Loading...

Fixing Throttled Wi-Fi on Windows

Home / Blog / Incident Response

330 Mbps
Baseline, defaults untouched
750+ Mbps
After four adapter changes

A wireless connection that tests well below the plan you're paying for isn't always an ISP problem, and it isn't always a router problem either. More often than either of those, it's Windows itself making conservative power-saving decisions on your behalf, and never telling you it's doing it. The fix lives entirely inside the operating system's adapter settings — no new hardware, no firmware flash, no call to support.

The pattern below is based on a real before-and-after: a laptop sitting a few feet from the router, on a connection rated for gigabit speeds, stuck at roughly a third of that number until four settings were changed one at a time. Each change was measured on its own, so you can see which ones are actually worth your time and which are just good housekeeping.

Before you touch anything, get a real baseline

Test the same way every time, or the numbers won't mean anything.

Run a speed test three times in a row, in the same spot, with other bandwidth-heavy apps and devices quiet. Average the results. Speed test tools open several parallel connections and average across them rather than measuring one steady stream, and the server you land on can vary in distance and load between runs — so a single test is a data point, not a verdict. Note your average, then change one setting, retest, and compare.

Step 1 — Stop the adapter from powering itself down

This is the one that matters most. If you only do one thing, do this.

01

Disable adapter power saving in Device Manager

Windows lets the Wi-Fi radio reduce its own activity and accept more latency in exchange for lower power draw. That trade-off makes sense when a laptop is idle or the lid is closed, but it also quietly applies during active downloads and streaming on plenty of systems, which is where most of the lost bandwidth was coming from in this case.

Open Device Manager → Network adapters, right-click your Wi-Fi adapter, choose Properties → Power Management, and uncheck the box that lets the computer turn the device off to save power. No restart needed — the change applies right away.

Measured result: 330 → 730 Mbps average
If the Power Management tab is missing

Some drivers — Realtek adapters in particular — don't expose this tab at all, which is a common enough complaint that it's worth a fallback path. The registry route works when the GUI option doesn't exist:

  1. Press Win + R, type regedit, and open the Registry Editor.
  2. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power.
  3. Look for a value named CsEnabled.
  4. If it exists, set it to 0. If it doesn't, create a new DWORD (32-bit) value with that name and set it to 0.
  5. Restart the machine for it to take effect.

Registry edits carry more risk than a checkbox in Device Manager, so back up the key first if you're not comfortable editing the registry directly.

Step 2 — Tell the adapter which band to prefer

02

Set a preferred band on dual-band adapters

Windows tends to optimize for signal strength, not speed, which can leave a device sitting on a strong 2.4GHz signal instead of a faster 5GHz one nearby. In practice 2.4GHz tops out around 100–150 Mbps regardless of what the router advertises, while 5GHz can reach close to a gigabit under good conditions.

In the same adapter Properties → Advanced tab, find Preferred Band and set it to 5GHz, or 6GHz if both your router and adapter support Wi-Fi 6E. A separate “Wireless Mode” field showing only legacy 802.11a/b/g options is a leftover compatibility setting on many drivers and generally isn't the thing capping your speed — safe to leave alone.

Measured result: higher peaks, more run-to-run variance

Step 3 — Turn down roaming aggressiveness

03

Lower how eagerly the adapter looks for a “better” connection

This setting decides how often your adapter scans for a stronger access point. High values mean more scanning and a higher chance of hopping between access points; low values mean it stays put until the signal genuinely drops. It's most relevant if you're running multiple access points or extenders on the same network name — a single-router setup may see little change.

Also on the Advanced tab, find Roaming Aggressiveness (sometimes labeled “Roaming sensitivity level”) and set it to the lowest option.

Step 4 — Remove the network throttling ceiling

04

Disable NetworkThrottlingIndex

This one dates back to Windows Vista, added to stop background network traffic from starving audio playback on much older, much slower hardware. It's still on by default, and it caps non-multimedia traffic at roughly 10,000 packets per second — around 120 Mbps on a modern connection. Fixing it doesn't require touching the registry directly; a single command handles it.

