IE7 wishful thinking

[Bobo]

I have set up a fairly simple script for one of my schools whereby the teacher can control various computer's internet access. I'm sure there is freeware out there for it and/or a better script, but, the only flaw in my script is kids can still access new IE7 through using the address bar in windows explorer which opens IE7.

 

So there are three questions I wish to ask:

 

1) Is there any way to disable IE7 opening through windows explorer?

2) Is there a group policy setting to completely disable the address bar in windows explorer.

and finally 3) Has anyone else a good script that works with regards to disabling other's internet access at a different computer?

 

I tried various methods of doing this and I found an effective way of doing this without too much hassle is remotely pskill the IE process, then remotely change the permissions on the IE folder in program files thus disabling any icon or shortcut, the downside is it doesnt stop it though URLs in Windows Explorer.

 

I feel I am going an arse about tit way of doing this, but I tried writing various scripts and batches and this seemed the most reliable and quick to do.

 

Thanks guys, sorry for the ramblings.

[Bobo]

No ideas anyone? Or does everyone use 3rd party software to disable internet?

[Stese]

Net Support can do this on a class to class or computer to computer basis....

 

Removing the Address Bar would be the solution otherwise, I think... my GPO books don't mention address bar in Explorer

[mortstar]

LanView by MST Software does this perfectly. It's donate-ware.

 

It also puts a little Traffic Lights Applet on the teacher's machine to turn internet on and off.

[Scotmk]

Netsupport or if CC3 RM Tutor (netsupport rebranded) will do the trick

[MkII]

In AD you can put in a duff proxy port and close off IE that way.

 

Using another method, we find blocking port 80 is pretty effective - against those pesky kids making browsers from word documents and using other browsers

[StewartKnight]

I do all of the above. For immediate stopping of internet (say for 1 lesson) lanviewer or RPKiller and to ban kids I have a move them to an OU with a null proxy

[Geoff]

Snort IDS signature to pick up the IE6/7 Useragent in HTTP requests. Stick it in the Packetfence NAC as a violation and hey presto. The machine gets ARP Poisoned off the LAN.

[NetworkGeezer]

Snort IDS signature to pick up the IE6/7 Useragent in HTTP requests. Stick it in the Packetfence NAC as a violation and hey presto. The machine gets ARP Poisoned off the LAN.

 

That's a bit BOFH Geoff. The computer in this case is meant to be on the school network. The problem was that a approved application was being used.

 

Wouldn't this be more job for a proxy/content filter?

[Heebeejeebee]

Snort IDS signature to pick up the IE6/7 Useragent in HTTP requests. Stick it in the Packetfence NAC as a violation and hey presto. The machine gets ARP Poisoned off the LAN.

 

That's a bit BOFH Geoff. The computer in this case is meant to be on the school network. The problem was that a approved application was being used.

 

Wouldn't this be more job for a proxy/content filter?

 

LOL

 

BOFH rocks!!

 

HBJB

[Geoff]

Wouldn't this be more job for a proxy/content filter?

 

Why choose? When you can have both? Defence in depth is your friend.

[Guest Guest]

I thought IE7 opened a sperate process in taskman, this made Lanview a viable solution once again (after IE6 which didnt oopen a sperate process)

[srochford]

IE7 opens in a separate process here.

 

To go back to the original point, trying to block IE7 opening is going to be hard work; as others have said, just typing a URL in word and clicking it will open a browser.

 

I don't think you can reset the proxy on a machine which is already running IE (so if a user has IE open and the teacher wants all users to stop using the internet then you can't just make a remote registry change on that machine) I could imagine a script which remotely kills the iexplore process and pokes in fake proxy values.

 

The way I started working (but never quite finished ...) was to have a rule in ISA which blocked access from a group of computers. Staff would have access to a web page which allowed them to add computers to the blocked group. One day I'll finish this :-)

[Bobo]

Hmm lots of info there, cheers guys. It cannot be AD based or anything of the sort, what they want is simply a button on the teachers desktop that turns off internet at client Pcs, they also don't want any proper GUI, they just want a batch file or something similar.

 

Well I can kill the process using Pskill but is there a way that you can block port 80 from another machine? The teachers are local admins and the kids aren't, can you do registry merges across networks easy?

[Manish]

Hi Bobo,

 

I really wouldn't do all that circus to simply control the Internet Access of the kids.

 

IMHO, you want to simply ensure that the kids go to only specific kinds of web-sites & do not go to porn etc. Maybe you also want some virus-scanning thrown in, along with checking user-agent signatures. And maybe you want to define the time-slots when the little guys can access the web. And maybe you want to be a complete "big-brother" who reports to the kid's parents with some impressive graphic reports about their kids, web-habits. This is pretty standard content filtering requirement.

 

I suggest you to check-up SafeSquid. It's a content filtering proxy.

The only down-side's you have to set-up a linux box. I know that this looks like a completely Microsoft Alley, but then the Windows Edition of SafeSquid's really pathetic. But the linux version, well ... you gotta use it to know it.

[Bobo]

Unfortunately that's not a possibility, this particular school is a PRU, basically where all the little sh*ts go when they get booted out of school. The teachers range from completely illiterate in IT to moderate and I have been specifically asked for a button to disable particular computer's internet access.

 

They are soon to get ranger remote control but they want something seperate than that to disable it on a computer to computer basis. It's a pain but I kind of promised to have it sorted by Friday (I rarely promise anything, was a bad move this time)

 

But yeah, it's not a normal school by any standards and they need something definitive to control the kids so any ideas would be hugely appreciated.

 

Even knowing how to disable completely the address bar in win explorer would be something without being able to put it back in.