Well, how about I tell you how to do what others have suggested
and then explain why it's not the best solution.
First off, open up My Computer and right click on your C drive.
Select Properties from the menu.
On the General tab, look under File System.
If it doesn't say NTFS, you won't be able to use permissions to
restrict internet access.
If NTFS is listed, keep reading.
In order to access the Security tab in Windows XP Home Edition
the computer has to be running in "Safe Mode".
To start in Safe Mode, reboot your computer and start tapping
the F8 key as soon as you see anything displayed on the screen.
Keep hitting F8 until the Advanced Startup Options menu
appears.
Use the up and down arrow keys on your keyboard to select Safe
Mode.
Hit Enter.
Make sure you logon with an account that is a Computer
Administrator.
Note: You'll know if you've successfully booted into Safe Mode
because it will say "Safe Mode" in each corner of your monitor.
Once you've booted into Safe Mode, Open My Computer or Windows
Explorer.
Navigate to the C:\Program Files\Internet Explorer folder.
Right click on the folder and select Properties from the menu.
Click on the Security tab.
Hit the Advanced button.
Remove the check mark from the box next to "Inherit from parent
the permission entries that apply to child object."
A box will pop up with three buttons, hit the Copy button.
Now in the box with the list of user groups, click on Users.
Hit the Remove button.
Note: Users may be listed more than once. You'll need to remove
both entries.
Do the same for the Everyone group.
Left in the list should be Administrators, System,
Creator/Owner and any individual accounts that are Computer
Administrators. They should all have Full Control.
Click OK twice.
Note: If there are any users who have limited accounts that
should still have internet access, you'll have to add each user
and assign them the Read and Execute permission.
Also, if sometime in the future you want to restore permissions
to the groups you removed simply go back and put the check mark
back in the box next to "Inherit from parent...".
Once you've completed the process for Internet Explorer, you'll
need to do the same for the Outlook Express and Messenger
folders. Since you mentioned Microsoft Office, you'll need to
follow this procedure for the Outlook.exe file. Here you're
restricting access to just one application. If you were to do
this at the folder level, the limited account would not have
access to any of the other Office programs.
As you may have already figured out, this is a complicated
process. It's also, in my opinion, not without some risk. And
it leaves an easy route to the internet wide open. A
resourceful person above the age of ten would find a way around
this in less than a day. Any kid in junior high would simply
ask the class geek and be told to open Windows Explorer (as
opposed to Internet Explorer) and enter the web site they
wanted to visit in the address bar and hit Enter.
So, you're asking, why not restrict access to Windows Explorer.
Sorry, no can do. Windows Explorer is really a program,
C:\Windows\Explorer.exe. If you remove access to this file for
the limited account, you've basically disabled that account.
Since you posted your original question to the "New Users"
group, I'm guessing that a lot of what I outlined above is
unfamiliar territory. If that's the case, why not look at
alternatives. Many ISP's provide parental control software that
can be used to restrict internet access. You might want to
check with yours. There are also a number of commercial
products available. Here are a few programs you might want to
consider using:
Windows XP Security Console
Courtesy of Doug Knox, MS-MVP
http://www.dougknox.com/xp/utils/xp_securityconsole.htm
Microsoft Shared Computer Toolkit for Windows XP
http://www.microsoft.com/windowsxp/sharedaccess/default.mspx
Net Nanny
http://www.netnanny.com/
Cyberpatrol
http://www.cyberpatrol.com/
I cannot vouch for the effectiveness of any of these programs.
I only know they are frequently recommended in response to a
question such as yours.
If you find none of this information helpful, I'd suggest that
you post a new question and provide more details about exactly
what environment the computer in questions operates and who
will be using the limited account. Is this a home computer and
the kids get the new account? Is this an office computer and an
employee who spends too much time on the web gets the limited
account?
Good luck
Nepatsfan
In (e-mail address removed) Katie K
wrote:
