Hayden

In enterprise environments, Bluetooth devices offer convenience while introducing potential security risks. Unrestricted Bluetooth connections can become pathways for data exfiltration, malware infections, and wireless network intrusions. This is why many IT administrators seek to systematically block Bluetooth connections through Group Policy Objects (GPO) in Active Directory (AD) environments. Today, we’ll explore multiple proven methods to effectively block Bluetooth device connections using AD GPO.

 

 

1. Registry Settings via Group Policy Preferences

One of the most common and effective approaches is using GPO’s Group Policy Preferences feature to directly control registry values.

Complete Bluetooth Service Deactivation

Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bthserv

Setting Value Description
Value Name Start Controls service startup type
Value Data 4 Disable service
Value Type REG_DWORD 32-bit integer value

GPO Configuration Path:

  1. Launch Group Policy Management Console
  2. Edit target GPO → Computer Configuration
  3. Preferences → Windows Settings → Registry
  4. Create new registry item

Block Bluetooth File Transfer

Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters

Setting Value Description
Value Name DisableFsquirt Controls file transfer functionality
Value Data 1 Disable file transfer
Value Type REG_DWORD 32-bit integer value

 

 

2. Service Control via System Services

A more direct approach involves using GPO’s System Services policy to disable the Bluetooth Support Service (BthServ).

GPO Configuration Path:

  1. Computer Configuration → Policies
  2. Windows Settings → Security Settings
  3. System Services → Bluetooth Support Service
  4. Set service startup mode to Disabled

This method’s advantage is that it prevents the service from starting altogether, saving system resources.

 

 

3. MDM Policy via PowerShell Scripts

Modern Windows environments allow controlling MDM (Mobile Device Management) policies through PowerShell.

# Must run as System account
$namespaceName = "root\cimv2\mdm\dmmap"
$className = "MDM_Policy_Config01_Connectivity02"

# Disable Bluetooth toggle
New-CimInstance -Namespace $namespaceName -ClassName $className -Property @{
    ParentID="./Vendor/MSFT/Policy/Config"
    InstanceID="Connectivity"
    AllowBluetooth=0
}

AllowBluetooth Value Definitions:

  • 0: Completely disable Bluetooth
  • 1: Allow discovery/advertising only
  • 2: Allow all functionality

GPO Implementation:

  1. Computer Configuration → Policies → Windows Settings
  2. Scripts (Startup/Shutdown) → Startup
  3. Add PowerShell script

 

 

4. Bluetooth Policies via Administrative Templates

Using Windows’ built-in Administrative Templates enables more granular control.

GPO Configuration Path:

  1. Computer Configuration → Administrative Templates
  2. Network → Bluetooth
  3. Enable “Turn off the Bluetooth user experience”

Disable Swift Pair Feature

GPO Configuration Path:

  1. Computer Configuration → Administrative Templates
  2. Windows Components → Device Pairing
  3. Enable “Turn off Swift Pair”

This setting prevents automatic Bluetooth pairing, blocking indiscriminate device connections.

 

 

5. Granular Control via Device Control Policy

In environments with Microsoft Defender for Endpoint, Device Control Policy can selectively block specific Bluetooth services.

Block File Transfer Services Only

Bluetooth service UUIDs to block:

  • 00001105-0000-1000-8000-00805F9B34FB (OBEX Object Push)
  • 00000008-0000-1000-8000-00805F9B34FB (File Transfer)

This method allows Bluetooth headsets, mice, etc., while blocking only file transfers, maintaining both user convenience and security.

 

 

Policy Application and Verification

Force GPO Application

gpupdate /force

Check Policy Application Status

gpresult /r /scope computer

Generate Detailed Policy Report

gpresult /h c:\gpo_report.html /scope computer

 

 

Among the five methods presented, select the most appropriate for your environment and implement gradually. The Group Policy Preferences registry control method is particularly recommended for most environments due to its stability and predictable results. After policy implementation, monitor for unexpected side effects and maintain systems for immediate remediation when necessary.

 

Leave a Reply