Control bandwidth usage with QoS policies in Windows 11

Controlling network usage in Windows 11 isn't just about speed; it's about ensuring that important applications take priority when the connection becomes congested. Quality of Service (QoS) policies allow you to flag and limit outgoing traffic so that critical applications, such as VoIP or video, don't experience interruptions or latency spikes.

Much of the confusion stems from old myths about Windows "reserving" bandwidth and reducing your speed. In reality, QoS in Windows 11 combines DSCP flagging and policy-based throttling . It's applied via Group Policy to users or computers and can filter by app, URL, IP address, and port. Furthermore, it offers advanced options such as TCP receive window control and DSCP flag override, ensuring only your policies take precedence.

What is QoS in Windows and why you might care

In Windows, the QoS policy combines standards-based QoS with GPO management, allowing you to apply rules from Active Directory without manually accessing each computer. The system supports two key controls: DSCP flagging (0–63) , useful for routers and access points to prioritize queues, and rate limiting to restrict specific outbound traffic.

Routers interpret DSCP to determine the queue for each packet; thus, your organization can define queues such as "latency sensitive," "control," "business critical," "best effort," or "bulk transfers" and route accordingly. With the throttling component, a QoS policy can restrict the outgoing bandwidth of an application or service to X KB/s or MB/s, which is especially useful in WANs with costs or SLAs.

Before you start: Key concepts (DSCP and limitation)

DSCP, defined in RFC 2474, uses the TOS field in IPv4 and the traffic class in IPv6 to mark packets with values ​​from 0 to 63. Windows computers can mark outgoing traffic with a specific DSCP value, and your routers and Wi-Fi access points will use that value to classify and queue the packets correctly.

Throttling is independent of the markup: a QoS directive can, for example, set a DSCP value of 46 for VoIP and at the same time limit a file server to 512 KB/s on port 443. Both controls can be combined or used separately depending on your strategy.

Where the directives live and to whom they apply

QoS policies must have unique names and can be created at both the computer and user levels. In the Group Policy Object Editor (GPOE), you'll find them under Computer Configuration > Windows Settings > QoS Policy and User Configuration > Windows Settings > QoS Policy . Computer-level policies apply regardless of the logged-on user, while user-level policies apply wherever that user logs on.

For these policies to take effect, remember to link the GPO with the QoS policies to the corresponding AD DS container (domain, site, or organizational unit ). The GPO with the highest priority will prevail if there are policy name conflicts .

How to create a QoS policy in Windows 11 step by step

To create it, edit a GPO from the Group Policy Management Console (GPMC). In the tree, right-click the QoS Policy node and choose "Create a new policy." The wizard consists of four pages that define the profile, scope, addresses, and protocols/ports.

Wizard (page 1): Policy Profile

On this screen, you assign a unique name and decide whether to enable DSCP, limit flow, or both. You can enable Specify DSCP value with a value between 0 and 63, and/or Specify rate limiting with units in KB/s or MBps (the value must be > 1).

1. In "Policy name”, indicates a clear and unique identifier to recognize the policy.
2. Activate "Specify DSCP value"If you want it marked, enter a number between 0 and 63 for the priority.
3. Activate "Specify limiting speed” If you want to contain the flow rate, select KB/s or MBps and a valid value.
4. Click on "Next” to continue with the scope of application.

Assistant (page 2): Application name

Decide whether the policy applies to all applications , to a specific executable (ending in .exe), to a complete path (which may include environment variables such as %ProgramFiles%), or to HTTP server applications that respond to a specific URL.

• "All applications”: The policy for page 1 applies to all matching traffic on subsequent pages.
• "Only applications with this executable name”: type, for example, MyApp.exe to delimit by binary.
• "Only HTTP server applications that respond to this URL”: Restricts web traffic to specific servers.

The URL must conform to RFC 1738, with format http[s]://<hostname>:<port>/<url-path>. Wildcards are allowed.*"only by completely replacing hostname I port (for example, https://training.* o https://*.*), but not as substrings (they are not valid https://my*site/ ni https://*training*/). In addition, you can check “Include subdirectories and files" for what https://training also cover https://training/video.

1. Choose whether this policy applies to “All applications” or “Only applications with this executable name.”
2. If you choose executable, provide a valid .exe; if you prefer path, include the full path (with variables if applicable).
3. Click on "Next” to pass to source/destination IP addresses.

Wizard (page 3): IP addresses

Here you can restrict by source and/or destination IP address, allowing addresses or prefixes . If you choose "Only for the following IP address", you can enter:

• IPv4: for example 192.168.1.1 or prefix 192.168.1.0/24.
• IPv6: for example 3ffe:ffff::1 or prefix 3ffe:ffff::/48.

