Windows Server 2016 – Blacklist Mobile devices on WIFI network

Let’s assume you have 2 WIFI networks. 1 for the Office users and 1 for the Guests on a separate VLAN.

Now you don’t want to have all the Office users using there mobile device to log on to the local LAN.

Most challenging is that if you apply MAC address filtering on the Access Point.

It will block the device on both WIFI networks Sad smile

PREQUISITES :

On your DHCP server you need to activate the BLOCK MAC address filtering

Open the DHCP console and enable the DENY LIST using the FILTERS Tab

image

Now you can add the BLOCKED Mac ADDRESSES in the DENY section

image

Tip :

You can also use WILDCARDS like this :

image

Solution :

Windows 2008r2 :

You can use the NETSH command to block MAC addresses on your local LAN.

netsh dhcp server v4 add filter deny 00-0c-29-fe-dd-60 "Mary's PC"

If you need to automate this on a Windows 2008r2 server you need to apply some regular expressions to grab the  MAC address ,-)

Took me more then a day to figure that out how to make it work Sad smile

Windows 2012r2 and higher :

You can use the DHCP Powershell cmdlets

Get-DhcpServerv4Scope -cn YourServer

Set-DhcpServerv4FilterList -ComputerName "YourServer" -Allow $False -Deny $True

Get-DhcpServerv4FilterList

Add-DhcpServerv4Filter -List Allow -MacAddress "F0-DE-F1-7A-00-5E" -Description "Laptop 09"

Remove-DhcpServerv4Filter -MacAddress "F0-DE-F1-7A-00-5E","F0-DE-F1-7A-00-5E"

See also here how to build a Blacklist for PUBLIC IP addresses.

Enjoy !

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: