HTA For Controlling Workstation Internet Access

[sahmeepee]

I'm pretty sure you can stop them from typing locations into the address bar in explorer.exe or even remove the address bar completely via GPO.

[ChrisH]

You can stop them doing UNC paths but for some reason not web requests I think.... DOnt quote me on that though

[sahmeepee]

grrr. I checked and you're right of course!

 

Something more devious is clearly in order! Perhaps pointing the machines to a broken/non-existant proxy would do it?

[wesleyw]

As long as you have got say OUs of pupils

 

Year7

Year8

Year9

Year10

Year11

 

And then another OU called

Sin Bin

 

And within that

Year7

Year8

Year9

Year10

Year11

 

This set of OUs could have a GPO with the proxy settings removed and options to change lan settings greyed out.

 

You could use a program I wrote a few years ago to swap pupils in and out of the GPO. It could easily be modified for your particular setup of course and then recompiled. The only downside was the fact that you had to log the user out. I suppose I could see how to remotely update the user policy if enough people are interested! If anyone out there knows how to do this let me know!

 

Send a PM to me if you'd like a look at the source code for this!

[ChrisH]

You could use something like psexec to do a remote gpudate maybe?

[Pear]

I'm trying to do the total opposite and open the internet explorer with a teacher defined website on every computer in the room and have this so far:

 

psexec @"%room%.txt" "c:\Program Files\Internet Explorer\IEXPLORE.EXE" http://%website%

 

It works fine if I am logged on as admin, but not for the kids. It starts up as a service on the clients, however the browser never appears on the screen.

[webman]

@Pear: You need to supply PSExec with the interactive desktop switch (-i, I think) for it to be visible.

[ChrisH]

I have tried this before and found you couldnt launch Internet explorer that way. Maybe I was missing something but I was only experimenting so I didnt look into it to much.

[Pear]

I put the /I in and it did work, however as always I found a problem with it and that was that the gpo settings are not applied. Therefore the page doesn't load as it doesn't have the correct settings and if the connection did work then the students would have full access to IE.

 

Do I have to put a load of crazy lines of code into my script now to make it work ?

[ChrisH]

Now I think about it my problem was it didnt load the page I wanted it to. What Exactly are you trying to do? and how are you stoppping them going any further than this page?

[webman]

By the way, you can run IE in fullscreen mode so they can't click close (only ALT+F4) with no address bar, by passing the -k switch to iexplore.exe, thus:

 

"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -k "http://www.example.com"

[arctan]

Re the request for a clean up script- I'm going to put it here in a simple readable form, as I haven't seen how to attach a file yet etc. Please move/ copy to relevant area if required.

There is some redundant instalation code in there,mainly at the front.

 

@echo off

:*****************************************************************

:*

:* This script is designed to tidy up WinXP and Win2k client machines

:*

:* Ver: 1.2

:* Date: 01/04/04

:*

:*****************************************************************

 

:*****************************************************************

:Set the time of the computer to that of the domain controller

:*****************************************************************

echo Setting the time

net time /domain:boys /set /y

 

 

:*****************************************************************

:flowol fix

:*****************************************************************

 

rem \\boys.jktc.uk\home\Software\Flowol2\Install_Mimic_Creator\Setup.exe

rem \\boys.jktc.uk\home\Software\Flowol2\Install_Mimic_Creator\SetupEx.exe

xcopy /c/r/y \\ict_srv1\netlogon\flowol2_Default.ini %windir%\flowol2.ini

 

:*****************************************************************

:merge in useful registry entries

:*****************************************************************

echo adding registry entries

regedit.exe /s "\\ict_srv1\NETLOGON\Standard_Student.reg"

:pause

 

:*****************************************************************

:copy JKBTC Wallpapers

:*****************************************************************

c:

cd c:\

if exist c:\wallpapers goto SkipWall

 

echo copying Wallpapers

xcopy "\\ict_srv1\NETLOGON\Wallpapers" "C:\Wallpapers\" /h /r /c /y

:pause

 

:SkipWall

 

:*****************************************************************

: install qca exams

:*****************************************************************

rem "\\boys.jktc.uk\Software\QCATest2005\KS3ICT-2005-P-ABC 2215\KS3ICT-2005-P-ABC 2215.msi" /q

rem "\\boys.jktc.uk\Software\QCATest2005\KS3ICT-2005-P-FMA 3084\KS3ICT-2005-P-FMA 3084.msi" /q

rem "\\boys.jktc.uk\Software\QCATest2005\KS3ICT-2005-P-FMB 3084\KS3ICT-2005-P-FMB 3084.msi" /q

rem "\\boys.jktc.uk\Software\QCATest2005\KS3ICT-2005-S-PRE 1430\KS3ICT-2005-S-PRE 1430.msi" /q

 

:*****************************************************************

:copy special version of MS Paint

:*****************************************************************

rem c:

rem cd c:\

rem echo copying MS Paint (Special Version)

rem xcopy "\\ict_svr\1111 config files\hex edits for apps\mspaint.exe" %windir%\system32\dllcache\mspaint.exe /h /r /c /y

rem xcopy "\\ict_svr\1111 config files\hex edits for apps\mspaint.exe" %windir%\system32\mspaint.exe /h /r /c /y

:pause

 

:*****************************************************************

: Move to location for "profiles" and remove old profiles

:*****************************************************************

echo "Removing profiles"

 

cd "c:\Documents and Settings"

 

if exist DeleteFolders.log del /Q DeleteFolders.log

 

: Hide foldes we want to keep

attrib +H Admin*

attrib +H "Default User"

attrib +H "Default User (Network)"

attrib +H "All Users"

attrib +H sweepupd

attrib +H Clean*.

