Dr Hu

We need to put in Internet Access to a department, which is, lets say, a bit of a liability!

I *REALLY* can't give them unrestricted net access - they would do rock all day, and probably get arrested

They only need access to two particular sites for information.

Any way of easily locking down the PC, so they can only access these two sites? I thought of doing it with using a local policy to hide the address bar in IE and using shortcuts on the desktop or favourites pre setup to go to the specific pages. However I know this will be really limiting, if a page address is dynamic.
plus they could prob work out how to create new shortcuts to get around the address bar.

Running NT4.0, and IE

Any other better ideas?

stevencotton

Stick a proxy in front that only allows those sites to be passed through.

Jeff Wiltshire

Depending on what Firewall you have just allow those IP addresses to have access to the specific sites only on http....

Dr Hu

Thanks for the info.

We do run a MS Proxy Server for the whole company. Can I limit certain users to what websites they are passed to using our current proxy server then?

Not really explored our proxy server as its looked after by someone else. (who again prob doesnt know much about it!)

David_Wallis

you can do it using internet explorer admin kit..

Create a PAC file that uses javascript to do it..

I have examples at work..

Mail me on monday if you want copies..

David

Dr Hu

Thanks David - Yes please.....

Hurriedly goes off to email Mr Wallis...

stevencotton

Sounds well nasty that solution, proxy is the standard method.

David_Wallis

it isnt nasty at all..

You use IEAK to create an ins file for Automatic configuration settings.. you then have a proxy configuration file that basically says...

if host = www.scoobynet.co.uk
return proxy = 10.0.0.1 or whatever
if host = www.bbc.co.uk
return proxy = 10.0.0.1
else
return proxy = 127.0.0.1

etc..

can post up here if you want..

works well and very secure when done with policys..

David

stevencotton

It smells to me because it's not portable and not standard, especially when there's a proxy there already, which can cache too.

David_Wallis

depends on the proxy really.. some proxys can also be nasty to do it based on departments..

problem is our firewall allowed port 80.. no restrictions based on nt groups / departments..

If it works.. I know what you mean though... (we dont do it this way now if we can help it..)

David