What can I do with bad clients who change their Mac addresses ?I'm using ARP Table , but they Keep changing their mac and IP .! :(I work with Win2003Ent, non-domain .Is there any advice or help , cause I'm in needed .. AMoktar

Hello, From the description, you want to prevent users from changing the MAC address for maintain the client though ARP table. By default, the local administrators of the clients have the permissions to change the IP addresses and MAC addresses in GUI (if presented) or in the registry. We cannot prevent an administrator from changing the MAC and IP address. The MAC address for a NIC in Windows is stored in: Registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\XXXX\ Value: NetworkAddress Value type: REG_SZ The XXXX subkey starts with 0000 that indicates network interface installed in the system.You can identify the NIC according to DriveDesc (NIC description ) and NetCfgInstanceID (NIC GUID) attributes in the XXXX subkey. The local administrators can change the NetworkAddress vaule data because they have the FULL CONTROL permission on the following registry keys. As a "workaround", you may consider restoring the TRUE Hardware burned-in MAC Address when a client is restarted. To do so, you can write a start up script for clients to remove the "NetworkAddress" keyword in the registry every time the computer starts. In the non-domain environment, you may have to manually configure the clients start up script in every computer's Local computer policy. However, please note even with this script we still can't totally prevent local administrator from change MAC address because they are ADMINISTRATORS.

thank you dear Mr. Miles Li ... That was helpful , and a complete answer . AMoktar