How To Disable IP address modification and prevent lan ip conflict attacks on LAN computers

How To Disable IP address modification and prevent lan ip conflict attacks on LAN computers
How can I prevent LAN computers from modifying IP addresses and preventing LAN IP conflict attacks? The author believes that it can be implemented through the following channels:
 
Method 1: Disable IP address modification in the registry or Nic IP address modification in the registry.
 
You can use the registry to effectively prohibit the computer from modifying IP addresses or IP addresses. There are two ways to disable it:
 
1. Use the Registry to Disable IP address modification. The method is as follows:
 
First, you need to hide the "Network Neighbor" icon on the desktop, so that others cannot enter the TCP/IP Parameter Setting interface through the "Network Neighbor" attribute window. Expand
"HKEY_CURRENT_USER", "Software", "Microsoft", "Windows", "CurrentVersion", "related ies", and "Explorer" subkeys, And then under the "Explorer" subkeys, create a double byte value named "NoNetHood" and set it to "1.
 
Second, hide the "network" icon in the control panel window so that others cannot open it.
The TCP/IP parameter settings page is displayed. As long as you open "WindowsSys_tem (remove" _ ") netcpl. cpl file, and then enter a line at [don "t load], such as" netcpl. cpl = no. After saving the code again, the "network" icon disappears from the control panel window.
 
At this point, all the ways to change the IP address are "disconnected", so that other people can do nothing even if they want to modify the IP address.
 
In addition, in order to completely prevent technical staff from re-modifying IP addresses by Reverse modification, we need further reinforcement. Methods: Expand the subkeys "HKEY_CURRENT_USER", "Software", "Microsoft", "Windows", "CurrentVersion", "PolicIEs", and "Network" in the Registry in sequence, create a dual-byte value named "NoNetSetup" under the "Network" subkey and set it to "1". Then, if you want to open the "Network Neighbor" or "network" attribute window, you will receive a prompt that you are not authorized to access the window.
 
2. Disable registry access to network protocol Properties
We can disable the function of accessing network protocol properties so that users cannot change it even if they want.
Create the Registry File "forbidden to access network protocol properties. reg" and enter the following content:
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER \ SOFTWARE \ Policies \ Microsoft \ Windows \ Network Connections] "NC_LanChangeProperties" = dword: 00000000
After saving and importing the registry, we can use the registry to prohibit the computer from modifying the IP address.
Method 2: Disable computer ip address modification through group policy, and Disable IP address modification through group policy
Enter "gpedit. msc "OK. Run the Group Policy Editor. In the left-side dialog box of the Group Policy, choose" user configuration ">" management template ">" network ">" network connection "(), then, in the border on the right, find and double-click "prohibit access to properties of the LAN connection component". In the displayed window, set it to "enabled" and click "OK ", after you use the "gpupdate/force" command to update the Group Policy, you cannot modify the IP address without permission. As shown in:
Figure: the Group Policy prohibits you from setting IP addresses.
Method 3: Use a third-party tool to prohibit IP address software modification and IP address modification.
Although registry and group policies can be used to prohibit computers from modifying IP addresses. However, because this method of disabling IP address modification is implemented through operating system settings, some technical staff can also perform reverse modification, in this way, the IP address can be modified again by bypassing the management. Therefore, in this case, you can also use a third-party software to prohibit IP address modification or an IP address modification tool. For example, there is a "portable to USB port disabling software" (: http://www.grabsun.com/monitorusb.html), is a completely prohibit U disk, disable USB storage device software, but does not affect the use of non-USB storage devices, this prevents copying computer files through USB storage devices. The firewall-to-USB port shielding software integrates the function of disabling IP address modification. You only need to check the software interface to prohibit the computer from modifying the IP address. As shown in:
Figure: Disable the computer from modifying the IP address software. In addition, the firewall-to-USB port management software also integrates key operating system locations such as disabling the registry, disabling group policies, and disabling computer management, this can completely protect the security of computer files and prohibit the computer from modifying IP addresses.
In short, whether it is through the registry or through a group policy or through a third party to prohibit the modification of IP address software, can be achieved to prohibit the computer to modify the IP address, specific measures, enterprises and institutions can choose based on their own needs.