Managing Connections Using Group Policy

In previous Windows platforms, you could use Group Policy to lock down or manage certain aspects of network connections on the computer. The Group Policy settings for doing this are located at:

User Configuration\Policies\Administrative Templates\Network\Network Connections

For example, by enabling the Prohibit Access To The Advanced Settings Item On The Advanced Menu policy setting, you could prevent users from opening Advanced Settings under the Advanced menu option in the Network Connections folder. If you also enable the Enable Windows 2000 Network Connections Settings For Administrators policy setting, even local administrators on the computer would not have access to Advanced Settings.

Beginning with Windows Vista, however, because of UAC and how it is implemented, some of these Group Policy settings are no longer supported. For example:

• If a user is a local administrator on a computer running Windows Vista or later versions, none of the restrictions from these Group Policy settings found under User Configuration\Policies\Administrative Templates\Network\Network Connections applies. Also, the Enable Windows 2000 Network Connections Settings For Administrators policy setting is no longer supported. This policy was used in older Windows platforms to enable Group Policy restrictions for Network Connections to apply to administrators and not just ordinary users.
• If a user is a standard user on a computer running Windows Vista or later versions, some but not all of the Group Policy settings found under User Configuration\Policies \Administrative Templates\Network\Network Connections still apply. The exception is policies for actions that now require administrative privileges to perform them. An example of this exception is accessing Advanced Settings under the Advanced menu option in the Network Connections folder, which in Windows Vista and later versions requires administrative privileges to perform. As a result, the Prohibit Access To The Advanced Settings Item On The Advanced Menu policy setting in Windows Vista and later versions does not apply to standard users, because they cannot perform this action anyway without administrator credentials; therefore, this Group Policy setting is superfluous. Another example is installing or removing network features for a connection, which requires administrative privileges. As a result, the Prohibit TCP/IP Advanced Configuration policy setting does not apply to standard users because this policy setting is superfluous for them.

Table below summarizes support for Network Connection user policy settings in Windows Vista and later versions.

Support for Group Policy User Settings for Network Connections for Standard Users in Windows Vista and Later Versions