Students unchecking proxy in IE5

[skendrick]

I recently installed a proxy server for our students at the school I work for so they could not view certain sites, and to speed up some stuff. They all are Windows 98SE computers with Internet Explorer 5. The proxy worked for a while but now they figured out that all they have to do is uncheck proxy and they can view pretty much what ever they want. Is their any way to make it where they cannot do this? Like some kind of security policy or something to make them use the proxy or either have no Internet.

Thanks,
Sterling Kendrick

 

[TheBigDog]

Are you running a Windows 2000 Server by chance?

 

[TheBigDog]

More on that.. If you run a Windows 2000 Domain, you can restrict that setting by editing the group policy in Active Directory User and Groups.

If you don't run that, I believe you can use the Internet Explorer Admin Kit (IEAK) to set up a custom .ins file. See this link for help.

http://www.microsoft.com/windows/ieak/techinfo/deploy/60/en/

See this link to download.

http://www.microsoft.com/windows/ieak/downloads/ieak6/ieak6sp1.asp

 

[skendrick]

I am running Windows 2000, could you please explain how to edit active directory users and computers. Every student uses one default user name. I have not had time to individualy set up user names, and I am new to the Windows 2000 Advanced Server.

Thanks,
Sterling Kendrick

 

[TheBigDog]

Ok. Assuming you don't want to change privileges for all users.. Try this:

1. Goto Start->Programs->Administrative Tools-> Active Directory Users and Groups
2. Right Click the top level domain, select New... Organizational Unit (OU). Call it students.
3. Go to the "Users" folder. Right click on the students username. Go to All Tasks.. Move... Move it to the new OU called students.
4. Right click on the OU called students. Select Properties.
5. Click on the Group Policy Tab.. Click on New. Name it Students Policy.
6. Click the policy, click the edit button.
7. Navigate to User Configuration/Administrative Templates/Windows Components/Internet Explorer. Double click the "Disable Changing Proxy Settings"
8. Click on the radio button "Enabled"
9. Hit Ok.
10. Thats it.. May take a few mintues to propogate, and the user would need to relogin for setting to take affect.


This policy tool is great for restricting virtually anything you want. I found it useful to just "browse" around to see what I could restrict/change, etc.

Now this will still allow every other user to change proxy settings except the student login. If you wish to have other users restricted from this, simply move their user account into the "Student" OU.

Hope this helps! Let me know if that works for you!

 

[skendrick]

I created an OU called Student moved my default user into this OU, created student policy for OU Student and Enabled disable changing proxy settings. And it still don't work. I even created another user named student in the OU Student gave it a logon script, the script ran everything mapped right, but no changed on the browser. Could you please tell me what I am doing wrong.

Thanks,
Sterling

 

[TheBigDog]

Humm.. I did the same thing here and it worked.

I few things to try:

Right click on the OU, click group policy. Double click the field "No Override" so a check mark shows up next to your new policy.

Also make sure you have saved your changes, then logged out of the student login, and log back in. The Proxy settings should be greyed out.

Set the "Disable the Connections page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel).

It is also possible that because the users are Win 98, and not Win 2k or above, that the computer doesn't understand this. I don't have any client machines with win98 to test that one. Do you have another Win2k machine to login as a student to see if it works there?

I'll check into a few things to see if I can figure anything else out.

 

[skendrick]

I logged my other Windows 2000 Server out and logged it back in as the default user name and it still didn't work. I also done the No override thing also, but still something is not right.

Thanks,
Sterling

 

[TheBigDog]

I think the issue lies in the fact the client is win98. (the other win2k server, however, is just overriding the active directory policy with the local policy... a different issue)

Have you tried using the IEAK as described in my first post? That may be you only shot given you have win98 client... Unless you want to upgrade, then it should be fairly easy!

Hope this helps!

 

[skendrick]

About your first post, I asked the head guy and he don't want to use the IEAK because it installs IE6 and right now untill they give us money to up date our programs that use IE to connect we can only use IE5. If you know where I could find IEAK 5 that would be great. Thanks for all of your help!!!!

Thanks,
Sterling

 

[TheBigDog]

Not sure if you can still download it.

One last option I thought of over lunch.

Could you describe your method of connecting to the internet. For example, you your win98 machines have private or public IP addresses, does your server(s) have pri/pub addresses?

When you setup up the proxy server, does the win98 machine use a private or public address to reach the proxy server?

Basically my thought is if you can configure the machines & proxy server correctly, the workstations would be unable to retrieve internet pages without going through the proxy. Make any sense?

 

[skendrick]

My 98 computers have private ip's and my server has public and private ip's. The server uses one public and one private ip per subnet(I have two subnets). The 98 computers use the public address of the server to connect to the proxy. So how would I need to configure both machine and server so that the computers have to use the proxy?

Thanks,
Sterling

 

[sixer]

We had similar problems at a school when running win98 we since upgraded to win 2000 and security is much more manageable but as this is not an option for you, maybe our previous solution will help.

We successfully used poledit to alter the registry settings for the local machine and local user; and by enabling the "dont show connections page" tab the students could not even see the proxy settings.

ADM files can be easily downloaded and poledit is easy to use. The best one for IE is inetres.adm.

I know this means editing each machine but it may be worth the effort.

hope this helps.

PF

 

[BeenThereDoneThat]

skendrick:

Here is a temporary fix you may want to try, although I think it's just a matter of time before the students figure it out.

Since these are Win 98 computers, open the file 'control.ini' on each machine and under the [don't load] header add the line "inetcpl.cpl=no" without the quotes. This does not load the Internet Options into the Control Panel. The students will not be able to go to the Internet Options to untick the 'use proxy server'

You can still acess it if you have to by going to Start>Run and typing in rundll32.exe shell32.dll,Control_RunDLL inetcpl.cpl

By the way IEAK 5 is available. Go to

http://www.alltheweb.com

and click on the FTP Search tab, enter the term IEAK 5 and press Search. There are many servers that still have this available.