---
title: "Set-DbaExtendedProtection"
description: "Configures Extended Protection for Authentication on SQL Server network protocols"
url: "https://dbatools.io/Set-DbaExtendedProtection/"
availability: "Windows only"
tags: ["Instance", "Security"]
author: "Claudio Silva (@claudioessilva), claudioessilva.eu"
source: "https://github.com/dataplat/dbatools/blob/master/public/Set-DbaExtendedProtection.ps1"
last_updated: "2024-01-01"
---

# Set-DbaExtendedProtection

## Synopsis

Configures Extended Protection for Authentication on SQL Server network protocols

## Description

Modifies the Extended Protection registry setting for SQL Server network protocols to enhance connection security. Extended Protection helps prevent authentication relay attacks by requiring additional authentication at the network protocol level.  
  
This security feature is particularly useful in environments where you need to protect against man-in-the-middle attacks or when connecting over untrusted networks. When set to "Required", clients must support Extended Protection to connect, which may require updating older applications or connection strings.  
  
The function modifies Windows registry values directly and requires administrative privileges on the target server. Changes take effect immediately for new connections without requiring a SQL Server restart. This setting requires access to the Windows Server and not the SQL Server instance. The setting is found in SQL Server Configuration Manager under the properties of SQL Server Network Configuration > Protocols for "InstanceName".

## Syntax

```powershell
Set-DbaExtendedProtection
    [[-SqlInstance] <DbaInstanceParameter[]>]
    [[-Credential] <PSCredential>]
    [[-Value] <Object>]
    [[-AcceptedSpn] <String[]>]
    [-EnableException]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

```

## Examples

### Example 1: Set Extended Protection of SQL Engine on the default (MSSQLSERVER) instance on localhost to &quot;Off&quot;

```powershell
PS C:\> Set-DbaExtendedProtection
```

Set Extended Protection of SQL Engine on the default (MSSQLSERVER) instance on localhost to "Off". Requires (and checks for) RunAs admin.  

### Example 2: Set Extended Protection of SQL Engine on the default (MSSQLSERVER) instance on localhost to &quot;Required&quot;

```powershell
PS C:\> Set-DbaExtendedProtection -Value Required
```

Set Extended Protection of SQL Engine on the default (MSSQLSERVER) instance on localhost to "Required". Requires (and checks for) RunAs admin.  

### Example 3: Set Extended Protection of SQL Engine for the SQL2008R2SP2 on sql01 to &quot;Off&quot;

```powershell
PS C:\> Set-DbaExtendedProtection -SqlInstance sql01\SQL2008R2SP2
```

Set Extended Protection of SQL Engine for the SQL2008R2SP2 on sql01 to "Off". Uses Windows Credentials to both connect and modify the registry.  

### Example 4: Set Extended Protection of SQL Engine for the SQL2008R2SP2 on sql01 to &quot;Allowed&quot;

```powershell
PS C:\> Set-DbaExtendedProtection -SqlInstance sql01\SQL2008R2SP2 -Value Allowed
```

Set Extended Protection of SQL Engine for the SQL2008R2SP2 on sql01 to "Allowed". Uses Windows Credentials to both connect and modify the registry.  

### Example 5: Sets the accepted SPNs for Extended Protection without changing the current Extended Protection level

```powershell
PS C:\> Set-DbaExtendedProtection -SqlInstance sql01 -AcceptedSpn "MSSQLSvc/sql01.domain.local:1433", "MSSQLSvc/sql01:1433"
```

### Example 6: Shows what would happen if the command were executed

```powershell
PS C:\> Set-DbaExtendedProtection -SqlInstance sql01\SQL2008R2SP2 -WhatIf
```

### Optional Parameters

##### -SqlInstance

The target SQL Server instance or instances.

| Property | Value |
| --- | --- |
| Alias |  |
| Required | False |
| Pipeline | true (ByValue) |
| Default Value | $env:COMPUTERNAME |

##### -Credential

Allows you to login to the computer (not SQL Server instance) using alternative Windows credentials

| Property | Value |
| --- | --- |
| Alias |  |
| Required | False |
| Pipeline | false |
| Default Value |  |

##### -Value

Specifies the Extended Protection level for SQL Server network protocols. Accepts "Off", "Allowed", or "Required" (or equivalent integers 0, 1, 2).  
Use "Off" to disable Extended Protection, "Allowed" to accept both protected and unprotected connections, or "Required" to enforce Extended Protection for all client connections.  
Defaults to "Off" when not specified. Setting to "Required" may prevent older applications from connecting unless they support Extended Protection authentication.

| Property | Value |
| --- | --- |
| Alias |  |
| Required | False |
| Pipeline | false |
| Default Value | Off |
| Accepted Values | 0,Off,1,Allowed,2,Required |

##### -AcceptedSpn

Specifies the service principal names SQL Server accepts for Extended Protection service binding. Multiple values are stored as a semicolon-delimited registry value.  
When this parameter is supplied without Value, the current Extended Protection level is left unchanged. Pass an empty string to clear the accepted SPN list.

| Property | Value |
| --- | --- |
| Alias |  |
| Required | False |
| Pipeline | false |
| Default Value |  |

##### -EnableException

By default, when something goes wrong we try to catch it, interpret it and give you a friendly warning message.  
This avoids overwhelming you with "sea of red" exceptions, but is inconvenient because it basically disables advanced scripting.  
Using this switch turns this "nice by default" feature off and enables you to catch exceptions with your own try/catch.

| Property | Value |
| --- | --- |
| Alias |  |
| Required | False |
| Pipeline | false |
| Default Value | False |

##### -WhatIf

If this switch is enabled, no actions are performed but informational messages will be displayed that explain what would happen if the command were to run.

| Property | Value |
| --- | --- |
| Alias | wi |
| Required | False |
| Pipeline | false |
| Default Value |  |

##### -Confirm

If this switch is enabled, you will be prompted for confirmation before executing any operations that change state.

| Property | Value |
| --- | --- |
| Alias | cf |
| Required | False |
| Pipeline | false |
| Default Value |  |

## Outputs

**PSCustomObject**

Returns one object per target SQL Server instance containing the Extended Protection configuration that was applied.

**Properties:**

- ComputerName: The computer name where the registry change was made
- InstanceName: The SQL Server instance name (e.g., MSSQLSERVER, SQL2019)
- SqlInstance: The full SQL Server instance name in computer\instance format
- ExtendedProtection: The Extended Protection setting value with human-readable description (e.g., "0 - Off", "1 - Allowed", "2 - Required")
- AcceptedSpns: The accepted service principal names configured for Extended Protection, returned as individual strings

---

Part of [dbatools](https://dbatools.io/), a free and open source PowerShell module for SQL Server administration. Full command index: https://dbatools.io/commands/