COMMAND EVERYTHING.
Creates an extended ACL for a virtual network adapter.
Microsoft Hyper-V reference: Creates an extended ACL for a virtual network adapter. The syntax and selected example below are adapted from the pinned Windows Server 2025 reference. Module availability, target configuration and delegated permissions determine whether it can run in your environment. Documentation and parameter text: Microsoft, CC BY 4.0; formatting adapted by Cmdlet World. No execution testing is claimed.
Use an account with the target resource permissions documented for Add-VMNetworkAdapterExtendedAcl. Modifying administrative cmdlets may require elevation or delegated administration. This catalog does not assert that ordinary users can execute the command.
Windows / Hyper-V · Windows Server 2025 documentation; feature/module prerequisites apply
-Action (required)- Specifies the action for the ACL. The acceptable values for this parameter are: - Allow - Deny
-CimSession- Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a New-CimSession or Get-CimSession cmdlet. The default is the current session on the local computer.
-ComputerName- Specifies an array of Hyper-V hosts. The cmdlet adds the ACL to the network adapters on the Hyper-V hosts that you specify.
-Confirm- Prompts you for confirmation before running the cmdlet.
-Credential- Specifies one or more user accounts that have permission to perform this action. The default is the current user.
-Direction (required)- Specifies the direction of network traffic, from the perspective of the virtual machine, to which the ACL applies. The cmdlet adds an ACL that has the value that you specify. The acceptable values for this parameter are: - Inbound - Outbound If you run the Get-VMNetworkAdapterExtendedAcl cmdlet, the entry that you create appears in both the inbound ACL and the outbound ACL.
-IdleSessionTimeout- Specifies a time-out period, in seconds, for idle sessions.
-IsolationID- Specifies an ID of a virtual subnet. The cmdlet adds an ACL that applies to traffic on the isolated network that you specify. The subnet uses virtual local area network (VLAN) or Hyper-V Network Virtualization. For more information about isolation IDs, see the Set-VmNetworkAdapterIsolation cmdlet.
-LocalIPAddress- Specifies the local IP address for the ACL. For an inbound packet, the local address is the destination IP address. For an outbound packet, the local address is the source IP address. You can specify a host address or a subnet address, or specify a wildcard, such as 0.0.0.0/0 for all IPv4 addresses, ::/0 for all IPv6 addresses, or ANY for all IPv4 and IPv6 addresses.
-LocalPort- Specifies the local port for the ACL. A port range format can also be used (i.e. "49152-49182", for example). For an inbound TCP or UDP packet, the local port is the destination port. For an outbound packet, the local port is the source port.
-ManagementOS (required)- Indicates that the cmdlet operates on the parent or host operating system. If you specify this parameter, this cmdlet creates an ACL that applies to the parent or host operating system.
-Passthru- Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.
-Protocol- Specifies the protocol that the ACL applies to. The acceptable values for this parameter are: - TCP - UDP - an integer IP protocol ID (use 1 for ICMP)
-RemoteIPAddress- Specifies the local IP address for the ACL. For an inbound packet, the remote address is the source IP address. For an outbound packet, the remote address is the destination IP address. You can specify a host address or a subnet address, or specify a wildcard, such as 0.0.0.0/0 for all IPv4 addresses, ::/0 for all IPv6 addresses, or ANY for all IPv4 and IPv6 addresses.
-RemotePort- Specifies the remote port for the ACL. A port range format can also be used (i.e. "49152-49182", for example). For an inbound TCP or UDP packet, the remote port is the source port. For an outbound packet, the remote port is the destination port.
-Stateful- Indicates whether the ACL applies to packets in both directions of the same session. If you specify a value of $True, the ACL applies to a return packet even though that packet has the opposite direction with respect to the ACL.
-VM (required)- Specifies an array of virtual machine objects. The cmdlet adds an ACL for the virtual machines that you specify. To obtain a virtual machine object, use the Get-VM cmdlet.
-VMName (required)- Specifies an array of names of virtual machines. The cmdlet adds an ACL for the virtual machines that you specify.
-VMNetworkAdapter (required)- Specifies an array VM network adapters as VMNetworkAdapterBase objects. The cmdlet adds an ACL to the adapters that you specify. To obtain a network adapter, use the Get-VMNetworkAdapter cmdlet.
-VMNetworkAdapterName- Specifies the name of a virtual network adapter. The cmdlet adds an ACL to the adapter that you specify.
-Weight (required)- Specifies the weight of an ACL entry. Larger weight values apply first, and once an ACL entry applies to a packet, other entries are no longer relevant for that packet.
-WhatIf- Shows what would happen if the cmdlet runs. The cmdlet is not run.
Windows with the Hyper-V module and the Windows feature or management tools that provide it. Confirm target connectivity and version compatibility using the linked Microsoft reference.
This cmdlet changes system state. Review every target and parameter in the official reference, test outside production, and prepare an appropriate backup or rollback. Do not execute the example automatically.