Windows Security Policies

[Necrom]

I've been tring to modify security policies on my windows PC and I can't figure out how to restrict the internet access on the guest acount. In other words I don't want the guest acount to use the internet, I have a broad band conection.

Any help will be most apreciated...

Necrom

[thadbme]

The quickest fix I can think for restricing guest access is permissions to the web services. Set the security permissions for IE, mail, or any other web aware applications. If you made your computer restrictive enough to the guest account it should work.

I'm not sure what flavor of windows you are working with, but if its W2k Pro, or WIN XP Pro I'm sure that you could change your local computer policy to restrict network access, however I haven't found that just yet. I'll look again in a few minutes upon my return. If you have one of those operating systems and you'd like to look, just go to run, type mmc and enter. From there choose Add / Remove snap-in. And from there add group policy. You can configure just about every aspect of the computer, but this might be a bit too extreme for what your needing.

How many people access this computer? Is it yours, or is it on a network? More info please!

[Necrom]

Thanks for the reply Thadbme.

It's a computer at a friends store. It is not on a network, it's running winXP Pro, it has a broadband connection directly to the tower, no modems, and hes trying to keep people form using the connection. Only the guest and his account are active on the PC. I tried checking the local security settings but got stuck.

Necrom

[thadbme]

You could always just axe the guest account! That may be a demo computer or something that you want people to be able to use correct?

[thadbme]

Ok, I think I might have found what your looking for, and that is if you don't want the guest account as part of the network at all. If you open your local security policy under administration tools, then expand user rights assignment. From there the policy "Access this computer from the network" , if you remove the guest account from this it should do the trick. This is assuming the guest can log on locally. Hopefully thats enough! If not maybe someone else can check it out as they may have more ideas.

[Tiger Shark]

Thadbme: That only blocks the Guest account from logging into the system from a remote location.

Necrom: Disable the network connection when you log off as the administrator. The Guest should only be in the users group and therefore will not be able to re-enable it due to not having the appropriate rights. When your friend logs in and wants to use the internet he just has to enable the network connection, do his stuff and disable it prior to logout.

[djscribble]

what i have seen done before, is what tiger shark suggested, but done through a batch file so whenever the guest logs on, then it is disabled -- the batch file uses the runas command, is hidden somewhere deep in the windows system32 folder, and is started by the registry this way your admin user/password is not given up.

[thadbme]

Thats the way I read it as well, but one of my co-workers swore that would work. Anyways I don't see the point of a guest account in the first place unless this is some sort of a display computer.