Hey folks,
I'm looking for advice on how to effectively block Wi-Fi and Bluetooth on HP machines within our enterprise environment while ensuring that the wired Ethernet stays functional. We manage these devices using Active Directory and Group Policy, and I want a solution that scales across various HP models without requiring constant updates due to changing hardware IDs.
Here's what I need to achieve:
- Disable/block Wi-Fi
- Disable/block Bluetooth
- Ensure wired connections continue to work seamlessly
- Scale across different HP models
- Minimize manual maintenance on our end
I've been exploring options:
1. Blocking by hardware ID seems very precise, but maintaining an updated list for every future HP model could be a logistical nightmare since different devices may have different wireless chipsets.
2. Using class IDs (like `PCICC_0280`) seems to have potential, but is it reliable enough?
3. I'm aware of blocking Bluetooth using class GUIDs, which appears more straightforward.
4. There's also the option of disabling WLAN and Bluetooth services, but I feel like that's more of a workaround than a true solution.
5. Disabling through BIOS or UEFI is off the table.
I'm reaching out for real-world approaches that your teams have successfully implemented. Specifically, I want to know:
- Is the hardware ID method the only reliable way to go through Group Policy?
- Has anyone found success using `PCICC_0280` across multiple devices?
- What do you do about new HP models without constantly having to update policies?
- What layered strategies would you suggest for strong enforcement?
- How effective are WMI filters for targeting HP devices specifically?
I'm looking to gather practical advice from those who've dealt with this in a production setting. Thanks a ton!
4 Answers
Honestly, if you need to block Wi-Fi and Bluetooth on these HP machines, one option could be to disable the services like `wlansrv` and `bthserv` using GPO. This way, users wouldn’t be able to turn them back on easily. There's also a BIOS management tool from HP that can potentially help you disable those adapters directly from Windows. Just a thought!
Blocking hardware ID might seem precise, but it can be tedious given the varying IDs across HP models. Instead, if you have control over the computers physically, using BIOS settings would be the cleanest option. Many enterprises also just remove the Wi-Fi/Bluetooth cards physically if possible, but that's only if you're starting from scratch.
That’s a valid point, but unfortunately, our devices are already in use. I need something that works with what we have!
Given the situation, you might want to consider using a class ID for blocking Wi-Fi like `PCICC_0280`. It may catch various wireless devices but do keep in mind it might not cover everything. Also, you could apply a GPO to steer machines towards an empty Wi-Fi profile to avoid any connections without affecting your wired Ethernet. Just an idea!
You might want to rethink the idea of just software solutions. If you can gain physical access, using HP’s BIOS management tools will allow for bulk adjustments to disable Wi-Fi and Bluetooth. It's usually a set-and-forget solution that saves a lot of hassle!
Definitely looking into the BIOS tool. It might just be the streamlined solution we need!
That sounds promising! I’ll check into that BIOS management tool for sure. My biggest issue is just making it scalable for different models.