If you set both, the source and destination must be the same type of address (both IPv4 or both IPv6). If you specified an HTTP server URL on the previous page, the source IP will be grayed out (it belongs to the HTTP server and is not configured here), although you can customize the destination to differentiate clients.

1. Under “This QoS policy applies to (source)”, select “Any IP address” or “Only the following source address.”
2. If you restrict source, enter a valid IPv4/IPv6 or prefix to precisely narrow down the source. the legal end.
3. Under “This QoS policy applies to (destination)”, choose “Any address” or “Only the following destination address.”
4. If you restrict the destination, use an IPv4/IPv6 or prefix of the same type as the one defined in the source to avoid inconsistencies.
5. Click on "Next” to define affected protocols and ports.

Wizard (page 4): Protocols and Ports

Defines whether the policy applies to TCP, UDP or both, and if you narrow down by source/destination ports. You can leave “any”, a single port, or a interval with the format Bajo:Alto (without spaces), where both ends are between 1 and 65535.

1. In “Select the protocol…”, choose TCP, UDP o TCP and UDP to cover the right type of traffic.
2. In “Specify the source port number”, leave “From any port” or define a specific port/range.
3. If you define interval, use the format 1000:2000 without spaces; it is the correct way to indicate ranges.
4. In “Specify the destination port number”, leave “In any port” or adjust to one or a specific range.
5. Ends with “Finalize”; the new policy will appear in the GPO editor pane ready to be linked.

After creating it, remember to link the appropriate GPO to the domain, site, or OU so that computers and users receive the configuration . Without the link, the policy will not be applied.

View, edit, delete, and audit QoS policies

To review or change a policy, right-click its name in the GPO editor. Selecting " Properties " will display the following tabs: Policy Profile, Application Name, IP Addresses, and Protocols and Ports, which exactly mirror the pages in the wizard.

If you need to change it, use " Edit existing policy "; to remove it, use "Delete policy". It's advisable to periodically audit using GPMC (Group Policy Management Console) reports to see which QoS policies are effective on a computer or user, their DSCP, limits, conditions, and the prevailing GPO.

In the results view, when multiple policies with the same name exist in different GPOs, the policy with the highest priority is applied. The other conflicting policies with lower priority are not applied. This report makes it easier to identify what is actually in effect and whether there are any overlaps.

QoS Policy Priority Rules

For outbound TCP/UDP traffic, only one QoS policy can be applied at a time; there are no cumulative effects (for example, limitations do not stack ). To resolve conflicts, the policy with the most specific conditions prevails , according to these rules:

• User vs. team level: A user policy wins over a computer policy when they match on the same traffic.
• Application vs. quintuple- A policy that identifies the app (especially with a full path) is more specific than one based only on quintuple; if several still apply, the first one is compared. quintuple.
• Inside the quintuple: : matters the specificity and priority order of fields.

The network quintuple consists of: source IP address, destination IP address, source port, destination port, and protocol (TCP/UDP). If two policies match, the one that specifies more fields or a more specific value takes precedence. Within the quintuple, the order of priority is: source IP address > destination IP address > source port > destination port > protocol. For example, 192.168.4.1 has higher priority than 192.168.4.0/24.

Practical examples: If policy_A specifies app.exe and policy_B defines destination 192.168.1.0/24, when app.exe sends to an IP address within that range, policy_A applies because it is more specific . If policy_C covers destination 10.0.0.1 and TCP "any" and policy_D covers destination 10.0.0.1:80 TCP, when compared to 10.0.0.1:80, policy_D wins due to its greater specificity.

Advanced QoS Settings

In addition to policies, Windows includes a computer-level " Advanced QoS settings " section. Accessed from Computer Configuration > Windows Settings > QoS Policy > Advanced QoS settings, it offers two tabs: Incoming TCP traffic and DSCP override.

Incoming TCP traffic (receive window)

This option limits TCP reception performance on the receiver by adjusting the advertised window. Modern Windows dynamically sizes up to 16 MB (compared to 64 KB in older versions), and here you can set the maximum size for growth: 0 = 64 KB, 1 = 256 KB, 2 = 1 MB, 3 = 16 MB . The actual size will be less than or equal to the maximum depending on the conditions.

1. In the GPO editor, enter the “Advanced QoS Settings".
2. Activate “Configure TCP receive throughput” and select the level desired (0–3) depending on your environment.
3. Link the GPO to the target OU to apply control on TEAM.

DSCP Marking Invalidation

This option restricts applications from setting their own DSCPs. If you define " Ignore ," apps that use QoS APIs will have their DSCPs forced to 0, leaving the setting exclusively to your policies . By default, Windows allows apps to set DSCPs; this feature gives you complete control when you need consistency.

