How to Prevent Proxy Changes via Regedit

Preventing unauthorized modifications to network proxy configurations is critical for maintaining corporate network security, compliance, and content filtering. System administrators can block users from changing proxy settings through the Windows Registry (regedit) by enforcing Group Policy Objects (GPOs), locking specific registry permissions, removing administrative privileges, and configuring proxy settings globally at the machine level.

1. Disable Access to Registry Editing Tools

The most direct way to stop users from modifying proxy values in the registry is to prevent them from launching regedit entirely.

  1. Open the Group Policy Management Console (gpmc.msc) on a Domain Controller or the Local Group Policy Editor (gpedit.msc) on a local machine.
  2. Navigate to: User Configuration > Administrative Templates > System
  3. Double-click Prevent access to registry editing tools.
  4. Set the policy to Enabled.
  5. Under the Options pane, set Disable regedit from running silently? to Yes (this also stops automated script-based registry edits using .reg files).
  6. Click Apply and OK.

2. Lock Proxy Settings via Group Policy

Administrators should also lock down the proxy settings UI to ensure consistency alongside registry restrictions.

  1. In the Group Policy Editor, navigate to: User Configuration > Administrative Templates > Windows Components > Internet Explorer
  2. Locate and double-click Prevent changing proxy settings.
  3. Set the policy to Enabled.
  4. Click Apply and OK.

This disables the proxy configuration interface in Windows Settings and Internet Options, preventing users from altering network routing.

3. Enforce Proxy Settings Per-Machine

By default, proxy settings can be stored per-user under HKEY_CURRENT_USER (HKCU), where standard users have write permissions. Setting proxy configurations at the machine level moves the enforcement to HKEY_LOCAL_MACHINE (HKLM), which standard users cannot edit without administrative privileges.

  1. Navigate to: Computer Configuration > Administrative Templates > Windows Components > Internet Explorer
  2. Double-click Make proxy settings per-machine (rather than per-user).
  3. Set the policy to Enabled.
  4. Click Apply and OK.

4. Adjust Registry Permissions (ACLs)

If standard users must retain access to regedit for other tasks, administrators can explicitly remove write access to the specific registry keys responsible for proxy settings.

  1. Press Win + R, type regedit, and press Enter.
  2. Navigate to: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
  3. Right-click the Internet Settings key and select Permissions.
  4. Click Advanced.
  5. Select the target user group (such as Users or Authenticated Users) and click Edit.
  6. Set the type to Allow, but uncheck Full Control and Set Value, leaving only Read permissions.
  7. Click Apply and OK.

5. Remove Local Administrator Privileges

Users with local administrative rights can bypass policy restrictions and restore permissions to registry keys. Ensure standard enterprise accounts are placed only in the standard Users group rather than the local Administrators group. Without administrative rights, users cannot alter machine-level (HKLM) proxy configurations or overturn applied Group Policies.