I'm creating an Intune-based process to move users from an old Wi-Fi network to a replacement network. A detection script checks the currently connected SSID and triggers a remediation when the device is still using the old network. The remediation runs `netsh wlan connect name="NewSSID"`.
The target Wi-Fi profile already exists on every endpoint, including the user certificate needed for authentication, and it is configured to connect automatically when in range. However, the command succeeds inconsistently—roughly 7 out of 10 test devices fail. It often works only after the user opens the Wi-Fi settings and scans for nearby networks. Another manually configured PSK network also has automatic connection enabled and sometimes appears to take priority. What is the most reliable way to switch profiles or configure the profile priority?
4 Answers
If the Wi-Fi profile is already installed, `netsh wlan connect name="NewSSID"` should work without the user opening the Wi-Fi interface. If it does not, verify that the profile name exactly matches the stored profile and that the target SSID is actually visible and in range. Also check the WLAN AutoConfig event logs for authentication, certificate, or profile errors rather than relying only on the command’s output.
This is usually better handled through Intune Wi-Fi and certificate policies instead of a PowerShell remediation. Deploy the replacement profile with automatic connection enabled, confirm the certificate is installed in the correct user or computer store, and remove or disable the old profile once migration is complete. Certificate-based Wi-Fi can fail if the profile’s authentication settings do not match the certificate deployment.
The manually added PSK profile may be winning because Windows prefers it based on profile order, signal strength, or connection history. Set the new profile to a higher priority, lower the old profile’s priority, and disconnect before allowing Windows to reconnect. For example: `netsh wlan set profileorder name="NewSSID" interface="Wi-Fi" priority=1`, then set the old profile to a lower priority and run `netsh wlan disconnect`. Make sure the interface name matches the device.
A successful `netsh wlan connect` command does not necessarily mean the device connected; it can only mean that Windows accepted the request. Capture the command output and query `netsh wlan show interfaces` afterward to confirm the actual SSID and state. Testing whether the new SSID appears in `netsh wlan show networks` can also distinguish a profile problem from a radio, range, or scanning problem.
The profile name and SSID are correct, and the profile is present on all the test devices. The failure seems to happen mainly when the device has not recently scanned for nearby networks.