GPO: Disable WiFi when computer is connected to LAN with wire

Question

Is anyone of you know how to disable, thru a GPO, the Wireless connection as soon as the computer is connected to the LAN with a wire.

By example, a user is at home with his laptop, connected to his home wifi connection. He leaves and comes to the office but the Wifi is still enabled. He plugs the ethernet cable in the computer and then, both wifi and wire connection are enable.

I would like to apply a GPO that does this...

Thanks a bunch!

Answer 1

I haven't found any GPO that does that but I found a script that... does it!

Let me know what you think if that could be good:

---

... So you've gone through the trouble of setting up a rock-solid firewall. You have your routers implementing some pretty rigid switch-port security settings to only allow certain MACs on the network... you feel you've got your office on lockdown....

... and then some user leaves his Wireless card on which is in range of a couple insecure networks, and suddenly your network's security rests in the confidence of that single PC's access instead of your firewalls etc. This isn't just an issue of interface priority so your user can still function - this is a potential vulnerability in your network!

Some vendors (like Dell etc) make some device-specific tools to facilitate this, but what if you have a mixed network or what if that vendor doesn't provide a mass-auditing tool to disable wireless cards while connected to the LAN?

Let's dive into a possible logon script to disable any wireless network card!

Collect/Share the Necessary Tools (devcon, qgrep)

The script requires devcon ( http://support.microsoft.com/kb/311272 ) and qgrep from the Windows 2k3 Resource Kit ( http://www.microsoft.com/downloads/details.aspx?FamilyID=9D467A69-57FF-4AE7-96EE-B18C4790CFFD&displaylang=en )

Devcon is a command-line utility for Device Manager. We'll be using Devcon to query our hardware and to disable or enable it.

Qgrep is a grep-like tool from the windows resource kit. We'll be using it to search for the line number of our wireless card's hardware ID (outputted from devcon).

So grab these two files and place them on a network-accessible server share (for this how-to, I'm going to be using \FileServer\Script$\ as the location devcon and qgrep are saved to.

Create our Script Here's the sample script in its entirety... discussion and explanation will follow. Be aware that line-breaks may happen unintentionally from copy/pasting

---

@echo off

rem - Copying Command Line Device Manager to clients... 
IF NOT EXIST %SystemRoot%\System32\devcon.exe copy \\FileServer\Script$\devcon.exe %SystemRoot%\System32\devcon.exe

rem - Copying QGrep tool to clients... 
IF NOT EXIST %SystemRoot%\System32\qgrep.exe copy \\FileServer\Script$\qgrep.exe %SystemRoot%\System32\qgrep.exe

devcon hwids =net > "%userprofile%\devconout.txt" 
qgrep -n -y "wireless" "%userprofile%\devconout.txt" > "%userprofile%\qgrepout.txt"

FOR /F "tokens=1* usebackq delims=:" %%a in ("%userprofile%\qgrepout.txt") do set /a WirelessLine=%%a+1 & goto Locate 
goto Cleanup

:Locate 
echo ID Located on line %WirelessLine%

FOR /F "tokens=1* usebackq skip=%WirelessLine% delims=: " %%z in ("%userprofile%\devconout.txt") do set WirelessHID="%%z" & goto Shutdown 
goto Cleanup

:Shutdown 
echo ID is %WirelessHID% 
devcon disable %WirelessHID%

:Cleanup 
del /q "%userprofile%\qgrepout.txt" 
del /q "%userprofile%\devconout.txt" 
echo Done!

---

Step-By-Step Explanation

I'm not a scripting guru... I usually just keep banging my head against a wall until they work. I'm certain there is probably a more efficient or effective way to script this - and I'll happily append/change the script in deference to some comments! So if you see a better way to accomplish these steps, speak up!

Let's dive it to the examination:

@echo off

rem - Copying Command Line Device Manager to clients... 
IF NOT EXIST %SystemRoot%\System32\devcon.exe copy \\FileServer\Script$\devcon.exe %SystemRoot%\System32\devcon.exe

rem - Copying QGrep tool to clients... 
IF NOT EXIST %SystemRoot%\System32\qgrep.exe copy \\FileServer\Script$\qgrep.exe %SystemRoot%\System32\qgrep.exe 

This section is checking whether our client machine already has qgrep and devcon. If not, it copies them from our server share into the system32 folder of the client. Pretty simple stuff, but we want the check to ensure we're not constantly copying files needlessly to clients.

Next up:

devcon hwids =net > "%userprofile%\devconout.txt" 
qgrep -n -y "wireless" "%userprofile%\devconout.txt" > "%userprofile%\qgrepout.txt" 

We need some writeable space (our script is going to output a couple intermediate text files), so we're assuming our user's home directory is writeable.

