Add Proactive Remediation: Prefer IPv4 over IPv6 (DisabledComponents)

[lcerff]

Type

Enhancement — new remediation script pair

Summary

Add a detect/remediate script pair to the baseline that configures Windows to prefer IPv4 over IPv6, per Microsoft's recommended approach. This does not disable IPv6 (which Microsoft explicitly advises against) — it only adjusts prefix policy precedence via the DisabledComponents registry value.

Background

No native Settings Catalog or ADMX policy exists for this setting, and the target path (HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters) falls outside the Policy/Registry CSP's permitted namespace, so it can't be pushed via a standard OMA-URI custom profile. A Proactive Remediation is the most reliable Intune-native delivery method, and gives us ongoing drift detection (e.g. if a firmware/driver update or on-prem GPO resets the value on hybrid-joined devices).

Registry details

Key	Value
Path	HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters
Name	DisabledComponents
Type	REG_DWORD
Value	32 (0x20) — Prefer IPv4 over IPv6

Reference: Microsoft Learn – Guidance for configuring IPv6

Proposed implementation

• Detect-PreferIPv4.ps1 — checks DisabledComponents == 32, exits 0/1 accordingly
• Remediate-PreferIPv4.ps1 — creates/sets the value if missing or incorrect
• Deploy as System context (not user), since the key is under HKLM
• Suggested schedule: daily, to catch drift from GPO conflicts on hybrid-joined endpoints

Detect-PreferIPv4.ps1

<#
.SYNOPSIS
    Detection script - checks if IPv4 is preferred over IPv6 via DisabledComponents registry value.
.NOTES
    Intune Proactive Remediation - Detection
    Exit 0 = Compliant (no remediation needed)
    Exit 1 = Non-compliant (triggers remediation script)
#>

$RegPath  = "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters"
$RegName  = "DisabledComponents"
$Expected = 32  # 0x20 - Prefer IPv4 over IPv6

try {
    $CurrentValue = Get-ItemPropertyValue -Path $RegPath -Name $RegName -ErrorAction Stop

    if ($CurrentValue -eq $Expected) {
        Write-Output "Compliant: DisabledComponents is set to $CurrentValue (IPv4 preferred)."
        Exit 0
    }
    else {
        Write-Output "Non-compliant: DisabledComponents is set to $CurrentValue, expected $Expected."
        Exit 1
    }
}
catch {
    Write-Output "Non-compliant: Registry value not found or inaccessible. $($_.Exception.Message)"
    Exit 1
}

Remediate-PreferIPv4.ps1

<#
.SYNOPSIS
    Remediation script - sets DisabledComponents to prefer IPv4 over IPv6.
.NOTES
    Intune Proactive Remediation - Remediation
    Runs only if Detection script exits 1.
#>

$RegPath  = "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters"
$RegName  = "DisabledComponents"
$Value    = 32  # 0x20 - Prefer IPv4 over IPv6

try {
    if (-not (Test-Path $RegPath)) {
        New-Item -Path $RegPath -Force | Out-Null
    }

    New-ItemProperty -Path $RegPath -Name $RegName -Value $Value -PropertyType DWORD -Force -ErrorAction Stop | Out-Null

    Write-Output "Remediated: DisabledComponents set to $Value (IPv4 preferred over IPv6)."
    Exit 0
}
catch {
    Write-Output "Remediation failed: $($_.Exception.Message)"
    Exit 1
}

Validation steps

ping bing.com                              # should resolve to an IPv4 address
netsh interface ipv6 show prefixpolicies   # ::ffff:0:0/96 should have higher precedence than ::/0

Notes / caveats

• Takes effect on new connections immediately; existing established sockets won't re-evaluate until torn down — no reboot strictly required, but flag this in change notes for latency-sensitive links.
• Applies to Windows only; not relevant to other baseline platforms.

Acceptance criteria

• Detection/remediation scripts added under /remediations/network/
• Deployed as Proactive Remediation, System context
• Verified compliant on a hybrid-joined test device
• README/changelog updated