Blocking Internet Access

[ChrisH]

Some of the indirect ways of running of running IE have it run as system which can bypasses certain things. This is apparently improved with IE 7.

[Gatt]

jcollings..

 

Run GPResults to make sure that the proxy settings are still being applied to the security group.

 

If you have GPMC installed it should tell you what GPO is being applied..

 

We use SchoolGuardian and have a security group called G No Internet which blocks internet access to members of that group

 

How do you apply the policy - are the users moved to another (sub-)OU or is the GPO set to only apply to the security group?

 

We have a similar setup for denying USB drives where we have SUb-OU's in each Year's OU called "No Drives" - a GPo is then attached to this Sub-OU to disable pen drives and the "Enforced" flag is set..

 

Craig.

[TheCrust]

On connecting to the room with netsupport we found the same user logged onto 3 machines

 

 

Have a look at CConnect on the Windows server resource kit if you get a mo.

 

We use this to restrict the maximum number of concurrent logons that will be accepted for any one student user ID.

 

It also comes with a handy admin front end that shows you where the little scamps are logged on, and allows you to remotely log them off too.

[Gatt]

On connecting to the room with netsupport we found the same user logged onto 3 machines

 

 

Have a look at CConnect on the Windows server resource kit if you get a mo.

 

We use this to restrict the maximum number of concurrent logons that will be accepted for any one student user ID.

 

It also comes with a handy admin front end that shows you where the little scamps are logged on, and allows you to remotely log them off too.

 

Other than LimitLogin - is there a non RM equvelant to this?

[Ryan]

I create a sub OU (not internet access) with a new GPO and enter false proxy server settings. then under User Config/Admin Template/System/Don't Run Specified Windows Applications (add iexplore.exe, firefox.exe and firefoxportable.exe) to the list.

 

Also make sure that the user cannot logon if their profile fails to load (ie student may remove network cable during logon so that GP settngs are not applied) Comp Settings/Admin Templates/System/User Profiles/ Log User off when roaming profile fails

 

Wow, just tried this (as we wanted to block a couple of little darlings from all web activity due to misuse while letting the rest carry on) - works perfectly. Nice one. I thought this'd be a huge operation, but all i need to do is drop them into the sub OU that denies the above - sweeeeet.