Or you could just turn off all file access to the business PCs' drives from the the users logged on at the test PCs. That's the conventional way to do it. I'll have to test that subnet mask thing, though.