Beating them up after the event will be a pleasure, however I'd rather make it hard for them in the first place.

I may have to resort to popping up a window if I find it's on an authorised subnet, and frighten them into submission.

I'm also considering shutting down the interfaces if I don't like the network, and providing a method of allowing the user to bypass the restriction with a passkey that they will have to telephone the support department to get. the passkey will of course be based on the subnet / DHCP server.

BTW I'm not sure fixing the DNS will work - I had to do something similar recently, and the DNS server value from the DHCP server was appended to end of the static DNS server list.