Networks

Ask something
Question Locked

How to make ISA 2000 Proxy Mandatory

0 helpful
8 replies

by link470

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I'm working at a school that uses the ISA proxy server and has scripts that make the ISA server be what the web browsers go through.

The problem is that even with getting the IE7 and Firefox ADM packages installed to configure the browsers to use the proxy and force it, students can still download another browser and use that, such as Netscape, Flock, Opera, or use a registry hack to bypass proxy.

I need a way that makes all users go through the proxy and only the proxy, so I can continue to use the rules and blocked sites lists. If I can't force proxy, I'm looking at getting a Barracuda unit from http://www.barracudanetworks.com/ns/?L=en . If anyone has any suggestions please do let me know. Thanks!

8 replies

by absolutely

If you're filtering their content, they should not have Administrator accounts. They should not be installing programs or editing the registry.

by link470

That's what I thought too, that the students shouldn't have administrator accounts. I don't know why they have access to so much. I checked Active Directory and can't find any policies or memberships that would make them at that high of a level. Normally, a typical domain user shouldn't have that elevated a priveledge. But the previous techs allowed them to have way too much, they more wanted things to work and didn't worry too much about Security. I personally like things to work, but also run cleanly, efficiently, and securely with ONLY the permissions they need to do their job.

The kids at this time can install software etc. no problem, browse whatever they want because they download other browsers etc., and I can't find where the previous techs set them to be able to do that. I created a lockdown group policy today to shut them out of the registry and restrict their Windows XP user interface a ton in the mean time while I figure out what is causing them to be so high in priveledges. Anywhere you'd check?

by absolutely

It sounds like somebody stole the old admin's passwords, or he shared them. I'd start by doing what you just said you just did, then making sure to change all the passwords.

by matrixduke

Local computer managment , local users and groups.. u can connect to those through MMC and open another computer.

by cg it

then you need to create an OU in AD users and computers under the domain and collect all students into this OU.

From there, create a domain GPO that removes the ability of students to get into the control panel. Also you can specify the proxy server for IE in GP. Collect the students in an OU if they aren't already in one and apply the GPO.

I would also collect computers into AD users and computer/computer OU. Make up an OU for computer configuration and apply it to the OU.

It sounds like students don't actually belong to the domain users group which would automatically restrict them from most of what your seeing.

by retro77

1.) Make your proxy the default gateway [requires 2 NICs on the proxy]
2.) Setup firewall rules to only allow the proxy server [and your other servers] out to the internet.

by matrixduke

why dont u remove the privilige of the users to actually install software.

This discussion is closed to new replies.