We run the following on all macs with a wireless card as a offline policy via Casper at logout.

This script will:

1. Enable the wireless service if it’s not been enabled.
2. Clear any set DNS servers & search domains (can be turned off for 10.4, reasoning is that 10.5+ can receive DNS from DHCP)
3. Turns off the wireless card.

The script itself has been built from a few scripts contained within Caspers Resource Kit & then modified for 10.7+ by myself.