Hello folks,

A customer ran into an issue this week and the first thing that was suggested was “Hey, I know, lets disable IPV6….”

Really?? No research, no questions?  It’s easy! I’ve been told…  Just go to the Ethernet Adapter setting and unbind the protocol.

WRONG!

Microsoft recommends leaving IPv6 enabled even when not in active use.  if you really have to,  you can.  It is supported.  but you have to do it the right way.  We’ll cover that later in this post.

I wanted to talk about why it is not recommended to disable IPV6.  First Windows XP and Windows Server 2003 (and earlier) did not natively support IPv6. These OS’s require manual intervention to install and enable IPv6.  Starting with Windows Vista and Windows Server 2008, IPv6 is installed and enabled by default.  That was made possible because Microsoft redesigned and built the TCPIP stack using native IPv6.  That’s why IPv6 cannot be uninstalled on these operating systems (or later ones), but it can be disabled

Here is a extract from the IPV6 FAQ (http://technet.microsoft.com/en-us/network/cc987595.aspx)

Better yet!  read Understanding IPv6 from Microsoft Press.  http://www.microsoft.com/learning/en/us/book.aspx?ID=4883&locale=en-us

“From Microsoft’s perspective, IPv6 is a mandatory part of the Windows operating system and it is enabled and included in standard Windows service and application testing during the operating system development process. Because Windows was designed specifically with IPv6 present, Microsoft does not perform any testing to determine the effects of disabling IPv6. If IPv6 is disabled on Windows 7, Windows Vista, Windows Server 2008 R2, or Windows Server 2008, or later versions, some components will not function. Moreover, applications that you might not think are using IPv6—such as Remote Assistance, HomeGroup, DirectAccess, and Windows Mail—could be.”

Did you read that?  Microsoft products are not tested with IPv6 disabled. Disabling IPv6 places that host and application into a less-tested state.  Which means we don’t know what you’re going to get!!  if you contact the MS support center, they may ask you to re-enable it.   In the end, leaving IPv6 enabled, even when not in use, does not impact production networks.

But if you ARE going to disable it…..  DO IT RIGHT!

Like i said earlier, disabling it in the Properties of the NIC is NOT Recommended.   When you do that a few things come into play:

• You Unbinds IPv6 from that one interface only.  which means if you replace it or introduce another it will be enabled on that one.
• The disabling cannot be easily scripted and validated.
• and even if you do….  The IPv6 loopback is still enabled

This will introduce support issues. Things will start to break. There are known issues reported already. The product group do not perform any regression testing by keeping IPv6 disabled.

There is no easy way to manage “Unbind or “Bind” operation for IPv6 centrally. You need to go to each server locally to configure this setting. There is no GPO or scripted way to manage this configuration. In other words it is going to increase your administration overhead when you may wants to turn this setting on (Bind IPv6 again) the machines at the enterprise level.

How to Disable IPv6

OK OK…  after all i just said if you still want to disable IPV6 here’s how you do it.

It is recommend using the DisabledComponents Registry Key to disable IPV6 it’s well documented in the following KB article. http://support.microsoft.com/kb/929852 

The DisabledComponents key does not exist by default and must be created the KB tells you how to do that too…

So, create HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpip6ParametersDisabledComponents

Enter  any one of the following values in the Value data field to configure the IPv6 protocol the way you want it

• 0 - to enable all IPv6 components. (Windows default setting) 
• 0xffffffff  – to disable all IPv6 components, except the IPv6 loopback interface. This value also configures Windows to prefer using Internet Protocol version 4 (IPv4) over IPv6 by modifying entries in the prefix policy table. For more information, see Source and Destination Address Selection (http://technet.microsoft.com/library/bb877985.aspx) .
• 0×20 – to prefer IPv4 over IPv6 by modifying entries in the prefix policy table. 
• 0×10 – to disable IPv6 on all nontunnel interfaces (on both LAN and Point-to-Point Protocol [PPP] interfaces). 
• 0×01 – to disable IPv6 on all tunnel interfaces. These include Intra-Site Automatic Tunnel Addressing Protocol (ISATAP), 6to4, and Teredo. 
• 0×11 – to disable all IPv6 interfaces except for the IPv6 loopback interface.

Of course you need to leave the IPv6 box checked in the NIC properties when using the DisabledComponents Key to disable it.  And watch out for 6to4 address that may get generated automatically and get registered in DNS if the IPv4 address is defined in public range of addresses. if you’re running private addresses,  don’t worry about it.

Individual transition technologies (ISATAP, 6to4, Teredo, IP-HTTPS) can be disabled individually via GPO on Windows 7, Windows Server 2008 R2 and higher.

The policy is located here in the GPO:

• Computer Configuration
  • Administrative Templates
    • Network
      • TCPIP Settings
        • IPv6 Transition Technologies

•

I know some people have already mentioned using the firewall to bloc the traffic, well all i can tell you is that it’s not supported or recommended.

Now you know. 

If you are considering this, take a really good look at why you’re trying to disable it.  you might be introducing more issues that it’s worth.

That’s my IT 2 cents.

Chao!

MCITP, ITIL | Senior Technical Account Manager | Directeur de Compte Technique Senior
Twitter | Facebook | LinkedIn