I would like to (programmatically, or through a group policy) disable
the wireless interface on individual workstations iff the wired
interface is already active.

For example, we have many laptops with both wired and wireless
capability. While they are logged into the LAN at work, we want to
prevent them from connecting to the unprotected free access point in
the coffee shop next door. It's not that individuals necessarily do so

out of malice - they come in from a previous hotspot and their
operating environment automatically connects them to both, in effect
granting a split tunnel (and huge security problem).

Assuming I have some of the regular security tools available for my
workgroup (domain GPO, Norton AntiVirus), what can I do?

Thanks to you very much,
..Chu.