intune wifi key visibile

[mrstrong]

just coming back to investigate intune (again), so far I've got a win 11 laptop (usb clean install) through autopilot and into intune

(user driven enrollment (standard user). First thing I've tried to do is connect wifi:

    manage devices , configuration, create policy , windows 10 and later , templates, wifi 
    WPA/WPA2-Personal etc then assigned to computer security group

 

Works fine but then I noticed from a standard cmd prompt

 

netsh wlan show profile name="OurSSID" key=clear

 

reveals they key  

 

is this expected ? is there a way to hide it or a better/more secure way to deploy wifi ?
(please don't say use radius 😁)

[CHiLL]

The same command in Windows natively shows the key in clear text, so I think it's just by design. 

 

On a somewhat related note, I discovered today that by default Intune will sync user and system settings, which includes not only user settings but also WiFi profiles. This has meant that while we are preparing the student laptops using our global admin account, it is automatically importing all saved WiFi profiles from that account, which included some very relaxed filtering networks. Luckily, these laptops are only for use at home so are not used within school...but it's still concerning.

 

I had to enable the setting "Allow Sync My Settings" from the Settings Catalog section in Intune and toggle the option to "Block", then assign that to the user group containing our admin accounts.

[speakercon]

I thuought it only shows the key if cmd is run as admin?

 

Could you just disallow cmd for users?

[MYK-IT]

1 minute ago, speakercon said:

I thuought it only shows the key if cmd is run as admin?

 

Could you just disallow cmd for users?

 

@mrstrong is possibly running netsh as (local) administrator, based on below

1. Use AppLocker or Windows Defender Application Control (WDAC)

   • Create rules to block netsh.exe or restrict it to admin users only.

2. Deploy Wi-Fi Profiles as Device-Based (Not User-Based)

   • This limits visibility and access to the profile settings for standard users.

[FN-GM]

This isn't an InTune specific thing, it's like this on Windows 10 & 11 (maybe 8 as well).

 

Use Radius / WPA Enterprise - that would be the way to go outside of small deployments.

[DrCheese]

Issue with WPA/radius with intune is you can't use Windows NPS with it to authenticate machines - It's incredibly annoying that Microsoft still don't have an answer for this, beyond their crazy expensive cloud radius.

[Davit2005]

Not jus windows but other devices allow wifi key sharing. The only secure method is to use WPA enterprise. MPSK where you have a different PSK for each device might be possible if your WiFi supports it but still not as good as WPA enterprise. And anything based on MAC address could be problematic due to random MAC addresses. MAC addresses can still be spoofed.

[DrCheese]

19 minutes ago, Davit2005 said:

Not jus windows but other devices allow wifi key sharing.

Yes that's very true - Both iOS and MacOS allows the user to view all saved wifi passwords & it will auto try to share them with mutual contacts, eg If a friend comes to my house & we're in each others contacts, it will offer to share my Wifi password with them - Same applies when out in public with WiFi one of us has saved in device.

 

Wouldn't surprise if me windows does something similar in time.

 

[speakercon]

Yes iOS lets users view the key, unless depoyed through an MDM then it doesn't (in our case anyway).

 

For andriod devices managed in Intune there is 'Wi-Fi setting changes' which I have set to 'Block' which stops the key being viewed.

[MYK-IT]

2 hours ago, DrCheese said:

Issue with WPA/radius with intune is you can't use Windows NPS with it to authenticate machines - It's incredibly annoying that Microsoft still don't have an answer for this, beyond their crazy expensive cloud radius.

 

Agree, very annoying.

 

I have just enabled and starting 'testing' Access Manager (available via Meraki Early Access Program section on our Dashboard) connected to Entra ID.

 

Looks promising, however...

 

Quote

 

Note: Access Manager is currently in early access preview and will be rolled out to customer organizations in phases. During this period, there will be no licensing enforcement (free trial for all organizations). Licensing details for general availability will be shared soon.

 

Once it is available on your organization, you can participate in a free trial by opting-in to Access Manager on Early Access page  (Organization > Early Access). 

 

 

So, certainly not rolling out until licensing costs are known!

[Koldov]

For me it only shows when running CMD as an admin...

 

 

It's also restricted to admin going through the 'Network and Sharing Centre' > Connections > Wireless Properties > Security > Show Characters - Can you see it there on Win 11...?

 

EDIT: Windows 10 though and not an InTune device, so is that the problem...?

Edited June 20, 2025 by Koldov

[FN-GM]

19 hours ago, DrCheese said:

Issue with WPA/radius with intune is you can't use Windows NPS with it to authenticate machines - It's incredibly annoying that Microsoft still don't have an answer for this, beyond their crazy expensive cloud radius.

 

You can use WPA Enterprise with InTune / Radius - We do it for all our devices. 

This issue is with Windows NPS? There is a limitation in NPS that means the computer has to be Azure AD joined. But using another Radius product such as FreeRadius or Cisco ISE and it will work.

Edited June 21, 2025 by FN-GM

[RobFuller]

What setup are you using @FN-GM?

Have been looking over this recently and pondering if they is a promising idea or not - https://tech.nicolonsky.ch/radius-aad-joined-devices/

Edited June 23, 2025 by RobFuller

[FN-GM]

33 minutes ago, RobFuller said:

What setup are you using @FN-GM?

Have been looking over this recently and pondering if they is a promising idea or not - https://tech.nicolonsky.ch/radius-aad-joined-devices/

 

We use Cisco ISE and permit devices with a valid certificate issued by our certificate authority. The certificates are issued to devices using SCEP. Certificates are only issued to devices that are enrolled.