Network Connection Properties - Disabling

http://social.technet.microsoft.com/Forums/en-US/w7itpronetworking/th...

Search Windows with Bing

United States (English)

Sign in

Home

Windows 7

Windows Vista

Windows XP

Library

Forums

Windows Client TechCenter > Windows 7 IT Pro Forums > Windows 7 Networking > Network Connection Properties Disabling

Need Help with Forums? (FAQ)

My Forum Links

Network Connection Properties - Disabling

Search Windows 7 Networking Forum

Ask a question

Sign In To Forums Forums Home Browse Forums Users

Speedy_Sandwich

Thursday, December 17, 2009 3:52 PM

I raised this issue at Windows7Forums and only got a small response. In Win XP Professional to stop users changing the IP address in the Network Connection properties you can make the user a 'Limited' account. However, if you require the user to have admin rights then they Sign In to can access the Network Connection Properties. If you go into the Group Policy Editor you can change the settings so that everyone including administrators cannot access the Network Connection Properties (The Vote right click menu option for 'Properties 'is disabled). The two Policies i enabled are; GPEDIT Local Computer Policy....User Configuration....Administrative Templates....Network....Network Connections

1. Prohibit access to properties of a LAN connection 2. Enable Windows 2000 Network Connections settings for Administrators And this works a treat - admittedly Admins can change the policies but the idea is to stop people fiddling (a padlock can still be broken off) In Windows 7 Professional i changed these policies BUT it does not stop an Administrative account from being ablke to access the Network Connection Properties. I have tried this on 4 machines each running Win7 Pro and i can still get access to the Network Connection Properties. I posted the problem in the "Windows7Forums" and received minmal replies but also a reply from a guy who is experiencing the same issue in Win7 Ultimate. I decided to contacted MS Support who after two long phone calls and using "Easy Access" were a little perplexed as they could get the disabling to work on their Win7 Ultimate machines but not on my Win7Pro machine. At this point i may have accepted that this was not avaolable in Win7 Pro but the reply to my post in Windows7Forums made me think otherwise. Also the MS support guy said he would pass this to another team. I was rang again today and told that my problem would require registry tweaking and this would be under chargeable support (199). Now for something that i think is a BUG i don't think i should be charged. Can all who read this enable the two Policies and reply with results - has Networtk Connection Properties been disabled? Can anyone help me to solve this issue.
Edited by Speedy_Sandwich Thursday, December 17, 2009 9:28 PM Added Link

Related Topics
= Unanswered = Answered

Windows 7 RC1 - Strange Network Errors [DHCP errors, Connection ... Intermittent Network Connection Lapses Wired Network Connection unavailable when booting Windows 7 from ... Disabling Updates Over Slow Connection Intermittent network connection drops (Vista Ultimate SP1) Guest keeps losing network connection! Error message when try access the shared resources in a ... updates problem (keeps trying to load the same update), & won't ... Troubleshooting the Network Troubleshooting Utility / After-Sleep ... IPV6 - No network access issue

Changed Type Nicholas Li Microsoft Contingent Staff, Moderator Monday, December 21, 2009 7:33 AM

