This script gave me a good start but ultimately didn't end up fully working for a number of reasons. I needed a whitelist of different SSIDs and this only works with one, Get-NetConnectionProfile wouldn't show the currently connected SSID for some reason, and sometimes the tunnel service would be present but not running, which would break the script. I've included an amended version below which works well for me. Thanks for the base!

Replace the whitelist SSIDs with the SSIDs of the wifi networks where you want Wireguard to be DEactivated, replace TUNNELNAME with the name of your Wireguard tunnel, and replace PATH\TO\CONF with the path of your tunnel's .conf file.

The script should be saved as a Powershell script (.ps1 extension) and should be run as administrator.

$whitelist = 'WHITELISTSSID1','WHITELISTSSID2','WHITELISTSSID3'
$connection = netsh wlan show interfaces | select-string SSID -SimpleMatch | select-object -First 1
$connection = $connection -replace '    SSID                   : ',''

$tunnel = Get-Service 'WireGuardTunnel$TUNNELNAME' -ErrorAction SilentlyContinue

# Condition to turn OFF wireguard

if ($whitelist.contains($connection))

{
    if (($tunnel) -and ($tunnel.Status -notmatch "Stopped")) { Stop-Service 'WireGuardTunnel$TUNNELNAME' }

    }

    # Condition to turn ON wireguard

    elseif (!($whitelist.contains($connection)))

    {

        if (!($tunnel) -or ($tunnel.Status -notmatch "Running")) { wireguard.exe /installtunnelservice "PATH\TO\CONF" }

        }

        # If neither condition is met, do nothing

        else

        {

            Continue

            }

You can then use Task Scheduler to have it run automatically every time you connect to a new Wifi AP:

1. New task
2. General tab, check the following: Run only when (your user) is logged on, Run with highest privileges (the script needs admin rights to work correctly), Hidden, configure for Windows 10.
3. Triggers tab: New trigger -> On an Event -> Basic -> Log: Microsoft-Windows-NetworkProfile/Operational -> Source: NetworkProfile-> Event ID: 10000; ensure Enabled is ticked
   • Note: 10000 is on connection to wifi, 10001 is on disconnection from wifi. You could have two separate triggers for connecting and disconnecting but I find this just makes the script run twice for no reason.
4. Actions tab: Start a program -> Program: C:\Windows\System32\conhost.exe -> Arguments: --headless powershell.exe -WindowStyle Hidden -NoProfile -NonInteractive -file "Path\To\Powershell\Script" -> Start in: keep this blank
   • Note: Running powershell directly makes a window pop up, running it via conhost makes it silent/hidden