Prevent tethering to mobile phone...

[Koldov]

Looking through the connection log of a couple of teacher's laptops I noticed some SSIDs that caused me a little concern such as:

 

AndroidAP

 

Rebecca?s iPhone

 

I know that they can connect to any network they want outside of school, I am only concerned that if connected whilst at school it obviously bypasses filtering.

 

I have used GPO to disable the 'Hotspot' option but if I have read correctly this only stops other devices using the laptops connection and not the other way round.

 

Now, before before this thread is inundated with posts about AUPs and 'this is a management issue', I would like to say that I am just asking if anyone knows a technical solution and the rest I can deal with thanks...

[OLPTech]

Hi I'm not sure if this will help but they way we have it to restrict users from connecting to certain networks is to create a GPO and under Wireless Network Policies we have defined a network name and set the permission to deny

 

Hope this helps

[SpaceInvader83]

You can just have an allow list only for SSID's, by enabling the Prevent connection to adhoc networks and then adding Allowed Networks (In the above policy posted by Liam).

[Koldov]

Thanks!

 

If I'm reading correctly, you need to know the name of the SSID you're denying... also, the names of SSIDs to allow?

Edited November 16, 2021 by Koldov

[OLPTech]

I believe if you only wanted to allow the schools WIFI you can tick the boxes "prevent connections to infrastructure networks" and prevent connections to ad-hoc networks" and put the schools SSID into the allowed list that would work. The way we have it setup (in the screenshot) is we allow all networks excluding the one that is marked as Deny which is our BYOD network.

 

I've found a nice little guide here (it says Windows 7 but still applies to Windows 10) https://www.grouppolicy.biz/2010/03/how-to-use-group-policy-to-blackwhite-list-wireless-networks-in-vista-windows-7/

 

Cheers

[Koldov]

Unfortunately I'm not sure this will work for us as they do actually take the laptops home, to training sessions at the LEA and to other schools.

 

Limiting or only allowing certain SSIDs isn't going to be an option, unless I can apply the GPO or some other network restriction at school and reliably remove it when off-site.

[3s-gtech]

If you use AoVPN, you can have it so that the filtering is applied both on and offsite. If they tether, it'll connect to the VPN and direct traffic through the filter (where set to do so).