ICS is enabled by default in Windows, and ICS must be enabled in order for Application Guard to function correctly. We don't recommend disabling ICS; however, you can disable ICS in part by using a Group Policy and editing registry keys.
In the Group Policy setting, Prohibit use of Internet Connection Sharing on your DNS domain network, set it to Disabled.
Disable IpNat.sys from ICS load as follows:
System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\DisableIpNat = 1
Configure ICS (SharedAccess) to be enabled as follows:
HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Start = 3
(This step is optional) Disable IPNAT as follows:
HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\IPNat\\Start = 4
Reboot the device.