Announcement

Collapse
No announcement yet.

Disable Web Browsing for all users except Administrator

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Disable Web Browsing for all users except Administrator

    We have just installed a Terminal Server and do not want users to have access to the internet apart from the Administrator.

    Or even better would be that no Internet access is allowed but the TS still downloads MS Security updates.

    Anyone any suggestions?

    Cheers.../

  • #2
    Re: Disable Web Browsing for all users except Administrator

    Disable internet access by pointing at an "internal only" DNS, or by using a firewall or proxy to control it. There are other ways (you could prevent the browser program running, or set IE Security settings to prevent Internet Access in Group Policy for instance).

    I would advise managing an organisation's security patching via WSUS or PatchLink, (especially on Servers) rather than allowing Automatic Updates to do it.


    Tom
    For my own and your protection, I do not provide support by private message under any circumstances. All such messages will be deleted and ignored.

    Anything you say will be misquoted and used against you

    Comment


    • #3
      Re: Disable Web Browsing for all users except Administrator

      Yes. Just also make sure that, whatever you do, your TS can still get it's Antivirus definitions from the web. Just a gentle reminder.
      Best wishes,
      PaulH.
      MCP:Server 2003; MCITP:Server 2008; MCTS: SBS2008

      Comment


      • #4
        Re: Disable Web Browsing for all users except Administrator

        Hi, dudes.
        There are different components one can alter to interfere with the Internet browsing, but it depends a lot of what are the other needs of the TS users.
        I think that because the Administrator should be able to access the Internet, then DNS and gateway addresses should be correct. But one can alter proxy settings or disable access to the Internet browser(s) for the specific users.
        You should follow Stonelaughter's advice (if you do want the Administrator to browse, then firewall cannot be an option). And the WSUS.
        BTW, take a look at this solution: http://sillydog.org/forum/viewtopic.php?t=2677 . I found it funny Did not test it though

        Sorin Solomon


        In order to succeed, your desire for success should be greater than your fear of failure.
        -

        Comment


        • #5
          Re: Disable Web Browsing for all users except Administrator

          Currently I am using a fake proxy server and have removed then Connections tab so that the user cannot change it, but that means no AV updates etc

          Where can I just do this for users, or would I have to log on as each user and chance the users policy?

          Comment


          • #6
            Re: Disable Web Browsing for all users except Administrator

            Hi, Gordon.
            You should use GPO to enforce the bad proxy configuration only on the users. This way you will not have any problem with AV or OS updates.
            You can do that by using configuration settings in User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer.

            Sorin Solomon


            In order to succeed, your desire for success should be greater than your fear of failure.
            -

            Comment


            • #7
              Re: Disable Web Browsing for all users except Administrator

              When I chance the setting there the Administrator has a bad proxy also and my McAfee AV won't update

              Comment


              • #8
                Re: Disable Web Browsing for all users except Administrator

                Originally posted by Gordon.Wade View Post
                When I chance the setting there the Administrator has a bad proxy also and my McAfee AV won't update
                In GPO, the proxy is a "per user" setting and is therefore loaded in the HKEY_CURRENT_USER hive of the registry. If you apply the bad proxy to only the OU containing normal users, this GPO will not apply to your administrator and you will therefore be able to set the proxy for this user.


                Tom
                For my own and your protection, I do not provide support by private message under any circumstances. All such messages will be deleted and ignored.

                Anything you say will be misquoted and used against you

                Comment


                • #9
                  Re: Disable Web Browsing for all users except Administrator

                  And if you don't have your users in separate OUs (and don't want to separate them), I suggest to use the Security Filtering option (put all the users you want not to be able to browse in a group and apply the policy only on that group).

                  Sorin Solomon


                  In order to succeed, your desire for success should be greater than your fear of failure.
                  -

                  Comment

                  Working...
                  X