Feature: Network configuration for Network Configuration Operators (#3606) (#3608)

- Network Interface: members of the "Network Configuration Operators" group
  may change the network configuration without being an administrator, if
  NETworkManager runs elevated (IsInRole only reports enabled groups, so the
  check is only true in an elevated process). Only used by Network
  Interface; IsAdmin is unchanged for all other tools.
- Errors of netsh/ipconfig are no longer ignored: each command's output and
  exit code are checked, the first failing command stops the operation and
  its (localized) message is shown instead of "applied successfully".
  Commands that would not change anything (DHCP/DNS autoconfiguration
  already enabled) are skipped, since netsh fails for them.
- The admin hint is also shown as tooltip on the disabled "Apply" in the
  profile context menu, and mentions the group.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: BornToBeRoot

Source/NETworkManager.Localization/Resources/Strings.Designer.cs

@@ -316,7 +316,7 @@
     <value>Configuration applied</value>
   </data>
   <data name="NetworkInterfaceConfigureAdminMessage" xml:space="preserve">
-    <value>Configuring the network interface requires elevated rights!</value>
+    <value>Configuring the network interface requires elevated rights (administrator or member of the "Network Configuration Operators" group)!</value>
   </data>
   <data name="NewTab" xml:space="preserve">
     <value>New tab</value>

Source/NETworkManager.Localization/Resources/Strings.resx

@@ -4,6 +4,7 @@
 using System.Net;
 using System.Net.NetworkInformation;
 using System.Net.Sockets;
+using System.Security.Principal;
 using System.Threading.Tasks;
 using log4net;
 using Microsoft.Win32;
@@ -172,12 +173,7 @@ public static List<NetworkInterfaceInfo> GetNetworkInterfaces()
                 }
             }
 
-            // Check if autoconfiguration for DNS is enabled (only possible via registry key)
-            var nameServerKey =
-                Registry.LocalMachine.OpenSubKey(
-                    $@"SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{networkInterface.Id}");
-            var dnsAutoconfigurationEnabled = nameServerKey?.GetValue("NameServer") != null &&
-                                              string.IsNullOrEmpty(nameServerKey.GetValue("NameServer")?.ToString());
+            var dnsAutoconfigurationEnabled = IsDNSAutoconfigurationEnabled(networkInterface.Id) == true;
 
             // Check if IPv4 protocol is available
             var ipv4ProtocolAvailable = true;
@@ -420,10 +416,13 @@ private static void ConfigureNetworkInterface(NetworkInterfaceConfig config)
         var name = PowerShellHelper.EscapeSingleQuotes(config.Name);
         var commands = new List<string>();
 
+        // netsh returns an error if DHCP is already enabled. Skip these commands, so every error can be reported.
+        var (dhcpEnabled, dnsAutoconfigurationEnabled) = GetCurrentDhcpState(config.Name);
+
         // IP
         if (config.EnableStaticIPAddress)
             commands.Add($"& netsh interface ipv4 set address name='{name}' source=static address={config.IPAddress} mask={config.Subnetmask} gateway={config.Gateway}");
-        else
+        else if (dhcpEnabled != true)
             commands.Add($"& netsh interface ipv4 set address name='{name}' source=dhcp");
 
         // DNS
@@ -434,14 +433,75 @@ private static void ConfigureNetworkInterface(NetworkInterfaceConfig config)
             if (!string.IsNullOrEmpty(config.SecondaryDNSServer))
                 commands.Add($"& netsh interface ipv4 add dnsservers name='{name}' address={config.SecondaryDNSServer} index=2 validate=no");
         }
-        else
+        else if (dnsAutoconfigurationEnabled != true)
         {
             commands.Add($"& netsh interface ipv4 set dnsservers name='{name}' source=dhcp");
         }
 
