Are you asking sepcifically not to use IE while surfing or simply NO web browsing period ?!?

NO web browsing
 

Quote:Are you asking sepcifically not to use IE while surfing or simply NO web browsing period ?!?

The best option would be to have a separate user profile for this person and setup the profile such that the modem and/or lan devices are disabled under that profile.
 
Make sure you do this logged on as a local machine administrator and make sure this user profile is NOT a local machine administrator
 
To test things out you would logon with this users profile and see if you can browse the web and double check any other settings you may wish to disable.
 
I would also get the TweakUI tool from Microsoft to help out here.

That is a way to do it but the person will not be able to use the network at all plus they could just chooose the other profile. What I would do is put this person in a security group of there own, grant that group the same options as a user or super user with the exception of the security for iexplorer which I would deny access to. This way they would have network access to files they just could not use IE. You might want to do the same thing to any FTP clients on the machine insluding the DOS FTP command and give them USER access otherwise someone that knows what they are doing could just FTP download another browser and install it.

That would work too, just trying to keep things simple, there was no mention of a network but there could be so that would be a better option.
 
Also, choosing another profile/user should not work assuming everyone that shares that machine is given a unique user/pass and that you follow security protocol's and don't share this info with others

I've heard a lot of sketchy ways to disable Internet Access here. What's to keep the user from brining in a web browser on a CD or floppy? Just disable the user's rights to all reasonable internet ports 80, 25, and 21 would take care of most everything though would want to research what other ports should be disabled. Also if you don't trust a user enough to browse the web another question you might ask yourself is do you trust them enough to use the computer in the first place? Though I realize there are plenty of good examples where you would want your users to be able to use the computer and not the internet like at 24 Hour Fitness receptionist for example.
Cheers,
Christian Blackburn

Quote:That is a way to do it but the person will not be able to use the network at all plus they could just chooose the other profile. What I would do is put this person in a security group of there own, grant that group the same options as a user or super user with the exception of the security for iexplorer which I would deny access to. This way they would have network access to files they just could not use IE. You might want to do the same thing to any FTP clients on the machine insluding the DOS FTP command and give them USER access otherwise someone that knows what they are doing could just FTP download another browser and install it.

That WOULD work, but it has a MAJOR hole in it. What if the user obtained a copy of Opera and/or Mozilla? They DO have sufficient privelages to install either of them as a program for that own profile/user, and they can that way manage to surf the internet!