Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I am looking for suggestions to implement a group policy that gives the control to administrator of domain to allow or disallow a user whenever he/she connects to the wifi network. Is there any way i can do this?
For example, a person in my organization wants to connect to an unsecure/secure wifi. When he/she connects, a prompt or a message will be given to admin to either allow or disallow the access.
There is no such feature included in the operating system for sure. Your idea is also not really practicable for a variety of reasons. First of all you would need a secured data channel which is available all the time to give you the possibility to communicate with these laptops (which you don't have) and you would also need to be approachable 24/7 which you will likely not be.
You can whitelist and blacklist specific WLANs by group policy as described in this article. The problem there is that it relies on the SSID (The Name) of the given wireless network which is by no means unique or reliable.
You may want to try some type of captive portal solution. You could have people register and then be granted access based on the review of the form.
You may want to set it up where the registration is on a restricted network so if there is a compromise of the captive portal network they do not get onto the "real" wi-fi network. You could then assign the user a certificate or use some other method to grant them access to the "real" network.
This would probably not be a "domain" thing in terms of Windows, but you would have some type of admin interface and workflow.
You may want to research more on Network Admission Control.
If you want to whitelist / blaclist SSIDs, there is group policy for that:
However, if you want people remote to phone home everytime they connect to a random wifi network that may be impractical. You may instead want to consider some type of forced VPN solution back to your network, that way even though they are on the random network they can only connect once they are back on the corporate VPN. You may run into issues with some of these solutions when people are traveling and they can't get onto the wi-fi network unless they clear a captive portal, but you may find a solution that has a sandbox browser that allows captive portal registration before forcing the VPN connection.