Reply

Quote

All Replies
SAYED MOHAMMAD
45

Thursday, December 17, 2009 4:16 PM

I raised this issue at Windows7Forums and only got a small response. In Win XP Professional to stop users changing the IP address in the Network Connection properties you can make the user a 'Limited' account. However, if you require the user to have admin rights then they can access the Network Connection Properties. If you go into the Group Policy Editor you can change the settings so that everyone including administrators cannot access the Network Connection Properties (The right click menu option for 'Properties 'is disabled). The two Policies i enabled are; GPEDIT Local Computer Policy....User Configuration....Administrative Templates....Network....Network Connections 1. Prohibit access to properties of a LAN connection 2. Enable Windows 2000 Network Connections settings for Administrators And this works a treat - admittedly Admins can change the policies but the idea is to stop people fiddling (a padlock can still be broken off) In Windows 7 Professional i changed these policies BUT it does not stop an Administrative account from being ablke to access the Network Connection Properties. I have tried this on 4 machines each running Win7 Pro and i can still get access to the Network Connection Properties. I posted the problem in the "Windows7Forums" and received minmal replies but also a reply from a guy who is experiencing the same issue in Win7 Ultimate. I decided to contacted MS Support who after two long phone calls and using "Easy Access" were a little perplexed as they could get the disabling to work on their Win7 Ultimate machines but not on my Win7Pro machine. At this point i may have accepted that this was not avaolable in Win7 Pro but the reply to my post in Windows7Forums made me think otherwise. Also the MS support guy said he would pass this to another team. I was rang again today and told that my problem would require registry tweaking and this would be under chargeable support (199). Now for something that i think is a BUG i don't think i should be charged. Can all who read this enable the two Policies and reply with results - has Networtk

Statistics
Started: 12/17/2009 Last Reply: 5/26/2011 Helpful Votes: 1 Replies: 11 Views: 6,299

0
Sign In to Vote

1 of 4

07-11-2011 14:31

Network Connection Properties - Disabling

Connection Properties been disabled? Can anyone help me to solve this issue.

http://social.technet.microsoft.com/Forums/en-US/w7itpronetworking/th...

well i think its because your is also in the "Network Configuration Operators" Group so even when you limit this configuration from "administrators" Group your user have access/change permission from other Group which is "Network Configuration Operators" Group. By the way test this: 1-Right Click On Computer -->>Manage -->>Local User And groups\User 2-By default your Administrator User is disable and there is another user which you create during windows installation for example it's Jack 3-Right click on Jack and select Properties 4-In the Member of Tab remove the "Network Configuration Operators" from the user and click Apply and OK 5-Restart your Computer Hope it is work for you Good Luck Microsoft Certified System Engineer 2003 Reply Quote

Speedy_Sandwich

Thursday, December 17, 2009 6:44 PM

By default if they are an Administrator they are not in the "Network Configuration Operators" group. The NCO group, i believe, gives standard (limited) users the ability to change Network properties. So i'm afriad this doesn't work as it is a non-starter.

0
Sign In to Vote

Reply

Quote

SAYED MOHAMMAD

45

Thursday, December 17, 2009 8:28 PM

By default if they are an Administrator they are not in the "Network Configuration Operators" group. The NCO group, i believe, gives standard (limited) users the ability to change Network properties. So i'm afriad this doesn't work as it is a non-starter.

0
Sign In to Vote

well i don't get it really what your problem !! Are you wanna Block the primary administrator user from editing the Network Configuration or you want to allow a special user (NOT THE USER THAT CREATE DURING WINDOWS INSTALLATION) to configure the network setting? Microsoft Certified System Engineer 2003 Reply Quote

patwhatshtat

40

Thursday, December 17, 2009 8:33 PM

If you read his original post, you will see that he simply wants the group policy to work....like it has in previous OS's and is suppose to work according to Microsoft in Windows 7. I have tested this on both Windows 7 Ultimate 32 bit and Windows 7 Ultimate 64bit and he has tested on Windows 7 professional Sign In to and neither of us can make it work

Vote

Reply

Quote

Speedy_Sandwich

Thursday, December 17, 2009 9:16 PM

If you read his original post, you will see that he simply wants the group policy to work....like it has in previous OS's and is suppose to work according to Microsoft in Windows 7. I have tested this on both Windows 7 Ultimate 32 bit and Windows 7 Ultimate 64bit and he has tested on Windows 7 professional and neither of us can make it work

0
Sign In to Vote

Thanks for testing this i'm glad it's not just me. I think the more who try the more chance of MS doing something about it. Reply Quote

Speedy_Sandwich

Friday, December 18, 2009 10:36 AM

I can't believe there are no more answers/comments. This is obviously a problem - come on MS.

2 of 4

07-11-2011 14:31

Network Connection Properties - Disabling

http://social.technet.microsoft.com/Forums/en-US/w7itpronetworking/th...

