Control bandwidth usage with QoS policies in Windows 11

Monitor network usage in Windows 11 is not just about “going faster”, but about ensuring that what's important takes priority when the connection becomes saturated. Quality of Service (QoS) policies allow you to mark and limit outgoing traffic so that critical applications, such as VoIP or video, do not suffer from interruptions or latency spikes.

Much of the confusion stems from old myths about Windows “reserving” bandwidth and slowing down your speed. In reality, QoS in Windows 11 combines DSCP marking and throttling by policy, is applied via Group Policy to users or computers, and can filter by app, URL, IPs, and ports. It also offers advanced options such as TCP receive window control and DSCP flag override so that only your policies prevail.

What is QoS in Windows and why you might care

In Windows, QoS policy unites standards-based QoS with GPO management, so you can apply rules from Active Directory without touching each piece of equipment by hand. The system supports two key controls: dialing by DSCP (0–63), useful for routers and access points to prioritize queues, and speed limitation to contain specific outgoing flows.

Routers interpret the DSCP to decide the queue for each packet; thus, your organization can define queues such as “latency-sensitive,” “control,” “business-critical,” “best effort,” or “bulk transfers” and route accordingly. With the throttling part, a QoS policy can restrict the outflow of an app or service at X KB/s or MB/s, which is especially useful in WAN with costs or SLAs.

Before you start: Key concepts (DSCP and limitation)

The DSCP, defined in RFC 2474, uses the TOS field in IPv4 and the traffic class in IPv6 to mark packets with values ​​of the 0 al 63. Windows computers can mark outgoing traffic with a specific DSCP value, and your Wi-Fi routers and APs will use that value to sort and queue the packages correctly.

Throttling is independent of marking: a QoS policy can, for example, set a DSCP value of 46 for VoIP and at the same time limit a file server to 512 KB/s on port 443. Both controls can be combined or use separately according to your strategy.

Where the directives live and to whom they apply

QoS policies must have unique names and can be created at both the computer and user levels. In the Group Policy Object Editor (GPOE), you'll find them in Computer Configuration \ Windows Settings \ QoS Policy and in User Configuration \ Windows Settings \ QoS Policy. Team settings apply regardless of the logged-in user, and user settings apply wherever that user logs in.

For them to take effect, remember to link the GPO with the QoS policies to the corresponding AD DS container (domain, site, or organizational unit). The GPO with the highest priority will be the prevailing one if there are name conflicts of directives.

How to create a QoS policy in Windows 11 step by step

To create it, edit a GPO from the Group Policy Management Console (GPMC). In the tree, right-click the GPO node. QoS Directive and choose “Create a new policy”. The wizard consists of four pages that define the profile, scope, addresses and protocols/ports.

Wizard (page 1): Policy Profile

On this screen, you assign a unique name and decide whether to enable DSCP, limit flow, or both. You can activate Specify DSCP value with a value between 0 and 63, and/or Specify limiting speed with units in KB/s or MBps (value must be > 1).

1. In "Policy name”, indicates a clear and unique identifier to recognize the policy.
2. Activate "Specify DSCP value"If you want it marked, enter a number between 0 and 63 for the priority.
3. Activate "Specify limiting speed” If you want to contain the flow rate, select KB/s or MBps and a valid value.
4. Click on "Next” to continue with the scope of application.

Assistant (page 2): Application name

Decide if the policy applies to All applications, to a specific executable (ending in .exe), to a full path (may include Environment Variables such as %ProgramFiles%) or to HTTP server applications that respond to a Specific URL.

• "All applications”: The policy for page 1 applies to all matching traffic on subsequent pages.
• "Only applications with this executable name”: type, for example, MyApp.exe to delimit by binary.
• "Only HTTP server applications that respond to this URL”: Restricts web traffic to specific servers.

The URL must conform to RFC 1738, with format http[s]://<hostname>:<port>/<url-path>. Wildcards are allowed.*"only by completely replacing hostname I port (for example, https://training.* o https://*.*), but not as substrings (they are not valid https://my*site/ ni https://*training*/). In addition, you can check “Include subdirectories and files" for what https://training also cover https://training/video.

1. Choose whether this policy applies to “All applications” or “Only applications with this executable name.”
2. If you choose executable, provide a valid .exe; if you prefer path, include the full path (with variables if applicable).
3. Click on "Next” to pass to source/destination IP addresses.

Wizard (page 3): IP addresses

Here you can restrict by source and/or destination IP, allowing addresses or prefixesIf you choose “Only for the following IP address,” you can enter:

• IPv4: for example 192.168.1.1 or prefix 192.168.1.0/24.
• IPv6: for example 3ffe:ffff::1 or prefix 3ffe:ffff::/48.

