Let’s assume you have 2 WIFI networks. 1 for the Office users and 1 for the Guests on a separate VLAN.
Now you don’t want to have all the Office users using there mobile device to log on to the local LAN.
Most challenging is that if you apply MAC address filtering on the Access Point.
It will block the device on both WIFI networks
On your DHCP server you need to activate the BLOCK MAC address filtering
Open the DHCP console and enable the DENY LIST using the FILTERS Tab
Now you can add the BLOCKED Mac ADDRESSES in the DENY section
You can also use WILDCARDS like this :
Windows 2008r2 :
You can use the NETSH command to block MAC addresses on your local LAN.
netsh dhcp server v4 add filter deny 00-0c-29-fe-dd-60 "Mary's PC"
If you need to automate this on a Windows 2008r2 server you need to apply some regular expressions to grab the MAC address ,-)
Took me more then a day to figure that out how to make it work
Windows 2012r2 and higher :
You can use the DHCP Powershell cmdlets
Get-DhcpServerv4Scope -cn YourServer Set-DhcpServerv4FilterList -ComputerName "YourServer" -Allow $False -Deny $True Get-DhcpServerv4FilterList Add-DhcpServerv4Filter -List Allow -MacAddress "F0-DE-F1-7A-00-5E" -Description "Laptop 09" Remove-DhcpServerv4Filter -MacAddress "F0-DE-F1-7A-00-5E","F0-DE-F1-7A-00-5E"
See also here how to build a Blacklist for PUBLIC IP addresses.