Hmmm, are you working in a Domain or workgroup enviroment?
If Domain, the user should not be able to change the IP. If they are able to change the IP (If I Recall Correctly), then they are logged on either as Administrator, or they have been granted rights in User Manger to change the IP...they probably have admin rights.
***First step is to check User Manager on the server, and see what rights they have. Do they have any rights except standard user? If they have elevated rights, maybe it's time to take those away.
If they are logging on locally, they may have admin rights via the local logon and are changing IP's this way. They could log on locally, change the IP, then log back onto the domain.
***Second step is to ensure they can't logon locally, or at least they can't logon locally with admin rights. I.E., change the local admin password, and check local rights.
Regarding the network neighborhood icon, unless the right to see this icon is removed (either in system policies or via regedit), they will see it, even though the can't change the IP. It may show the IP info, but they won't be able to change the IP.
If you are in a NT$ workgroup situation, all above info is suspect, I only deal with domain situation at work. Sorry...
I don't have a NT4 workstation up at home, so I can't be more specific, sorry. Since we are still using NT$ at work, I have been meaning to install one, but haven't found my round to it, yet. Will check this thread tomorrow, and if still active will add further info based on sitting in front of a NT$ workstation.
Jeff
Always happy to hear followup to a thread, was the situation resolved?, etc..