notebook users (win 2000 pro sp4)

The Group policy is the easiest way to go. If you just use GPEDIT.MSC, open that, or you do it through an active directory Group Policy, go into that one. go to the user configuration> Administrative templates>Network>Network and Dial-up connections. You wil have several options there. if you want the user to be able to do something, then set the policy accordingly. All of those options start with prohibit, so to give the user the permission, you will have to set the policy to "disable".

I hope this Helps you,
Nerd32768

We have similar problems in our enterprise, and have yet to find a good solution to it. Our current workaround is to implement a local account that has admin rights to the machine. This account is assigned a random password which is documented on a spreadsheet. When a user needs to do something requiring admin rights, we give them the current password. They can log on and make the necessary changes. The next time they are on the LAN (either locally or VPN), we connect remotely to the machine via Computer Management and reset the password to the next one on the spreadsheet. This allows the user to have access as we deem necessary, but no permanent local admin rights. And since the remote account has none of their normal profile settings (My Documents doesn't map to the proper folder, Outlook profile is missing, etc.), normally only use the Remote account as intended.

I am aware that doesn't directly answer your question (except to say that I don't think it can be done), but this may provide an alternate solution for you.

Try these reg hacks...

In the following key:
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\
Network Connections]

Look for/add these entries. 0 to enable the restriction, 1 to disable the restriction. NOTE: the Data Type=REG_DWORD (DWORD Value)

HACKS:
NC_AddRemoveComponents - Restrict add and remove network components
NC_AdvancedSettings - Restrict changes to Advanced Settings
NC_AllowAdvancedTCPIPConfig - Restrict changes to advanced TCPIP configuration
NC_ChangeBindState - Restrict changes to protocol and service bindings
NC_DeleteAllUserConnection - Restrict deletion of public RAS connections
NC_DeleteConnection - Restrict deletion of RAS connections
NC_DialupPrefs - Restrict changes to the Dial-up Preferences
NC_EnableAdminProhibits - Enable Windows 2000 network connections for administrators
NC_LanChangeProperties - Restrict access to component properties of a LAN connection
NC_LanConnect - Restrict connecting and disconnecting a LAN connection
NC_LanProperties - Restrict access to properties of a LAN connection
NC_NewConnectionWizard - Disable the Network Connection wizard
NC_RasAllUserProperties - Restrict access to properties of public RAS connections
NC_RasChangeProperties - Restrict access to properties of a RAS connection
NC_RasConnect - Restrict connecting and disconnecting a RAS connection
NC_RasMyProperties - Restrict access to private RAS connection properties
NC_RenameAllUserRasConnection - Restrict renaming of public RAS connections
NC_RenameConnection - Restrict renaming of connections
NC_RenameLanConnection - Restrict renaming of LAN connections
NC_RenameMyRasConnection - Restrict renaming of private RAS connections
NC_Statistics - Disable status statistics for an active connection