Unable to change network settings after applying Microsoft Security Baseline

Copper Contributor

Hello,

 

After applying W10 1909 (on a non joined to Domain wks) Microsoft Security Baseline, my local users are NOT able to change any network settings (no issue for Admins) : 

 

Eg :

Renaming : "Error Renaming Connection"

Cannot rename this connection. The program is blocked by group policy. For more information, contact your system administrator.

 

Modify network properties : "Network Connections" An unexpected error occured.

 

As both problems were not present before applying the security baseline and the issue is not present for admins, I'm sure it is "permission/privilege/GPO related"

 

What I already did : 

 

1) My users belongs to local group Network Configuration Operators (described as : "Members in this group can have some administrative privileges to manage configuration of networking")

 

2) From a GPO aspect, I've checked 

User Configuration \ Administrative Templates \ Network \ Network Connections options.

By default they are not configured by MSoft Security Baseline so I forced (explicit) as disable all prohibit ones and enable all related to ability...

 

I also modified Computer Configuration \ Windows Settings \ Security settings \Network List Manager \All Networks     All networks that a user connects to.

To allow the users to rename them.

 

3) As some people were experiencing the same error message for changing settings of NIC, even if it was not related to privilegd, I tried deinstall/resinstall driver (using the last one found), regsvr32 %systemroot%\system32\netshell.dll and regsvr32 %systemroot%\system32\ole32.dll, netsh int ipvx reset reset.log... without any improvement

 

Any idea of the parameters I need to modify (my users need to be able to quit regular network (dhcp) and set a specific one to connect to devices (no dhcp available) but I don't want to set them admins !

 

Thanks in advance

 

BR

1 Reply

@cybermarsu You need to change the following option:

 

User Account Control: Behavior of the elevation prompt for standard usersPrompt for credentials on the secure desktop

 

The baseline will set the value "Automatically deny elevation requests".

That fixed my issue.