DSCP and WMM values ​​in Wi-Fi

The Wi-Fi Alliance defines WMM with four access categories: VO (voice), VI (video), BE (best effort), and BK (background). Broadly speaking, DSCP ranges are associated as follows: 48–63 → VO , 32–47 → VI, 24–31 and 0–7 → BE, 8–23 → BK. By setting DSCP according to these classes, laptops with WMM-certified Wi-Fi adapters and compatible access points will correctly prioritize your traffic.

Mobile scenarios, VPNs and servers

The purpose of these policies is to manage traffic on the company network. In mobile (laptop) scenarios, they are only enabled on interfaces connected to the corporate network, such as the VPN interface when connecting from a coffee shop; the physical Wi-Fi interface will not apply QoS while it is not connected to the company network.

In server workloads, the scenarios change: a server with multiple NICs might be at the perimeter, and the IT department will want to limit outbound traffic even if that NIC doesn't "perceive" the link as corporate. For this reason, QoS policies are always enabled on all interfaces in Windows Server .

Supported Systems and Locations in GPMC

Policy-based QoS is applicable across a wide range of operating systems: Windows 11/10 and modern versions of Windows Server, as well as Windows 8.x, 7, and Vista . On servers, in the Group Policy Management Editor, you can navigate to: “Default Domain Policy\Computer Configuration\Policies\Windows Settings\ Policy-based QoS ” or the user equivalent.

By default, there are no policies configured; you define the DSCP value and the bandwidth limits per application, IPs, ports and protocol , and you implement the granularity you need per user/computer through the GPO infrastructure you already manage.

Advantages of policy-based QoS

Compared to doing it on switches or routers, policy-based QoS gives you a higher level of detail (including user level), flexibility regardless of whether you connect via Wi-Fi or Ethernet, and a layer of security by being able to mark IPs before encrypting with IPsec, something impossible to classify later on intermediate devices.

It also adds performance by bringing the limitation closer to the source (where it works best) and improves manageability: you can manage policies from a single domain controller and also use URLs to group servers in a cluster under a common address without chasing individual IPs.

Limit bandwidth by application or port

A typical example is configuring a file server to never exceed X KB/s on port 443, or conversely, ensuring a VoIP app receives a high DSCP (for example, 46 ) so network equipment places it in low-latency queues. All of this is achieved without the app needing to be programmed against QoS APIs: your directives operate below the application layer.

The myth of “reservable bandwidth” in Windows

The idea that Windows "reserves 20% of the bandwidth" and that using gpedit will improve speed has been circulating for years. The reality is that Windows uses 100% of the bandwidth unless an app explicitly requests it via QoS. Even when an app requests bandwidth but doesn't use it, other applications can continue to use that bandwidth.

That said, there is the directive “Limit reservable bandwidth” in QoS Packet Scheduler (Administrative Templates), which some tutorials recommend enabling and setting to 0%. You can open gpedit.msc, go to Computer Configuration > Administrative Templates > QoS Packet Scheduler, edit the policy, enable “Enabled” and set “Bandwidth Limit (%)” to 0. Note: this does not guarantee faster browsing speed, because there are many factors (equipment, network, provider) and if there are no active reservations, you won't notice any change.

Practical recommendation: Don't change this policy without a reason. If your problem is prioritization, apply well-designed QoS policies ; if it's overall performance, check network congestion, Wi-Fi quality, ISP offerings, drivers , and Windows updates.

QoS on the router: when it helps at home

QoS is also available on home routers: it allows you to prioritize traffic (for example, streaming or gaming) and, in some models, limit speed per device . It's useful if you have many devices and the network is congested; if your network is never congested, enabling it doesn't offer much benefit and could even worsen the experience if configured incorrectly.

Some routers distinguish between adaptive QoS (with templates and drag-and-drop functionality), traditional QoS (manual parameters), and bandwidth limiting per client. Others allow you to categorize apps: real-time, priority, and background . On ASUS devices, for example, simply go to "Adaptive QoS" and choose the priority; on FRITZ!Box, go to Internet > Filters > Prioritize, and create rules per device and application.

Some carrier-specific models may lack QoS. For example, some Orange Livebox routers don't offer QoS but do have parental controls to block certain services (torrents, eMule). If you're unsure, check your router 's documentation or contact your carrier.

The exact route varies by manufacturer, but the logic is the same: define what traffic matters (gaming, streaming, video calls), assign priority, and, if necessary, set a limit per device so that no one hogs the link when the rest of the house needs bandwidth.

QoS policies in Windows 11 allow you to precisely mark and limit traffic by app, URL, IP address, and port; audit what's being applied to each computer or user; and control advanced aspects like TCP receive windowing or DSCP override. Combined with a router that offers sensible QoS, they're the best way to prioritize what's important and avoid bottlenecks in high-traffic environments.