If you set both, origin and destination must be the same. type of address (both IPv4 or both IPv6). If you specified an HTTP server URL on the previous page, you will see the IP of the origin (it is the HTTP server and is not configured here), although you can customize the final destination to differentiate customers.

1. Under “This QoS policy applies to (source)”, select “Any IP address” or “Only the following source address.”
2. If you restrict source, enter a valid IPv4/IPv6 or prefix to precisely narrow down the source. the legal end.
3. Under “This QoS policy applies to (destination)”, choose “Any address” or “Only the following destination address.”
4. If you restrict the destination, use an IPv4/IPv6 or prefix of the same type as the one defined in the source to avoid inconsistencies.
5. Click on "Next” to define affected protocols and ports.

Wizard (page 4): Protocols and Ports

Defines whether the policy applies to TCP, UDP or both, and if you narrow down by source/destination ports. You can leave “any”, a single port, or a interval with the format Bajo:Alto (without spaces), where both ends are between 1 and 65535.

1. In “Select the protocol…”, choose TCP, UDP o TCP and UDP to cover the right type of traffic.
2. In “Specify the source port number”, leave “From any port” or define a specific port/range.
3. If you define interval, use the format 1000:2000 without spaces; it is the correct way to indicate ranges.
4. In “Specify the destination port number”, leave “In any port” or adjust to one or a specific range.
5. Ends with “Finalize”; the new policy will appear in the GPO editor pane ready to be linked.

After creating it, remember to link the appropriate GPO to the domain, site, or OU so that computers and users receive the configurationWithout the link, the policy does not apply.

View, edit, delete, and audit QoS policies

To review or change a policy, right-click its name in the GPO editor. Selecting “Properties”, you will see the tabs: Policy Profile, Application Name, IP Addresses, and Protocols and Ports, which exactly reflect the wizard pages.

If you need to change it, use “Edit existing policy”; to remove it, “Delete policy”. It is advisable to audit periodically with the GPMC reports (Group Policy Results Wizard) to see which QoS policies are effective on a computer or user, its DSCP, limits, conditions, and the Prevalent GPO.

In the results view, when multiple policies with the same name exist in different GPOs, the one from the GPO with the highest priority is applied. All other conflicting policies are lower priority are not applied. This report makes it easier to detect what is actually in force and if there are overlaps.

QoS Policy Priority Rules

On outgoing TCP/UDP traffic, you can only apply one QoS policy at a time; there are no cumulative effects (e.g., throttling). they do not add up). To resolve conflicts, politics with conditions prevails more specific according to these rules:

• User vs. team level: A user policy wins over a computer policy when they match on the same traffic.
• Application vs. quintuple- A policy that identifies the app (especially with a full path) is more specific than one based only on quintuple; if several still apply, the first one is compared. quintuple.
• Inside the quintuple: : matters the specificity and priority order of fields.

By network quintuple we mean: source IP, destination IP, source port, destination port and protocol (TCP/UDP). If two policies match, the one that specifies more fields or a more specific value wins. Within the fivefold, the order of priority is: Source IP > Destination IP > Source port > Destination port > Protocol. For example, 192.168.4.1 has higher priority than 192.168.4.0/24.

Practical examples: if policy_A indicates app.exe and policy_B defines destination 192.168.1.0/24, when app.exe sends to an IP in the range, policy_A is applied because it is more specific. If policy_C covers destination 10.0.0.1 and TCP “any” and policy_D covers destination 10.0.0.1:80 TCP, when going against 10.0.0.1:80 policy_D wins by majority concretion.

Advanced QoS Settings

In addition to the policies, Windows includes a section of “Advanced QoS Settings” at the computer level. It is accessed from Computer Configuration \ Windows Settings \ QoS Policy \ Advanced QoS Settings, and offers two tabs: Incoming TCP traffic and DSCP override.

Incoming TCP traffic (receive window)

This option limits TCP receive throughput at the receiver by adjusting the advertised window. Modern Windows dynamically sizes up to 16 MB (compared to 64KB in older versions), and here you can set the maximum level for growth: 0 = 64KB, 1 = 256KB, 2 = 1MB, 3 = 16 MB. Actual size will be ≤ maximum depending on conditions.

1. In the GPO editor, enter the “Advanced QoS Settings".
2. Activate “Configure TCP receive throughput” and select the level desired (0–3) depending on your environment.
3. Link the GPO to the target OU to apply control on TEAM.

DSCP Marking Invalidation

With this option you restrict applications from setting their own DSCPs. If you define “Disregard", the apps that use QoS APIs will have their DSCP forced to 0, leaving the marking exclusively in the hands of your directivesBy default, Windows allows apps to set DSCP; this feature gives you full control when you need it. coherence.

DSCP and WMM values ​​in Wi-Fi

The Wi-Fi Alliance defines WMM with four access categories: VO (voice), VI (video), BE (best effort), and BK (background). Broadly speaking, the DSCP ranges are associated as follows: 48–63 → VO, 32–47 → VI, 24–31 and 0–7 → BE, 8–23 → BK. By setting DSCP according to these classes, the portable with WMM-certified Wi-Fi adapters and compatible APs will prioritize correctly your traffic.

Mobile scenarios, VPNs and servers

The purpose of these policies is to manage traffic on the corporate network. In mobile (laptop) scenarios, they are only enabled on interfaces connected to the corporate network, such as the interface VPN When connecting from a coffee shop, the physical Wi-Fi interface will not apply QoS until it is connected to the corporate network.

In server workloads the situation changes: a server with several NICs could be on the perimeter and the IT department will want to limit traffic from output even if that NIC does not “perceive” the link as corporate. For this reason, in Windows Server, QoS policies are always enabled on all interfaces.

Supported Systems and Locations in GPMC

Policy-based QoS is applied across a broad family: Windows 11/10 and modern Windows Server versions, as well as Windows 8.x, 7, and Eyeglasses. On servers, in the Group Policy Management Editor you can navigate to: “Default Domain Policy \ Computer Configuration \ Policies \ Windows Settings \ Policy-based QoS” or the equivalent of user.

There are no configured policies by default; you define the DSCP value and the flow limits by application, IPs, ports and protocol, and who implements the granularity you need per user/computer through the GPO infrastructure you already manage.

Advantages of policy-based QoS

Compared to doing it on switches or routers, policy QoS gives you a Level of detail superior (including user level), flexibility regardless of whether you connect via Wi‑Fi or Ethernet, and a layer of security to power mark IP before encrypting with IPsec, which is impossible to classify later on intermediate devices.

It also adds performance by bringing the limitation closer to the the origin (where it works best) and improves manageability: you can manage policies from a single domain controller and also use URL to group servers in a cluster behind a common address without chasing individual IPs.

Limit bandwidth by application or port

A typical case is to set a file server to never exceed X KB/s on port 443 or, conversely, to have a VoIP app get a high DSCP (e.g. 46) for network devices to place it in low-latency queues. All this without the app having to be programmed against QoS APIs: your policies act below the application layer.

The myth of “reservable bandwidth” in Windows

The idea that Windows “reserves 20% of the bandwidth” and that using gpedit will speed you up has been circulating for years. The reality: Windows uses the 100% of bandwidth Unless an app explicitly requests a reservation via QoS. Even if an app requests a reservation and then doesn't consume it, other apps can still use that reservation. bandwidth.

That said, there is the directive “Limit reservable bandwidth” in QoS Packet Scheduler (Administrative Templates), which some tutorials recommend enabling and setting to 0%. You can open gpedit.msc, go to Computer Configuration > Administrative Templates > QoS Packet Scheduler, edit the policy, enable “Enabled” and set “Bandwidth Limit (%)” to 0. Note: this does not guarantee faster browsing speed, because there are many factors (equipment, network, provider) and if there are no active reservations, you won't notice any change.

Practical recommendation: Don't touch this directive without a reason. If your problem is prioritizing, apply QoS policies well designed; if it's overall performance, check saturation, Wi-Fi quality, ISP offering, drivers and update of Windows.

QoS on the router: when it helps at home

QoS also exists in home routers: it allows prioritizing traffic (for example, streaming or games) and, on some models, limit speed per device. It is useful if there are many devices and saturation; if your network is never congested, activating it does not contribute much and could even worsen the experience if configured incorrectly.

Some routers distinguish between adaptive QoS (with templates and drag and drop), traditional QoS (manual parameters), and per-client bandwidth limiting. Others allow you to classify apps by categories: real-time, priority, and background. On ASUS devices, for example, simply go to “Adaptive QoS” and select the priority; on the FRITZ!Box, go to Internet > Filters > Prioritize, create rules for each device and application.

Operator models may lack QoS. Some Orange Liveboxes, for example, don't offer QoS but do offer parental controls to block certain services (torrent, eMule). If in doubt, check the documentation your router or contact your operator.

The exact route varies by manufacturer, but the logic is the same: define what traffic matters (gaming, streaming, video calls), assign priority, and, if appropriate, set a limit per device so that no one hogs the link when the rest of the house needs bandwidth.

QoS policies in Windows 11 allow you to precisely mark and limit traffic by app, URL, IP, and port; audit what's being applied to each computer or user; and control advanced aspects like the TCP receive window or DSCP override. Combined with a router that offers sensible QoS, they're the best way to prioritize what is important and avoid bottlenecks in environments where the network is really stressed.