Disabling Network export

[cdowgos]

dont care as much about the xml export that can be done from netsh, but is there a way, either in gpedit or registry, to disable the "copy this connection to usb drive"?

our environment has hidden ssid and encryption that only a few people know the key to, we used to deploy and manage via the dell wireless utility, but thats pretty much defunct in Win7

[Tripredacus]

You could use AppLocker to block the ability to run Netsh.exe from any user or group on the computer.

http://technet.microsoft.com/en-us/library...28WS.10%29.aspx

[cdowgos]

the netsh command isnt as much as an issue as the actual copy to usb option, netsh will actually encrypt the key into hex, and when importing STILL asks for key, which is fine by us. but if you export to usb with the option in network, it gives an export with an exe to run, the problem is the export also has a wsettings.txt file that has the key in plain sight

[cdowgos]

since no one can figure this out (and I realize even if we disable export we can still go to properties on the connection and click show password)

can anyone recommend a 3rd party, paid or free, wireless manager that disables wireless zero on w7 and takes it over for security?

Edited February 5, 2010 by cdowgos

[gosh]

why dont u report this to microsoft? Seems like a security bug. Originall Sysprep would store the windows key and users passwords in plain text in sysprep.inf, then with windows xp they encrypted it to avoid users discovering the windows key or users passwords. Seems like they might fix this. Only other option would be to use filemon to see what .dll netsh is using then delete the .dll

[cdowgos]

why dont u report this to microsoft? Seems like a security bug. Originall Sysprep would store the windows key and users passwords in plain text in sysprep.inf, then with windows xp they encrypted it to avoid users discovering the windows key or users passwords. Seems like they might fix this. Only other option would be to use filemon to see what .dll netsh is using then delete the .dll

its not just netsh though, its if you go to the properties on a connection, you export the wireless info or go to security tab and if admin, check a box to show password

[MrJinje]

You should implement MAC filtering to increase your security. Even if they manage to export the SSID + Key, it's worthless without a proper MAC Address.

[cdowgos]

You should implement MAC filtering to increase your security. Even if they manage to export the SSID + Key, it's worthless without a proper MAC Address.

Yeah was just discussing with the CTO about either MAC filtering or issuing certs. Guess thats the only option, was easier for us in XP because we just used the Dell Wireless Utility to manage our networks via the encrypted wpn file.