COMMAND EVERYTHING.

Add-VMNetworkAdapterAcl

Creates an ACL to apply to the traffic through a virtual machine network adapter.

Windows Server · Risk: High · Documentation Verified

Last verified: 2026-10-26

Microsoft Hyper-V reference: Creates an ACL to apply to the traffic through a virtual machine network adapter. The syntax and selected example below are adapted from the pinned Windows Server 2025 reference. Module availability, target configuration and delegated permissions determine whether it can run in your environment. Documentation and parameter text: Microsoft, CC BY 4.0; formatting adapted by Cmdlet World. No execution testing is claimed.

Add-VMNetworkAdapterAcl -Action <VMNetworkAdapterAclAction> -Direction <VMNetworkAdapterAclDirection>
 [-LocalIPAddress <String[]>] [-LocalMacAddress <String[]>] [-RemoteIPAddress <String[]>]
 [-RemoteMacAddress <String[]>] [-Passthru] [-VMNetworkAdapterName <String>] [-CimSession <CimSession[]>]
 [-ComputerName <String[]>] [-Credential <PSCredential[]>] [-VMName] <String[]> [-WhatIf] [-Confirm]
 [<CommonParameters>]

Copied 0 times

Required permissions

Use an account with the target resource permissions documented for Add-VMNetworkAdapterAcl. Modifying administrative cmdlets may require elevation or delegated administration. This catalog does not assert that ordinary users can execute the command.

Supported environments

Windows / Hyper-V · Windows Server 2025 documentation; feature/module prerequisites apply

Parameters

-Action (required): Specifies the action for the ACL. Allowed values are Allow, Deny, and Meter. A metering ACL must be IP-based, i.e. either -RemoteIPAddress or -LocalIPAddress must be specified.
-CimSession: Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a New-CimSession or Get-CimSession cmdlet. The default is the current session on the local computer.
-ComputerName: Specifies one or more Hyper-V hosts on which the ACL is to be created. NetBIOS names, IP addresses, and fully qualified domain names are allowable. The default is the local computer. Use localhost or a dot (.) to specify the local computer explicitly.
-Confirm: Prompts you for confirmation before running the cmdlet.
-Credential: Specifies one or more user accounts that have permission to perform this action. The default is the current user.
-Direction (required): Specifies the direction of the network traffic to which the ACL is to apply. Allowed values are Inbound, Outbound, or Both. . If Both is specified, the new ACL entry is added to both the inbound direction and the outbound direction. In the output of Get-VMNetworkAdapterAcl, the ACL entry appears in both the inbound ACL list and the outbound ACL list.
-LocalIPAddress: Specifies the local IP address to which the ACL is to apply. For an inbound packet, this is the destination IP address in the packet header; for an outbound packet, this is the source IP address in the packet header. It can be either IPv4 or IPv6 address. It can be either a host address or a subnet address, e.g. 1.2.3.4, 2001::2008, 192.168.1.0/24, or f001:f002:f003:f004::1/64. The IP address can also be a wildcard, 0.0.0.0/0 for all IPv4 addresses, ::/0 for all IPv6 addresses, or ANY for all IPv4 and IPv6 addresses.
-LocalMacAddress: Specifies the local MAC address to which the ACL is to apply. For an inbound packet, this is the destination MAC address in the packet header; for an outbound packet, this is the source MAC address in the packet header. It can be a host MAC address, e.g. 00-ab-00-11-22-33, or a wildcard, ANY, for all MAC addresses.
-ManagementOS (required): Specifies that the ACL is to be applied in the management (i.e. the parent, or host) operating system.
-Passthru: Specifies that an object is to be passed through to the pipeline representing the ACL to be added.
-RemoteIPAddress: Specifies the remote IP address to which this ACL is to apply. For an inbound packet, this is the source IP address in the packet header; for an outbound packet, this is the destination IP address in the packet header. It can be either IPv4 or IPv6 address. It can be either a host address or a subnet address, e.g. 1.2.3.4, 2001::2008, 192.168.1.0/24, or f001:f002:f003:f004::1/64.the IP address can also be a wildcard, 0.0.0.0/0 for all IPv4 addresses, ::/0 for all IPv6 addresses, or ANY for all IPv4 and IPv6 addresses.
-RemoteMacAddress: Specifies the remote MAC address to which this ACL is to apply. For an inbound packet, this is the source MAC address in the packet header; for an outbound packet, this is the destination MAC address in the packet header. It can be a host MAC address, e.g. 00-ab-00-11-22-33, or a wildcard, ANY, for all MAC addresses.
-VM (required): Specifies the virtual machine on which the ACL is to apply.
-VMName (required): Specifies the name of the virtual machine on which the ACL is to apply.
-VMNetworkAdapter (required): Specifies the virtual machine network adapter to which the ACL is to apply.
-VMNetworkAdapterName: Specifies the name of the virtual machine network adapter to which the ACL is to apply.
-WhatIf: Shows what would happen if the cmdlet runs. The cmdlet is not run.

Prerequisites

Windows with the Hyper-V module and the Windows feature or management tools that provide it. Confirm target connectivity and version compatibility using the linked Microsoft reference.

Security considerations

This cmdlet changes system state. Review every target and parameter in the official reference, test outside production, and prepare an appropriate backup or rollback. Do not execute the example automatically.

Examples

Example 1

Add-VMNetworkAdapterAcl -VMName Redmond -RemoteIPAddress 10.0.0.0/8 -Direction Both -Action Allow

This example adds an ACL to allow virtual machine Redmond to send to and receive from traffic on IP subnet 10.0.0.8/8. Source: Microsoft, CC BY 4.0; transcript prompt/output removed. This example was not executed.

Sources

https://github.com/MicrosoftDocs/windows-powershell-docs/blob/b7645dd8c687139b28e845119da30ec670526507/docset/winserver2025-ps/Hyper-V/Add-VMNetworkAdapterAcl.md

https://learn.microsoft.com/powershell/module/hyper-v/add-vmnetworkadapteracl?view=windowsserver2025-ps

Personal collections

Explain or customize this command with AI

Related commands

Add-CauClusterRole

Add-ClusterCheckpoint

Get-FsrmAdrSetting

Clear-HgsServer