Anyone who works with Windows network con­fig­ur­a­tions will sooner or later come across the Network Shell (Netsh). The term refers to an interface between users and the operating system, which enables the ad­min­is­tra­tion and con­fig­ur­a­tion of local, and remote network settings.

The range of ap­plic­a­tions includes settings for the Windows firewall and LAN/WLAN man­age­ment as well as IP and server con­fig­ur­a­tion. Moreover, networked in­fra­struc­ture can also be protected from external attack. Using the command line tool, it’s also possible to diagnose problems and carry out repairs in the network. A big advantage of Netsh is that network-related ad­min­is­tra­tion tasks can be performed quickly and con­veni­ently, and can be automated with scripts.

Netsh commands: starting the command prompt

It’s necessary to access the command line in order to use Netsh. There, you can open the “Run” menu as follows:

  1. Press the key com­bin­a­tion [Windows] + [R]
  2. Enter “cmd” in the entry field (1)
  3. Click the “OK” button (2)
Image: Opening the “Run” menu
Opening the command line (cmd.exe) on Windows.

The command prompt will then launch. The service program will open after you enter “netsh” and confirm with [Enter].

Image: Command prompt for Netsh commands
Windows command prompt with a Netsh command; here USERNAME is a place­hold­er for the active user account.

If Netsh commands and scripts aren’t run or if more fun­da­ment­al in­ter­ven­tions in the network con­fig­ur­a­tion are planned, you’ll need to start Network Shell with ad­min­is­trat­or rights. These steps are required on Windows 10:

  1. Right-click on the Windows symbol on the left side of the task bar or press the key com­bin­a­tion [Windows] + [X].
  2. Choose the entry “Command Prompt (Admin)” in the context menu that appears:
Image: Context menu opened via the Windows task bar symbol
Starting command prompt with ad­min­is­trat­or rights.

Netsh includes the program file netsh.exe located in the Windows system folder (%windir%\system32). Directly opening the file stream­lines the Netsh command entry procedure. You can enter the path C:\Windows\System32\netsh.exe into the address line of Windows Explorer and press [Enter]. You can then enter Netsh commands straight away in the entry window that appears.

Launching the file is even faster by using a shortcut. Once created, a simple mouse click will be enough to launch the command entry:

  1. Right-click on the Windows desktop. Click on the menu entry “New” (1) and then click on “Shortcut” in the next context menu (2):
Image: Creating a context menu shortcut
Creating a Netsh shortcut via the Windows desktop.
  1. In the shortcut assistant, enter the path C:\Windows\System32\netsh.exe (1) and click on “Next” (2):
Image: Path entry for the Netsh shortcut
Entering the program path for a Netsh shortcut.
  1. You should give the shortcut a suitable name (1); the shortcut will then be placed on the desktop after clicking “Finish” (2):
Image: Entering a name for the Netsh shortcut
Entering a suitable name for the Netsh shortcut.

How Netsh works

The service program Netsh provides an extensive command syntax. If you want to complete certain tasks, you’ll need to fa­mil­i­ar­ise yourself with the specific structure of the Network Shell. The structure of the service program is based on contexts that represent various ad­min­is­tra­tion levels. Each context en­com­passes a certain network func­tion­al­ity (e.g. IP, LAN and firewall con­fig­ur­a­tion). The program uses the files of the Dynamic-Link Library (DLL) for context-bound in­ter­ac­tion with other Windows com­pon­ents. For instance, Netsh utilises Dhcpmon.dll to change and manage DHCP settings.

To use a context, it’s necessary to switch to it in the command prompt of Windows. For example, the “LAN ad­min­is­tra­tion” context is accessed as follows:

  1. After opening the command prompt, enter “netsh” and confirm with [Enter].
  2. Then enter “lan” and confirm with [Enter].
  3. The command prompt will now show the context change: netsh lan>
Image: Context changes in Netsh
Netsh in the command prompt: switching levels to the “LAN” context.