         RunCommands(commands);
     }
 
+    /// <summary>
+    /// Checks whether the DNS servers of a network interface are assigned automatically (DHCP). This can only be
+    /// detected via the registry: the "NameServer" value of the interface is empty, if no static DNS servers are set.
+    /// </summary>
+    /// <param name="interfaceId">ID (GUID) of the network interface.</param>
+    /// <returns>Whether DNS autoconfiguration is enabled, or <see langword="null" /> if it cannot be determined.</returns>
+    private static bool? IsDNSAutoconfigurationEnabled(string interfaceId)
+    {
+        using var interfaceKey = Registry.LocalMachine.OpenSubKey(
+            $@"SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{interfaceId}");
+
+        var nameServer = interfaceKey?.GetValue("NameServer");
+
+        return nameServer == null ? null : string.IsNullOrEmpty(nameServer.ToString());
+    }
+
+    /// <summary>
+    /// Reads the current DHCP state of a network interface right before it is configured (the information shown in the
+    /// UI can be outdated). Returns <see langword="null" /> for values that cannot be determined, in which case the
+    /// corresponding command is not skipped.
+    /// </summary>
+    /// <param name="name">Name of the network interface.</param>
+    /// <returns>Whether DHCP is enabled for the IPv4 address and for the DNS servers.</returns>
+    private static (bool? DhcpEnabled, bool? DNSAutoconfigurationEnabled) GetCurrentDhcpState(string name)
+    {
+        try
+        {
+            var networkInterface = System.Net.NetworkInformation.NetworkInterface.GetAllNetworkInterfaces()
+                .FirstOrDefault(x => x.Name == name);
+
+            if (networkInterface == null)
+                return (null, null);
+
+            return (networkInterface.GetIPProperties().GetIPv4Properties()?.IsDhcpEnabled,
+                IsDNSAutoconfigurationEnabled(networkInterface.Id));
+        }
+        catch (Exception ex)
+        {
+            Log.Warn($"Could not read the DHCP state of network interface \"{name}\".", ex);
+            return (null, null);
+        }
+    }
+
+    /// <summary>
+    /// Checks whether the current process is allowed to change the network configuration (IP addresses, DNS servers,
+    /// release/renew, flush DNS cache). This is the case if it is running as administrator or as member of the
+    /// "Network Configuration Operators" group, which may modify the TCP/IP settings without being an administrator.
+    /// </summary>
+    /// <remarks><see cref="WindowsPrincipal.IsInRole(SecurityIdentifier)" /> only returns <see langword="true" /> if the
+    /// group is enabled in the access token. With UAC, both groups are only enabled if the application is running
+    /// elevated, so a non-elevated process is correctly reported as not allowed.</remarks>
+    /// <returns><see langword="true" /> if the network configuration can be changed.</returns>
+    public static bool HasPermissionToConfigure()
+    {
+        var principal = new WindowsPrincipal(WindowsIdentity.GetCurrent());
+
+        return principal.IsInRole(WindowsBuiltInRole.Administrator) ||
+               principal.IsInRole(new SecurityIdentifier(WellKnownSidType.BuiltinNetworkConfigurationOperatorsSid,
+                   null));
+    }
+
     /// <summary>
     /// Asynchronously flushes the system DNS resolver cache.
     /// </summary>
@@ -459,7 +519,7 @@ public static Task FlushDnsAsync()
     /// <remarks>Requires the application to be running with administrator privileges.</remarks>
     private static void FlushDns()
     {
-        RunCommands(["& ipconfig /flushdns"], checkExitCode: true);
+        RunCommands(["& ipconfig /flushdns"]);
     }
 
     /// <summary>
@@ -496,7 +556,7 @@ private static void ReleaseRenew(IPConfigReleaseRenewMode mode, string adapterNa
         if (mode is IPConfigReleaseRenewMode.ReleaseRenew6 or IPConfigReleaseRenewMode.Renew6)
             commands.Add($"& ipconfig /renew6 '{name}'");
 
-        RunCommands(commands, checkExitCode: true);
+        RunCommands(commands);
     }
 
     /// <summary>
@@ -551,28 +611,47 @@ private static void RemoveIPAddressFromNetworkInterface(NetworkInterfaceConfig c
     }
 
