Endpoint Protection

I am using SEP12.x. clients are using windows XP. I need to prevent the clients from changing the ip address of the client machines.... Is there any policy to prevent users to change the ip address in SEP. Like TCP/IP properties must me in hidden format... can any one tell me the solutions for it?????

This is not possible with SEP. You should be able to use a GPO to block a user from changing the IP address. If using DHCP, you can set up reservations so that machines will always get the same IP address.

Moving this thread to the Endpoint Protection forum.

Just remove administrator rights from the users. Non admin users can not change ip addresses.

This is not possible through SEP.

In my opinion the best way to do is remove admin rights for the user. If not possible you may achieve this goal by using Group Policy.

You can edit the registry to prevent users from modifying their IP addresses.

Navigate to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces registry subkey. Right click it abd select Security->Advanced-> Permissions. Clear the Allow inheritable permissions from parent to propagate to this object check box. In the Security dialog box that opens, click Remove to remove the inherited permissions. Then, click Add in the Permissions for Interfaces window. In the Select Users or Groups window that opens, select Everyone and click Add. Finally, click OK in the Permissions for Interfaces window. Now every user on the machine is prevented from modifying network settings.

In this case, you can use Group Policy to apply this registry subkey's permissions to all the machines on your network. Then, all the machines on your network will prevent users from modifying their network settings; however, it cannot prevent the users if they are the local administrators or power users on the client machines.

Hope this helps.