After changing to the “LAN” context, a number of context-specific and cross-context commands will be available. The context-specific commands include “set” (which con­fig­ures settings at in­ter­faces). An example for a general and cross-context Netsh command is the help command “/?”, which lists the available sub-contexts and commands in each section. Entering it in the “LAN” section will produce the following list of context-specific and cross-context commands:

Image: Commands in the “LAN” Netsh context
Netsh in the command prompt: calling up the command overview for the “LAN” context.

For instance, if you switch to the firewall context, the as­so­ci­ated command reference will look like this:

Image: Commands in the “firewall” Netsh context
Netsh in the command prompt: calling up the command overview for the “firewall” context.

Besides the context-bound structure, there are other special points to consider when using the program. Netsh can either be used in a non-in­ter­act­ive or in­ter­act­ive mode. In the non-in­ter­act­ive mode, for example, important network settings are exported to a text file and re­im­por­ted for sub­sequent recovery.

In the in­ter­act­ive mode, direct requests can be initiated. If you enter “netsh interface ip show address”, the current IP address of the computer will be displayed. The in­ter­act­ive mode can be used online or offline. The online model directly im­ple­ments op­er­a­tions, while the offline mode saves actions and runs them later. The saved actions are activated at the desired time via the Netsh command “commit”.

Netsh commands and their contexts

We’ve sum­mar­ised the main Netsh commands with a short ex­plan­a­tion of the contexts in the table below. In the case of general, cross-context commands, ad­di­tion­al ex­plan­a­tions are not necessary (right-hand column). Depending on the operating system version and the role in the network (client or server), the available commands may vary in some instances. The command entry on a computer with a Windows Server 2016 data centre is as follows:

Command Im­ple­ment­a­tion Netsh context managed
.. Switches to a context level higher
? Displays a list of commands
abort Discards changes made in offline mode
add Adds a con­fig­ur­a­tion entry to the list
ad­vfire­wall Switches to the “netsh ad­vfire­wall” context Firewall (policies and con­fig­ur­a­tion)
alias Adds an alias
branch­cache Switches to the “netsh branch­cache” context Branch cache settings
bridge Switches to the “netsh bridge” context Network bridge
bye Ends the program
commit Applies changes made in offline mode
delete Deletes a con­fig­ur­a­tion entry from the list of entries
dh­cp­cli­ent Switches to the “netsh dh­cp­cli­ent” context DHCP client
dnsclient Switches to the “netsh dnsclient” context DNS client settings
dump Displays a con­fig­ur­a­tion script
exec Runs a script file
exit Ends the program
firewall Switches to the “netsh firewall” context Firewall (policies and con­fig­ur­a­tion)
help Displays a list of commands
http Switches to the “netsh http” context HTTP server driver (http.sys)
interface Switches to the “netsh interface” context IP con­fig­ur­a­tion (v4, v6)
ipsec Switches to the “netsh ipsec” context IPSEC policies
ipsec­dos­pro­tec­tion Switches to the “netsh ipsec­dos­pro­tec­tion” context Pro­tec­tion against IPSEC denial-of-service attacks
lan Switches to the “netsh lan” context Wired network in­ter­faces
namespace Switches to the “netsh namespace” context DNS client policies
netio Switches to the “netsh netio” context Com­mit­ment filters
offline Sets the current mode to offline
online Sets the current mode to online
popd Switches to the context saved via pushd in the stack
pushd Applies the current context to the stack
quit Ends the program
ras Switches to the “netsh ras” context Remote-access server
rpc Switches to the “netsh rpc” context RPC service con­fig­ur­a­tion
set Updates the con­fig­ur­a­tion settings
show Displays in­form­a­tion
trace Switches to the “netsh trace” context
unalias Deletes an alias name
wfp Switches to the “netsh wfp” context Windows filtering platform
winhttp Switches to the “netsh winhttp” context Proxy and tracing settings of the Windows HTTP client
winsock Switches to the “netsh winsock” context Winsock con­fig­ur­a­tion
wlan Switches to the “netsh wlan” context Wireless network in­ter­faces

Syntax para­met­ers for Netsh – what do they mean?

