diff --git a/control/controlclient/direct.go b/control/controlclient/direct.go
index 94d2a75e8..2977ece67 100644
--- a/control/controlclient/direct.go
+++ b/control/controlclient/direct.go
@@ -553,6 +553,9 @@ func (c *Direct) sendMapRequest(ctx context.Context, maxPolls int, cb func(*netm
 	if health.RouterHealth() != nil {
 		extraDebugFlags = append(extraDebugFlags, "warn-router-unhealthy")
 	}
+	if health.NetworkCategoryHealth() != nil {
+		extraDebugFlags = append(extraDebugFlags, "warn-network-category-unhealthy")
+	}
 	if len(extraDebugFlags) > 0 {
 		old := request.DebugFlags
 		request.DebugFlags = append(old[:len(old):len(old)], extraDebugFlags...)
diff --git a/health/health.go b/health/health.go
index a00116a75..a8253f19c 100644
--- a/health/health.go
+++ b/health/health.go
@@ -56,6 +56,12 @@ func SetRouterHealth(err error) { set("router", err) }
 // RouterHealth returns the wgengine/router.Router error state.
 func RouterHealth() error { return get("router") }
 
+// SetNetworkCategoryHealth sets the state of setting the network adaptor's category.
+// This only applies on Windows.
+func SetNetworkCategoryHealth(err error) { set("network-category", err) }
+
+func NetworkCategoryHealth() error { return get("network-category") }
+
 func get(key string) error {
 	mu.Lock()
 	defer mu.Unlock()
diff --git a/wgengine/router/ifconfig_windows.go b/wgengine/router/ifconfig_windows.go
index fdfbccf69..ab41ea0b7 100644
--- a/wgengine/router/ifconfig_windows.go
+++ b/wgengine/router/ifconfig_windows.go
@@ -21,6 +21,7 @@ import (
 	"golang.org/x/sys/windows"
 	"golang.zx2c4.com/wireguard/windows/tunnel/winipcfg"
 	"inet.af/netaddr"
+	"tailscale.com/health"
 	"tailscale.com/net/interfaces"
 	"tailscale.com/net/tsaddr"
 	"tailscale.com/wgengine/winnet"
@@ -272,6 +273,7 @@ func configureInterface(cfg *Config, tun *tun.NativeTun) (retErr error) {
 		const tries = 20
 		for i := 0; i < tries; i++ {
 			found, err := setPrivateNetwork(luid)
+			health.SetNetworkCategoryHealth(err)
 			if err != nil {
 				log.Printf("setPrivateNetwork(try=%d): %v", i, err)
 			} else {