How to disable Tcp/Ip settings in windows 7 via GPO?

Question

I have enabled following policies,

• "Prohibit TCP/IP advanced connection"
• "Prohibit access to properties of components of a LAN connection"
• "Enable Windows 2000 Network Connections setings for Administrators"

after doing all these, all machines running windows xp, 2000 and vista have network settings properties button disabled as expected.

However all machines running windows 7 have no effect, I believe there are few more steps, all Windows 7 machines are on domain and we want to control this via Domain Controler's GPO.

Please let me know, what I need to do to have Windows 7 disable the properties of network connection, I am not network expert, I read few articles about what new has been added in GPO of windows 7 but I am blank.

Everything works fine on Windows XP, Vista, 2003 Server. Only Windows 7 is a problem.

Solution 1

If I'm not mistaken, those settings are only applicable to W2KSP1, WinXP, and W2K3 computers. You need to enable the "Prohibit access to the properties of a LAN connection" setting, which should prohibit access to any properties of a LAN connection in Windows Vista and Windows 7.

Solution 2

I should be User Configuration/Administrative Templates/Network/Network Connections/"Prohibit access to properties of a LAN Connection" (since Windows 200 SP1). The problem I'm having with GP is that you are not sure if it got applied, so restarting is always a good idea.

http://www.microsoft.com/downloads/details.aspx?familyid=18C90C80-8B0A-4906-A4F5-FF24CC2030FB&displaylang=en#filelist

Besides that I would like to point out two things:

1. Are your users local Administrators? Iirc even Power Users should not be able to configure LAN Adaptors...
2. Consider upgrading to Windows Server 2008 R2

Comments

[Akash Kava]

If you see my question, the 2nd point is the same policy you are talking about, still it works on Windows Vista, but not on 7.

[Akash Kava]

Yes, we are able to make changes, we do not want our users to change ip address at all once this policy is in place, but xp and vista disables the button correctly but 7 doesnt and it also allows user to change anything they want to.

[Siim K]

Just a thought - are you trying with a Administrator or a Standard user in Windows 7? I have been playing with the GPOs a bit and when I logged in as a Standard user in Win 7 then the settings in your original post worked - the Properties button was disabled...

[iainlbc]

+1 for testing in your environment, is your PDC Server 2008 or 2003 based?

[Akash Kava]

thanks for trying out, however even for administrators it did work on xp and vista, it doesnt work for administrators on 7

[jer.salamon]

us psexec on all computers and run gpudate /force

[Akash Kava]

I have Windows Server 2008 R2, the domain users who login to local machine, they are granted administrator access to the machine, but they are not domain administrators, everything works till windows vista, but for some reason it does not work on windows 7 only.

[Anna Reed]

With the GPO I posted it is possible to disable the settings even for local Administrators.