IPv6 is on the rise; there is no doubt about it. Emerging countries, such as China, are pushing IPv6 because they don’t have enough IPv4 addresses. With DirectAccess, Microsoft has, for the first time, introduced an important feature that requires IPv6. In fact, the number of IPv6 packets in our networks is increasing every day. I think this is a good time to disable IPv6.

Do you find it hard to follow my argument? If so, I assume you are not the one who is in charge of your network’s security. More and more network providers are upgrading their equipment these days to support IPv6. It is only a matter of time before the first IPv6 packets from China knock on your firewall’s door. I hope you know IPv6 well enough to be sure that this won’t mean a threat to your network.The most important rule when it comes to security is to only run services that are really necessary in your environment. Now ask yourself, do you need IPv6 right now? …See!

There is another point to consider. If you haven’t disabled IPv6 in your network, it will sooner or later cross your way. If you haven’t yet found the time to learn IPv6, you will run into problems. I can give you an example. When I first installed Active Directory on Windows Server 2008, the installation wizard was complaining that my network card didn’t have a static IP. Since I had just assigned the IP a minute ago, I assumed the wizard didn’t really know what it was talking about. Only later did I realize that the wizard was, indeed, smarter than me. As usual, I ignored the IPv6 settings.

There are also downsides to turning off IPv6. It is enabled by default on Windows Vista, Windows 7, Windows Server 2008, and Windows Server 2008 R2. Messing around with the default settings is usually not a good idea, especially if you do it on multiple machines. If you only have Windows XP and Windows Server 2003 machines in your network, you don’t have to worry anyway because IPv6 isn’t installed by default in those operating systems.

disable-ipv6-interface-properties It is not possible to uninstall IPv6 on Vista and Server 2008. The command “netsh interface ipv6 uninstall” that worked in XP and Server 2003 is no longer supported in newer Windows versions. However, it is possible to disable IPv6. You can do it manually for each network interface through the Network and Sharing Center. If your network firewall runs on Windows, you can disable it just there. If security is a top priority in your network, you might want to disable it on all machines in your network.

To disable IPv6 on all network interfaces on a computer you must create a DWORD 32-bit registry value named “DisabledComponents” in the following registry key branch:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tcpip6\Parameters\

disable-IPv6-DisabledComponents

The value data for DisabledComponents must be set to 000000FF.

You will then have to reboot to activate the new setting. If you check the network interface properties after the reboot, you will notice that IPv6 has not disappeared and is still activated. This is not a sign that IPv6 is still enabled. To make sure that you’ve really gotten rid of IPv6, you will need to run ipconfig on a command prompt. If you don’t see an IPv6 address, then everything is alright (see screenshots).

disable-ipv6-enabled disable-ipv6-disabled

Misha Hanin from the System Administrator blog has a little batch file that you can use if you want to disable IPv6 on multiple machines via a script. It is even more comfortable to use Group Policy for this purpose. Jeff Guillet created the corresponding admx template.