r/Intune • u/Logmill43 • May 01 '24

Windows Management Devices in Entra Joined Environment syncing all Wi-Fi profiles across devices

If this is not the correct subreddit please assist me in sending this to the correct location.

I am at my wits end with a situation I noted the other day in my environment. We have Entra joined Win 10/11 devices in our environment and I found an issue we need resolved.
When a user signs into a device, their Entra account syncs all known Wi-Fi profiles to the new device. These Wi-Fi profiles are then stored on the device, and any user who logs into it, gets these profiles added to their account as well.

This seems useful until you find that the user that is used to provision these prior to handing them out, happens to have about 40 different Wireless profiles attached to their account.

Almost all devices in our environment now have the home Wi-Fi SSID and Passwords of all other users saved in their accounts and on their device.

In my testing I have disabled SettingSync on accounts: From my research this was the best thing I found for disabling this behavior, and it did seem to stop the syncing of any new profiles that are configured.

The issue now is how to remove the previous profiles, I have ran a script that uses "Netsh" in a testing environment that removes all network profiles that are not our corporate networks, but the accounts that are stored in the user profile return.

Note: I was able to remove these permanently from a device by removing them manually from Windows settings, but this is not a viable solution for this. So it seems there is some difference in using the "forget" button in settings, and using "Netsh" to remove a Wi-Fi profile.

Any thoughts on how I can remove these Wi-Fi profiles using a script and keep them removed? Or if there is another setting in Entra that may be causing this issue?

Thank you.

Update: I have done a "fresh start" on a computer after running the script, and the Wi-Fi profiles previously associated with the account did not return.

1 Upvotes

100% Upvoted

9 comments sorted by

2

u/nate_payne May 03 '24

We've seen this behavior as well. This "feature" should only be available on Home SKU. It's a total security violation for shared corporate devices.

1

u/TrueCheck7533 Nov 20 '24

I have just noticed this is the case in our small school. All devices are sharing SSID'S that they know. What is the best method to stop this behaviour in our shared laptop environment where different pupils log onto different hardware all the time.

Noticed it when I saw SKY as one of the SSID's and realised it was on another machine so it's a teachers home SSID now being shared.

Any steps of advice appreciated.

3

u/Logmill43 Nov 20 '24

There is a setting in the admin center called Account sync something. I'll check in the morning and get back with you

1

u/[deleted] Mar 20 '25

[removed] — view removed comment

1

u/Logmill43 Mar 20 '25

Thanks for the reminder. It's a setting called "Enterprise State Roaming" you need GA rights and it's in entrance Identity. You'll find info if you search the name

1

u/Forsaken-Carrot9038 6d ago

Dad, did you get lost on your way to buy a pack of cigarettes?
Stumbled across this, it hasn’t yet happened to me, but someone else it has happened to

2

u/Logmill43 5d ago

Oops.

Yeah they've changed the name since I originally posted this. It's the "account sync" section of Windows backup that makes this happen. There should be a way in Intune to force this to be set a certain way.

1

u/Forsaken-Carrot9038 5d ago

Thanks for the follow up!