The netsh createalluserprofile parameter is writeable by any user

Yet another MS security wonder ?

I just connected to a wifi hotspot from a non-admin account on my laptop. Since it was only for testing purposes and with no intent of using it in the future, I decided to delete the wireless network profile once I've finished using it.

Most importantly, the createalluserprofile parameter is set to enabled=no. As far as I know, it means disabled.

So I begin the process :

Code:

netsh...
wlan...
show profiles...

WHAT ? I see the profile corresponding to the hotspot has been created as an all users profile. Seriously ? Isn't the createalluserprofile parameter supposed to give the option to restrict this to administrators only ? Hence I wasn't much surprised when I noticed I was able to delete said profile without admin rights.

It seems that making our PCs look like tablet computers is not enough, we get tablet grade security too. Amazing, in some sense !

So. Is there any way left to achieve this now, or is it gone forever ?

Where did you find that createalluserprofile is defaulted to no?

essenbe said:

Netsh Commands for Wireless Local Area Network (WLAN) in Windows Server 2008

I think we're aware of that, I'm not sure what your point is. I don't see where it says anything about a default setting.

Mystere said:

Where did you find that createalluserprofile is defaulted to no?

Where did I say it defaults to no ? I know it doesn't, I had it explicitly set to no by my humble self a long time ago, and it was (and is) still set to that value.
@essenbe : I'm not sure to catch the point of your post. Are you suggesting it applies to WS2008 and Vista only ? It used to work in W8, I checked back in the day but not since I upgraded to 10. And anyway, if the option is deprecated, there should be some on-context notification at the very least. None here, I checked...

Well, it's not clear what you're asking then. What do you see when you type netsh wlan show createalluserprofile?

You should also know that this change will not affect profiles already created as all user..

Code:

C:\Users\Olivier>netsh wla sho cre

Tout le monde n'est pas autorisé à créer le profil des utilisateurs.

Which means « Not everybody is authorised to create the users' profile ». A bad translation indeed, but I'm used to bad translations here and there in Windows...

I know that previously existing profiles won't be affected.

What I want is that system-wide wireless profiles are protected from unauthorised tampering such as change, deletion or adding another system-wide wireless profile. That's what setting createalluserprofile enabled=no used to do in W8, now it's ineffective.

IIRC there's a way to define wireless profiles by policy, maybe these would still be protected, I will have to check this again. Other advices are welcome !

In English it says the same thing, so it's not really a bad translation.