In enterprise environments, there are compelling security reasons to restrict Wi-Fi connections on domain-joined computers. Automatically blocking wireless connections when wired connections are available, or preventing access to unauthorized wireless networks, represents a critical security measure. This guide covers practical methods for effectively managing Wi-Fi connections using Active Directory Group Policy (GPO).

1. Complete Wi-Fi Blocking with Wireless Network Policy

The most direct approach involves creating an IEEE 802.11 wireless network policy that blocks all Wi-Fi connections.

Configuration Steps

1. Open Group Policy Management Console (GPMC)
   • Run gpmc.msc on the domain controller
   • Create a new GPO or edit an existing one
2. Navigate to Wireless Network Policy Path

   Computer Configuration > Policies > Windows Settings > 
   Security Settings > Wireless Network (IEEE 802.11) Policies
   

3. Create New Policy
   • Right-click “Wireless Network (IEEE 802.11) Policies”
   • Select “Create A New Wireless Network Policy for Windows Vista and Later Releases”
   • Enter policy name (e.g., “Complete Wi-Fi Block”)
4. Configure Network Permissions
   • Select Network Permissions tab
   • Check all the following options:
     • ☑ Block connections to ad-hoc networks
     • ☑ Block connections to infrastructure networks
     • ☑ Allow users to view denied networks (optional)

Policy Application and Verification

2. Smart Blocking with Windows Connection Manager

A more flexible approach that automatically disables Wi-Fi only when Ethernet connections are active.

Basic Policy Configuration

1. Navigate to GPO Editor Path

   Computer Configuration > Administrative Templates > 
   Network > Windows Connection Manager
   

2. Enable Connection Minimization Policy
   • Double-click “Minimize the number of simultaneous connections to the Internet or a Windows Domain”
   • Select Enabled
   • Choose from dropdown options:

Advanced Blocking Policies

Additional policies can be applied for stronger blocking capabilities.

1. Block Non-Domain Networks

   Computer Configuration > Policies > Administrative Templates > 
   Network > Windows Connection Manager > 
   "Prohibit connection to non-domain networks when connected to domain authenticated network"
   

   • Set to Enabled
   • Blocks all external Wi-Fi when connected to domain network
2. Disable Soft Disconnect

   Computer Configuration > Administrative Templates > 
   Network > Windows Connection Manager > 
   "Enable Windows to soft-disconnect a computer from a network"
   

   • Set to Disabled
   • Prevents connection maintenance during network transitions

3. Dynamic Control with PowerShell Scripts

PowerShell scripts can be used alongside GPO for more sophisticated Wi-Fi control.

WLAN Manager Script Deployment

1. Download and Install Script

   # Run PowerShell as Administrator
   Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force
   
   # Download WLAN Manager from GitHub
   # https://github.com/jchristens/Install-WLANManager
   

2. Deploy via GPO Startup Scripts

   Computer Configuration > Policies > Windows Settings > 
   Scripts (Startup/Shutdown) > Startup
   

Network Adapter Control Commands

4. Registry-Based Configuration

For environments where GPO cannot be applied, direct registry modification is possible.

Connection Minimization Setting

Key Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy
Value Name: fMinimizeConnections
Value Type: DWORD (32-bit)
Value Data: 3 (Prevent Wi-Fi when on Ethernet)

REG File Creation and Deployment

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy]
"fMinimizeConnections"=dword:00000003

Wi-Fi control through AD GPO is an effective method for strengthening enterprise security. Depending on your environment, you can choose from various approaches including complete blocking, conditional blocking, or script-based control. After applying policies, always test to verify the impact on business operations and implement exception handling as needed for flexibility.

Related Microsoft Documentation:

• Understanding and configuring Windows Connection Manager
• Wireless Access Deployment