How do disable IE so a user cannot access the internet. 2

[AccessGuruCarl]

Please Help...

We have a temp employee, that we don't want to have access to the internet.

Running Windows 2000
He's logs on as a general user, no roaming profiles or anything high tech...

How can I prevent the 'User' or 'Power User' Account from accessing IE.

From searching here and MS, It looks like I need to goto the Group Policy Settings? But, never really found a match to my question. Is this where I need to go, and where are the hidden? If I remember correctly, it's just a dos command.

FYI... I know very little about these advanced settings, I'm a really a programmer/and then it's whatever else they throw at me!
Lately, It's been security issues like this.

Thanks in advance,
Carl

AccessGuruCarl
Programmers helping programmers
you can't find a better site.

 

[bcastner]

Open notepad and copy and paste the below, save as Internet_off.vbs :

****** start copy/paste below this line
Option Explicit
On Error Resume Next

Dim WSHShell, n, p, itemtype
Set WSHShell = WScript.CreateObject("WScript.Shell")

p = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Control Panel\Connection Settings"
itemtype = "REG_DWORD"
WSHShell.RegWrite p, 1, itemtype

p = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Control Panel\Connwiz Admin Lock"
itemtype = "REG_DWORD"
WSHShell.RegWrite p, 1, itemtype

Set WshShell = Nothing
********* end copy/paste above this line

Place this in the logon script, or drop it into the users profile in the Startup folder.


To reverse this an turn things back on:

****** start copy/paste below this line
Option Explicit
On Error Resume Next

Dim WSHShell, n, p, itemtype
Set WSHShell = WScript.CreateObject("WScript.Shell")

p = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Control Panel\Connection Settings"
itemtype = "REG_DWORD"
WSHShell.RegWrite p, 0, itemtype

p = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Control Panel\Connwiz Admin Lock"
itemtype = "REG_DWORD"
WSHShell.RegWrite p, 0, itemtype


Set WshShell = Nothing
********* end copy/paste above this line

 

[Jump1ng]

Another option would be to block web access through IPsec and its quite an easy way to block a pc from access the web.

Look on this url for more information on howto set it up

http://www.petri.co.il/block_web_browsing_with_ipsec.htm

---
Make the best use of what is in your power, and take the rest as it happens.

 

[bcastner]

Jump1ng,

I love Daniel Petri's suggestion. My only concern is that it is machine-wide, not user-specific. In other words, every user on that machine is blocked.

My solution above is more granular by user.

Best to you,
Bill

 

[AccessGuruCarl]

Bcastner,
Your solution did not work, IE still loaded!
The code looks like it disables the connection setting and wizard. But they were both still available. And this pc has already been setup to access IE, I'm thinking that's why it failed!

I'll take a look at jump1ng's post. But like you mentioned, it disables the whole PC, not the user account.

Any other suggestions...

Thanks,
Carl

AccessGuruCarl
Programmers helping programmers
you can't find a better site.

 

[bcastner]

My apologies. Revised:


****** start copy/paste below this line
; version 1.1

Option Explicit
On Error Resume Next

Dim WSHShell, n, p, itemtype
Set WSHShell = WScript.CreateObject("WScript.Shell")

p = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Control Panel\Connection Settings"
itemtype = "REG_DWORD"
WSHShell.RegWrite p, 1, itemtype

p = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Control Panel\Connwiz Admin Lock"
itemtype = "REG_DWORD"
WSHShell.RegWrite p, 1, itemtype

p="HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable"
itemtype = "REG_DWORD"
WSHShell.RegWrite p, 1, itemtype

p="HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer"
itemtype = "REG_SZ"
WSHShell.RegWrite p, "10.0.0.1:5555", itemtype

Set WshShell = Nothing
********* end copy/paste above this line

Place this in the logon script, or drop it into the users profile in the Startup folder.


To reverse this an turn things back on:

****** start copy/paste below this line
Option Explicit
On Error Resume Next

Dim WSHShell, n, p, itemtype
Set WSHShell = WScript.CreateObject("WScript.Shell")

p = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Control Panel\Connection Settings"
itemtype = "REG_DWORD"
WSHShell.RegWrite p, 0, itemtype

p = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Control Panel\Connwiz Admin Lock"
itemtype = "REG_DWORD"
WSHShell.RegWrite p, 0, itemtype


p="HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable"
itemtype = "REG_DWORD"
WSHShell.RegWrite p, 0, itemtype

p="HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer"
itemtype = "REG_SZ"
WSHShell.RegWrite p, "", itemtype

Set WshShell = Nothing
********* end copy/paste above this line

 

[AccessGuruCarl]

bcastner,
Thanks for the quick reply,

I'll try it later tonight, on the PC at issue.

