Network Creation Flags

StifleR can automatically create a Network (location) the first time a client connects from a new subnet. The Network Creation Flags setting controls when this is allowed.

This is a more granular alternative to the basic AutoAddLocations on/off switch. Where AutoAddLocations simply turns automatic network creation on or off, Network Creation Flags let you allow — or block — automatic creation based on specific connection criteria.

How it works

In the configuration tool, each flag is a checkbox: enable it to turn that behavior on, leave it unchecked to turn it off. There's no manual value to calculate — just check the flags you want active.

Each flag either allows a network to be created when the client's connection matches it, or filters (blocks) matches based on specific conditions.

A network is created when the client's connection matches at least one of the checked "allow" flags, and is not stopped by a checked filter flag.

Flags reference

Flag	What it does
iPXE (1)	Allow WinPE / iPXE clients (e.g. during OS deployment) to create networks.
ManagedNetwork (2)	Allow networks where Windows has detected a domain controller.
VPN (4)	Allow VPN clients to create networks; these are created as VPN networks.
DomainAuthenticatedNetwork (8)	Allow networks where the client has authenticated against the domain.
AuthenticatedNetwork (16)	Allow networks that Windows classifies as a Domain network.
AcceptedNetworkName (32)	Allow networks whose Windows network name matches the Accepted network names setting.
SuperNet (64)	Automatically link new subnets to a network group that has a matching SuperNet range.
WiFiAllowList (128)	Allow networks when the client is connected to an SSID in the List of allowed Wi-Fi SSIDs setting.
PowerShell (256)	Allow networks when your custom AllowNewLocation.ps1 script returns true.
WiFiAllowListSeen (512)	Reserved for future use; currently has no effect.
DirectRoute (1024)	Allow networks when the client reaches the server without NAT (same internal and external IP).
AllowVirtualDuplicates (2048)	Accept virtual router MAC addresses (HSRP/VRRP) when matching clients to existing networks.
QueryClients (4096)	If the gateway MAC does not match, check other online clients on the subnet before treating it as a new network.
AllowInternetNetworks (8192)	Allow clients with a public IP address to create networks.
IgnoreNATChecks (16384)	Treat every client as directly routed. Use when a proxy or load balancer sits in front of the server.
OnlySecureWiFiAllowed (32768)	Block Wi-Fi networks that do not use 802.1X authentication.
DHCPAndDNSServerSameAsGateway (131072)	Block networks where the gateway is also the DHCP and DNS server — typical for home routers.
DHCPAndDNSServerSame (262144)	Block networks where the same server provides both DHCP and DNS.