Connect Only to Corporate SSID if in Range — Without Cisco NAM

[MSN]

We have a customer who wants laptops to only connect to the corporate Wi-Fi. If the corporate SSID is in range.

This worked well with Cisco AnyConnect NAM, but now they need to use the native Windows supplicant..

Is there a way to do this without NAM? Maybe using GPO or a script?

[Arne Bier]

I don't know if this is the same thing, but in Windows 10/11 you can re-order your SSID's in "preferred order" - I have never tested this but it looks promising. Change Wi-Fi Network Connection Priority Order in Windows 11 | Windows 11 Forum

Then the question is, how to set that via GPO/MDM etc. Should be doable.

[JPavonM]

@Arne Bier said you can prioritize Windows to connect to your corp SSID when in range, but users can manually change if the want, no way to prohibit that except if you deny this in the GPOs, but that will make to not connect to any SSID out of the office.

[JPavonM]

Additionally, by tunning this settings in RegEdit you can avoid simultaneous connectiosn to wire and wireless, and even bridging connections between wire and wireless to another network.

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy
## simultaneous to different domains
fBlockNonDomain == 1
## simultaneous to wire/wireless
fMinimizeConnections = 3   <== wire is preferred (https://learn.microsoft.com/en-us/windows-hardware/drivers/mobilebroadband/understanding-and-configuring-windows-connection-manager#windows-10-version-1809-build-17763404-and-later)

If you like simultaneous connections, please review this https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/connectivity-issues-multiple-default-gateways

[MSN]

The requirement is that if the corporate SSID is in range, the laptop should automatically connect to it, and users must be restricted from manually connecting to any other SSID. If the corporate SSID is not in range, users should be free to connect to any available SSID of their choice. Wired connectivity is not part of our deployment.

[Leo Laohoo]

---

@MSN wrote:
The requirement is that if the corporate SSID is in range, the laptop should automatically connect to it, and users must be restricted from manually connecting to any other SSID. If the corporate SSID is not in range, users should be free to connect to any available SSID of their choice.

---

There is a rule missing:  When Corp SSID is present, users are not allowed to connect to the Guest SSID name BLAH.  

We have this rule and it is all managed via GPO.