[1029] in winnt
Re: prevent web access
daemon@ATHENA.MIT.EDU (Kerem B Limon)
Fri Jan 24 10:26:32 2003
Message-Id: <5.1.1.6.2.20030124102158.02eb95a8@po11.mit.edu>
Date: Fri, 24 Jan 2003 10:26:21 -0500
To: Dave Broderick <djbroder@mit.edu>
From: Kerem B Limon <kerem.limon@MIT.EDU>
Cc: winpartners@mit.edu
In-Reply-To: <5.0.2.1.2.20030124094023.04c8ef08@hesiod>
Mime-Version: 1.0
Content-Type: multipart/alternative;
boundary="=====================_264629567==.ALT"
--=====================_264629567==.ALT
Content-Type: text/plain; charset="us-ascii"; format=flowed
At 2003-01-24 09:44 Friday, Dave Broderick wrote:
>can I create a user in Win2K who can't surf the web?
>
>Administrators (the actual owner of the machine) still need to surf the
>web, but casual users seem to want to surf, and we want them to use the
>computers for basically Filemaker only
Is this a local FileMaker database? If so, and no networking is needed for
the database access and other "restricted user" tasks, why not just not
disconnect the machine and administratively disable any NICs on the machine?
If you need networking, you could try creating a new user group, say
"restricted users" and then add the user account to that. Then, go through
the application folders containing your browser applications (IE, Netscape,
etc.) and explicitly set "deny" user rights for that user group to these
folders and recursively their subfolders. They should be unable to run any
browser application.
Finally, you could use a connection manager/personal firewall app like
ZoneAlarm to selectively deny outgoing access to applications and/or
protocols, but configuring that will be a bit more complicated and I'm not
100% sure on how ZoneAlarm or others will behave in a multi-user environment.
All this said, I'm sure this is a common question in certain environments.
Have you also tried a Google or Google Groups search?
>If we can create a user who can't surf, we just tell the owner of the
>machine to log off, and all other folks can log on as user. (this is a
>stand alone machine, not on a domain)
>
>David J. Broderick
>djbroder@mit.edu
> Audio Visual Project Technician
> MIT AV 617 253 2808
> FAX 617 253 5945
> <http://web.mit.edu/djbroder/www>http://web.mit.edu/djbroder/www
Kerem
--=====================_264629567==.ALT
Content-Type: text/html; charset="us-ascii"
<html>
At 2003-01-24 09:44 Friday, Dave Broderick wrote:<br>
<blockquote type=cite class=cite cite>can I create a user in Win2K who
can't surf the web?<br><br>
Administrators (the actual owner of the machine) still need to surf the
web, but casual users seem to want to surf, and we want them to use the
computers for basically Filemaker only</blockquote><br>
Is this a local FileMaker database? If so, and no networking is needed
for the database access and other "restricted user" tasks, why
not just not disconnect the machine and administratively disable any NICs
on the machine?<br><br>
If you need networking, you could try creating a new user group, say
"restricted users" and then add the user account to that. Then,
go through the application folders containing your browser applications
(IE, Netscape, etc.) and explicitly set "deny" user rights for
that user group to these folders and recursively their subfolders. They
should be unable to run any browser application.<br><br>
Finally, you could use a connection manager/personal firewall app like
ZoneAlarm to selectively deny outgoing access to applications and/or
protocols, but configuring that will be a bit more complicated and I'm
not 100% sure on how ZoneAlarm or others will behave in a multi-user
environment.<br><br>
All this said, I'm sure this is a common question in certain
environments. Have you also tried a Google or Google Groups
search?<br><br>
<blockquote type=cite class=cite cite>If we can create a user who can't
surf, we just tell the owner of the machine to log off, and all other
folks can log on as user. (this is a stand alone machine, not
on a domain)<br><br>
David J. Broderick <br>
<font color="#0000FF"><b>djbroder@mit.edu <br>
</b></font><x-tab> </x-tab>Audio
Visual Project Technician<br>
<x-tab> </x-tab>MIT AV 617
<b>253 2808 <br>
</b><x-tab> </x-tab>FAX
617 253 5945 <br>
<x-tab> </x-tab><a href="http://web.mit.edu/djbroder/www">http://web.mit.edu/djbroder/www</a>
</blockquote><br>
Kerem<br>
</html>
--=====================_264629567==.ALT--
