Network Connection Properties - Disabling
I raised this issue at Windows7Forums and only got a small response. In Win XP Professional to stop users changing the IP address in the Network Connection properties you can make the user a 'Limited' account. However, if you require the user to have admin rights then they can access the Network Connection Properties. If you go into the Group Policy Editor you can change the settings so that everyone including administrators cannot access the Network Connection Properties (The right click menu option for 'Properties 'is disabled). The two Policies i enabled are; GPEDIT Local Computer Policy....User Configuration....Administrative Templates....Network....Network Connections 1. Prohibit access to properties of a LAN connection 2. Enable Windows 2000 Network Connections settings for Administrators And this works a treat - admittedly Admins can change the policies but the idea is to stop people fiddling (a padlock can still be broken off) In Windows 7 Professional i changed these policies BUT it does not stop an Administrative account from being ablke to access the Network Connection Properties. I have tried this on 4 machines each running Win7 Pro and i can still get access to the Network Connection Properties. I posted the problem in the "Windows7Forums" and received minmal replies but also a reply from a guy who is experiencing the same issue in Win7 Ultimate. I decided to contacted MS Support who after two long phone calls and using "Easy Access" were a little perplexed as they could get the disabling to work on their Win7 Ultimate machines but not on my Win7Pro machine. At this point i may have accepted that this was not avaolable in Win7 Pro but the reply to my post in Windows7Forums made me think otherwise. Also the MS support guy said he would pass this to another team. I was rang again today and told that my problem would require registry tweaking and this would be under chargeable support (199). Now for something that i think is a BUG i don't think i should be charged. Can all who read this enable the two Policies and reply with results - has Networtk Connection Properties been disabled? Can anyone help me to solve this issue.
December 17th, 2009 6:52pm

I raised this issue at Windows7Forums and only got a small response.In Win XP Professional to stop users changing the IP address in the Network Connection properties you can make the user a 'Limited' account. However, if you require the user to have admin rights then they can access the Network Connection Properties. If you go into the Group Policy Editor you can change the settings so that everyone including administrators cannot access the Network Connection Properties (The right click menu option for 'Properties 'is disabled). The two Policies i enabled are;GPEDITLocal Computer Policy....User Configuration....Administrative Templates....Network....Network Connections1. Prohibit access to properties of a LAN connection2. Enable Windows 2000 Network Connections settings for AdministratorsAnd this works a treat - admittedly Admins can change the policies but the idea is to stop people fiddling (a padlock can still be broken off)In Windows 7 Professional i changed these policies BUT it does not stop an Administrative account from being ablke to access the Network Connection Properties. I have tried this on 4 machines each running Win7 Pro and i can still get access to the Network Connection Properties.I posted the problem in the "Windows7Forums" and received minmal replies but also a reply from a guy who is experiencing the same issue in Win7 Ultimate. I decided to contacted MS Support who after two long phone calls and using "Easy Access" were a little perplexed as they could get the disabling to work on their Win7 Ultimate machines but not on my Win7Pro machine. At this point i may have accepted that this was not avaolable in Win7 Pro but the reply to my post in Windows7Forums made me think otherwise. Also the MS support guy said he would pass this to another team. I was rang again today and told that my problem would require registry tweaking and this would be under chargeable support (199). Now for something that i think is a BUG i don't think i should be charged.Can all who read this enable the two Policies and reply with results - has Networtk Connection Properties been disabled?Can anyone help me to solve this issue. well i think its because your is also in the "Network Configuration Operators" Group so even when you limit this configuration from "administrators" Group your user have access/change permission from other Group which is "Network Configuration Operators" Group.By the way test this:1-Right Click On Computer -->>Manage -->>Local User And groups\User2-By default your Administrator User is disable and there is another user which you create during windows installation for example it's Jack3-Right click on Jack and select Properties4-In the Member of Tab remove the "Network Configuration Operators" from the user and click Apply and OK5-Restart your ComputerHope it is work for youGood LuckMicrosoft Certified System Engineer 2003
Free Windows Admin Tool Kit Click here and download it now
December 17th, 2009 7:16pm

By default if they are an Administrator they are not in the "Network Configuration Operators" group. The NCO group, i believe, gives standard (limited) users the ability to change Network properties. So i'm afriad this doesn't work as it is a non-starter.
December 17th, 2009 9:44pm

