Wireless and Connections¶
Settings that control what networks the machine will join and whether it will act as a bridge between them. A laptop that auto-joins open hotspots, or a desktop that shares its connection, is a way into the organization's network from outside it.
Where¶
gpedit.msc → Computer Configuration → Administrative Templates → Network.
The settings¶
| CIS | Setting | Path | Set to | Why |
|---|---|---|---|---|
| 18.6.23.2.1 | Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services | WLAN Service → WLAN Settings | Disabled | The machine won't join an open network on its own. Open hotspots are where traffic gets intercepted. |
| 18.6.21.1 | Minimize the number of simultaneous connections to the Internet or a Windows Domain | Windows Connection Manager | Enabled: 3 = Prevent Wi-Fi when on Ethernet | A machine on the wired network can't also be on Wi-Fi, which would bridge two networks |
| 18.6.11.2 | Prohibit installation and configuration of Network Bridge on your DNS domain network | Network Connections | Enabled | A user can't bridge two adapters and join networks together |
| 18.6.11.3 | Prohibit use of Internet Connection Sharing on your DNS domain network | Network Connections | Enabled | A user can't turn the machine into a router for other devices |
| 18.6.11.4 | Require domain users to elevate when setting a network's location | Network Connections | Enabled | Changing a network from Public to Private (which relaxes the firewall) needs admin rights |
| STIG WN11-CC-000060 | Prohibit connection to non-domain networks when connected to domain authenticated network | Windows Connection Manager | Enabled | A domain machine can't also be on an outside network |
| STIG WN11-00-000230 | Bluetooth: notify when a device attempts to connect (Settings → Bluetooth & devices → Devices → More Bluetooth settings → Alert me when a new Bluetooth device wants to connect) | Settings | On | If Bluetooth is on at all, pairing isn't silent |
| 5.36 | Windows Mobile Hotspot Service | services.msc |
Disabled | The hotspot feature itself. Covered in Services to Disable. |
Apply¶
reg add "HKLM\SOFTWARE\Microsoft\wcmsvc\wifinetworkmanager\config" /v AutoConnectAllowedOEM /t REG_DWORD /d 0 /f
One worked example; the rest are in the table. Type each reg add yourself (the syntax is on The Command Line) and read it back with reg query "<key>" /v <name> before moving on:
| Key | Value | Type | Data |
|---|---|---|---|
HKLM\SOFTWARE\Microsoft\wcmsvc\wifinetworkmanager\config |
AutoConnectAllowedOEM |
REG_DWORD | 0 |
HKLM\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy |
fMinimizeConnections |
REG_DWORD | 3 |
HKLM\SOFTWARE\Policies\Microsoft\Windows\Network Connections |
NC_AllowNetBridge_NLA |
REG_DWORD | 0 |
HKLM\SOFTWARE\Policies\Microsoft\Windows\Network Connections |
NC_ShowSharedAccessUI |
REG_DWORD | 0 |
HKLM\SOFTWARE\Policies\Microsoft\Windows\Network Connections |
NC_StdDomainUserSetLocation |
REG_DWORD | 1 |
HKLM\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy |
fBlockNonDomain |
REG_DWORD | 1 |
Verify¶
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\Network Connections"
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy" /v fMinimizeConnections
Try it¶
- Set the non-domain and hotspot values and find them with
reg query. - On a laptop image, list saved Wi-Fi profiles with
netsh wlan show profiles.
Build it¶
Add these values to tcpip.bat; they're network policy too.