Open Terminal or PowerShell as Administrator and run:

netsh interface tcp set global autotuninglevel=normal
Confirms with “Ok” — no restart required

What the combined changes actually looked like

Individually, the power management fix did the heavy lifting. Stacked together, later test runs briefly touched the connection's full 1 Gbps plan limit, and a follow-up batch of five tests averaged around 750 Mbps — more than double the untouched baseline. Some run-to-run variance is normal and expected: real-world 802.11ac/ax throughput typically lands at 40–70% of the negotiated link rate once you account for protocol overhead like contention and acknowledgment frames.

ChangeEffect Adapter power management off330 → 730 Mbps + Preferred band set to 5GHz~765 Mbps avg (variable) + Roaming aggressiveness loweredMinor, setup-dependent + Network throttling disabled~750 Mbps avg, peak 1.0 Gbps

Worth knowing before you start

A couple of caveats worth keeping in mind. First, this only affects Wi-Fi throughput — testing over Wi-Fi and testing your raw internet connection are related but not identical measurements, and a wired connection will usually outperform both if it's available. Second, not every laptop shows this behavior at all; some ship with power management defaults that never throttle active use, so your baseline may already be fine. And once you disable roaming aggressiveness and power saving, expect a very minor hit to battery life and to how gracefully the device hands off between access points — reasonable trade-offs for a machine that's usually plugged in anyway.

Rolling this out to more than one machine?

These same four settings can be scripted and pushed as a standard adapter policy across a fleet rather than fixed one laptop at a time.

Talk to us about endpoint automation

Continue Reading

Infrastructure · June 25, 2025

FreeIPA in the Enterprise

A practical, end-to-end walkthrough of FreeIPA versus Active Directory: installation, hardening, email integration, SSO, web app auth, and how we migrated an existing AD estate without a lights-out weekend.

Agentic Security · September 3, 2026

Staging, Knowledge & Agent Scaling

Skill files as governed policy, a quarantine pipeline for new capability, turning operator notes into skills, and how to scale an agent pool without losing coordination.

Pentesting · August 15, 2026

METATRON Installation & Operator Manual

A consolidated installation and operator manual for METATRON, covering native and Dockerized deployment, local-LLM-assisted reconnaissance, day-to-day operation, troubleshooting, and defensive monitoring.

Penetration Testing · June 26, 2026

Naabu: The Definitive Enterprise Port Scanner

Every flag, every scan mode, and every integration pattern—from high-speed port discovery to CI/CD pipelines and ProjectDiscovery Cloud—for practitioners conducting authorized security assessments.

Agentic Security · August 20, 2026

Multi-Agent AI Red Teams

We ran three autonomous agents against a single target in parallel and watched a terminal dashboard turn a solo operator into something closer to an operations floor.

Pentesting · June 15, 2025

Modern Penetration Testing

A phase-by-phase look at how a structured penetration test actually runs, from scope and reconnaissance through exploitation, post-exploitation, and a report your engineering team can act on.

Threat Hunting · June 20, 2025

svchost.exe Demystified

svchost.exe is one of the most common processes on a Windows endpoint—and one of the easiest for an analyst to misinterpret. Learn why multiple instances are normal, what healthy service-hosting behavior looks like, which telemetry matters, and how to investigate an instance that does not fit the expected pattern.

Endpoint Telemetry · May 20 2026

Windows hidden fingerprint

Windows hidden fingerprint, what the GDID revelation means for defenders

Endpoint Telemetry · July 2026

Windows hidden fingerprint

A federal complaint against an alleged Scattered Spider member surfaced a persistent Windows identifier most security teams have never heard of. Here's how it works, how it survived a VPN, and what defenders can do with that information.

Agentic Security · August 27, 2026

Professional Agent Lab on Kali

How we containerized a multi-agent red-team stack on Kali with Docker Compose, the advanced configuration that made it repeatable, and what it means for red and blue teams.