Block internet access for pupils at lunchtime

[LeMarchand]

Does anyone have a free method of doing the above?

 

Apparently the little darlings are allowed to use the suite unsupervised (for the main part) at lunch, but they don't want them to have internet access. So far the best solution I can come up with is:

 

 

1. Create a generic "Lunch" user who can log on at lunch time and in the suite only and who has no internet access
   
2. Disallow student logons over the lunch break
   
3. Turn off machines at start and end of lunch to force log off of and students (or "Lunch" users) logged in (end of lunch will also have the advantage of encouraging the lingerers back to class)
   

[simpsonj]

You could try adding a proxy setting that goes nowhere, and then use Item-level targeting to a time range of lunchtime. This could then be applied to student users, the specific machines, or both.

 

I have no idea whether it would work or not, nor how accurate the time range would be, but could be worth a shot?

[ITJS2015]

If you had classroom management software that would definitely work as there is a block internet option which you can just turn on and off for a number of computers in a suite but if you have got that I would recommend you creating an OU with all your policys but taking out your proxy settings which will navigate to nothing.

 

Make sure that your the pcs are on a restart script and remember to move the pcs in the ou which your polices are going to at dinner.

 

Other than that im out of suggestions

[LeMarchand]

You could try adding a proxy setting that goes nowhere, and then use Item-level targeting to a time range of lunchtime. This could then be applied to student users, the specific machines, or both.

 

I have no idea whether it would work or not, nor how accurate the time range would be, but could be worth a shot?

 

Where are you applying the proxy so that item level targeting is available? Would be a more elegant solution!

[ITGURU]

Are you not using a filtering product which supports this?

If we wanted to we could create a new policy where games are open and break and lunchtimes only and the normal policy applies out of these times..

[simpsonj]

So, in theory, you could add a GPP (Group Policy Preference) to users and add a proxy via Internet Settings. I've looked, and you can't add it to a computer unfortunately (that I can see anyway).

 

The picture below should help locate the setting. I would suspect that you would need another GPP to take off the proxy once the time has passed, but I could be wrong.

 

For full closure, I've had little success applying internet setting via GPP, but worth a go!

 

[LeMarchand]

Are you not using a filtering product which supports this?

If we wanted to we could create a new policy where games are open and break and lunchtimes only and the normal policy applies out of these times..

 

Controlled by LEA, who charge ridiculous amounts for changes. Have recently enquired about being allowed our own log on (which at least one of my other schools has). Just had a look with my other log on and could block access for everyone but not by OU.Apparently OU rules may be possible but quite a few hoops have to be jumped through.

 

 

The picture below should help locate the setting. I would suspect that you would need another GPP to take off the proxy once the time has passed, but I could be wrong.

 

That's where I apply the "standard" proxy. Just not sure how to apply it at set times. Also, wouldn't it all depend on when the GPO is refreshed? I'm not going to be popular if the first class of the afternoon has no net access!

[Davit2005]

It's amazing the technical hoops we have to go through to fix what is a human issue.

 

Do you have vLANS at all, just wondered if you could do any sort of time restriction based on IP address range at the firewall, filtring level.

 

My concern is that if you do policy there is a chance that it could overlap with a lesson somehow and as you say you would not be flavour of the month.

[LeMarchand]

It's amazing the technical hoops we have to go through to fix what is a human issue.

 

Do you have vLANS at all, just wondered if you could do any sort of time restriction based on IP address range at the firewall, filtring level.

 

No vLANs. Checked the switches that supply the Suite and nothing there that I could see in the web console, either.

[simpsonj]

That's where I apply the "standard" proxy. Just not sure how to apply it at set times. Also, wouldn't it all depend on when the GPO is refreshed? I'm not going to be popular if the first class of the afternoon has no net access!

 

I would set another GPP at a higher level (so it takes precedence over your existing GPP, I believe that's how it works) that changes the proxy to something that won't work, and set the Item filtering like the below. You could also change the Group Policy refresh rate to every 5 minutes, and give your self a bit of leeway (say internet comes back on 5 minutes before the end of lunch?). And then I would test it as extensively as I could! You're absolutely right, you don't want students not being able to use internet for their actual lessons.

 

[ih_aswc]

One possibility could be to deploy a PAC file into Internet Options on each of the suite workstations, and use the timeRange() function to specify a "fake" proxy for a period covering the lunch break, and to go out directly (or specify your real proxy, if you use one) for the rest of the day.

 

PAC Functions | FindProxyForURL (expand the timeRange() entry)

 

For example:

 

function FindProxyForURL(url, host) {

// Lunch break is 1200hrs to 1300hrs (for example), so return a dead address during this time

// 127.0.0.1 loops back web requests to localhost, thus causing the browser to error out

 

if (timeRange(12, 13)) return "PROXY 127.0.0.1:8080";

else return "DIRECT";

}

 

Or if you have a real proxy server:

 

function FindProxyForURL(url, host) {

// Lunch break is 1200hrs to 1300hrs (for example), so return a dead address during this time

 

if (timeRange(12, 13)) return "PROXY 127.0.0.1:8080";

else return "PROXY my.real.proxy:8080";

}

Edited June 22, 2016 by ih_aswc
font for code

[LeMarchand]

 

[ATTACH=CONFIG]37470[/ATTACH]

 

Cheers! Used Item Level Targeting before, but a) never looked at all the options and didn't know time-based existed and b) couldn't see where to do it in the IE options. Going to play with this today.

