Josh:
I have also been trying to get this to work, without success, so unless we're both doing something wrong, I would guess that you can't make this work sufficiently to impact the members of the local administrators group. What I have done here is moved those particular users into the "Power Users" groups (Win7 maintained this group for backwards compatability) this still lets them do most stuff but without an administrators account and password they won't be able to change IP address or anything else in the network connection properties. Don't know if this will work for you, it may be too restrictive in other areas.