Gets a list of IP addresses that need to be added and deleted to an IPsec rule based on the differences detected between the IP addresses for the existing rule and the IP addresses derived from the input parameters, and creates a Windows PowerShell® script (.ps1) that updates the IPsec rule in the appropriate policy stores.
Microsoft NetSecurity reference: Gets a list of IP addresses that need to be added and deleted to an IPsec rule based on the differences detected between the IP addresses for the existing rule and the IP addresses derived from the input parameters, and creates a Windows PowerShell® script (.ps1) that updates the IPsec rule in the appropriate policy stores. The syntax and selected example below are adapted from the pinned Windows Server 2025 reference. Module availability, target configuration and delegated permissions determine whether it can run in your environment. Documentation and parameter text: Microsoft, CC BY 4.0; formatting adapted by Cmdlet World. No execution testing is claimed.
Use an account with the target resource permissions documented for Get-DAPolicyChange. Modifying administrative cmdlets may require elevation or delegated administration. This catalog does not assert that ordinary users can execute the command.
Supported environments
Windows / NetSecurity · Windows Server 2025 documentation; feature/module prerequisites apply
Parameters
-DisplayName (required)
Specifies the display name to match the differences in IP addresses of the IPsec rule.
-DnsServers
Specifies a list of DNS server IP addresses that will be used for name resolution used to determine IP address differences. This parameter accepts one or more DNS server IP addresses. If this parameter is not specified, then this cmdlet uses the default DNS servers.
-Domains
Specifies the domains from which the deltas in IP addresses are derived. The list is specified by an array of fully qualified domain names (FQDN).
-EndpointType (required)
Specifies that the local or remote endpoint should be modified by adding or removing the IP address differences. The acceptable values for this parameter are: Endpoint1 or Endpoint2. Endpoint1 corresponds to the local address and Endpoint2 corresponds to the remote address for any IPsec rule.
-PSLocation (required)
Specifies the path for the newly created Windows PowerShell script (.ps1) file. This parameter supports standard Windows PowerShell path syntax. This parameter must contain a rooted path, such as C:\users\User1\WPS_Script.ps1.
-PolicyStore
Specifies the policy store from which to retrieve the rules to be retrieved. A policy store is a container for firewall and IPsec policy. The acceptable values for this parameter are: - PersistentStore: Sometimes called static rules, this store contains the persistent policy for the local computer. This policy is not from GPOs, and has been created manually or programmatically (during application installation) on the computer. Rules created in this store are attached to the ActiveStore and activated on the computer immediately. - ActiveStore: This store contains the currently active policy, which is the sum of all policy stores that apply to the computer. This is the resultant set of policy (RSOP) for the local computer (the sum of all GPOs that apply to the computer), and the local stores (the PersistentStore, the static Windows service hardening (WSH), and the configurable WSH). ---- GPOs are also policy stores. Computer GPOs can be specified as follows. ------ -PolicyStore hostname. ---- Active Directory GPOs can be specified as follows. ------ -PolicyStore domain.fqdn.com\GPO_Friendly_Namedomain.fqdn.comGPO_Friendly_Name. ------ Such as the following. -------- -PolicyStore localhost -------- -PolicyStore corp.contoso.com\FirewallPolicy ---- Active Directory GPOs can be created using the New-GPO cmdlet or the Group Policy Management Console. - RSOP: This read-only store contains the sum of all GPOs applied to the local computer. - SystemDefaults: This read-only store contains the default state of firewall rules that ship with Windows Server® 2012. - StaticServiceStore: This read-only store contains all the service restrictions that ship with Windows. Optional and product-dependent features are considered part of Windows Server 2012 for the purposes of WFAS. - ConfigurableServiceStore: This read-write store contains all the service restrictions that are added for th
-Servers
Specifies a list of server IP addresses that will be used to derive IP address differences.
Prerequisites
Windows with the NetSecurity module and the Windows feature or management tools that provide it. Confirm target connectivity and version compatibility using the linked Microsoft reference.
Security considerations
This is a read-oriented cmdlet; protect any sensitive results and check the documented effects of your selected parameters.
This example gets the list of IP addresses that need to be added and deleted to an IPsec rule based on the differences detected between the existing rule IP addresses and the IP addresses derived from the input parameters and returns a .ps1 file that updates the local end point for the rule. Source: Microsoft, CC BY 4.0; transcript prompt/output removed. This example was not executed.