restrict internet access to administrator account only

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

If you're in a domain environment and using group policies, set a proxy server setting that points to 127.0.0.1. Make this setting apply to all users/groups, except Administrators. Make sure you remove the user's access to the Connections tab in Internet Options.

--
Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/x [...] onsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

"KenMartin" <KenMartin@discussions.microsoft.com> wrote in message news:E8853C1C-1176-41A1-BD06-7BD7F15A1BC8@microsoft.com...
> Hi, I am trying to find a way to restrict internet access to administrator
> accounts only. I need the user level accounts to access shared printers,
> files, etc on the internal netowrk, but want to deny internet access. I have
> attempted restricting IE access to admin only, but it is still possible to
> enter web addresses directly into the address bar of an explorer window.
>
> Any ideas?
>
> Thanks,
>
> Ken

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

Yes, but you'd have to make the changes manually on each user's account. Copy and paste the following into a Notepad file and save it as "PROXY.REG". Save the file to a location where all users have "read" access.

------------- copy below this line ----------------------
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable"=dword:00000001
"ProxyServer"="127.0.0.1"
"ProxyOverride"="<local>"

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel]
"ConnectionsTab"=dword:00000001

------------- copy above this line including the blank line ----------------------

Now, create a shortcut in Documents and Settings\All Users\Start Menu\Programs\Startup

The command for the shortcut should be C:\Windows\REGEDIT.EXE /S X:\<path to file>\proxy.reg Modify the command accordingly, if Windows isn't on C:, and change the <path to file> to the actual location of the REG file. Now, when the user logs on, this change will be made silently. Administrators can import another REG file to turn the proxy settings off.

------------- copy below this line ----------------------
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable"=dword:00000000
"ProxyServer"="127.0.0.1"
"ProxyOverride"="<local>"

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel]
"ConnectionsTab"=dword:00000000

------------- copy above this line including the blank line ----------------------

Save this file as Proxy2.reg and save it in a location that only Administrators have access to.

--
Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/x [...] onsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

"KenMartin" <KenMartin@discussions.microsoft.com> wrote in message news:9A8C2A90-0D85-48DF-8AF8-83A53250B518@microsoft.com...
> We're not in a domain environment, we're using workgroups... would the fix
> still work?
>
> Thanks,
>
> Ken
>
> "Doug Knox MS-MVP" wrote:
>
>> If you're in a domain environment and using group policies, set a proxy server setting that points to 127.0.0.1. Make this setting apply to all users/groups, except Administrators. Make sure you remove the user's access to the Connections tab in Internet Options.
>>
>> --
>> Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
>> Win 95/98/Me/XP Tweaks and Fixes
>> http://www.dougknox.com
>> --------------------------------
>> Per user Group Policy Restrictions for XP Home and XP Pro
>> http://www.dougknox.com/xp/utils/x [...] onsole.htm
>> --------------------------------
>> Please reply only to the newsgroup so all may benefit.
>> Unsolicited e-mail is not answered.
>>
>> "KenMartin" <KenMartin@discussions.microsoft.com> wrote in message news:E8853C1C-1176-41A1-BD06-7BD7F15A1BC8@microsoft.com...
>> > Hi, I am trying to find a way to restrict internet access to administrator
>> > accounts only. I need the user level accounts to access shared printers,
>> > files, etc on the internal netowrk, but want to deny internet access. I have
>> > attempted restricting IE access to admin only, but it is still possible to
>> > enter web addresses directly into the address bar of an explorer window.
>> >
>> > Any ideas?
>> >
>> > Thanks,
>> >
>> > Ken
>>

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

You're welcome :-)

--
Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/x [...] onsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

"KenMartin" <KenMartin@discussions.microsoft.com> wrote in message news:AEB9D6E8-6D06-4B04-B6F4-26E57E2704F5@microsoft.com...
> Worked like a champ, Doug! Thanks!
>
> "Doug Knox MS-MVP" wrote:
>
>> Yes, but you'd have to make the changes manually on each user's account. Copy and paste the following into a Notepad file and save it as "PROXY.REG". Save the file to a location where all users have "read" access.
>>
>> ------------- copy below this line ----------------------
>> Windows Registry Editor Version 5.00
>>
>> [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
>> "ProxyEnable"=dword:00000001
>> "ProxyServer"="127.0.0.1"
>> "ProxyOverride"="<local>"
>>
>> [HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel]
>> "ConnectionsTab"=dword:00000001
>>
>> ------------- copy above this line including the blank line ----------------------
>>
>> Now, create a shortcut in Documents and Settings\All Users\Start Menu\Programs\Startup
>>
>> The command for the shortcut should be C:\Windows\REGEDIT.EXE /S X:\<path to file>\proxy.reg Modify the command accordingly, if Windows isn't on C:, and change the <path to file> to the actual location of the REG file. Now, when the user logs on, this change will be made silently. Administrators can import another REG file to turn the proxy settings off.
>>
>> ------------- copy below this line ----------------------
>> Windows Registry Editor Version 5.00
>>
>> [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
>> "ProxyEnable"=dword:00000000
>> "ProxyServer"="127.0.0.1"
>> "ProxyOverride"="<local>"
>>
>> [HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel]
>> "ConnectionsTab"=dword:00000000
>>
>> ------------- copy above this line including the blank line ----------------------
>>
>> Save this file as Proxy2.reg and save it in a location that only Administrators have access to.
>>
>> --
>> Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
>> Win 95/98/Me/XP Tweaks and Fixes
>> http://www.dougknox.com
>> --------------------------------
>> Per user Group Policy Restrictions for XP Home and XP Pro
>> http://www.dougknox.com/xp/utils/x [...] onsole.htm
>> --------------------------------
>> Please reply only to the newsgroup so all may benefit.
>> Unsolicited e-mail is not answered.
>>
>> "KenMartin" <KenMartin@discussions.microsoft.com> wrote in message news:9A8C2A90-0D85-48DF-8AF8-83A53250B518@microsoft.com...
>> > We're not in a domain environment, we're using workgroups... would the fix
>> > still work?
>> >
>> > Thanks,
>> >
>> > Ken
>> >
>> > "Doug Knox MS-MVP" wrote:
>> >
>> >> If you're in a domain environment and using group policies, set a proxy server setting that points to 127.0.0.1. Make this setting apply to all users/groups, except Administrators. Make sure you remove the user's access to the Connections tab in Internet Options.
>> >>
>> >> --
>> >> Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
>> >> Win 95/98/Me/XP Tweaks and Fixes
>> >> http://www.dougknox.com
>> >> --------------------------------
>> >> Per user Group Policy Restrictions for XP Home and XP Pro
>> >> http://www.dougknox.com/xp/utils/x [...] onsole.htm
>> >> --------------------------------
>> >> Please reply only to the newsgroup so all may benefit.
>> >> Unsolicited e-mail is not answered.
>> >>
>> >> "KenMartin" <KenMartin@discussions.microsoft.com> wrote in message news:E8853C1C-1176-41A1-BD06-7BD7F15A1BC8@microsoft.com...
>> >> > Hi, I am trying to find a way to restrict internet access to administrator
>> >> > accounts only. I need the user level accounts to access shared printers,
>> >> > files, etc on the internal netowrk, but want to deny internet access. I have
>> >> > attempted restricting IE access to admin only, but it is still possible to
>> >> > enter web addresses directly into the address bar of an explorer window.
>> >> >
>> >> > Any ideas?
>> >> >
>> >> > Thanks,
>> >> >
>> >> > Ken
>> >>
>>