How to Prevent Proxy Changes via Regedit
Preventing unauthorized modifications to network proxy configurations
is critical for maintaining corporate network security, compliance, and
content filtering. System administrators can block users from changing
proxy settings through the Windows Registry (regedit) by
enforcing Group Policy Objects (GPOs), locking specific registry
permissions, removing administrative privileges, and configuring proxy
settings globally at the machine level.
1. Disable Access to Registry Editing Tools
The most direct way to stop users from modifying proxy values in the
registry is to prevent them from launching regedit
entirely.
- Open the Group Policy Management Console
(
gpmc.msc) on a Domain Controller or the Local Group Policy Editor (gpedit.msc) on a local machine. - Navigate to:
User Configuration>Administrative Templates>System - Double-click Prevent access to registry editing tools.
- Set the policy to Enabled.
- Under the Options pane, set Disable regedit from running
silently? to Yes (this also stops automated
script-based registry edits using
.regfiles). - Click Apply and OK.
2. Lock Proxy Settings via Group Policy
Administrators should also lock down the proxy settings UI to ensure consistency alongside registry restrictions.
- In the Group Policy Editor, navigate to:
User Configuration>Administrative Templates>Windows Components>Internet Explorer - Locate and double-click Prevent changing proxy settings.
- Set the policy to Enabled.
- Click Apply and OK.
This disables the proxy configuration interface in Windows Settings and Internet Options, preventing users from altering network routing.
3. Enforce Proxy Settings Per-Machine
By default, proxy settings can be stored per-user under
HKEY_CURRENT_USER (HKCU), where standard users have write
permissions. Setting proxy configurations at the machine level moves the
enforcement to HKEY_LOCAL_MACHINE (HKLM), which standard
users cannot edit without administrative privileges.
- Navigate to:
Computer Configuration>Administrative Templates>Windows Components>Internet Explorer - Double-click Make proxy settings per-machine (rather than per-user).
- Set the policy to Enabled.
- Click Apply and OK.
4. Adjust Registry Permissions (ACLs)
If standard users must retain access to regedit for
other tasks, administrators can explicitly remove write access to the
specific registry keys responsible for proxy settings.
- Press
Win + R, typeregedit, and press Enter. - Navigate to:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings - Right-click the Internet Settings key and select Permissions.
- Click Advanced.
- Select the target user group (such as Users or Authenticated Users) and click Edit.
- Set the type to Allow, but uncheck Full Control and Set Value, leaving only Read permissions.
- Click Apply and OK.
5. Remove Local Administrator Privileges
Users with local administrative rights can bypass policy restrictions
and restore permissions to registry keys. Ensure standard enterprise
accounts are placed only in the standard Users group
rather than the local Administrators group. Without
administrative rights, users cannot alter machine-level
(HKLM) proxy configurations or overturn applied Group
Policies.