How to disable "View Wi-Fi Security Key" option for end user devices

Question

How to disable "View Wi-Fi Security Key" option for end user devices

Zeeshan Bute 95

Hi All, How can I disable the "View Wi-Fi Security Key" option for end-user devices through Intune? Deleting the registry key HKEY_CLASSES_ROOT\AppID{86F80216-5DD6-4F43-953B-35EF40A35AEE} only encrypts the password from Advanced Wi-Fi Network properties. Here's an image of the option I'm referring to: User's image

Zeeshan Bute 95 Reputation points

2024-01-18T07:33:40.11+00:00

Hey, Thanks, is there any way where we can restrict this view option to end-user devices? Thanks ZB
Zeeshan Bute 95 Reputation points

2024-01-18T10:14:27.1533333+00:00

@Pavel yannara Mirochnitchenko How to remove admin rights for those users from Intune? because I have 500+ users in the Azure active directory. Thanks ZB

Safak AYDIN 5

@Zeeshan Bute I don't know if you've found a solution since, but using the following article as an example: https://learn.microsoft.com/en-ie/answers/questions/1633038/windows-11-23h2-view-wi-fi-security-key

I have created a Powershell script that modifies the permissions of this button to pop-up a UNC :

# If not present, create PSDrive "HKCR"
New-PSDrive -Name "HKCR" -PSProvider Registry -Root "HKEY_CLASSES_ROOT" -ErrorAction SilentlyContinue
# Path of the register key
$registryPath = "HKCR:\AppID\{86F80216-5DD6-4F43-953B-35EF40A35AEE}"
# Get ACL of the register key
$acl = Get-Acl -Path $registryPath
# Remove all the rules
$acl.SetAccessRuleProtection($true, $false)
$acl.Access | ForEach-Object { $acl.RemoveAccessRule($_) }
# Add the group "SYSTEM"
$groups = "SYSTEM"
# Create an ACL for the group "SYSTEM"
$permission = $groups, "FullControl", "Allow"
$accessRule = New-Object System.Security.AccessControl.RegistryAccessRule($permission)
# Set ACL for rules
$acl.SetAccessRule($accessRule)
# Add group "Administrateur" as Owner
$acl.SetOwner([System.Security.Principal.NTAccount]"Administrators")
# Set ACL
Set-Acl -Path $registryPath -AclObject $acl

Zeeshan Bute 95 Reputation points

2024-04-30T06:42:18.1266667+00:00

@Safak AYDIN Hi,

Thanks for your consideration on this.

Could you please guide me more with your PowerShell script? and how I will perform and also if you can help with the steps to deploy this script.

Thanks

ZB
Safak AYDIN 5 Reputation points

2024-04-30T07:32:22.9733333+00:00
Hi @Zeeshan Bute

I think that the rights to the registry key "HKCR:\AppID{86F80216-5DD6-4F43-953B-35EF40A35AEE}" are configured so that domain users can read and modify the value,

I therefore remove all the defined groups and simply leave the "SYSTEM" group (top right on Windows).

As a result, only administrator accounts will have the right to read the Wifi password,

As far as deploying the script is concerned, if you have an in-house RMM system, it's easy to run the script on several workstations at once.

If you don't have such a system, I recommend either creating a GPO for deployment, or deploying via psexec or PDQ Deploy, which offers 2 weeks' free use.
fedthans hamann 1 Reputation point

2024-09-11T10:29:37.5266667+00:00

try to delete the string in page regedit but i get the error as you can see
I have also try the script error occur - run with admin right

4 answers

Your answer

Zeeshan Bute 95 Reputation points

2024-01-18T07:33:40.11+00:00

Hey, Thanks, is there any way where we can restrict this view option to end-user devices? Thanks ZB
Zeeshan Bute 95 Reputation points

2024-01-18T10:14:27.1533333+00:00

@Pavel yannara Mirochnitchenko How to remove admin rights for those users from Intune? because I have 500+ users in the Azure active directory. Thanks ZB
Safak AYDIN 5 Reputation points

