Detections
Analytics
18.5.21.2 Ensure 'Minimize the number of simultaneous connections to the Internet or a Windows Domain' is set to 'Enabled: 3 = Prevent Wi-Fi when on Ethernet'
Warning! Audit Deprecated
This audit has been deprecated and will be removed in a future update.
View Next Audit VersionInformation
This policy setting prevents computers from establishing multiple simultaneous connections to either the Internet or to a Windows domain.The recommended state for this setting is: Enabled: 3 = Prevent Wi-Fi when on Ethernet.
Rationale:
Preventing bridged network connections can help prevent a user unknowingly allowing traffic to route between internal and external networks, which risks exposure to sensitive internal data.
Impact:
While connected to an Ethernet connection, Windows won't allow use of a WLAN (automatically or manually) until Ethernet is disconnected. However, if a cellular data connection is available, it will always stay connected for services that require it, but no Internet traffic will be routed over cellular if an Ethernet or WLAN connection is present.
Solution
To establish the recommended configuration, set the following Device Configuration Policy to Enabled: 3 = Prevent Wi-Fi when on Ethernet:To access the Device Configuration Policy from the Intune Home page:
Click Devices
Click Configuration profiles
Click Create profile
Select the platform (Windows 10 and later)
Select the profile (Administrative Templates)
Click Create
Enter a Name
Click Next
Configure the following Setting
Path: Computer Configuration\Network\Windows Connection Manager
Setting Name: Minimize the number of simultaneous connections to the Internet or a Windows Domain
Configuration: Enabled: 3 = Prevent Wi-Fi when on Ethernet
Select OK
Continue through the Wizard to complete the creation of the profile (profile assignments, applicability etc.)
Note: More than one configuration setting from each of the Configuration profiles (ex: Administrative Templates, Custom etc.) can be added to each Device Configuration Policy.
Default Value:
Enabled: 1 = Minimize simultaneous connections. (Any new automatic internet connection is blocked when the computer has at least one active internet connection to a preferred type of network. The order of preference (from most preferred to least preferred) is: Ethernet, WLAN, then cellular. Ethernet is always preferred when connected. Users can still manually connect to any network.)
See Also
Item Details
References: CSCv7|15.5
Plugin: Windows
Control ID: c862cd308141068b2ce44392cad022511ab302e962a3732095a145792c76dc67