Wave of network profiles set as "Public"

[HCHTech]

We have an alert in our monitoring for the network being set to public instead of private or domain-joined. We've had a rash of these lately, enough that makes me wonder if a recent update might have broken something. Is anyone else seeing this?

 

[Markverhyden]

I've never seen any of those just randomly changing type. From what I've seen there's always some program somewhere that does this. So I'd start looking at app activities. Are they happening to devices not on the RMM?

 

[Metanis]

I only see this when my small customers lose their primary Internet service and try to connect to their phone's hotspot.

 

[HCHTech]

Yeah, never assume things are not self-inflicted, I guess - haha. The alert is in our RMM, so that's the only sample I have. I'm not complaining, it generates a reason to contact the customer, which always results in a few more things to look at, so it's nicely billable. Just wondering about the cause since they all seemed to come out of nowhere.

 

[YeOldeStonecat]

Windows recognizes "networks"....by memorizing the MAC address of the gateway. If you change firewalls/routers/gateways..be it third party, or the ISPs wireless gateway, Windows will do this behavior...change from private to public again.

Not sure if this was just one client of yours, or many at the same time. Common trends....same ISP across these?

 

[Markverhyden]

Windows recognizes "networks"....by memorizing the MAC address of the gateway. If you change firewalls/routers/gateways..be it third party, or the ISPs wireless gateway, Windows will do this behavior...change from private to public again.

Not sure if this was just one client of yours, or many at the same time. Common trends....same ISP across these?

That's actually a good point. Most locations have two connections for BoH. One copper and one 802.xx.

 

[HCHTech]

just one client of yours, or many at the same time.

Yes, several clients at the same time, that's what I was thinking an update, but I didn't keep track of the ISPs, so that's definitely a thought. I think this is still a good thing to monitor as having your network suddenly defined as public breaks some things for sure.