Change the WiFi password of a network deployed via GPO

Question

My problem has a series of conditions that need to be met, so sorry for the long introduction ... Consider the following scenario:

We deploy the profile of a WiFi network with weird settings that cannot be automatically resolved by Windows (eduroam) via a group policy such that users do not have to configure this manually (on Windows 10, doing it manually is almost impossible as there is so much to configure and you cannot edit existing profiles, so you have do set each and every setting correctly at once). Users cannot change such a profile nor can they delete it, because it has been deployed via GPO.

Additionally, the user has connected to this network and chose to save the password.

Next, assume the user changes the password for the aforementioned network via a portal of the WiFi network, i.e. the password is not tied to the domain account.

Now the following happens: Windows 10 continuously tries to connect to the network using the previously stored password and never prompts for a new one. Eventually, the WiFi controller will block the device because of too many failed logins. Furthermore, the user cannot change the stored password, because any solution I found on the internet eventually requires removing the WiFi profile alltogether from the machine and recreating it, which is not possible, because the profile has been deployed via GPO. The only solution I found so far is creating a security filter for the device in question such that it does not receive the profile any more, wait for it to replicate, update the GPO on the machine, delete the profile, remove the security filter, wait for replication, update the GPO and finally login with the new password. This cannot be the solution for that problem!

My question therefore is: How can a user change the saved WLAN password of a network, which of the profile has been deployed via GPO without intervention of a domain admin?

Thanks in advance,
Christoph

Answer 1

No, I actually did a factory reset in the end after a lengthy discussion with support. They told me that they suggested to the product team to add a festure that would allow to selectively delete the stored credentials only via the context menu, but I have not heard anything about whether this is on track or work on it has even started ...