When managing a mixed environment with Windows XP/Vista and Windows 7 machines, you might encounter this specific issue where your carefully configured Group Policy settings for network connections work perfectly on older systems but fail on Windows 7. Here's what's happening under the hood:

// Typical GPO settings that should work:
User Configuration → Administrative Templates → Network → Network Connections
   → Prohibit access to properties of components of a LAN connection (Enabled)
   → Prohibit TCP/IP advanced configuration (Enabled)

Microsoft introduced significant networking stack changes in Windows 7, including a new Network Shell (netsh) architecture and revamped Network Connections interface. The policy processing engine handles these settings differently compared to previous versions.

For Windows 7 specifically, you need to enable this additional policy:

Computer Configuration → Administrative Templates → Network → Network Connections
   → Prohibit access to properties of the LAN connection (Enabled)

This policy exists in both User and Computer configurations, but the Computer Configuration version is what actually locks down the interface in Windows 7.

After applying these settings, run the following command on a Windows 7 client to verify policy application:

gpresult /R

Look for these policies in the output under both Computer and User sections.

If you need to verify the settings directly in the registry, check these keys:

HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Network Connections
   NC_LanProperties (DWORD) = 1
   NC_LanChangeProperties (DWORD) = 1

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Network Connections
   NC_LanProperties (DWORD) = 1
   NC_AllowAdvancedTCPIPConfig (DWORD) = 0

• Always wait for policy refresh cycles or force update with gpupdate /force
• Check Windows 7 clients are receiving the updated GPO version
• Verify no conflicting local policies exist on Windows 7 machines
• Consider using Security Filtering to target only Windows 7 machines

For precise targeting, create a WMI filter with this query:

SELECT * FROM Win32_OperatingSystem 
WHERE Version LIKE "6.1%" AND ProductType="1"

Attach this filter to your GPO to ensure settings only apply to Windows 7 workstations.

While the same Group Policy settings work perfectly for Windows XP, Vista, and Server 2003 machines, Windows 7 introduces new networking components that require additional configuration. The core issue lies in how Windows 7 handles network connections through the "Network and Sharing Center" rather than the classic interface.

Beyond the policies you've already implemented, these additional settings are crucial for Windows 7:

User Configuration → Administrative Templates → Network → Network Connections
   → "Ability to change properties of an LAN connection" → Disabled

Computer Configuration → Administrative Templates → Network → Network Connections
   → "Prohibit access to properties of components of a LAN connection" → Enabled
   → "Prohibit editing of connections" → Enabled

For machines where GPO doesn't propagate correctly, create a registry script:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Network Connections]
"NC_LanProperties"=dword:00000001
"NC_LanChangeProperties"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Network Connections]
"NC_AllowNetBridge_NLA"=dword:00000000
"NC_StdDomainUserSetLocation"=dword:00000001

Create a PowerShell script to verify settings across domain computers:

Get-ADComputer -Filter {OperatingSystem -like "*Windows 7*"} | ForEach-Object {
    $comp = $_.Name
    $reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey(
        'LocalMachine', $comp)
    
    try {
        $key = $reg.OpenSubKey(
            "SOFTWARE\\Policies\\Microsoft\\Windows\\Network Connections")
        $NC_LanChangeProperties = $key.GetValue("NC_LanChangeProperties")
        
        if($NC_LanChangeProperties -ne 1) {
            Write-Output "$comp : TCP/IP settings NOT locked down"
        }
    }
    catch {
        Write-Output "$comp : Registry access failed"
    }
}

Create a WMI filter to ensure policies only apply to Windows 7:

SELECT * FROM Win32_OperatingSystem 
WHERE Version LIKE "6.1%" AND ProductType="1"

For advanced management when UI is disabled, use netsh commands:

netsh interface ipv4 set address name="Local Area Connection" 
source=static addr=192.168.1.100 mask=255.255.255.0 gateway=192.168.1.1

netsh interface ipv4 set dnsservers name="Local Area Connection" 
static 8.8.8.8 primary