WIN-028 · Script
Wi Fi Profile Deployment
Checks for a Wi-Fi profile and, in Apply mode, adds it for all users from an exported profile or from a network name and key, without prompts.
What it does
The profile can come from one of three places:
- -ProfileXmlPath: a profile file exported with netsh wlan export profile
- -ProfileXml: the same XML passed as text, or as Base64 text
- -Ssid with -NetworkKey: builds a WPA2-Personal or WPA3-Personal profile
For enterprise (802.1X) networks, export the profile from a configured device and use -ProfileXmlPath or -ProfileXml.
Report mode (default) checks whether the WLAN AutoConfig service and a wireless adapter are present, and whether the profile already exists. It logs what Apply would do and changes nothing. Apply mode adds the profile with netsh wlan add profile (an existing profile with the same name is updated) and, if -ConnectNow is used, tries to connect. Remove mode deletes the profile with the given name.
The network key is never written to the log. The temporary profile file is deleted when the script ends. Runs silently as SYSTEM from any RMM or Intune. No prompts, no user interaction.
Requirements
Windows PowerShell 5.1+, run as SYSTEM or local admin. A Wi-Fi adapter and the WLAN AutoConfig service.
How to run it
- Run as: SYSTEM or a local administrator
- Run from: any RMM or MDM, Intune, a Group Policy startup script, a scheduled task, or an elevated PowerShell window
- Script type: PowerShell, 64-bit
- User interaction: none; the script never prompts
- Timeout: 10 minutes (30 for Windows Update installs)
Settings
| Name | What it does | Options | Default |
|---|---|---|---|
| Mode | Report (default) = read-only. Apply = add or update the profile. Remove = delete the profile. | Report, Apply, Remove | Report |
| ProfileXmlPath | Path to an exported profile XML file, for example C:\Temp\Wi-Fi-Staff.xml. | ||
| ProfileXml | Profile XML as text, or Base64-encoded XML (handy in RMM fields). | ||
| Ssid | Network name (SSID) when building a profile, or the profile name for Remove. Example: SchoolStaff. | ||
| NetworkKey | Wi-Fi password (pre-shared key) for -Ssid, 8 to 63 characters. Never logged. | ||
| Authentication | WPA2PSK (default) or WPA3SAE for WPA3-Personal. WPA3 needs a recent Windows build and adapter driver. | WPA2PSK, WPA3SAE | WPA2PSK |
| Hidden | The network does not broadcast its name. Windows will probe for it. | False | |
| ManualConnect | Do not connect automatically when in range. Off by default (auto connect). | False | |
| ConnectNow | In Apply mode, try to connect to the network right after adding the profile. | False |
Exit codes
- 0 = Profile present (Report), added (Apply) or removed (Remove)
- 1 = Profile missing (Report), no Wi-Fi on this device, or netsh reported a failure
- 2 = Script error or bad parameters
Testing steps
- Run it first with the mode set to Report on one test device. Nothing is changed in that mode.
- Read the log and confirm the planned changes are what you expect.
- Run your chosen settings on the same test target and confirm the result.
- Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
- Roll out to a small group next, then everyone.
Rollback steps
Run the script with -Mode Remove -Ssid '<profile name>', or run netsh wlan delete profile name="<profile name>".
Version and change log
| Version | Date | Changes |
|---|---|---|
| 1.0.0 | November 2026 | First release. |