The Devcon line is asking for a profile of all net associated hardware IDs. We're outputting this to devconout.txt in our user's home directory. Next up we ask qgrep to find any line with the word "wireless" (regardless of capitalization, which is the -y flag) and output the line numbers (the -n flag) and lines to qgrepout.txt

Next up: our favorite command line beast: the For command!

FOR /F "tokens=1* usebackq delims=:" %%a in ("%userprofile%\qgrepout.txt") do set /a WirelessLine=%%a+1 & goto Locate 
goto Cleanup 

This is asking the for command to crawl through our qgrepout file (which, if you'll recall, begins with the line numbers). We use the set /a flag so we can perform arithmetic on the first variable FOR finds (in our case, the line number).

So we add 1 to the line number and call it our "Wireless Line" variable. Because we want to disable the first instance of any hardware that calls itself "wireless", we jump to the locate function to avoid subsequent wireless drivers etc from overwriting our WirelessLine variable.

Finally, if qgrepout is empty and FOR never matches a line (the client PC doesn't have any hardware that calls itself wireless) we jump to the cleanup function.

Next, let's examine the "Locate" function:

:Locate 
echo ID Located on line %WirelessLine%

FOR /F "tokens=1* usebackq skip=%WirelessLine% delims=: " %%z in ("%userprofile%\devconout.txt") do set WirelessHID="%%z" & goto Shutdown 
goto Cleanup 

You can nuke the echo line, I just wanted to see what line number we're jumping to so I could troubleshoot the script... regardless, the For command is going to skip to the WirelessLine we've had qgrep identify and grab the hardware ID (we're calling it WirelessHID... and we're putting it in quotes to aid our devcon disable command down below). Then we jump away with a goto command before the for command can set the WirelessHID to the next token it finds.

Now that we've found a hardware ID associated with the work wireless, let's shut it down!

:Shutdown 
echo ID is %WirelessHID% 
devcon disable %WirelessHID% 

Again the echo command isn't necessary, but it is nice to see what's being asked of devcon. So after all that work of locating the first reference to wireless in device manager and finding it's associated HID. the actual disable command isn't that tough. Just be certain the HID is surrounded by quotes, or you could find yourself fast disabling more than you bargained for:)

Finally, the cleanup stage (optional):

Cleanup 
del /q "%userprofile%\qgrepout.txt" 
del /q "%userprofile%\devconout.txt" 
echo Done! 

This step just deletes the two files we created. You probably don't want to clean up the two text files we wrote to when you're first testing the script (you can use these in your test lab to verify proper devcon output and qgrep identification).. but I figure the less clutter in the user's home directory, the better.

1. Create an "Enable" script (optional) You may wish to re-enable their wireless card at logoff... the same script will work word-for-word after changing the:

   devcon disable %WirelessHID%

to:

devcon enable %WirelessHID% 

Conclusion

This script comes with many caveats... first off, if we knew the hardware ID of the wireless cards, this script is vastly simplified – just devcon disable the specific hardware ID.

Second, this script only looks for the first hardware ID that names itself something including the word wireless... now, this works for a vast majority of cases, but you'll likely need to exercise some judgment and do some testing on your own.

Third, the script is only written with concern for one wireless device… multiple wireless hardware devices (is there a case for this?) would require editing the script.

Fourth, access rights should be considered any time you’re scripting something. Does the script have access to enable/disable items from control panel? When you’re adding it to group policy or whatever, ensure proper security/permissions across the board.

Hopefully you’re at least introduced to two potent tools: devcon and qgrep… and can see how something as seemingly complicated as disabling any wireless card when logging in to your LAN may be scriptable (without paying for a third-party product or relying on device manufacturers)

Answer 2

.. or you do it the easy way and configure network metrics. Make a GPO to set ethernet metrics to some number, like 50, then set wireless metrics to 100 (or whatever number that is higher than ethernet) and, voila, if an ethernet connection exists, your computer will use it instead of using wireless.

Answer 3

There is a utility that can change the Network Adapter Binding Priority in Windows. The WLAN can have a higher priority than LAN, but with this utility you can change that, even in a managed environment (since it is a command line utility)!

http://archive.msdn.microsoft.com/nvspbind

Example: put the LAN NIC on the top of the binding order for IPv4: nvspbind.exe /++ "Local Area Connection" ms_tcpip

Example: put the LAN NIC on the top of the binding order for IPv6: nvspbind.exe /++ "Local Area Connection" ms_tcpip6