By default if they are an Administrator they are not in the "Network Configuration Operators" group. The NCO group, i believe, gives standard (limited) users the ability to change Network properties. So i'm afriad this doesn't work as it is a non-starter. well i don't get it really what your problem !!Are you wanna Block the primary administrator user from editing the Network Configuration or you want to allow a special user (NOT THE USER THAT CREATE DURING WINDOWS INSTALLATION) to configure the network setting?Microsoft Certified System Engineer 2003
Free Windows Admin Tool Kit Click here and download it now
December 17th, 2009 11:28pm

If you read his original post, you will see that he simply wants the group policy to work....like it has in previous OS's and is suppose to work according to Microsoft in Windows 7. I have tested this on both Windows 7 Ultimate 32 bit and Windows 7 Ultimate 64bit and he has tested on Windows 7 professional and neither of us can make it work
December 17th, 2009 11:33pm

If you read his original post, you will see that he simply wants the group policy to work....like it has in previous OS's and is suppose to work according to Microsoft in Windows 7. I have tested this on both Windows 7 Ultimate 32 bit and Windows 7 Ultimate 64bit and he has tested on Windows 7 professional and neither of us can make it work Thanks for testing this i'm glad it's not just me. I think the more who try the more chance of MS doing something about it.
Free Windows Admin Tool Kit Click here and download it now
December 18th, 2009 12:16am

I can't believe there are no more answers/comments. This is obviously a problem - come on MS.
December 18th, 2009 1:36pm

One thing that confuses me about your setup is are your computers on a domain?If so, then I absolutely suggest managing them through your domain Group Policy settings, and not messing around with the Local Machine Group Policy settings. On a totally overkill method, disable the ncpa.cpl through the various methods:Setup a Domain Group Policy policy that only affects the users/OU that you want it to.. And for safe measure I always add the Deny Group Policy setting for the domain admins, in case it somehow wass placed on them by slippery fingers.User Configuration\Administrative Templates\Control Panel\Hide specified Control Panel appletsAdd -> ncpa.cplPATH RULE: User Configuration\Windows Settings\Security Settings\Software Restriction Policies\Additional RulesNew -> Path Rule ->Path: %SystemRoot%\System32\ncpa.cplSecurity Level: DisallowedYou could also add a HASH rule, however you would have to add this for every version of the ncpa.cpl file you could think of.User Configuration\Administrative Templates\Network\Network Connections\Enable all the Prohibit policies you want =-)
Free Windows Admin Tool Kit Click here and download it now
December 18th, 2009 11:17pm

Apologies for no reply recently - thanks for the advice. No the PC's are not part of a Domain, that would have been easier to sort i'm sure. I don't want to disable the whole CP when the GP Editor SHOULD be able to do the job i require. I've spoken to the support guys again and it would appear that it is not likely that it will ever work as it is something to do with the difference between Administrators in Win 7/Vista and all previous versions of Windows. Digress slightly - Some will know that the actual Administrator account in Win 7 & Vista is hidden whilst in XP it came to life in Safe Mode. I'm not sure what this has to do with Group Policies but i can only think that when you create an Administrators account in XP it is different than creating an Administrator account in Win 7. (I knew that already otherwise the GP changes would have worked LOL!!) Back on track - the upshot is that i will raise the issue with support again soon, but.... Santa's coming and i have an important job to do for my kids etc! When i have more info i will post again. (Before the end of the year i hope). I would like to finish with a note to MS; I'm not going to get all bitter now, but when you buy a product you expect things to work don't you? I mean you wouldn't buy a car with electric windows that you had to open and close by cranking a handle, would you. Cmon guys tis the season to be joyful and giving!! Merry Xmas to one and all! PS: In this world of political correctness why is it that there is no such thing as a Snowwoman, we have a Snowman? Thanks to my wife for the answer "Only a man stands around the whole of Christmas and does nothing" - one less present to buy... sorry dear!
December 22nd, 2009 6:40pm

Yes Sandwich After these changes you will be able to see the lan connection properties in administrator account But you just create one simple user with limited privilege, log in to that user and see. I have checked it personally once you log in to that simple user you will see the lan properties is disabled. Reply me back if I am wrong
Free Windows Admin Tool Kit Click here and download it now
May 6th, 2010 3:59pm

Any updates?Regards, Konstantin Salavatov
March 4th, 2011 9:50am

I have the same problem in windows 7. I've tried to monitor registry actions using process monitor when clicking properties menu from local area connection. In XP, explorer.exe read HKCU\...\Network Connection\NC_LanProperties and apply it but In Win7, explorer.exe doesnot read HKCU\...\Network Connection\*, so it doesn't applied. I think this is a bug of Windows 7. If you have any idea, pls post it. Bye. Thanks.
Free Windows Admin Tool Kit Click here and download it now
May 26th, 2011 2:15pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics