-1

We are trying to apply a SSID Restriction policy for computers where i work.

We created a GPO which applies to computers in an specif OU without any security or WMI filters

We want the computers to see only 2 specifics SSID when they are at work(i.e. are connected to the bussines network where DC's are)

But we want these computer to be able to connect to other networks when the carry their laptops to their homes.

So since the GPO is applied to computers even if they log in with a local account they cant see other SSIDs.

What we were thinking was that maybe there is a way of turning on or off the policy when the pc is connected to the network or maybe to restrict the policy to be applied to the computer only when the user logged in is a domain user not a local user.

Summing up we want to restrict SSIDs access when laptops are in workplace but to be able to see other networks when they are not

Thanks.

2 Answers 2

1

How does the computer recognize it's in the office? If connected by LAN, you probably would not need something like that. Otherwise they would know, if the office Wifi network is detected. In that case, tell the computer to connect to it when it is discovered.

Does that fulfill your needs?

  1. Open the Active Directory GPO in the Group Policy Object Editor.
  2. Expand Computer Configuration, Windows Settings, Security Settings, and then click Wireless Network (IEEE 802.11) Policies.
  3. Right-click Wireless Network (IEEE 802.11) Policies and then click Create A New Windows Vista Policy. The Wireless Network Properties dialog box appears.
  4. To add an infrastructure network, click Add and then click Infrastructure to open the Connection tab of the New Profile Properties dialog box. In the Network Names list, click NEWSSID and then click Remove. Then, type a valid internal SSID in the Network Names box and click Add. Repeat this to configure multiple SSIDs for a single profile. If the network is hidden, select the Connect Even If The Network Is Not Broadcasting check box.
  5. On the New Profile Properties dialog box, click the Security tab. Use this tab to configure the wireless network authentication and encryption settings. Click OK.

These settings will configure client computers to connect automatically to your internal wireless networks and not to connect to other wireless networks.

Source https://technet.microsoft.com/en-us/magazine/gg266419.aspx

1
  • Thanks for your answer, but this problem is for laptops using wireless. since what we need is that when Laptops are in the workplace they should only see SSID A but when they take their laptops to their homes they should be able to see all other networks, because if they dont they can´t connect Feb 4, 2016 at 20:34
-1

Group Policy can be set for local accounts or domain accounts, normally the domain account takes precedence over the local policy. But here is an article that should help.

How to prevent domain Group Policies from applying to certain user or computer accounts. https://support.microsoft.com/en-us/kb/816100

Group Policy Precedence: h t t p s //technet .Microsoft . com/en-us/library/cc785665(v=ws.10) .aspx

2
  • I've read that and wasn't helpfull, anyway i did a Rsop with my local account and the wireless policy(applied by the domain gpo) was being applied to the computer so i couldn´t make the computer to not to apply the gpo. Since this policy if for computers not users i think it will be impossible so solve Feb 4, 2016 at 20:38
  • @Francisco Fernandez Cecchetto maybe this will help. social.technet.microsoft.com/Forums/windows/en-US/… If they are still off lan you can't just disable the Group Policy because they won't see it, but all group policies do is change registry keys for the user so identify the registry key and you can create a .reg file that can be applied to reverse the group policy. As soon as they are on the lan group policy will take over and put back.
    – StixO
    Feb 4, 2016 at 21:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .