Locking down XP

Villain

I need to lock a pc that is running windows XP to allow users to only access our company intranet. Now I have done a bit of research and found some reg keys that allow me to lock some things like preventing users shutting down the pc, disabling task manager and hiding the desktop. Now if I was able to remove the start menu I'd be nearly there just put a shortcut to the intranet site I want in the all users startup folder and change the IE settings to block internet (not sure how to do that).

Is there any easy way to do this? I know I could stop the shell pointing to explorer.exe but will I be able to launch iexplorer then??

So if anyone knows how to hide/disable the start menu or get ie to launch after changing the shell from explorer.exe I'd be very garteful.

Villain

Never mind I got it eventually, thanks anyway.

ressem

Just for info as you're talking about registry hacks.

Can you not apply a domain or local group policy to this particular machine?
http://www.comptechdoc.org/os/windows/win2k/win2kgpolicies.html

Think you're looking at the kiosk setup as described
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/management/csws2003.mspx

Makes it easier to maintain or transfer to other PCs and its easier to be selective with plenty of prewritten scripts. E.g disabling just bits that you don't want from the start menu, disabling the task manager, allow only selected programs to run.

Otherwise you've to log all of the registry changes that you make to the machine.

Capt'n Midnight

Can you post how you did it ?

Other ways to Block IE without affecting the rest of windows are to disable external DNS so they can't lookup stuff on the internet. Using Proxy.Pac files to redirect internet requests to null servers. You could also block direct connections so they have to use a proxy and then setup the rules on it.

Villain

I edited the group policies through mmc, allowing only iexplore.exe to run and then I edited the proxy settings in the registry so users can only access Intranet. There may well be an easier way to do it but that done the trick for me.