What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Intune’s firewall policy includes a setting named “Firewall IP sec exemptions allow router discovery.” Despite how it looks, it is not a switch that turns off Internet Router Discovery Protocol (IRDP). It exempts router-discovery traffic from IPsec processing. The Windows control that turns off IPv4 ICMP router discovery is a different setting, RouterDiscoveryEnabled. Microsoft documents that setting for Windows unattended configuration, not as an Intune policy. This article separates the three related settings so you don’t ship the wrong one.
The three settings people confuse
| Setting | What Microsoft documents | Limit |
|---|---|---|
IPv4 RouterDiscoveryEnabled |
Controls ICMP router discovery on an interface. false disables it, and false is the documented default (Microsoft Learn). |
It comes from the Windows unattended-setup reference. That reference doesn’t say Intune exposes it or supports a particular delivery method. |
IPv6 RouterDiscoveryEnabled |
Controls IPv6 Neighbor Discovery. false disables it, and true is the documented default (Microsoft Learn). |
It is a separate setting from IPv4 IRDP. |
| Intune firewall IPsec exemption for router discovery | Lets router-discovery traffic bypass IPsec as an exemption (Intune firewall settings; also listed in Windows endpoint-protection settings). | It permits traffic. It does not disable the protocol. |
Why the Intune firewall setting is the wrong tool
IPsec exemptions decide which traffic skips IPsec rules. Enabling the router-discovery exemption makes that traffic easier to pass. Leaving it unset doesn’t turn router discovery off on the host. Treating it as a hardening control could leave IRDP exactly as it was. It could also change IPsec behavior in ways you didn’t intend.
As an Amazon Associate I earn from qualifying purchases.
Why disable IRDP at all
The CIS Microsoft Windows Server 2012 R2 Benchmark v2.20 describes the PerformRouterDiscovery setting as controlling whether IRDP detects and configures default gateway addresses automatically. It flags a potential denial-of-service concern (CIS benchmark PDF). That is a benchmark rationale for one older Windows Server release. It isn’t a measured incident rate, and it doesn’t show that every network faces the same exposure. The underlying idea is simple. A device that accepts gateway information from the network can be told to use the wrong gateway. Fixing the gateway through DHCP or static configuration removes that dependency.
What is and isn’t established for Intune
- Microsoft documents the Windows setting’s behavior and defaults.
- Microsoft’s Intune firewall reference documents only the IPsec exemption, not an IRDP-disable control.
- The sources I could cite do not name an Intune policy path, a supported Windows version range, or a supported deployment method (Settings catalog, script, or custom policy) for changing IPv4 IRDP. I won’t invent one.
A safe way to approach it
- Check the default first. The documented IPv4 default is already
false. Many devices may need no change. Audit the actual state on a sample of devices before building a policy. - Look for a native setting. In the Intune admin center, create a Windows 10 and later profile with the Settings catalog. Use the setting picker to search for “router discovery” and “PerformRouterDiscovery”. Use a native setting only if your tenant lists one, and read its description to confirm it targets IPv4 IRDP and not the IPsec exemption.
- Pilot before broad assignment. If you rely on any non-native method, test it on a small device group. Confirm the interface setting is applied and that connectivity, VPN and DHCP still behave as before.
- Leave IPv6 alone unless you mean it. Turning off IPv6 router discovery affects IPv6 Neighbor Discovery. That is a different change with different risks, so give it its own review.
- Don’t touch the firewall exemption. Leave “allow router discovery” at its default unless your IPsec design specifically needs that traffic exempted.
Where the real protection lies
Disabling a host-side discovery feature is one layer. Network-side controls cover the larger picture: a trusted DHCP source, switch-level protections, and network segmentation. Whether you need to act on IRDP depends on whether your environment depends on it, and on your compliance baseline. If you follow a CIS benchmark, apply the version that matches your Windows release rather than the 2012 R2 document cited here.
Quick Recap
Rank #3
- WINDOWS 11 | STABLE PERFORMANCE: Powered by Intel Celeron N4020 processor and Windows 11 system, this laptop delivers stable performance for everyday computing tasks. It supports web browsing, online learning, document editing, email communication, and basic office work with optimized power efficiency, providing a practical and reliable experience for essential daily use for daily use.
- 15.6” FHD IPS DISPLAY: Features a 15.6-inch Full HD IPS display with narrow bezels, offering wider viewing angles and clearer image details compared to standard panels. The improved screen-to-body ratio enhances visual experience for study, reading, document work, and video playback, making it suitable for both productivity and entertainment use.
- 4GB DDR4 + 128GB eMMC STORAGE: Equipped with 4GB DDR4 memory and 128GB eMMC storage for everyday basics such as browsing, documents, email, and online learning platforms. The built-in TF card slot supports storage expansion up to 1TB, giving you more flexibility for files, photos, videos, and daily documents. TF card not included.
- CONNECTIVITY & PORTS: Includes 1× TF card slot, 2× USB 3.2 Gen1 ports, and 2× full-featured Type-C ports (USB 3.2 Gen1). The Type-C ports support data transfer, charging, and video output, enabling flexible connection with external devices such as monitors, storage, and peripherals for daily work and study use.
- LIGHTWEIGHT DESIGN | ONLINE COMMUNICATION: Designed with a slim, portable profile, this laptop is easy to carry for school, commuting, and travel. A built-in 1MP front camera supports online classes, video meetings, remote communication, and everyday conferencing. The 3300mAh battery works with the low-power system design to support practical daily use, while thermal optimization helps maintain quieter operation during extended tasks.
Rank #2
- 256 GB SSD of storage.
- Multitasking is easy with 16GB of RAM
- Equipped with a blazing fast Core i5 2.00 GHz processor.
#1 Best Overall
- 14" diagonal, 1366x768 resolution, HD BrightView LED, Glossy NON-TOUCH Display
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
