isa server login

[krisd32]

just found an issue with our isa server and can't seem to find anything i can do to change it, i had stopped one of our pupils from accessing the internet which it is doing, but it is however providing them with a login box box when they double click internet explorer where they can then put another students details in. is there anyway that you can stop this login appearing.

 

many thanks

 

Kris D

[mrforgetful]

I'm not sure, but you can always see who's they use and ban them too, pretty soon they'll respect the sanctity of their passwords and not give them out!

[Quackers]

I had this problem, so i altered the way i disable internet. I made a new group called "Internet Disabled", made a group policy apply only to those groups which put in DISABLED:0000 in the proxy settings with no overide. Then just add the student to that group.

[krisd32]

i will give that a go at the moment i just remove their username from the allowed list in the isa server access policy and leave it like like that until now. don't know how they do it but they always find a way round everything. random clicking must be the way of the future

 

thaks guys

 

kris

[Geoff]

If NTLM authentication fails then ISA server will fall back to basic authentication. I don't know if you can disable basic authentication anywhere in ISA server though.

[Guest richard]

What I do is set the action on the site and content rule to redirects the little angels to a static page that tells them that the are banned from the internet

[ChrisH]

Ric_ had this problem and he set their homepage to a script that closed the browser or something similar.

[krisd32]

thanks richard your solution seemed to solve my problem, i just created a new site and content rule and made a simple website saying that their internet account had been disabled.

and now all i need to do is put the kids that are banned into the applies to part and hey presto we're working!!!

 

thanks again

 

kris

[Ric_]

@ChrisH: I remember now... that seems like years ago... and it was! That was before the nice people at MS prevented scripts doing handy things like that to the browser

[Gatt]

I move disabled users to a seperate OU, then add a GPO with IE as a denied application in SRP - stops them even opening IE!

[mrforgetful]

I move disabled users to a seperate OU, then add a GPO with IE as a denied application in SRP - stops them even opening IE!

 

Why are you picking on the unfortunate

[krisd32]

i've just got one of surf controls denied pages altered with a big red hand saying that their internet access is disabled.

 

quite impressed the teachers but then again so do many other simple things!

 

Cheers

Kris

[Guest richard]

thanks richard your solution seemed to solve my problem, i just created a new site and content rule and made a simple website saying that their internet account had been disabled.

and now all i need to do is put the kids that are banned into the applies to part and hey presto we're working!!!

 

thanks again

 

kris

 

the easiest way I have found is to create a group called banned and add that to the site and content rule. Then you just add the students to that group when you ban them.

[mrforgetful]

the easiest way I have found is to create a group called banned and add that to the site and content rule. Then you just add the students to that group when you ban them.

 

I've had something like that set up for quite some time, but I'm not telling the teachers until I really need to.

Too often it's just a case of 'Can you disable this pupil for blahblah' and I don't want the first line fo defence for internet misuse to become a ban, otherwise it'll be 'They were on games...they wouldn't stop doing such-n-such....can we ban them'

[krisd32]

we only ban off the net when they do something quite serious like racial aggrevated and such or porn and other carry on which i class as direct misuse of the internet.

[mrforgetful]

Those would result in a few days off school here I believe.

[krisd32]

i don't know what else happens to them but i know i have to give the head all sorts of reports etc.. what they have been on. its handy having surf control for stuff like that, and then i block their internet access possibly they do get kicked out for a couple of days but i'm none the wiser to it!

[Ric_]

@krisd: IIRC the kids will find a way around that and get prompted for authentication... hence why I closed the window.

[inkyscribe]

The way we get round it is that there is an Internet Banend group within ISA Server but instead of blocking access it always redirects to a banned page, eg

 

http://www.ourschool.sch.uk/banned.htm

 

Therefore the students aren't presented with the NTLM password box.

 

We also use Impero in the ICT Suites so teachers can block students at the click of a mouse button.

 

HTH

 

Marcus