Community archive

Ask something
Discussion Locked

Preventing use of Internet

0 helpful
14 replies

by drno

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Is there a way of preventing users from accessing the Internet without the use of 3rd party software? We are currently using NT4 workstations, and I have applied permissions on the internet browsers' directory, so that only people who have access tothat directory can use the application. Now I found out that everyone can access that directory (even the ones without permissions), because they can use the LINKS from emails they receive or office applications document.

Pls help

14 replies

by willh

I have tried this before and found that without a proxy you will likely never be able to block access selectively.If you could find apolicy template that supported internet access rights maybe it would work. But true authentication for outside access cannot be replaced by permissions. As browsers have become so tightly integrated with OS it has become next to impossible to address the issue of outside access without some sort of dedicated security.

by tmaclennan

Actually, this isn't as hard as it sounds. You need to build a registry export file that names a non-existent proxy server, disables user access to change settings, and names local servers for which users don't need a proxy server. Then import thoseregistry settings on login. The key you want to edit is [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

by drno

This might work. BUT I'm no expert in registry manipulation..export..imports.

by fred_e944

If you want to restrict Internet access by workstation remove the default gateway IP address under TCP/IP Properties in the Network Properties screen. If the workstation has no gateway it can't access the Internet.

by drno

This is OK. But the problem is, each workstation are being shared by users, therefore different internet usage policy. Some user can use internet some cannot. Hence, the directory permission directory.

by bill cassada

I agree with Fred above, but you can also simply restrict the user from running the internet connection wizard. If you are using DHCP or are on a large network removing the gateway may not be feasible. The network admin can restrict users from executing the internet connection wizard. YOu should also restrict them from installing software to discourage installation of Netscape or some other browser which doesn't require the internet connection wizard.

by >@ >@ gone fishing @< @<

Buy A BIG STICK, and hammer some nails in, than teach those users a lesson. (Only joking) How do the systems get access to the internet, if you are running a server, you will need to be running a PROXY of some description ? Microsoft proxy server can be set to only allow this particular GROUP access to the internet. So you create a Internet Group and add only those that deserve to be there.

If you don't run a proxy, how are the workstations connecting to the internet.

You could also manually set the PROXY settings in Internet Explorer to be INCORRECT, or if you use a modem set it to use a proxy and it won't be able to find its connection. You would have to be running profiles so that users that are allowed access have it.
Could you give more detail as how the systems get there connection to the internet.

by drno

setting the proxy to have a wrong address worked!! but I had to set the IE to each individual user. Maybe someone out here knows how to create a script file to set the proxy for the IE?

that is my next question for points

Thanks a million!

by white wolf

Well I've come up with a quick & Dirty solution that usually works - really restrict the IE's use. Go into Tools>Internet Options, then Select the Content tab, and enable the Content Advisor (assign an admin password). Then on the ratings tab set the Ratings level to zero, and On the General tab clear the checkbox on "Users can see sites that have no rating". Since a huge portion of websites don't use the content rating system, they won't be able to pull those sites up. This usually makes the users give up in frustration fast. (Sure, they can hunt for content rated sites they can pull up, but then only the *REALLY* determined will continue to try, & These people can usually be handled by giving a stern reminders of why IE's been restricted. If they still "refuse to behave" after that, perhaps a displinary action is required. )

This discussion is closed to new replies.