Blocking internet from office

[phil sigley]

Hello,

I wonder if someone can help, we have a small number of students who
wont concentrate on coursework during lessons, mainly because the
internet is too much of a distraction.

I have setup of a group policy on our domain to add these users to
which is more restricted than the default pupil policy. The main
difference being that i set up the policy so that internet expolorer
cannot be run, this works fine and when the user attempts to use the
IE icon on the profile they are informed that it is disabled.

However the can still get IE running and browse the net via office xp
either via the web toolbar or typing a url and clicking it. How can i
prevent this access to IE via other applications with a GPO. We use
2000 server, XP pro clients and Office XP Pro.

Thanks Phil Sigley

 

[Lewis]

Hello,

I wonder if someone can help, we have a small number of students who
wont concentrate on coursework during lessons, mainly because the
internet is too much of a distraction.

<snip>

Why not make another GPO up which has a false proxy setting in it. It
doesn't matter if they open IE or try to browse via office - since they
won't be able to get anywhere as the false proxy obviously won't respond.
You could assign this GPO to the students before their lessons and remove it
after for example. That way you don't have to do it the hard way by trying
to stop IE from running. It's also easier to allow certain students to
access the net without changing their whole profile.

 

[Cary Shultz [A.D. MVP]]

Lewis,

Good answer. Please do not forget to mention the setting that will disable
their ability to change the Proxy Address. Otherwise the Proxy Address
change will be useless. Someone will figure it out and then be "da Man" for
sneaking past the Sys Admin. Can't let that happen, can we?

Wie geht's in Berlin?

HTH,

Cary

 

[Steven L Umbach]

If you have access to the firewall you may be able to add their computers to a rule
that does not allow internet access, possibly be a day/time schedule. For this to
work correctly you will need to assign static IP addresses to those computers. If
they are not local administrators or in the network configuration operators group on
their computer you could also not configure their computer to have a default gateway.
Another solution is to create an Ipsec filtering policy for the computers they use.
Ipsec filtering policies use permit and block rules to restrict computer access to
the network. A mirrored block all IP rule and then another mirrored permit rule for
the subnet would let the computer access the local subnet but not the internet.
Computer configuration rules apply to all users on that computer. User solutions
could be software firewalls that have different configurations for each user or a
Group Policy/user configuration rule to create a bogus proxy address for the user
and then blocking user access to IE configuration settings. The problem with the
bogus proxy is that it will work only for Internet Explorer but that can be a lot
better than nothing. --- Steve

http://www.securityfocus.com/infocus/1559 -- info on ipsec filtering.

 

[Nightfang]

I am a student at a Maths and Computing College and what
the IT Admin have installed is a program called Codework
Browser Control, when a teacher or admin log in, they can set
it so that every pc can have internet access or a selected few.

http://www.codework.com/bcontrol/product.html

 

[Alex Harrington]

I am a student at a Maths and Computing College and what
the IT Admin have installed is a program called Codework
Browser Control, when a teacher or admin log in, they can set
it so that every pc can have internet access or a selected few.

STILL no autoupdater on this though so when there is a new release one
of our team has to visit 250 workstations and perform a manual upgrade.

Other than that it does the job well.

Cheers

Alex

 

[Ken B]

::tosses in a nickel::

I remember at my college, they used a program that appeared as "NetOp
School" where the teacher could take control over a computer, lock the
keyboard/mouse, display the teacher workstation on every screen, display a
particular student's display on every screen, etc. Pretty schnazzy
program... but I don't think it'll lock out the internet and allow the
students to continue to work

Worth looking at...

"Can I have my 3 cents change please?"

Ken

 

[Albrow SJ]

Hello,

I wonder if someone can help, we have a small number of students who
wont concentrate on coursework during lessons, mainly because the
internet is too much of a distraction.

I have setup of a group policy on our domain to add these users to
which is more restricted than the default pupil policy. The main
difference being that i set up the policy so that internet expolorer
cannot be run, this works fine and when the user attempts to use the
IE icon on the profile they are informed that it is disabled.

A technoligical soloution for a behavioural problem.

Fail them, its a life skill - at work they will not have managers taking
away their internet access.
Have you spoken to them about it.
At the end of the day its their choice if they want to fail is it not?

However the can still get IE running and browse the net via office xp
either via the web toolbar or typing a url and clicking it. How can i
prevent this access to IE via other applications with a GPO. We use
2000 server, XP pro clients and Office XP Pro.

Just my opinion
Sam

 

[Kev Crocombe]

A technoligical soloution for a behavioural problem.

Fail them, its a life skill - at work they will not have managers taking
away their internet access.
Have you spoken to them about it.
At the end of the day its their choice if they want to fail is it not?

Have to disagree with you there - having been an IT manager in industry
- removing internet usage was often a request from other departments.

In school - there aren't as many levers to pull - saying quietly to an
employee that abuse of the internet use will result in dismissal can
often concentrate the mind - specially if a few co-workers have already
had this happen to them.

 

[jaimin]

Hi Alex

I just spotted your email....I work for Codework! Actually there is
now an Auto-updater, so anyone who is using Browse Control v1.4 or
later can upgrade to a new release rather than having to uninstall and
re-install the whole thing on each machine. The latest version is
v1.7, you can download it from:
http://www.codework.com/bcontrol/product.html

but if you email me at (e-mail address removed) with the version you are
running then I can ask someone in support to email you the upgrade
details rather than, as you say, have to re-install everything!

Good to see Browse Control is mentioned here favourablly by people,
we've got a few hundred schools using it now in the UK.

Regs
Divyesh