Changing WiFi password

[EssentialRug]

Hi all,

 

Can I ask how you go about changing the WiFi password on your networks with lots of end user devices?

 

We use InTune to manage most of our devices...do you push out the new WiFi credentials as a policy and then wait x amount of time for them to grab it and then change? Really don't want to be trudging around manually entering the info...

 

Any best practice advice would be amazing.

 

Thanks!

[Davit2005]

802.1x for managed devices, you don't have to bother then, jus need to deploy the cert to the devices each year before the old one runs out. Edited May 12, 2023 by Davit2005

[EssentialRug]

802.1x for managed devices, you don't have to bother then, jus need to deploy the cert to the devices each year before the old one runs out.

 

Thanks for this...we are largely serverless, do we need a RADIUS server for this?

[Davit2005]

Thanks for this...we are largely serverless, do we need a RADIUS server for this?

 

Yes but you can host in the cloud if need be. It depends how many devices you are talking about but it is the best option security wise as no PSK is needed. I'm using MPSK at home running freeradius on a few docker hosts, each device gets a complex pre-shared key. The issue you are always going to have is the security of that key that is where radius has the advantage plus more. A PSK per device or user is still probably better than one PSK though.

Edited May 12, 2023 by Davit2005

[jthompson]

Perhaps deploy an additional new SSID, keeping the original in service for a period of time that's suitably long enough for clients to use it to be able to pull down the new SSID details.

[EssentialRug]

Yes but you can host in the cloud if need be. It depends how many devices you are talking about but it is the best option as no PSK is needed. I'm using MPSK at home running freeradius on a few docker hosts, each device gets a complex pre-shared key. The issue you are always going to have is the security of that key that is where radius has the advantage plus more. A PSK per device or user is still probably better than one PSK though.

 

That's great...I think once we go completely serverless and inevitably have a lot more devices on site this is something we will definitely look to implement.

[EssentialRug]

Perhaps deploy an additional new SSID, keeping the original in service for a period of time that's suitably long enough for clients to use it to be able to pull down the new SSID details.

 

Brilliant...this was my first thought. Suppose I could hide the new SSID as to not cause any confusion until we are ready to decommission the original.

Edited May 12, 2023 by EssentialRug

[mavhc]

yeah, new ssid, wait until your stats say no one is using the old one.

 

netsh wlan set profileorder name="NETWORK-PROFILE-NAME" interface="YOUR-INTERFACE-NAME" priority=1

[EssentialRug]

yeah, new ssid, wait until your stats say no one is using the old one.

 

netsh wlan set profileorder name="NETWORK-PROFILE-NAME" interface="YOUR-INTERFACE-NAME" priority=1

 

Any way in InTune I can set priority of the SSID joined so I can say use the new one first and fallback to the original?