Need to block access to Internet Explorer

[Hank Arnold]

We have been asked by management to determine how to block access for
specific users to the internet via IE or conversely, block everyone and
allow specific users access.

We have three different environments. Some users are running XP Pro and log
on locally using domain resources (printers, applications, etc.).

Most people access our Citrix (MetaFrame XPa) servers (running W2K Advanced
Server w/Terminal Services) and get their desktops issued from there. Most
of the workstations that access Citrix via clients are running Win 9x. That
will change over time (possibly by YE05). The workstations automatically log
on as "default" (with no access to the domain) and launch the Citrix ICA
client. This connects them to the Citrix server using their domain logon
userid. In this situation, they can escape to the W9x desktop. We are in the
process of deleting any icons that connect to IE, but obviously, a smart
user could run IEXPLORE.EXE and launch it that way. In this situation,
completely removing IE from the workstation would be fine. Any concerns
about deleting IEXPLORE.EXE??

I'd like to see if there is a GP process for the other two.

 

[Peter Lawton]

You're probably better to consider blocking Internet access at the border
rather than trying to disable Internet explorer, many MS apps can access the
Internet now - Windows Explorer and MS Word for example, try selecting
file/open and then typing in http://www.microsoft.com ;-)

What we do is deny all Internet access except from our Terminal Servers and
a few specific IP addresses and only allow access from them via an ISA proxy
server where access can be controlled by group membership. This also allows
us to deny users rights to download executables and virus scan all Web
traffic using Symantec AV for ISA server.

Peter Lawton