To implement specific actions and tasks, Netsh commands can be given optional para­met­ers. The syntax scheme for the com­bin­a­tion of Netsh commands and para­met­ers is as follows:

netsh [-a AliasFile] [-c Context] [-r RemoteComputer] [-u [DomainName\]UserName] [-p Password | *] [command | -f ScriptFile]

The following para­met­ers are all optional, so they can be added and used where needed.

-a Return to Netsh command prompt after running the alias file
AliasFile Specifies the name of the text file that contains at least one Netsh command
-c Switches to the specified Netsh context
Context Place­hold­er for the context to be entered (e.g. WLAN)
-r Causes the command to be run on a remote computer; the remote re­gis­tra­tion service must be executed there.
Re­mote­Com­puter Name of the remote computer that is con­figured
-u Indicates that the Netsh command is run under a user account
Do­main­Name\ Des­ig­nates the user account domain (the standard value is the local domain if no special domain is specified)
UserName Name of the user account
-p A password can be entered for the user account
Password Specifies the password for the user account that is stated with -u UserName
Net­sh­Com­mand Netsh command to be run
-f Ends Netsh after running the script file
Script­File Script to be run

Resetting the TCP/IP Stack with Netsh

A common use for Netsh commands is to reset the TCP/IP stack, which provides for the exchange of data packages in networks. In the event of network and internet issues, this measure can help to remove defective or in­cor­rectly con­figured TCP/IP protocols for example. The following repair command executes a reset and re-installs TCP/IPv4:

netsh int ip reset

A protocol file can also be created that logs the changes made:

netsh int ip reset c:\tcpipreset.txt

After running the reset, the computer will need to be restarted.

Tip

Netsh commands can also be used in batch files (*.bat) to automate routine tasks. Find out more in our guide “Removing Batch Files”.

Importing and exporting network settings

Netsh allows you to export current network settings into a plain text file. In case of network problems, a func­tion­ing and error-free con­fig­ur­a­tion can then be quickly restored.

In the first step (export), the network con­fig­ur­a­tion is read out, written into a text file (netcnfig.txt)), and saved in the example directory “Network Con­fig­ur­a­tion” on the C:\ drive. Before the first export, you’ll need to manually create the “Network Con­fig­ur­a­tion” folder on the des­tin­a­tion drive (Netsh does not perform this step auto­mat­ic­ally). Then, switch to the command prompt and enter the code below:

netsh -c interface dump>c:\Network Configuration\netcnfig.txt

The following command entry is required for sub­sequently importing the settings:

netsh -f c:\Network Configuration\netcnfig.txt
Tip

Windows 10 also supports copy and paste in the command prompt. You can simply copy the command syntax from this article and insert it into the entry window.

IP con­fig­ur­a­tion with Netsh

A prevalent use case for Netsh is changing IP settings. If a computer in the network doesn’t contain a static IP address but an auto­mat­ic­ally assigned one, the Dynamic Host Con­fig­ur­a­tion Protocol (DHCP) is used. This com­mu­nic­a­tion protocol auto­mat­ic­ally assigns IP addresses to clients in a network, and other required con­fig­ur­a­tion data. This process takes multiple steps:

In the first step, the current settings and names of the available network adapters are requested:

netsh interface ipv4 show interface
Image: Display of network adapters
Calling up the available network adapters with Netsh.

Now a certain LAN adapter (in this case: Ethernet) is de­term­ined as the addressee for the IP as­sign­ment via DHCP.

netsh interface ipv4 set address name="Ethernet" source=dhcp

Next, DHCP applies the dynamic ad­min­is­tra­tion for network settings that relate to the Ethernet adapter.

Ac­tiv­at­ing and de­ac­tiv­at­ing Windows firewall

If you wish to activate or de­ac­tiv­ate the Windows firewall, all you need is a simple Netsh command syntax. A firewall is activated as follows:

netsh firewall set opmode enable

Firewall de­ac­tiv­a­tion requires the following command:

netsh firewall set opmode disable
Note

In some contexts, Windows will recommend al­tern­at­ives to network ad­min­is­tra­tion with Netsh. Here, Windows Power­Shell is often suggested and you can find an in­tro­duc­tion to it in our Digital Guide.

Go to Main Menu