Windows hotspots as Rogue APs...

[SocialEyesNP]

Windows 10 allows users to create Wi-Fi hotspots, which work quite well... However, from our perspective, this is a rogue AP because it allows access to the LAN by random devices. Can we detect the creation of a Wi-Fi hotspot using the Meraki?

Or are 3rd-party tools required?

[Roska]

I´ve seen security marshall feature built in to most of Meraki MR models do the trick in notifying when a hot-spot comes up on Android and iOS.

[SocialEyesNP]

Would like to know how to enable this feature... It's on presently but nothing shows up in the Rogue AP panel even if the SSID is put in.

[MacuserJim]

Have you been expanding the time window for which the rouge SSIDs are being displayed? I have found that it can be kind of tricky to catch a phone under the Rouge SSIDs tab of the Air Marshal page since they only show up briefly. If you go to "Network-wide > Alerts > Network-wide" and check the box for "A rouge AP is detected" you'll get an email notification a few minutes after someone attempts to use a hotspot. I have found this to be the most helpful so I am not just trying to chase hotspot attempts.

What model of MR's are you running and can you post a screenshot of your Air Marshal configuration?