You can configure your Web Content Zones to disable downloads through Internet
Explorer via Group Policy/user configuration/Windows settings/Internet Explorer
maintenance/security - security zones and web content. This is a user configuration,
so if the policy does not apply to administrators they will not receive the settings.
Note you will also want to use Group Policy/user configuration/administrative
templates/Windows components/Internet Explorer to restrict users from changing any
policy you want to apply be restricting their access to Internet Explorer settings.
Keep in mind that this will only restrict downloads from Internet Explorer. To
restrict other garbage such as file swap programs, etc you can configure your
firewall to allow only needed/authorized outbound access such as ports 80,443,25,110
tcp and 53 upd for dns, etc. Ipsec filtering can also be enabled on W2K/XP Pro
computers to do the same if you can not configure your firewall that way. Keep in
mind that some of the garbage programs will try to tunnel through port 80 which means
you will need to be vigilant and watch your firewall logs and place specific deny
rules for those websites that are used for such. For more extreme measures, personal
firewalls can be installed on computers that have outbound access rules configured to
map to authorized applications that are protected by md5 hashes. Another thing to
consider is enabling disk quotas on the disk volume which cab restrict the amount of
file space a user can use based on ownership of files. --- Steve
http://support.microsoft.com/default.aspx?scid=kb;en-us;183322
http://www.microsoft.com/windows/ie/using/howto/security/setup.mspx