Restricting Access in Windows XP

[noODle]

I think it is the best deal to create a user account that belongs to the 'users' group and restrict everything the dude does not need.
Including things like regedit, control panel, run box, cmd prompt etc.
Make a box with one entry in the start menu: programs and have the programs he needs preinstalled.
Also remove all icons from the desktop. I believe this can be done by using gpedit.msc otherwise find some registry tutorial.
Like this one:
http://www.easydesksoftware.com/regtrick.htm

Cheers
noODle

[Zonewalker]

correct me if I'm wrong but... XP home doesn't have a group policy editor does it??

It'd be easier if the internet connection was dial up cos then you could set up your friend as a user and set the dial up account to be accessible only to yourself. I say this cos if you go through the 'connect to' menu and click on the relevant dial up connection there should be a section saying 'save this password for... 'me only' or 'anyone who uses this computer' - obvious which choice you take... this solution would be perfect for you but I don't think it'd work for an always on connection (sadly I don't have one at home just yet ) - might be worth a look tho'....

I'm not entirely sure you'd be able to do this without some third party software.... I have something in mind tho' give me a bit of time and I'll see if I can find something for you

Z
[edit] mmm... no sorry the software I had in mind (wasn't a firewall), only supports win9x... I'd go with the other suggestions if mine about 'save password... ' etc isn't available

[bballad]

I don't usually suggest proxies for security but in this case. Most windows based proxies (there is a free one from 602 software that is decent) will not only let you share an internet connect, but also restrict network access by user and time. So setup a user for this guy, and restrict that users access (some firewalls can do this also...but they would have to be software based on your box)

[dac0braman]

you could try tweakui http://downloads-zdnet.com.com/3000-...ml?tag=lst-0-1 just download it then extract it then right click tweakui.inf and click install then goto control panel and click on tweakui and you can restrict allsorts of stuff or if you need more help on installing it check out
http://www.antionline.com/showthread...hreadid=243017
hope this helps you

[Dagreat1]

X-watch is good, so are others like Surf control and net nanny etc.
I havent used X-Watch so i wouldnt know if it has a custom blocking list or not.
If he still gets through the IE Content advisor, which is easy, as you have to remove one key from the regedit or change the ratings.pol file to ratings.old,
Anyways, if he still gets through, check the websites he vistis and add them to the HOSTS file with the lookup address as the loopback, 127.0.0.1
About Kazaa, blocking Kazaa.com etc has nothing to do with kazaa downloads,
Kazaa works on p2p protocol and opens up randon ports and connects to random ip's(In the case of downloading from someone) to download.
Kazaa has a conetnt restriction, family filter, or whatever they call it.
You can pass protect it.
It's pretty self explainatory, mess with it a little and you'll get it.
Also, if you want restrictios implied on the box he uses, you can manulay edit the registry keys for hiding of stuff you dont want his acces to.. the run button or Internet explorer etc etc.
If you dont know the keys and the way the operate(Dword values, String values, 1=enable, 0=disable etc) then i recommend Winboost.
Google for it.
Also, you can get a firewall, (Highly recommend Outpost) it has a content restriction in it aswell.
You can specify words that a website contains, which is to be blocked.
In your case, obscene words, and phrases.
...

[KissCool]

Strange. I have searched exactly the same thing today for applications under XP. I wil have to provide access to my master pc for standard users and I don't want to let them play with config or access to what I have not decided they could access.
I recommend you to protect well your 'normal' accounts before creating the new one, after what you should check you have well disabled "administrators" and "guests" accounts in "computer administration" (in the config panel->admin).
Agter what you will have to install the already advised by everybody firewall and to restrict access to programs. If you know well your system, I would recommend you to go into "folder options"->"view" tab -> uncheck the "use simple file sharing" option. It will enable a "security" tab in properties of each files/folders in your computer where you will be able to give to users access (or not) to thus stuffs.

I will also advise you to keep bootdisks and papers with passwords on them in a secure place (ie not near your computer)

KC

[infosecguru2]

Windows XP Home is built on the NT kernel. This means that instead of having "services" located all over the OS configuration files, they are all in one neat and tidy place in the registry. So, adding onto what No0dle suggested, all you do is load up mmc, add the services snap-in and disable the following:

1. Workstation
2. DHCP Client
3. DNS Client

You have to be admin to enable/disable these services, so make sure your 'friend' is using a normal 'user' account, and he will be effectively cut off from the net. Unfortunately, XP Home does not have group policy, so you can't lock down the workstation through GUI tools and because it is a standalone workstation, the policy would apply to all users anyway, which would elsucko. Admin w/o a desktop .

[UpperCell]

Believe it or not, norton internet security is a beutiful setup when used with windows XP and properly configured. It can use windows built in security and if your using NTFS (why wouldn't you?) then it's offers security as good as windows itself. This product allows you to unconditionally restrict internet access to certain users, and has many configuration options if you wan't it somewhere in between on and off. It does cost a bit though and there's no free version, so it may not be the best option.

[sanriver12]

check out this software

http://www.winability.com/folderguard/

What you can do with Folder Guard:

Actually hide files and folders
Make files and folders read-only for real
Protect files and folders with passwords
Prevent users from installing unauthorized programs
Prevent users from running programs from the floppy disks
Prevent users from reformatting local drives
Restrict access to the Dial-Up Networking settings
Prevent access to the Date/Time settings
Monitor the logon and disable the CANCEL button on the password window
Restrict access to Control Panel and other resources
Restrict software downloads from the Internet
Restrict the Save As Wallpaper command
And much more...