Wireless and Connections¶
Settings that control what networks the machine will join and whether it will act as a bridge between them. A laptop that auto-joins open hotspots, or a desktop that shares its connection, is a way into the organization's network from outside it.
Where¶
gpedit.msc → Computer Configuration → Administrative Templates → Network.
The settings¶
| CIS | Setting | Path | Set to | Why |
|---|---|---|---|---|
| 18.6.23.2.1 | Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services | WLAN Service → WLAN Settings | Disabled | The machine won't join an open network on its own. Open hotspots are where traffic gets intercepted. |
| 18.6.21.1 | Minimize the number of simultaneous connections to the Internet or a Windows Domain | Windows Connection Manager | Enabled: 3 = Prevent Wi-Fi when on Ethernet | A machine on the wired network can't also be on Wi-Fi, which would bridge two networks |
| 18.6.11.2 | Prohibit installation and configuration of Network Bridge on your DNS domain network | Network Connections | Enabled | A user can't bridge two adapters and join networks together |
| 18.6.11.3 | Prohibit use of Internet Connection Sharing on your DNS domain network | Network Connections | Enabled | A user can't turn the machine into a router for other devices |
| 18.6.11.4 | Require domain users to elevate when setting a network's location | Network Connections | Enabled | Changing a network from Public to Private (which relaxes the firewall) needs admin rights |
| STIG WN11-CC-000060 | Prohibit connection to non-domain networks when connected to domain authenticated network | Windows Connection Manager | Enabled | A domain machine can't also be on an outside network |
| STIG WN11-00-000230 | Bluetooth: notify when a device attempts to connect (Settings → Bluetooth & devices → Devices → More Bluetooth settings → Alert me when a new Bluetooth device wants to connect) | Settings | On | If Bluetooth is on at all, pairing isn't silent |
| 5.36 | Windows Mobile Hotspot Service | services.msc |
Disabled | The hotspot feature itself. Covered in Services to Disable. |
Apply¶
reg add "HKLM\SOFTWARE\Microsoft\wcmsvc\wifinetworkmanager\config" /v AutoConnectAllowedOEM /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy" /v fMinimizeConnections /t REG_DWORD /d 3 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Network Connections" /v NC_AllowNetBridge_NLA /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Network Connections" /v NC_ShowSharedAccessUI /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Network Connections" /v NC_StdDomainUserSetLocation /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy" /v fBlockNonDomain /t REG_DWORD /d 1 /f
Verify¶
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\Network Connections"
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy" /v fMinimizeConnections