Windows 2003 Server Restricted Access

[deepusurana]

Hi,

I have a windows 2003 server and there are loads of users using that machine.

I have created multiple accounts for the users.

What i want is that i want to restrict the access to the Internet for some users.

One of the way i think that can be done is making a log on script, which i dont know.

Please suggest me some other way for to do this, or may be a log on script will also do in which we can do a face proxy setting for each user.

 

Thanks a ton in advance.

 

Deepak Surana

[Gatt]

Not sure how effective this will be (if at all)

 

Create a group (say: "G No Internet"), and add the relevent users to that group

Then add the group to the "C:\Program Files\Internet Explorer\" folder and set the Deny Permissions for that group..

[deepusurana]

Not sure how effective this will be (if at all)

 

Create a group (say: "G No Internet"), and add the relevent users to that group

Then add the group to the "C:\Program Files\Internet Explorer\" folder and set the Deny Permissions for that group..

 

 

 

That does no work...

[deepusurana]

Not sure how effective this will be (if at all)

 

Create a group (say: "G No Internet"), and add the relevent users to that group

Then add the group to the "C:\Program Files\Internet Explorer\" folder and set the Deny Permissions for that group..

 

But i also tried the same permission set on internetexplorer executable file and it worked perfectly fine.

But here comes the another issue, the user can opne windows explorer and then type in the website name in address bar and access internet.

Sounds funny but i just tried it.

[ChrisH]

Put IE7 on the machine then theres one other DLL you could try permissions on as well is mshtml.dll or something similar named.

[deepusurana]

Put IE7 on the machine then theres one other DLL you could try permissions on as well is mshtml.dll or something similar named.

 

Thanks sir,

its working but it has now created another problem...

the users cant access outlook now.

How to tackle with it.?

[FN-GM]

What you could do is make a special OU for the users assign a group policy to that and in that group policy set some proxy settings to an non existent proxy server. Therefore the computer cannot find the internet. Then the users have full use of the computer including outlook (unless there are other policies in force)

[deepusurana]

What you could do is make a special OU for the users assign a group policy to that and in that group policy set some proxy settings to an non existent proxy server. Therefore the computer cannot find the internet. Then the users have full use of the computer including outlook (unless there are other policies in force)

 

Can you please provide me with the steps for the same or any link in which i can find similar thing.

 

Thanks.

[FN-GM]

OK, just a qucik question are you on a domain or a stand alone machine here?

[Heebeejeebee]

OK, just a qucik question are you on a domain or a stand alone machine here?

 

... or even have a proxy?

 

We go the OU route and place banned users in a group where the proxy is set to the local host (as suggested).

 

HBJB

[Michael]

I agree with comments written above. Create a new OU and enter duff proxy information. Even more importantly, enforce it so if they go into Internet Options, proxy settings are greyed out. Alternatively deny access to Internet Options altogether.

 

As for MS Outlook or Outlook Express, use software restriction policies, supported in XP/2003 AD. Enter the file path and executable for Outlook/Outlook Express and users will receive a message that software restriction policies are in place. I also use the same technique for MSN Messenger and IE Toolbars so they'll never be able to run. Hope this helps.

[deepusurana]

OK, just a qucik question are you on a domain or a stand alone machine here?

 

Its on a domian.

Actually this machine is a server whihc has many accounts, and each user logs onto machine and also works on it as they have thin client.

[deepusurana]

I agree with comments written above. Create a new OU and enter duff proxy information. Even more importantly, enforce it so if they go into Internet Options, proxy settings are greyed out. Alternatively deny access to Internet Options altogether.

 

As for MS Outlook or Outlook Express, use software restriction policies, supported in XP/2003 AD. Enter the file path and executable for Outlook/Outlook Express and users will receive a message that software restriction policies are in place. I also use the same technique for MSN Messenger and IE Toolbars so they'll never be able to run. Hope this helps.

Thats gr8,

but can you please tell me the steps to do the same..

 

Thanks.

[deepusurana]

OK, just a qucik question are you on a domain or a stand alone machine here?

 

... or even have a proxy?

 

We go the OU route and place banned uses in a group where the proxy is set to the local host (as suggested).

 

HBJB

 

I didnt got what exactly you mean to say. Please explain.

[pallen]

Are you talking about users logging onto the client machines or the server directly? For users logging into client machines you can set the ADM templates to non existant proxy servers (as suggested). Alternatively if you have been using scripts to set the proxy address you can call the script at logon and change it to the non existant proxy that way. Either way you will need to make sure users cannot change it back.

[deepusurana]

Are you talking about users logging onto the client machines or the server directly? For users logging into client machines you can set the ADM templates to non existant proxy servers (as suggested). Alternatively if you have been using scripts to set the proxy address you can call the script at logon and change it to the non existant proxy that way. Either way you will need to make sure users cannot change it back.

 

I want to know how to do it... I am looking for the steps to do the same.. anything.

And i can restrict the user to not to change the proxy settings. But how to make those proxy settings either by using script or the ADM templates.

And ya its is a single machine on which user are loggin on to using thin client.

[Heebeejeebee]

OK, just a qucik question are you on a domain or a stand alone machine here?

 

... or even have a proxy?

 

We go the OU route and place banned uses in a group where the proxy is set to the local host (as suggested).

 

HBJB

 

I didnt got what exactly you mean to say. Please explain.

 

OU = Organizational Unit - an Active Directory group that can have policy restrictions applied to it. For example change the proxy settings to 127.0.0.1 here and here.

 

Proxy = Wikipedia article

 

HBJB

[deepusurana]

OK, just a qucik question are you on a domain or a stand alone machine here?

 

... or even have a proxy?

 

We go the OU route and place banned uses in a group where the proxy is set to the local host (as suggested).

 

HBJB

 

I didnt got what exactly you mean to say. Please explain.

 

OU = Organizational Unit - an Active Directory group that can have policy restrictions applied to it. For example change the proxy settings to 127.0.0.1 here and here.

 

Proxy = Wikipedia article

 

HBJB

 

But that will change the proxy for all the users i think.

I want to do it for some set of users.

[pallen]

You simply create a New OU (Called NoInternet for example) and move the users who you wish to have no internet access in there. When you want to allow them access again, you can simply move them back into the main OU with the rest of the users.

 

 

Obviously the internet settings will only take affect when the users logs off and then back on again. If you wish to do it on the fly you will need to do it differently. Take a look at LanView3 which works with IE7 if you want to restrict users launching IE.

[SpuffMonkey]

You simply create a New OU (Called NoInternet for example) and move the users who you wish to have no internet access in there. When you want to allow them access again, you can simply move them back into the main OU with the rest of the users.

 

This is what we do - its OK