How to Completely Disable ‘Mobile Hotspot’ via Group Policy in Windows 11

The Mobile Hotspot feature in Windows 11 allows users to share their computer’s active internet connection (whether Ethernet or Wi-Fi) with other devices over a localized Wi-Fi or Bluetooth broadcast. While convenient for personal use, this feature presents a severe security risk in a corporate enterprise environment. If an employee connects their corporate laptop to a secure, wired intranet and then activates the Mobile Hotspot, they effectively create a rogue, unmanaged wireless access point. Unauthorized devices could connect to this ad-hoc network, completely bypassing the corporate firewall, RADIUS authentication, and physical building security to gain direct access to the internal network.

This guide explains how to completely disable the Mobile Hotspot feature system-wide using the Group Policy Editor in Windows 11, ensuring your endpoints cannot be used as unauthorized network bridges.

Disable Mobile Hotspot via Group Policy

To enforce a strict block that prevents the operating system from initializing the virtual Wi-Fi adapter and locks the settings from user modification, we must deploy an administrative template. Note that this requires Windows 11 Pro, Enterprise, or Education editions.

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, strictly follow this exact path:

   Computer Configuration > Administrative Templates > Network > Network Connections > Prohibit installation and configuration of Network Bridge on your DNS domain network

   Note: For specifically targeting just the hotspot UI, navigate to:

   Computer Configuration > Administrative Templates > Network > Mobile Hotspot

5. In the right-hand pane, locate the policy named Prohibit use of Internet Connection Sharing on your DNS domain network.
6. Double-click the policy to open its configuration window.
7. Select the radio button next to Enabled. (Note: You must enable this policy to enforce the prohibition).
8. Click Apply, then click OK.

Verify the Configuration Lockdown

To enforce the change immediately across the system without requiring a full reboot, open an elevated Command Prompt and execute gpupdate /force.

To verify the restriction is active, open the Settings app and navigate to Network & internet > Mobile hotspot. The master toggle switch to turn on the Mobile Hotspot will be completely greyed out and locked in the ‘Off’ position. A red message at the top of the window will state, “Some of these settings are hidden or managed by your organization.” The Windows networking stack is now strictly prohibited from routing external traffic through the workstation.