Heading back to this store in a few minutes.


Thanks Again,
Carl

AccessGuruCarl
Programmers helping programmers
you can't find a better site.

 

[amen1973]

it will work. Lol I think Bcastner and I found the same info and I tested it to try it before posting. And works like a charm

 

[AccessGuruCarl]

Thanks for the post!
It did work like a charm.

Didn't really have a chance to test it, so I put the code to turn IE back on in the Admin's Account.
Just in case... Do you know if this is really needed?

One last thing,
Do you know where the html page is, that is being displayed when I turn IE off?

I would like to modify it, and add a line so that it reads You May Not Have Sufficient Rights To Use IE. and blah,blah,blah...

Or even better, can I display a custom page when IE is turned off?

Thanks Again bcastner, 2 stars...
One for turning off, other for turning on!

Carl

AccessGuruCarl
Programmers helping programmers
you can't find a better site.

 

[bcastner]

Didn't really have a chance to test it, so I put the code to turn IE back on in the Admin's Account.
Just in case... Do you know if this is really needed?"

The registry writes are the HKEY_CURRENT_USER, which is the user specific registry hive. If the Administrator has never turned internet access off it should not matter, but cannot hurt.

The resident page displayed by IE should appear on the bottom left, and can be edited.

 

[AccessGuruCarl]

Hi bcastner,

I've tried to locate the file/page being displayed.

Page Results:
IE tries to open default Home Page
This is what is displayed....

The page cannot be displayed
The page you are looking for is currently unavailable. The Web site might be experiencing technical difficulties, or you may need to adjust your browser settings.

--------------------------------------------------------------------------------

Please try the following:

Click the Refresh button, or try again later.

If you typed the page address in the Address bar, make sure that it is spelled correctly.

To check your connection settings, click the Tools menu, and then click Internet Options. On the Connections tab, click Settings. The settings should match those provided by your local area network (LAN) administrator or Internet service provider (ISP).
See if your Internet connection settings are being detected. You can set Microsoft Windows to examine your network and automatically discover network connection settings (if your network administrator has enabled this setting).
Click the Tools menu, and then click Internet Options.
On the Connections tab, click LAN Settings.
Select Automatically detect settings, and then click OK.
Some sites require 128-bit connection security. Click the Help menu and then click About Internet Explorer to determine what strength security you have installed.
If you are trying to reach a secure site, make sure your Security settings can support it. Click the Tools menu, and then click Internet Options. On the Advanced tab, scroll to the Security section and check settings for SSL 2.0, SSL 3.0, TLS 1.0, PCT 1.0.
Click the Back button to try another link.



Cannot find server or DNS Error
Internet Explorer




Attempts:
File -->Edit with FrontPage

Error no port 80, I realized error and ran IE turn back on.

Frontpage then displayed some data from Google.
My default home page.

Then tried
File --> Properties
Results:
res://C:\WINDOWS\system32\shdoclc.dll/dnserror.htm#

http://www.google.com/

I did a search for dnserror.htm; Not found
How do edit the page within the shdoclc.dll?
I didn't think you could modify a dll file.

FYI
I'm also testing this at home.
OS = XP Pro

Users OS = Win2000

Not sure if it makes that much difference?

Thanks for the help.
Carl

AccessGuruCarl
Programmers helping programmers
you can't find a better site.

 

[bcastner]

In the following location in the Registry you can find many of the possible errors, and you can change the value to be the location of the custom web page of your choice.

Hive: HKEY_LOCAL_Machine
Key: Software\Microsoft\Internet Explorer\AboutURLs
Name: varies
Data Type: REG_SZ
Value: varies

For instance, double-click the NavigationCanceled string, and change the value from "res://shdoclc.dll/navcancl.htm" to

http://myserver.com/myerror.htm.

Please use caution and frequent backups when editing the Registry.

http://windows.about.com/library/tips/bltip568.htm

 

[AccessGuruCarl]

Perfect...

Just what I was looking for.

Another Star for bcastner

Carl

AccessGuruCarl
Programmers helping programmers
you can't find a better site.