2024-04-24T13:51:12.57+00:00

@Zeeshan Bute I don't know if you've found a solution since, but using the following article as an example: https://learn.microsoft.com/en-ie/answers/questions/1633038/windows-11-23h2-view-wi-fi-security-key

I have created a Powershell script that modifies the permissions of this button to pop-up a UNC :

# If not present, create PSDrive "HKCR" New-PSDrive -Name "HKCR" -PSProvider Registry -Root "HKEY_CLASSES_ROOT" -ErrorAction SilentlyContinue # Path of the register key $registryPath = "HKCR:\AppID\{86F80216-5DD6-4F43-953B-35EF40A35AEE}" # Get ACL of the register key $acl = Get-Acl -Path $registryPath # Remove all the rules $acl.SetAccessRuleProtection($true, $false) $acl.Access | ForEach-Object { $acl.RemoveAccessRule($_) } # Add the group "SYSTEM" $groups = "SYSTEM" # Create an ACL for the group "SYSTEM" $permission = $groups, "FullControl", "Allow" $accessRule = New-Object System.Security.AccessControl.RegistryAccessRule($permission) # Set ACL for rules $acl.SetAccessRule($accessRule) # Add group "Administrateur" as Owner $acl.SetOwner([System.Security.Principal.NTAccount]"Administrators") # Set ACL Set-Acl -Path $registryPath -AclObject $acl
Zeeshan Bute 95 Reputation points

2024-04-30T06:42:18.1266667+00:00

@Safak AYDIN Hi,

Thanks for your consideration on this.

Could you please guide me more with your PowerShell script? and how I will perform and also if you can help with the steps to deploy this script.

Thanks

ZB
Safak AYDIN 5 Reputation points

2024-04-30T07:32:22.9733333+00:00

Hi @Zeeshan Bute

I think that the rights to the registry key "HKCR:\AppID{86F80216-5DD6-4F43-953B-35EF40A35AEE}" are configured so that domain users can read and modify the value,

I therefore remove all the defined groups and simply leave the "SYSTEM" group (top right on Windows).

As a result, only administrator accounts will have the right to read the Wifi password,

As far as deploying the script is concerned, if you have an in-house RMM system, it's easy to run the script on several workstations at once.

If you don't have such a system, I recommend either creating a GPO for deployment, or deploying via psexec or PDQ Deploy, which offers 2 weeks' free use.
fedthans hamann 1 Reputation point

2024-09-11T10:29:37.5266667+00:00

try to delete the string in page regedit but i get the error as you can see
I have also try the script error occur - run with admin right

Answer 1

Pavel yannara Mirochnitchenko 13,331 MVP

@Zeeshan Bute you can use my script: https://github.com/yannara/Intune/blob/main/RemoveLocalAdmin.ps1 Assign it to users.

Answer 2

Pavel yannara Mirochnitchenko 13,331 MVP

This is very interesting finding. We don't use certificate based Wifi anymore, but pre-shared password is stored in Intune policy. I didn't know that it can be viewed from Windows. But, good news is that viewing the password requires admin rights, so we are partly safe from that :)

Answer 3

Pavel yannara Mirochnitchenko 13,331 MVP

@Zeeshan Bute by removing local admin rights from users for sure :)

Answer 4

fedthans hamann 1

@Safak AYDIN Hey Safak
try to delete the string in page regedit but i get the error you can see also try the script error occur

User's image

Safak AYDIN 5 Reputation points

2024-09-11T12:12:49.6333333+00:00

@fedthans hamann Have you checked your registry key to see if it exists?
fedthans hamann 1 Reputation point

2024-09-12T07:47:06.9233333+00:00

yes it is there the key and the respont is attach here.

Sorry forgot to say that it's win 10 I'm trying on.

Share via

How to disable "View Wi-Fi Security Key" option for end user devices

4 answers

Your answer