 32. For the full IPv6 component disablement configuration, the expected decimal value is 255.

9.2 Check IPv6 interfaces

Get-NetAdapterBinding -ComponentID ms_tcpip6

This command displays the IPv6 binding state for network adapters. Do not expect the binding checkbox to become unchecked merely because DisabledComponents has been set. The registry setting and adapter binding state are different.

9.3 Inspect IPv6 addresses

Get-NetIPAddress -AddressFamily IPv6 |
    Select-Object InterfaceAlias, IPAddress, AddressState

IPv6 addresses may still appear depending on the interface and address type. This output alone does not establish whether the registry setting is effective.

9.4 Check the IPv6 loopback address

ping ::1

The loopback address may continue to work even when IPv6 components have been disabled through DisabledComponents. This is expected and does not necessarily indicate a failed configuration.

9.5 Verify IPv4 preference when using value 32

Run:

netsh interface ipv6 show prefixpolicies

Review the prefix policy output to verify that the IPv4-mapped prefix ::ffff:0:0/96 has higher precedence than the default IPv6 prefix ::/0. This helps confirm the IPv4 preference configuration.

You can also use the following command to inspect the addresses returned for a hostname:

ping bing.com

The address selected by this test is not, by itself, conclusive proof that all application traffic prefers IPv4. Use the registry and prefix policy checks together.

10. Troubleshooting Common Problems

The registry value is missing

• Confirm that the GPO is linked to the correct OU.
• Check that the computer account is in scope.
• Review security filtering and permissions.
• Run gpupdate /force and inspect gpresult /r.
• Verify that the Registry Item uses the correct hive, key path, value name, and DWORD type.

The setting is present, but behavior has not changed

Check whether the computer has been restarted after the registry value was applied. Also confirm that the intended value was deployed: decimal 32 prefers IPv4, whereas decimal 255 disables IPv6 components according to the documented bitmask.

IPv6 still appears in network commands

IPv6 addresses and loopback functionality may remain visible depending on the configuration. Do not use the presence of an IPv6 address alone as evidence that the setting failed. Check the registry value, restart status, prefix policies, and the behavior you intended to change.

An application or Windows service stops working

Restore the previous configuration if necessary and investigate the application’s network requirements. Some Windows components and enterprise applications depend on IPv6. Review vendor documentation before changing critical infrastructure.

11. Roll Back or Re-enable IPv6

If the configuration causes unexpected problems, reverse the GPO and registry change in a controlled manner.

11.1 Restore the default IPv6 registry behavior

The default value is 0. You can deploy a registry preference that updates the existing DWORD to zero:

New-ItemProperty `
    -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" `
    -Name "DisabledComponents" `
    -PropertyType DWord `
    -Value 0 `
    -Force

This command changes only the local computer. For domain-wide rollback, create or modify the appropriate GPO Registry Item so that it sets the value to decimal 0 on all affected computers.

11.2 Complete the rollback

1. Update the GPO to set DisabledComponents to 0, or remove the original registry preference and deploy an explicit reset value.
2. Run gpupdate /force on target computers.
3. Restart the computers during a maintenance window.
4. Verify the registry value and network behavior.
5. Remove or disable the temporary rollback policy after confirming that the intended settings are restored.

12. Enterprise Best Practices

• Prefer IPv4 instead of disabling IPv6: Use the Microsoft-recommended value of decimal 32 when IPv4 preference is the actual requirement.
• Use a test OU: Validate the registry preference before deploying it across the domain.
• Protect critical infrastructure: Evaluate domain controllers, clusters, messaging servers, and management systems independently.
• Schedule restarts: The registry configuration requires a restart to take effect.
• Maintain a rollback plan: Document how to restore the registry value and validate recovery.
• Audit effective policies: Use Group Policy reports and registry inspection to confirm deployment.
• Follow vendor requirements: Check application and hardware vendor guidance before disabling protocol functionality.
• Document the reason: Record the business requirement and scope of the change for future administrators.

13. Frequently Asked Questions

14. Related Windows Server Tutorial

If you are managing device visibility on Windows domain computers, see our related guide to Network Discovery and Group Policy.

Conclusion

Group Policy Preferences provide a practical way to manage the DisabledComponents registry value across Windows domain computers. Administrators can centrally deploy the setting, verify the resulting registry configuration, and plan a controlled rollback.

However, completely disabling IPv6 is not Microsoft’s recommended general-purpose approach. When your goal is simply to make Windows prefer IPv4, use decimal 32 and validate the prefix policy. Use decimal 255 only when a documented requirement justifies disabling IPv6 components and testing confirms that the environment will continue to operate correctly.

15. References and Authoritative Sources

1. Microsoft Learn: Configure IPv6 for advanced users
2. Microsoft Learn: Install and configure IP version 6
3. Microsoft Learn: gpupdate command reference
4. Microsoft Learn: gpresult command reference

Always verify the applicable Microsoft guidance for your Windows version and the specific application or infrastructure role being managed.