How to Disable Wi-Fi for a Specific User on Windows 11 Enterprise

You cannot disable Wi-Fi for a specific user on Windows 11 Enterprise using standard Group Policy because network connectivity is a system-level resource, not a per-user setting. The only reliable method to restrict internet access for a specific account while preserving it for administrators is configuring Windows Firewall rules that target the user’s security identifier (SID) or applying third-party endpoint security software with granular user-based filtering capabilities.

Understanding the Technical Limitation

Many administrators attempt to use Group Policy to block Wi-Fi adapters, but this approach fails because the Network Adapter settings in secpol.msc or Group Policy Objects (GPO) apply to the computer object, not the user object. When you disable a network adapter via GPO, it disables the hardware interface for every session on that machine, including the administrator’s. This is why previous guides suggesting "Change System Time" or generic GPO paths are incorrect; those mechanisms do not exist for selective user network restriction. Windows 11 Enterprise does include advanced networking features, but they are designed for managing connectivity profiles (Home, Work, Public) rather than restricting specific users from using the underlying radio. The operating system treats the Wi-Fi driver as a shared kernel-mode resource. Therefore, any solution must operate at the firewall level or the application level, where user context is respected.

Method 1: Using Windows Defender Firewall with Advanced Security

The most native way to restrict a user’s network access is by creating outbound and inbound firewall rules that apply only to that specific user’s SID. This allows the administrator to retain full network access while blocking the target user. First, identify the Security Identifier (SID) of the user you wish to restrict. You can find this by opening PowerShell as Administrator and running:

Get-LocalUser -Name "TargetUserName" | Select-Object Name, SID

Note the SID value (e.g., S-1-5-21-...). Next, open Windows Defender Firewall with Advanced Security from the Start menu. Create a new Outbound Rule by right-clicking Outbound Rules and selecting New Rule. Choose Custom and proceed to the Scope tab. Leave the remote IP addresses as Any. On the User tab, select These users and groups, click Browse, and enter the SID you copied earlier. Click Check Names to validate it, then click OK. On the Action tab, select Block the connection. Ensure all three profiles (Domain, Private, Public) are checked. Finish the wizard and name the rule "Block User Network Access". To ensure complete isolation, repeat these steps for an Inbound Rule. This effectively cuts off the user’s ability to send or receive data over any network interface, including Wi-Fi, while leaving the admin’s sessions untouched. Note that this blocks all internet traffic for that user, not just Wi-Fi, which is often the desired outcome for security compliance. For more details on managing user restrictions, see Preventing Regular Users from Pinning/Unpinning Shortcuts to the Taskbar in Windows 11.

Method 2: Third-Party Endpoint Security Solutions

If you need to allow general internet access but block specific websites or applications for a user, firewall rules become unwieldy. In such cases, enterprise endpoint management tools like Microsoft Intune, CrowdStrike, or Symantec Endpoint Protection offer user-aware network policies. These agents run in the user context and can filter traffic based on identity rather than just IP or port. For example, in Microsoft Intune, you can configure Network Filter Policies that apply to specific device groups, but true user-specific filtering usually requires integration with Identity-Aware Proxy (IAP) solutions or Azure AD Conditional Access policies. However, Conditional Access typically affects cloud resources rather than local Wi-Fi connectivity. For local control, dedicated parental control or employee monitoring software is the industry standard. These tools install a kernel driver that hooks into the network stack and drops packets based on the logged-in user profile. This method is robust against workarounds, whereas firewall rules can sometimes be bypassed if the user has administrative privileges themselves. If your issue is related to hardware compatibility rather than policy, check Windows 11: Lenovo IdeaPad 3 Can't Connect to Wi-Fi Network (iPhone Hotspot Included) for troubleshooting steps.

Why Registry Edits Fail

Some online forums suggest editing registry keys under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WlanSvc to disable Wi-Fi. This is dangerous and ineffective for user-specific restrictions. Modifying these keys affects the entire system service. If you disable the WLAN service, no one on the computer can connect to Wi-Fi, requiring a reboot and potential recovery mode to restore access. Furthermore, Windows 11 enforces strict integrity checks on system services, making manual registry hacks prone to failure after updates. Always prefer built-in security tools like the Firewall over registry modifications for stability and auditability.

Alternative: Application Whitelisting

Instead of blocking all network traffic, you might want to allow browsing but block specific apps like games or social media. This is best achieved through AppLocker or Windows Defender Application Control (WDAC). These technologies allow you to define policies based on file path, publisher, or hash. While they don’t directly block Wi-Fi, they prevent unauthorized applications from launching, which indirectly reduces network usage for non-compliant users. Combine this with the firewall rule mentioned earlier for a layered security approach.

Frequently Asked Questions

Can I use Local Group Policy Editor to disable Wi-Fi for one user?

No, the Local Group Policy Editor applies settings to the computer or to all users within a domain. There is no built-in GPO setting that targets a single user’s network adapter functionality. Any attempt to do so will either fail or disable the adapter for everyone.

Does disabling Wi-Fi for a user also block Ethernet connections?

The firewall rule method described above blocks all network interfaces for the specified user SID, including Ethernet, USB tethering, and Wi-Fi. If you need to distinguish between connection types, you must create separate firewall rules with different conditions for each adapter GUID, which is complex and rarely recommended.

Will this workaround work on Windows 11 Home?

Windows 11 Home does not include the Full Windows Defender Firewall with Advanced Security GUI, nor does it support Group Policy. You would need to use command-line netsh commands to create firewall rules, which is significantly more difficult and error-prone. Third-party software is the more viable option for Home editions.

How do I re-enable network access for the user?

To re-enable access, simply delete the outbound and inbound firewall rules you created in the "Block User Network Access" section. Alternatively, if you used third-party software, remove the user from the restricted group in that application’s console. A restart is not required for firewall changes to take effect immediately.

What happens if the user is a local administrator?

If the restricted user has local administrator rights, they may be able to modify or delete the firewall rules you created. To prevent this, you should deny write permissions on the firewall rule objects to that user, or better yet, ensure they are not part of the local Administrators group. For broader security controls, consider Windows 11 Cannot Connect to Wi-Fi for general connectivity troubleshooting instead.