Restrict ability to turn off AirPort

[justinkallas]

I looked through Configuration Profiles but not seeing anything for this. On the Advanced tab in Network configuration, there is a check box to only allow administrators to turn off wireless. Is it possible to set that with a Configuration Profile so that users cannot turn off wireless?

[mm2270 · Accepted solution]

I'm not sure if there's a way in a Config Profile. Maybe, but not sure.
I do know it can be enabled with the following command (adjust the "en<number>" to reflect the device id for Wi-Fi on the target Mac, or obtain the right one in your script)

sudo /usr/libexec/airportd en0 prefs RequireAdminPowerToggle=YES

[Look]

Coupled like this might work

WFINT=$(networksetup -listallhardwareports | awk ' /Wi-Fi/ {getline; print $2 }')
/usr/libexec/airportd $WFINT prefs RequireAdminPowerToggle=YES

Create a script in Casper and run it with a policy, or throw it in whatever first run option you are using.

[wubbelsl]

I thought it was in the Managed Preferences (not Configuration Profiles), but I'm not seeing it anymore. I do have a post-imaging script that sets all our AirPort options though.

#!/bin/bash
## Symlink to sbin folder. Allows running airport with sudo from anywhere
ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /usr/sbin/airport

## Keeps connection persistand on login screen
airport prefs DisconnectOnLogout=NO

## Set join mode -- Options: Automatic, Prefered, Ranked, Recent, Strongest
airport prefs JoinMode=Strongest
airport prefs JoinModeFallback=KeepLooking

## Remember Networks. Forgets user added networks.
airport prefs RememberRecentNetworks=NO

## Require admim password for using device as access point
airport prefs RequireAdminIBSS=YES

## Require admin password to change networks
airport prefs RequireAdminNetworkChange=NO

## Require admin to turn WiFi off
airport prefs RequireAdminPowerToggle=NO


## Setup networks
## -addpreferredwirelessnetworkatindex <device name> <network> <index> <security type> [password]
networksetup -addpreferredwirelessnetworkatindex en1 "StudentsWifiExample" 0 "wpa2" "examplePassword"

[justinkallas]

Thank you all for the suggestions. I took mm2270's advice and deployed a policy which ran that command as a script. Worked like a charm, non-admins are now prompted for credentials to disable WiFi. Thanks!