Prevent Network Profile Changes via Windows Registry

This guide explains how system administrators can prevent standard Windows users from altering network configuration profiles using the Registry Editor (Regedit). By adjusting Registry permissions on specific network profile keys and enforcing administrative restriction policies directly in the registry, administrators can secure network settings against unauthorized modifications on a local computer.

Step 1: Open the Registry Editor with Elevated Privileges

  1. Press Win + R on the keyboard to open the Run dialog.
  2. Type regedit and press Ctrl + Shift + Enter (or click OK and accept the User Account Control prompt) to launch the Registry Editor as an administrator.

Step 2: Restrict Permissions on Network Profile Registry Keys

Network profiles and connection types (Public, Private, Domain) are stored under the NetworkList key. Restricting write access prevents standard users from modifying existing profiles or their properties.

  1. In the Registry Editor, navigate to the following path:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles

  2. Right-click the Profiles folder (key) and select Permissions.

  3. In the Permissions window, click the Advanced button.

  4. Locate the Users or Authenticated Users group in the permission entries list.

  5. Click Edit (or double-click the entry) and ensure the permission is set to Read only. Ensure Full Control and Write permissions are unselected.

  6. Check the box at the bottom labeled Replace all child object permission entries with inheritable permission entries from this object.

  7. Click Apply, confirm any prompt by clicking Yes, and then click OK.

Step 3: Enforce Network Configuration Policies via Registry

To completely lock down the ability to modify network adapter properties, TCP/IP settings, and network profile characteristics, configure the Network Connections policy keys:

  1. Navigate to the following policy location:

    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Network Connections

    (If the Network Connections key does not exist under Windows, right-click Windows, select New > Key, and name it Network Connections.)

  2. Right-click in the right pane, select New > DWORD (32-bit) Value, and name it:

    NC_EnableAdminProhibits

  3. Double-click NC_EnableAdminProhibits and set its Value data to 1. This enforces connection settings restrictions on standard users and administrators alike.

  4. Create another DWORD (32-bit) Value named:

    NC_StdDomainUser

  5. Double-click NC_StdDomainUser and set its Value data to 1. This blocks standard users from accessing and modifying LAN connection properties.

Step 4: Apply the Changes

  1. Close the Registry Editor.
  2. Restart the Network List Service via services.msc or restart the local computer to ensure all permissions and policy changes take full effect.