block internet

[Bruce]

Help, not sure if I am in the right spot, I have a
computer with 2000, installed, and have 10 employees. I
have set myself as the administrator, and the rest as
users. They still have the ability to access the
internet, but I would like to block all downloads, and
also stop them from installing other programs. when
logged in as user, I went to properties, and blocked
downloads there, but all they have to do is uncheck it.
Can I do it with my administrator rights and stop
them...thank you
Bruce
(e-mail address removed)

 

[Steven L Umbach]

You can use gpedit.msc on your computer to access Group Policy. Check out the
settings under user configuration and you will find a couple places to configure
Internet Explorer. In one of those places you can disable the abilities of users to
change settings. However on a stand alone machine, these settings will apply to all
users. You can get around that by going to the \winnt\system32\grouppolicy\users
folder and give the administrator deny permissions to that folder - as an
administrator you can always take ownership and change it back any time you need.
Make sure the other users are only regular users and change the ntfs permissions on
the root folder to read/list/execute. Do NOT check to make the changes apply to all
child objects on the advanced properties page. This should stop the other users from
installing most programs, but not all. If that does not work out, consider upgrading
to Windows XP Pro because the Software Restriction Policies it has are very powerful
in preventing users [while exempting administrators] from installing/using any
unwanted software with path, certificate, and hash rules. I would also install a
personal firewall on the computer, because many like Sygate and Kerio can restrict
internet access by specific application. That will prevent users from running
"unauthorized" internet applications. There are $120 consumer/small office firewalls
like the Netgear FVS318 that can do that also. Disk quotas is another feature of
Windows 2000 that can help keep users in check by giving them limited storage based
on file ownership on a volume that you configure. --- Steve

http://support.microsoft.com/?kbid=183322
http://www.webattack.com/Freeware/security/fwfirewall.shtml
http://support.microsoft.com/?kbid=310791

 

[BBarker]

Or if you do not want them on the internet at all,
implicitly deny all permissions for them on the
programfiles\internet explorer folder. If they cannot
access the folder they cannot run the program, problem
solved. If they need access to only a handful of sites
build an HTA and put links only to the specific sites they
need access to, note if any of them are search engines
they could side step the restrictions of that, then you
could repoint all shortcuts from IE to your HTA. Would be
simple to build, if you want such an app, email me and aAI
will build it, no charge. Just be sure to include all
sites you want access to from it...

-----Original Message-----
You can use gpedit.msc on your computer to access Group Policy. Check out the
settings under user configuration and you will find a couple places to configure
Internet Explorer. In one of those places you can disable the abilities of users to
change settings. However on a stand alone machine, these settings will apply to all
users. You can get around that by going to the \winnt\system32\grouppolicy\users
folder and give the administrator deny permissions to that folder - as an
administrator you can always take ownership and change it back any time you need.
Make sure the other users are only regular users and change the ntfs permissions on
the root folder to read/list/execute. Do NOT check to make the changes apply to all
child objects on the advanced properties page. This

should stop the other users from

installing most programs, but not all. If that does not work out, consider upgrading
to Windows XP Pro because the Software Restriction

Policies it has are very powerful

in preventing users [while exempting administrators] from installing/using any
unwanted software with path, certificate, and hash rules. I would also install a
personal firewall on the computer, because many like Sygate and Kerio can restrict
internet access by specific application. That will prevent users from running
"unauthorized" internet applications. There are $120

consumer/small office firewalls

 

[jaimin]

Hi Bruce

We have something called Browse Control which achieves both things:

1. There is aan application Blocker which gives you the ability to
create a "banned list" of applications which users are not able to run
on their PCs.

2. There is an Internet Restriction functionality which helps you
block internet access...i.e. turn it on/off or only allow access to
certain sites.

You can download it from:
http://www.codework.com/bcontrol/product.html

Cheers
Divyesh