For users of networked "workgroup" to access anything on the network, each
account has to be added to each networked computer with the same identical
account name and password. With this setup the user can gain access to shares
and is authenticated with s/he user account and the privleges attached to it.
If a user's account is not set up identicall on each networked computer, then
s/he is authenticated with the Guest account, with all the limitations of the
Guest Account. However, if the guest account is not enabled, and to do so and
have the network work, then Simple File Sharing has to be disabled, and NTFS
file permissions enabled. If you have Windows Home on the network, then by
default Simple File Sharing has to be enabled in order to gain network access
and all users are authenticated as the Guest Account with its limitations.
However, as the Simple File Sharing uses the Guest Account for authentication
purposes, everything on the Netowrk is accessable and the Guest Account is
considered the Creator Owner, and as the Creater Owner has full access to all
folders and files which are shared. If you have Professional or Media Edition
OSs, then you can disable both Simple File Sharing, and the Guest Account,
not duplicate your son's account on any other computer and he will not be
able to access the network. That would shut him out of any computer except
his own.
Now, if you are using Media Edition or Professional in your son's computer,
there are other things you can do to restrict his use of his own compuer. As
he is your son you are the legitimate owner and have the right to configure
it anyway you choose. You can use Group Policy to set over 1400 limitations
which will provide great limitations, from not allowing downloads, to
inability to change settings you make in Internet Explorer, or the desktop,
or any area you feel needs restricting. If he or he and ohter children are
the sole users, this is a great way to ensure safety. When Vista is released
these types of settings can be applied to different groups on the same
machine. Until then, the settings now affect every user account on the
machine, but not every machine on the network.
I hope this helps you in your quest to restrict your sons use, have a great
day,