Sign In to Vote

Reply

Quote

Amaranthe

20

Friday, December 18, 2009 8:17 PM

One thing that confuses me about your setup is are your computers on a domain?

Sign In to messing around with the Local Machine Group Policy settings. Vote

If so, then I absolutely suggest managing them through your domain Group Policy settings, and not

On a totally overkill method, disable the ncpa.cpl through the various methods: Setup a Domain Group Policy policy that only affects the users/OU that you want it to.. And for safe measure I always add the Deny Group Policy setting for the domain admins, in case it somehow wass placed on them by slippery fingers. User Configuration\Administrative Templates\Control Panel\Hide specified Control Panel applets Add -> ncpa.cpl PATH RULE: User Configuration\Windows Settings\Security Settings\Software Restriction Policies\Additional Rules New -> Path Rule -> Path: %SystemRoot%\System32\ncpa.cpl Security Level: Disallowed You could also add a HASH rule, however you would have to add this for every version of the ncpa.cpl file you could think of. User Configuration\Administrative Templates\Network\Network Connections\ Enable all the Prohibit policies you want =-) Reply Quote

Speedy_Sandwich

Tuesday, December 22, 2009 3:40 PM

Apologies for no reply recently - thanks for the advice. No the PC's are not part of a Domain, that would have been easier to sort i'm sure. I don't want to disable the whole CP when the GP Editor SHOULD be able to do the job i require. I've spoken to the support guys again and it would appear Sign In to that it is not likely that it will ever work as it is something to do with the difference between Administrators in Win 7/Vista and all previous versions of Windows. Vote

Digress slightly - Some will know that the actual Administrator account in Win 7 & Vista is hidden whilst in XP it came to life in Safe Mode. I'm not sure what this has to do with Group Policies but i can only think that when you create an Administrators account in XP it is different than creating an Administrator account in Win 7. (I knew that already otherwise the GP changes would have worked LOL!!) Back on track - the upshot is that i will raise the issue with support again soon, but.... Santa's coming and i have an important job to do for my kids etc! When i have more info i will post again. (Before the end of the year i hope). I would like to finish with a note to MS; I'm not going to get all bitter now, but when you buy a product you expect things to work don't you? I mean you wouldn't buy a car with electric windows that you had to open and close by cranking a handle, would you. Cmon guys tis the season to be joyful and giving!! Merry Xmas to one and all! PS: In this world of political correctness why is it that there is no such thing as a Snowwoman, we have a Snowman?

Thanks to my wife for the answer "Only a man stands around the whole of Christmas and does nothing" - one less present to buy... sorry dear!
Edited by Speedy_Sandwich Tuesday, December 22, 2009 3:40 PM spellings

Reply

Quote

Durgacharan (Partner)

Thursday, May 06, 2010 12:59 PM

Yes Sandwich

After these changes you will be able to see the lan connection properties in administrator account personally once you log in to that simple user you will see the lan properties is disabled. Reply me back if I am wrong

Sign In to But you just create one simple user with limited privilege, log in to that user and see. I have checked it Vote

Reply

Quote

Konstantin Salavatov USP (Partner)

30

Friday, March 04, 2011 11:15 AM

Any updates?

3 of 4

07-11-2011 14:31

Network Connection Properties - Disabling

http://social.technet.microsoft.com/Forums/en-US/w7itpronetworking/th...

Regards, Konstantin Salavatov

0
Sign In to Vote

Reply

Quote

wooyeoly ( )

Thursday, May 26, 2011 2:09 PM

I have the same problem in windows 7.

0
Sign In to Vote

I've tried to monitor registry actions using process monitor when clicking properties menu from local area connection. In XP, explorer.exe read HKCU\...\Network Connection\NC_LanProperties and apply it but In Win7, explorer.exe doesnot read HKCU\...\Network Connection\*, so it doesn't applied. I think this is a bug of Windows 7. If you have any idea, pls post it. Bye. Thanks.

Reply

Quote

2011 Microsoft. All rights reserved.

Terms of Use | Trademarks

| Privacy Statement

4 of 4

07-11-2011 14:31