A rogue access point is a wireless access point that has been installed on a network without the authorization or knowledge of the network administrator. A rogue access point can pose a serious security risk, as it can allow unauthorized users to access the network, intercept network traffic, or launch attacks against the network or its devices. The first action that should be taken to protect the network while preserving evidence is to disconnect the rogue access point from the network.
This will prevent any further damage or compromise of the network by blocking the access point from communicating with other devices or users. Disconnecting the rogue access point will also preserve its state and configuration, which can be useful for forensic analysis and investigation.
Disconnecting the rogue access point can be done physically by unplugging it from the network port or wirelessly by disabling its radio frequency.