Deny internet access to specific users

Thomas_S_Hunterson

Currently running XP Pro SP2

Just wondering it's possible to deny specific users, eg. the guest user access to the internet using the inbuild administrative options? and if so how???? it's been wrecking my head for ages now!

Thanks in advance

seamus

Yes, but it's tricky. It would be easier to know more about the setup - is this a home PC, or an office PC. If it's the latter, what kind of network is in place?

ntlbell

you could do things like deny permissions to explorer.exe or force fake proxy settings to IE via local group policy.

Depends how far you want to go with it but like seamus said it's pretty long winded.

Thomas_S_Hunterson

It's a home computer, there's no sort of network server or anything involved it's just a standalone machine, connected t BT broadband via the LAN cable, if thats at all important?

Capt'n Midnight

make sure the users are not admins

in a command prompt type
ipconfig to see Address, mask and gateway
address 192.168.0.22
mask 255.255.255.0
gateway 192.168.0.1 <== this is the one to block / remove

manually setup TCP/IP so there is no gateway (to undo change back to automatic)

add a batch file to add in the route for the users you want to see the internet (not sure if they need to be power users or not)
route add 0.0.0.0 mask 0.0.0.0 192.168.0.1 (or whatever)

but anyone clued up with physical access to the machine could bypass easily

policies are messy for home users

Why do you have a guest account ?
usually the first thing to do with it is to put a password on then rename to []£$%^! and then set to expire tomorrow and disable (or just rename + disable if not that paranoid)

Thomas_S_Hunterson

No, it's not paranoia regarding the guest account, I need to give a user an account on the machine, but for what he will be doing, internet access is not required, so I want to lock it out. It's not really worth installing new software or anything over, i was just hoping someone might know an easy workaround?

LowTek

Well... I think you can just delete the shortcut for IE or Firefox (or whatever browser your using) from the Desktop. If he has his own acount, you'll need to delete the shortcut from his Desktop. Then, and I'm not sure about this, but I think you password lock the folder that holds your Browser's executable file, and restrict access to it, to your ID only. You might have to disable the CMD line, and the Run box as well though.

aFlabbyPanda

log on as the use you want to block, open IE, go to tools, internet options, connections, LAN settings, tick the box that says "use a proxy server, etc" and enter in 10.0.0.1 in the address and 8080 as the port. Click ok all the way back out. job done. because your not running a proxy server (but IE doesnt know that) there is no more internet access.

Thomas_S_Hunterson

BrianjG wrote:

log on as the use you want to block, open IE, go to tools, internet options, connections, LAN settings, tick the box that says "use a proxy server, etc" and enter in 10.0.0.1 in the address and 8080 as the port. Click ok all the way back out. job done. because your not running a proxy server (but IE doesnt know that) there is no more internet access.

Quite easy to undo however...I might give it a try