How to Completely Disable ‘Internet Connection Sharing’ (ICS) via Group Policy in Windows 11

Internet Connection Sharing (ICS) is a legacy networking feature in Windows 11 that allows a computer connected to a network (via Ethernet or Wi-Fi) to act as a localized NAT router, sharing its internet connection with other devices on a secondary network adapter. While occasionally useful in consumer scenarios or temporary field setups, ICS is a catastrophic network security and data loss prevention (DLP) liability in strict enterprise, military, or zero-trust deployment environments. If a user enables ICS on a corporate workstation, they effectively create an unauthorized, unmonitored “rogue router.” This bypasses corporate firewall appliances, intrusion detection systems (IDS), and Network Access Control (NAC) policies, potentially bridging a secure intranet to an unvetted external network or allowing unauthorized devices to piggyback onto the corporate domain.

This guide explains how to completely disable ‘Internet Connection Sharing’ (ICS) via Group Policy in Windows 11, enforcing a strict zero-trust model where the OS is cryptographically prevented from acting as a network bridge or router.

Disable Internet Connection Sharing (ICS) via Group Policy

To enforce a strict block that permanently neutralizes the ICS routing engine globally across all network adapters, we must deploy an administrative template. Note that this requires Windows 11 Pro, Enterprise, or Education editions.

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, strictly follow this exact path:

   Computer Configuration > Administrative Templates > Network > Network Connections

5. In the right-hand pane, locate the policy named Prohibit use of Internet Connection Sharing on your DNS domain network (or the more aggressive Prohibit installation and configuration of Network Bridge on your DNS domain network to block bridging entirely). For maximum security, configure both.
6. Double-click the Prohibit use of Internet Connection Sharing… policy to open its configuration window.
7. Select the radio button next to Enabled. (By explicitly enabling this prohibition policy, we instruct the Windows networking stack (tcpip.sys and SharedAccess service) to permanently block the UI elements and the underlying API calls required to instantiate NAT sharing).
8. Click Apply, then click OK.

Verify the Configuration Lockdown

Group Policy changes affecting the core networking stack require the system to refresh its configuration.

To force the policy update immediately across the OS, open Command Prompt as Administrator and run gpupdate /force. To verify the restriction is active, press Windows Key + R, type ncpa.cpl, and press Enter to open the Network Connections control panel. Right-click any active network adapter (e.g., Ethernet or Wi-Fi) and select Properties. Navigate to the Sharing tab. The checkbox for “Allow other network users to connect through this computer’s Internet connection” will be completely greyed out or missing entirely. The Windows 11 workstation is now cryptographically bound to a strict, non-routing state, ensuring absolute compliance with network perimeter defenses.