How to Completely Disable ‘Proxy Settings’ Modifications via Group Policy in Windows 11

Windows 11 includes a comprehensive proxy configuration interface within the Settings app, allowing users to define manual proxy servers or enable automatic proxy setup scripts (PAC files) for routing their web traffic. While necessary for some legacy network topologies, granting standard users the ability to modify system proxy settings introduces a critical operational security (OPSEC) and data exfiltration liability on provisioned corporate workstations or secure terminals. A compromised user account or malicious software could silently alter the proxy configuration to route all HTTP/HTTPS traffic through a malicious intercept server, enabling catastrophic Man-in-the-Middle (MitM) attacks, TLS stripping, and the undetected exfiltration of sensitive credentials and session tokens.

This guide explains how to completely disable user access to ‘Proxy Settings’ via Group Policy in Windows 11, enforcing a strict block that locks the network routing configuration and prevents any unsanctioned proxy interception vectors.

Disable Proxy Settings Access via Group Policy

To enforce a strict configuration that explicitly locks the system proxy parameters and strips the OS of its ability to accept proxy modifications from standard users, we must deploy an administrative template. Note that this requires Windows 11 Pro, Enterprise, or Education editions.

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, strictly follow this exact path:

   Computer Configuration > Administrative Templates > Windows Components > Internet Explorer

   Note: Although branded as Internet Explorer, this legacy policy governs the core WinINet proxy settings used system-wide by Windows 11 and Microsoft Edge.
5. In the right-hand pane, locate the policy named Prevent changing proxy settings.
6. Double-click the policy to open its configuration window.
7. Select the radio button next to Enabled. (By explicitly enabling this restriction, we instruct the Windows networking stack to lock the WinINet proxy registry keys, rejecting any modifications initiated via the Windows 11 Settings UI or legacy Control Panel).
8. Click Apply, then click OK.

Verify the Configuration Lockdown

Group Policy changes modifying core OS networking configurations require the operating system to update its local security policy state.

Open Command Prompt as Administrator and run gpupdate /force. To verify the restriction is actively enforced, launch the Windows 11 Settings app and navigate to Network & internet > Proxy. You will immediately notice that all toggle switches and edit buttons under “Automatic proxy setup” and “Manual proxy setup” are completely greyed out and locked in their administratively defined state. A prominent banner at the top of the window will declare, “Some of these settings are managed by your organisation.” Furthermore, any attempt by malware to silently modify the proxy registry keys (e.g., ProxyEnable or ProxyServer) via standard user contexts will be actively rejected by the OS. The terminal’s outbound HTTP/HTTPS routing is now strictly secured against MitM redirection attacks.