How do they connect now? Direct connection via a router?
Are there any configurations you can make on the router that can help you?
I'm assuming you dont have a firewall either, otherwise you could do it there.
The only thing about trying to restrict access at the desktop is that it wont be foolproof. What can be done can always be undone by someone who knows what they're doing.
I'm not sure about Win98 system policies.
...but I suppose you could create an IE configuration scriptusing the IEAK that...
a. Disables further changes to the configuration script setting.
b. Points to a bogus proxy server
c. Disallows changing of above
d. Disallows changing of anything else you dont want changed to undo the above.
But if I were you I'd be lobbying to get a machine to act as a firewall or proxy server and do it properly (if thats at all an option...)
Cheers,
Tim.