     /// <summary>
-    /// Runs one or more native commands via a PowerShell runspace.
-    /// When <paramref name="checkExitCode"/> is <see langword="true"/>, a non-zero
-    /// <c>$LASTEXITCODE</c> is treated as an error via <c>Write-Error</c>.
-    /// Use <see langword="false"/> for <c>netsh</c>, whose exit codes are unreliable
-    /// for idempotent operations (e.g. returns 1 when already on DHCP).
+    /// Runs one or more native commands (<c>netsh</c>, <c>ipconfig</c>) one after another via a PowerShell runspace.
+    /// Stops at the first command that fails (non-zero exit code) and throws an exception with the output of the
+    /// command (e.g. "The requested operation requires elevation."), which is localized by Windows and shown to the
+    /// user. Commands that would not change anything (and therefore fail with <c>netsh</c>) must not be passed.
     /// </summary>
-    private static void RunCommands(IEnumerable<string> commands, bool checkExitCode = false)
+    /// <param name="commands">Commands to run, e.g. <c>&amp; netsh interface ipv4 ...</c>.</param>
+    /// <exception cref="Exception">If a command fails.</exception>
+    private static void RunCommands(IEnumerable<string> commands)
     {
-        string script;
+        foreach (var command in commands)
+        {
+            using var ps = SMA.PowerShell.Create();
+
+            ps.AddScript($"$output = {command} 2>&1 | Out-String{Environment.NewLine}" +
+                         "[PSCustomObject]@{ Output = $output; ExitCode = $LASTEXITCODE }");
+
+            var result = ps.Invoke().LastOrDefault();
 
-        if (checkExitCode)
-            script = string.Join(Environment.NewLine, commands.Select(cmd =>
-                $"{cmd}{Environment.NewLine}if ($LASTEXITCODE -ne 0) {{ Write-Error \"Command failed with exit code $LASTEXITCODE\" }}"));
-        else
-            script = string.Join(Environment.NewLine, commands);
+            // The script itself failed and did not return a result.
+            if (result == null)
+                throw new Exception(ps.HadErrors
+                    ? string.Join("; ", ps.Streams.Error.Select(e => e.ToString()))
+                    : $"\"{command}\" did not return a result.");
 
-        using var ps = SMA.PowerShell.Create();
-        ps.AddScript(script);
-        ps.Invoke();
+            // Each command runs in a new runspace, so the exit code is only set if the native command was started.
+            var exitCode = result.Properties["ExitCode"]?.Value as int?;
+
+            if (exitCode == 0)
+                continue;
 
-        if (checkExitCode && ps.HadErrors)
-            throw new Exception(string.Join("; ", ps.Streams.Error.Select(e => e.ToString())));
+            var output = result.Properties["Output"]?.Value?.ToString()?.Trim();
+
+            Log.Error($"Command \"{command}\" failed with exit code {exitCode?.ToString() ?? "-/-"}: {output}");
+
+            if (!string.IsNullOrEmpty(output))
+                throw new Exception(output);
+
+            throw new Exception(exitCode == null
+                ? $"\"{command.TrimStart('&', ' ')}\" could not be run."
+                : $"\"{command.TrimStart('&', ' ')}\" failed with exit code {exitCode}.");
+        }
     }
 
     #endregion

Source/NETworkManager.Models/Network/NetworkInterface.cs

@@ -60,6 +60,12 @@ public bool IsNetworkInterfaceLoading
         }
     }
 
+    /// <summary>
+    /// Gets a value indicating whether the application has the permission to change the network configuration
+    /// (running as administrator or as member of the "Network Configuration Operators" group).
+    /// </summary>
+    public bool HasPermissionToConfigure { get; } = NetworkInterface.HasPermissionToConfigure();
+
     /// <summary>
     /// Gets or sets a value indicating whether configuration is allowed.
     /// </summary>
@@ -846,7 +852,7 @@ private bool AdditionalCommands_CanExecute(object parameter)
                !ConfigurationManager.Current.IsChildWindowOpen;
     }
 
-    private bool ConfigureCommands_CanExecute(object parameter) => ConfigurationManager.Current.IsAdmin &&
+    private bool ConfigureCommands_CanExecute(object parameter) => HasPermissionToConfigure &&
                                                                    Application.Current.MainWindow != null &&
                                                                    !((MetroWindow)Application.Current.MainWindow).IsAnyDialogOpen &&
                                                                    !ConfigurationManager.Current.IsChildWindowOpen;

