How to strengthen public Wi-Fi security on managed endpoints. Public Wi-Fi is convenient, but for managed endpoints, it can expose devices to data interception, credential theft, and session hijacking. In this video, we'll outline six steps to secure Windows endpoints on public networks, so your users stay protected when connecting outside trusted networks. Before we begin, be sure to subscribe to NinjaOne's IT Video Hub and our YouTube channel for more tech content like this. Step-by-step guide to public Wi-Fi endpoint security. Block or allow specific SSIDs. Using SSID allowlists and denylists, you can prevent devices from connecting to unsafe or spoofed hotspots, and restrict them to only approved access points. For individual machines, netsh commands in PowerShell let you block specific networks, permit trusted ones, and delete risky saved profiles. For broader enforcement, use Wireless Network Policies in Group Policy to manage allowed and denied SSIDs across managed domain-joined devices. Preload and prioritize trusted network profiles. Once you've restricted which networks devices can join, make sure they automatically connect to the right ones. Preload approved Wi-Fi profiles using preconfigured XML files, set your corporate SSIDs to the highest connection priority, and remove stale profiles pointing to old or open networks. For authentication, always use WPA2-Enterprise or WPA3-Enterprise where supported. These enforce stronger encryption and reduce exposure compared to standard consumer protocols. Harden device settings on untrusted networks. When a device connects to an unfamiliar network, it should automatically apply a stricter security posture. Here's how to make that happen: Force the Windows network category to Public for unknown or untrusted networks to trigger restrictive settings automatically. Block all unsolicited inbound connections via the Public firewall profile while allowing outbound traffic. Disable Network Discovery and File and Printer Sharing to stop devices from broadcasting their presence on shared networks. Enforce encrypted connections. Without encryption, traffic on open networks can still be intercepted. Configure VPN policies to automatically engage whenever a device's network category is set to Public, ensuring all traffic is routed through an encrypted corporate tunnel. In browsers, enforce HTTPS-only mode and HSTS preload lists to block insecure HTTP connections. Where supported, enable DNS over HTTPS through Group Policy or device management policies to ensure even DNS queries are encrypted and protected from tampering. Train users on safe public Wi-Fi habits. Technical controls are essential, but user behavior is often the deciding factor. Cover these key points in your training: Verify network names before connecting. Always connect through the corporate VPN before accessing sensitive data on open networks. Stop and disconnect if a browser shows certificate or connection warnings. Report suspicious behavior like repeated disconnections, unexpected redirects, or multiple login prompts to IT immediately. Monitor and review your Wi-Fi security posture. Policies can drift over time. Build these reviews into your operations to keep controls effective: Monthly: Review new SSIDs, connection exceptions, and firewall activity across endpoints. Quarterly: Spot-check VPN behavior, firewall compliance, and public network enforcement across the fleet. Watch for warning signs like new or unapproved Wi-Fi profiles appearing on endpoints, frequent public network transitions, or applications opening unexpected listeners when the public profile is active. Public Wi-Fi will always be part of how modern teams work, but with SSID filtering, hardened device settings, encrypted connections, user education, and consistent monitoring in place, you can manage that risk without restricting how your users operate. For more information, check out our official blog post on how to strengthen public Wi-Fi security on managed endpoints, linked in the description below.