 

One possibility could be to deploy a PAC file into Internet Options on each of the suite workstations, and use the timeRange() function to specify a "fake" proxy for a period covering the lunch break, and to go out directly (or specify your real proxy, if you use one) for the rest of the day.

 

Another thing I didn't know you could include a time-based option in - thank you! I do seem to recall that the "rules" on PAC files changed and that they have to be "properly" hosted (not local and possibly not UNC) IIRC. Not something I've done so I'm going to try @simpsonj 's GPO method first on the grounds that it's more familiar work and try this if it's a bust.

 

Does anyone know for sure if local/UNC PAC files are now no-go?

[simpsonj]

Good luck!

[DanHamilton]

If you are creating a generic lunch login for them couldn't you just restrict the applications they can use? E.G No Chrome, No Internet Explorer etc?

 

Allow only Office applications

Edited June 23, 2016 by DanHamilton

[LeMarchand]

If you are creating a generic lunch login for them couldn't you just restrict the applications they can use? E.G No Chrome, No Internet Explorer etc?

 

That was the plan. The "how to do it at lunchtimes" was the main problem. We already use something like that for one child without a time restriction (no internet ever). Who obviously then just gets a log in from one of his chums.

[Steve21]

Depends if you mind scriptyness, but in terms of not having to manually log on etc, no reason you couldn't do this via task scheduler etc.

 

Sets AutoLogon details in Registry to "LunchUser"

Set Deny Local Logon to Students in Registry

Restart Machine

(Auto logins in as LunchUser)

Proxy disabled on LunchUser via GPO

 

And basically just reserved at end of lunch. AutoLogin Removed -> Deny Local Removed -> Restarts etc

 

Not cleanest way, but means no manual work for anyone supervising the machines either

 

Steve

[dapaulio]

Does your proxy not support this feature

 

Smoothwall you can create rules that block/relax policies. we have a rule that allows pupils to access games etc during lunch hour but in the same way you can throw out a blanket block between 1200 and 1300

[LeMarchand]

Depends if you mind scriptyness, but in terms of not having to manually log on etc, no reason you couldn't do this via task scheduler etc.

 

Not great with scripts, and never seem to have any luck with Scheduled Tasks via GPO, but I will keep this in mind as a third line of attack. Thank you.

[LeMarchand]

Does your proxy not support this feature

 

Currently under LEA control. Site blocking etc free, but anything else =

 

 

Looking at being allowed access to some features, but I believe that filtering by OU involves a lot of prerequisites.

[LeMarchand]

Thanks again to @simpsonj. Got this (sort of) working at last. Nonactivated proxy box in the GPO had me stumped for a while.

 

Next question: if a user is logged on during a "changeover" time the new (deny or allow access) policy won't apply. Can anyone think of a way around this beyond a forced restart or log off?

 

For future seekers of wisdom: local or UNC proxy paths are a no go; you'll have to set up/adapt a web server/IIS server. I failed. Might go back to now that the way I was confident about my ability to get working is up.

[LeMarchand]

So, sussed out how to host a pac on IIS and (eventually) that I had to remove/add it back to the browser to get it to apply any changes, but no luck with a time-based pac. If it applies the "time" bit it doesn't ignore it after the end of the time period. Has anyone ever got this working? @ih_aswc?

 

Code below. I've also tried it with pre- and post-block time proxified lines.

 

function FindProxyForURL(url, host)
{
//Stop access to all those nasty *.io Flash game sites that the firewall doesn't seem to spot
   if (shExpMatch(url, "*.io*")) return "DIRECT";
//If in disallowed time range send traffic direct (no connection)
   if (timeRange(14, 00, 16, 35)) return "DIRECT";
// Otherwise use proxy
   else return "PROXY ProxyName:Port";
}

[Steve21]

Pac files are loaded when the browser loads. So if they keep it open it'll keep the pac file applied and thus never stop working (At least from how I understood them).

 

It'd only stop if they close and re-open browser etc. (again from my understanding)

 

That's why I'd say really if you're looking at this automated you'd need an autologout etc.

 

Steve

[LeMarchand]

Pac files are loaded when the browser loads. So if they keep it open it'll keep the pac file applied and thus never stop working (At least from how I understood them).

That's what I thought, too - but the above example (which, according to everything I've found, should work - but doesn't) would be permanently applied and should only block sites at the specified times. The "day of the week" filter seems to apply correctly. I'm wondering if I'm going to find a note 10 pages back in Google that the function is deprecated. I've even tried the .pac MIME type as the two different strings listed on Wikipedia.

[Steve21]

From my understanding it's "if in time" set proxy. Else don't, but once it's set its set? Might be wrong though

 

Steve

[Steve21]

Saying that though I'm testing the pac file on IE/FF and it never doesn't return true to me :s

 

I can put the time to 1-2am and it still returns that proxy hmm, maybe that timerange one was removed? :s

 

Steve