WiFi + GP policy updates + UNC Path hardening

[mrbios]

Struggling this one, wonder if anyones found a solution beyond disabling UNC path hardening...

 

Windows 10 and 11 devices on WiFi won't gpupdate. Event log records an error 1058 on gpupdate /force. Error description contains "Network access is denied".

 

Essentially I'm seeing the exact issues highlighted here which have been ongoing since 2015:

https://learn.microsoft.com/en-us/archive/msdn-technet-forums/6a20e3f6-728a-4aa9-831a-6133f446ea08

 

The last comment on that thread said disabling netbios fixed their issue. I've disabled netbios on all adapters (Been doing that by default for years) and that doesn't resolve the issue.

 

As soon as i remotely connect to a laptop, change the registry keys for UNC path hardening, restart, then group policies update perfectly. Restart again once UNC path hardening is enabled change a GP and the machine fails to pick it up again.

 

My group policy settings contain the same settings as the minimum recommended configuration as outlined here:

https://support.microsoft.com/en-us/topic/ms15-011-vulnerability-in-group-policy-could-allow-remote-code-execution-february-10-2015-91b4bda2-945d-455b-ebbb-01d1ec191328

 

Anyone tackled this issue before and found a solution or workaround without disabling UNC path hardening?

 

EDIT:

new development.... gpupdate works fine when i'm on a PSK WiFi SSD. The issue appears to be specific to a deployed wireless profile utilising radius!

Edited September 24, 2024 by mrbios