Blocking Internet Access

[jcollings]

OK - currently we have a group called Webdeny - if you're in that security group IE won't run for you and the proxy server is changed to a bogus one. This has worked fine for ages but students seem to have found a way round it (not sure what yet).

So 2 questions:
1. How are they getting round it
2. What ways do you use to block specific students when they've been bad boys (or girls)

Cheers

[tech_guy]

Are they using Mozilla FF on a USB stick?

[richard.thomas]

Loads of different ways, so we're gonna need abit more information.

Can pupils run .exes from their home drive of removable media? If so they could be using another browser from there...

Does your proxy do transparent proxying? It's possible that without any proxy information they may be able to browse the web using another browser?

I'm sure other people have points to add...

[jcollings]

Are they using Mozilla FF on a USB stick?

No - this guy was using IE. We have it so they can't run stuff from USB drives etc.

[jcollings]

Loads of different ways, so we're gonna need abit more information.

Can pupils run .exes from their home drive of removable media? If so they could be using another browser from there...

Does your proxy do transparent proxying? It's possible that without any proxy information they may be able to browse the web using another browser?

I'm sure other people have points to add...

No it was IE and they can't run stuff from home drives or flash drives.
No it has to have the proxy info in there.

[richard.thomas]

Interesting... I presume since he's been added to your blocking OU the pupil has logged off and logged back on?

[jcollings]

Interesting... I presume since he's been added to your blocking OU the pupil has logged off and logged back on?

Yes - he's been blocked for ages. Very irritating though.

[localzuk]

How about using a macro to call IE from Excel? That always seems to be a way round things.

[ICT_GUY]

I would deny access by changing the proxy settings to point somewhere that does not exist. Then block access to the settings In IE. All done by AD.

You might be able to bypass this with a .reg file, but this depends on your setup.

[Hecate]

How about setting up a logon script that alerts you when he logs on then using a remote viewer to see what he's doing?

[K.C.Leblanc]

Depending on you set up, it might be possible for users who have a localy cached profile to log on with the network cable unpluged. Doing this stops GPOs being applied. If there is a proxy specified in the default user profile he'd be able to use the net.

Another possibility is he's using someone elses account.

Spuid & DansGuardian or an older version of censornet (when it was still free) are two free Linux based solutions for net filtering.

[pallen]

you haven't upgraded from IE6 to IE7 have you? Aren't the Adm templates different for those versions? Could it be that you have setup the Webdeny for IE6 and it's not working on IE7?

[jcollings]

I would deny access by changing the proxy settings to point somewhere that does not exist. Then block access to the settings In IE. All done by AD.

You might be able to bypass this with a .reg file, but this depends on your setup.

That's exactly how it is configured.

[jcollings]

How about setting up a logon script that alerts you when he logs on then using a remote viewer to see what he's doing?

Thanks guys - I've got a few things to try from this. In terms of a script to let me know when someone logs on - does anyone have one please?

[sahmeepee]

Logging on as someone else? The oldies are the best!

EDIT: For the script - are your current login scripts vbs/bat/kix/somethingelse?