 

:pause

 

: Get list of visible folders. These are the ones we delete

dir /b >> DeleteFolders.log

 

FOR /F "tokens=*" %%A in (DeleteFolders.log) do rmdir /S /Q "%%A"

 

if exist DeleteFolders.log del /Q DeleteFolders.log

 

:pause

 

:Unhide the folders

 

attrib -H Admin*

:attrib -H "Default User"

:attrib -H "Default User (Network)"

attrib -H "All Users"

attrib -H sweepupd

attrib -H Clean*.

 

:pause

 

:*****************************************************************

:Delete some temporary files (Windows and Internet Explorer)

:*****************************************************************

echo Delete temporary files

del /q /s "c:\Documents and Settings\Admin\local settings\Temporary internet files\*.*"

del /q /s "c:\Documents and Settings\Admin\local settings\Temp\*.*"

del /q /s "c:\Documents and Settings\Administrator\local settings\Temporary internet files\*.*"

del /q /s "c:\Documents and Settings\Administrator\local settings\Temp\*.*"

 

:pause

 

:*****************************************************************

: Hide various important folders and files in top level of C:

:*****************************************************************

echo tidy up c:\

cd C:\

 

attrib +H "Documents and Settings"

attrib +H "Program Files"

attrib +H "RECYCLER"

attrib +H "System Volume Information"

attrib +H "%windir%"

attrib +H "arcldr.exe"

attrib +H "arcsetup.exe"

attrib +H "AUTOEXEC.bat"

attrib +H "boot.ini"

attrib +H "CONFIG.SYS"

attrib +H "IO.SYS"

attrib +H "MSDOS.SYS"

attrib +H "ntldr*"

attrib +H "pagefile.sys"

 

:pause

 

:*****************************************************************

: Tidy up the contents of the top level of the C:

:*****************************************************************

cd c:\

 

del c:\*.jif

del c:\*.txt

del c:\*.tmp

del c:\*.doc

del c:\*.xls

del c:\*.pub

del c:\*.bmp

del c:\*.jpg

del c:\*.zip

del c:\*.gbc

del c:\*.wma

del c:\*.wav

del c:\*.mp3

del c:\*.mpeg

del c:\*.mpga

del c:\*.avi

del c:\*.wa_

del c:\*.rm_

del c:\*.pdf

del c:\*.htm

del c:\*.html

del c:\*.theme

del c:\newfol~1\*.* /Q /S

rd c:\newfol~1 /Q /S

del c:\~

 

:pause

 

:*****************************************************************

: Tidy up the Temp directory

:*****************************************************************

echo Tidy up Temp dir etc

del c:\temp\*.* /Q /S

rd c:\temp\ /Q /S

md c:\Temp

 

del %windir%\temp\*.* /Q /S

rd %windir%\temp\ /Q /S

md %windir%\Temp

 

:*****************************************************************

: Tidy up "Program Files"

:*****************************************************************

del c:\progra~1\*.pub

del c:\progra~1\*.doc

del c:\progra~1\*.xls

 

:*****************************************************************

: Tidy up "Windows directory"

:*****************************************************************

cd %windir%

del %windir%\*.txt

del %windir%\*.tmp

del %windir%\*.doc

del %windir%\*.xls

del %windir%\*.pub

del %windir%\*.cdr

del %windir%\*.acl

del %windir%\*.pcb

del %windir%\*.asd

del %windir%\*.jpg

del %windir%\*.gif

del %windir%\*.cct

del %windir%\*.dmp

del %windir%\*.wma

del %windir%\*.zip

del %windir%\*.gbc

del %windir%\*.mp3

del %windir%\*.mpeg

del %windir%\*.mpga

del %windir%\*.avi

del %windir%\*.wa_

del %windir%\*.rm_

del %windir%\*.pdf

del %windir%\~

 

:pause

 

:*****************************************************************

: logoff from the machine

:*****************************************************************

if NOT exist %windir%\system32\down.exe xcopy \\ict_srv1\NETLOGON\down.exe %windir%\system32\ /h /r /c /y

:pause

%windir%\system32\down hostname /R /Q 20 "Rebooting this machine"

[daveyboy]

Why not just import a reg key giving a null proxy?

 

 

WinGuides

[webman]

@daveyboy: My reason for not doing this is that it would deny teachers (for example) access as well.