How Can I Dissalow IE Use for One User 1

[baldhead]

Hello all,

Does anyone know howto dissalow IE use for one user on a domain that has local admin rights on all computers (by the way they need local admin rights so they can play certain games). I've used the GPO setting of "Don't Run specified Windows Applications" and added iexplore.exe which dissalows them from executing this actual file as well as disabled access to the command prompt, but if there's an html/htm file that resides on the computer they're on which points to a website they can simply double click this file and they're up and surfing to wherever they want (the GPO settings don't affect this). What do you guys recommend I do to make it so that a certain user has no rights to use IE as local admin? Finally they can't login locally.

thanks
baldhead

 

[mmendes]

Setup a GPO that sets their IE connection to use a proxy server that does not exist! You can also set this same GPO to hide the connection tab in IE properties! Both of these GPO settings are user settings they can easily be assigned to whatever users you want.

 

[ffoschiatti2]

Here's another idea:

Implement ISA Server and deny web protocols (http, https, ftp and gopher) to this specific domain account.

(or use any other web proxy software)

 

[markdmac]

Both sets of advice above are good. The only problem with going with the ISA route is the expense. ISA will give you the ability to allow the person to use Internal web sites if you choose also while allowing them to be restricted from going externally.

The proxy configuration can give yo the same result by checking the box to bypass the proxy for all Internal Addresses. If you don't want them to be able to surf at all then leave this box blank.

Finally, I'd lock them out of the games too. Calmly explain to them that this is a busienss machine and not their home playstation. You might even want to have some fun with them, change the shortcust to the games so that they report each time a game is launched prior to actually opening the file. Then show them the report to demonstrate how often they are goofing off.

I hope you find this post helpful. Please let me know if it was.

Regards,

Mark

 

[lyonmt]

markdmac,

It would be really sweet if you could tell me the shortcut command that will report each time a program is launched prior to actually opening the file.

 

[markdmac]

You basically would need to create a script that write to a log file and then starts the game they want. Then replace their game shortcusts with the script and specify to use the game EXE for the icon so they don't know the difference.

Here is the script that should do it for you.

Set WSHShell = CreateObject("WScript.Shell")
Set WSHNetwork = CreateObject("WScript.Network")
Set fso = CreateObject("Scripting.FileSystemObject")

UserName = WSHNetwork.UserName

'edit the line below with the server path to where the user log will go
WSHNetwork.MapNetworkDrive "G:", "\\server\reports",True

'Edit the line below For the name of the game you want to track.
report = UserName & " started Solitaire at " & Date

Set ts = fso.CreateTextFile ( "G:\" & UserName "GameReport.txt", ForAppending)
ts.write report
'Report is written now remove the drive letter so the user does not see it.
WSHNetwork.RemoveNetworkDrive "G:"

'Edit this line for the path to the game to start
Call WSHShell.Run("C:\Windows\sol.exe")

I hope you find this post helpful. Please let me know if it was.

Regards,

Mark

 

[lyonmt]

Thanks markdmac,

That was very informative.

I imagine that the script is written in VB? I don't know VB yet, but I will record your directions for future use after I do learn it!

~Matt.

 

[markdmac]

Yes, this is a vbscript. Just copy the above text to a text file and give it a vbs extension.

I hope you find this post helpful. Please let me know if it was.

Regards,

Mark

 

[gurner]

Any idea why your script gets a

(13, 48) Compilation error: expected ')'

I can't see a prob (but then i'm not a VB developer, just a VB 'modifier' ha)

Cheers

Gurner

What is Divine Paradox?

http://www.divineparadox.co.uk

 

[markdmac]

Sorry about that, my fault.
Please replace

Set ts = fso.CreateTextFile ( "G:\" & UserName "GameReport.txt", ForAppending)

with

Set ts = fso.CreateTextFile ( "G:\" & UserName [b]&[/b] "GameReport.txt", ForAppending)

I hope you find this post helpful. Please let me know if it was.

Regards,

Mark

 

[gurner]

spot on

Gurner

What is Divine Paradox?

http://www.divineparadox.co.uk