UNC path hardening and wifi - group policies dont load

James2995 · 2025-07-08T11:51:04.822Z

Having a frustrating issue with domain windows devices on wifi (tried psk and eap-tls) not loading group policies when a device starts up. However it’s inconsistent…

With a cable connected gpos load cleanly and without issue.

The issue is easiest to test straight after imaging a device (MECM task sequence) soon as it’s on the login screen, i can disconnect the cable, restart, GPOs wont be picked up on startup or on logon. I can repeat that process over and over.

If i login and try to access \domain.local\sysvol it’ll prompt for a username and password. Entering one says access denied.

I can leave the device logged in for 30-60 minutes and eventually it will start working, sysvol will be accessible and i can then do gpupdate /force for it to pull down the policies. Restart though and it’ll fail again…albeit with the policies partially loaded.

Plugin a network cable, and the device works perfectly again. In fact once it’s pulled down the policies from a restart with the network cable plugged in and the user logged in, i can then unplug the network lead and it’ll carry on working on subsequent restarts… yet to determine if that stops working after a period of time has passed though.

I’ve explored all sorts of avenues in attempting to resolve this. First i thought it was credential guard, then i thought it was the 802.1x profile Then i thought maybe it’s certificate problems.

If i disable UNC path hardening on sysvol, it works. That’s the temporary workaround i’ve put in place for users. To me this suggests a kerberos issue with the machine account, but why would that be wifi specific? I’m at a complete loss and desperate for help!

James2995 · 2025-07-08T14:52:09.511Z

I think after days of tearing my hair out, i might have finally solved this one.

It was all down to overly restrictive settings in Windows Defender Exploit Guard settings deployed via GPO in an xml file.

I don’t know which of the 5 expoint guard settings was causing it, for now i’ve disabled exploit guard entirely but this was the xml file in question:

<?xml version="1.0" encoding="UTF-8"?>
<MitigationPolicy>
  <SystemConfig>
    <DEP Enable="true" EmulateAtlThunks="false" />
    <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" />
    <ControlFlowGuard Enable="true" SuppressExports="false" />
    <SEHOP Enable="true" TelemetryOnly="false" />
    <Heap TerminateOnError="true" />
  </SystemConfig>
</MitigationPolicy>