Source/NETworkManager/ViewModels/NetworkInterfaceViewModel.cs

@@ -63,7 +63,10 @@
         </DataTemplate>
         <x:Array x:Key="NetworkInterfaceProfileContextMenuExtraItems" Type="{x:Type MenuItem}">
             <MenuItem Header="{x:Static localization:Strings.Apply}"
-                      Command="{Binding ApplyProfileCommand}">
+                      Command="{Binding ApplyProfileCommand}"
+                      ToolTip="{x:Static localization:Strings.NetworkInterfaceConfigureAdminMessage}"
+                      ToolTipService.ShowOnDisabled="True"
+                      ToolTipService.IsEnabled="{Binding HasPermissionToConfigure, Converter={StaticResource BooleanReverseConverter}}">
                 <MenuItem.Icon>
                     <Rectangle Width="16" Height="16"
                                Fill="{DynamicResource MahApps.Brushes.Gray3}">
@@ -1464,7 +1467,7 @@
                         </Grid>
                         <Grid Grid.Row="5"
                               Background="{DynamicResource MahApps.Brushes.Gray10}"
-                              Visibility="{Binding Source={x:Static settings:ConfigurationManager.Current}, Path=IsAdmin, Converter={StaticResource BooleanReverseToVisibilityCollapsedConverter}}"
+                              Visibility="{Binding HasPermissionToConfigure, Converter={StaticResource BooleanReverseToVisibilityCollapsedConverter}}"
                               Margin="0,10,0,0">
                             <StackPanel VerticalAlignment="Center" HorizontalAlignment="Stretch"
                                         Margin="10">

Source/NETworkManager/Views/NetworkInterfaceView.xaml

@@ -79,7 +79,11 @@ The options you can set correspond to the network adapter properties `Internetpr
 
 :::note
 
-All actions on this tab require the application to be running with **administrator privileges**. If the app is not elevated, a banner is shown at the bottom with a **Restart as Administrator** button.
+All actions on this tab (and **Apply** from the profile context menu) require the application to be running elevated, either with **administrator privileges** or as a member of the **Network Configuration Operators** group. If the app is not elevated, a banner is shown at the bottom with a **Restart as Administrator** button.
+
+Members of the **Network Configuration Operators** group don't need to be administrators: with User Account Control, the group is only active in an elevated process. Use **Restart as Administrator** and confirm the prompt with your own credentials.
+
+If a change fails (e.g. due to missing permissions), the error message of Windows is shown below the configuration.
 
 :::
 

Website/docs/application/network-interface.md

@@ -36,6 +36,10 @@ Release date: **xx.xx.2026**
 
 ## Improvements
 
+**Network Interface**
+
+- Members of the **Network Configuration Operators** group can now change the network configuration (IP address, DNS servers, release/renew) without being an administrator. NETworkManager has to run elevated (**Restart as Administrator**, confirm with your own credentials). The hint is now also shown as tooltip on **Apply** in the profile context menu. [#3606](https://github.com/BornToBeRoot/NETworkManager/issues/3606)
+
 - The collapsed/expanded state of profile groups (e.g. **linux-server**) is now remembered per profile file and shared across all tools, instead of resetting every time you switch tools or restart the application. [#3539](https://github.com/BornToBeRoot/NETworkManager/pull/3539)
 
 **IP Scanner**
@@ -67,6 +71,10 @@ Release date: **xx.xx.2026**
 
 ## Bug Fixes
 
+**Network Interface**
+
+- Fixed errors when changing the network configuration (e.g. missing permissions) not being shown — the change was reported as successful although it failed. The error message of Windows is now shown. [#3606](https://github.com/BornToBeRoot/NETworkManager/issues/3606)
+
 **Dashboard**
 
 - Fixed the **Network Connection** widget running a full connection check on every application startup, even if the Status Window or Dashboard was never opened. It now only checks when actually shown - via the tray icon, on a network change, or when the Dashboard tab is opened. [#3553](https://github.com/BornToBeRoot/NETworkManager/pull/3553)