1

Is it possible to stop someone from changing the MAC address of a Windows machine using GPOs?

5
  • 3
    On Windows I believe it requires administrator rights anyway. Don't give your users admin rights and you should be safe. Of course, if MAC spoofing is a risk it suggests there's a bigger problem somewhere else. – André Borie Jul 14 '16 at 12:54
  • Don't have any network interfaces and you won't be able to change their MACs. – iAdjunct Jul 14 '16 at 13:10
  • 1
    Do you know how MAC's are spoofed on windows? finding the answer out for that question may help you with this one ;) – Sighbah Jul 14 '16 at 13:20
  • @Sighbah no I don't know how they are spoofed on Windows, but I've seen how easy it is to do on Linux. (But ya do have to be root!) – leeand00 Jul 14 '16 at 13:21
  • Haha im not sure either tbh never really had a reason to do it on a windows machine. Having a quick google it seems this is achieved by changing the network address on the adapter properties, so rolling out a GPO with restricition to the adapter properties either in the user or machine policy would probably restrict the ease this can be done. – Sighbah Jul 14 '16 at 13:41
3

(There may be network cards which use a fixed MAC address, but I've not yet heard of them.)

As the comments suggest, an Administrator account in Windows can adjust the MAC address, as well as the IP address. A non-administrator account cannot. So, if you do not trust the user, or want to reduce the risk of viruses, you should certainly run a non-administrator account.

However, with physical access to the machine, there are many possible ways to bypass the user account controls, and gain administrator access anyway. Properly securing a machine when someone has physical access is quite complex and depends on the specific requirements.

And besides that, could someone just unplug the network cable and plug it into a a separate device for which they have root access?

The best thing to do would be to have a middle-man device which controls the traffic. For example, with a Managed Switch, each PC can be plugged into a separate port. The physical port number can be tied to a specific IP address and MAC address requirement.

Besides a proper Managed Switch, many Routers, or small computers with multiple ethernet ports have the ability to enforce such restrictions.

(Finally, were you to use a Proxy or NAT, then the MAC address would be reset in that way, but this is probably not what you are looking for.)

4
  • Actually, a proxy is exactly why I'm interested in this. I'm filtering internet access with pfSense. – leeand00 Jul 14 '16 at 15:06
  • 1
    If you use a Proxy, why do you care what the MAC address is? Is it to control whether they get access to the Proxy? – 700 Software Jul 14 '16 at 15:18
  • 1
    It's to control which users get to access which sites at which times...I'm aware that there's probably a way to do this with usernames too but I'm not there yet. – leeand00 Jul 14 '16 at 15:21
  • 1
    Don't use MAC addresses for any sort of access control - it's really not a strict identifier – Rory Alsop Jul 14 '16 at 18:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.