Restricting Access in Windows XP

I appreciate, in advance, any help that can be offered.
Thank you...

This is what I would like to do:

I want to have it so when I set-up a new user, I only want them to be able to do certain things. For example, playing games, using Office for reports and what not, and general computer use, but nothing to do with the internet...not without a password.

So, first question, is this possible? If so, could someone lead me through some steps? My computer here is very accessible to people and although I don't want to totally restrict people, I want it to be under my control. And, if at all possible, without the need to download software. If you can download and install it, there's a way to un-install it...which I want to eliminate.

I would appreciate any insight anyone can give or offer me. You can either respond here or email me at [email protected].
Thank you for your time.

do you have a dail-up/broadband/etc

Sorry about lack of clarity...

I have Windows XP Home
Cable Internet Connection
512 mb RAM
120gig HD
2.2 Mhz AMD

If there is anything else, let me know.
Thank you

If you just want to restrict internet access to a user I would suggest using sygate personal firewall. Set a (strong) password on that and then when YOU log out set the firewall to 'block all' mode. Make sure the user you have created does not belong to an administrators or power users group as they could shut down the firewall without being prompted for a password.

Another way of restricting user rights is through group policy editor.
Type 'gpedit.msc' in a run box.
I am not sure about restricting internet access through that one though.

Hope it helps

I totally appreciate your response no0dle.

Is there anywhere where I can get a sysgate firewall, freeware, or am I going to have to drop a few bucks?

Also, with this firewall, can it be user-specific? Meaning, would there be a way to designate it as "block all" for one user, and then when I log into another account, it resume normal, or would I have to manually reset it back to "normal?"

Just to clarify so that you know the exact situation...

I have a friend who uses my computer all of the time, and sometimes when I check the history/temp/ folders, I notice that he has gone to "adult sites" and whatnot. Alright, so I approached him and we worked out a deal where I installed software called "X-watch" that if he goes to any questionable site, a list of the "bad sites" will be emailed to me. So, a little internet accountability.

Well, he came to me and said that he can still get "stuff" through Kazaa, so I blocked the site kazaa.com through the Content Advisory in IE, as well as kazaalite and so on. Well, naturally there are ways around this, which he knows, so what I want to do is create an account for him so he can use the computer for games (single player), office products, and general computer use, but I don't want him to use the internet without either entering a password that I know, or just not using it at all unless I am around...to keep him in check.

Sorry for the length of this explanation. I just want to make sure that I explain everything and leave nothing to chance..

so, if anyone has any suggestions, I would appreciate it.
Thank you again...

Actually to solve your problem is quite easy.First of all,you can make use of your router to assign certain ports for them to go such as open the port for 80,21,8080,110,25 and the rest of the ports you close it.As for application,you can make use of the user setting for the area or application which set for the user to use.That's it but the home edition has some limitation.

I don't think I have a router wacky_sung.

I mean, I could be wrong, but all I have is a cable modem and a NIC card. I guess I just have to get home and play with the group policy and settings and see what works and what doesn't.

Thanks for your help. If you have any more suggestions, please keep responding.
Thank you

Quote:

---

I guess I just have to get home and play with the group policy and settings and see what works and what doesn't.

---

This is the only way which you can do.Otherwise if you have a hardware firewall,you can also play around with the setting.

Sygate personal firewall can be obtained from:
http://www.sygate.com/

It is free for personal use.

You can set it only to one mode at the same time.
So you will have to set it to 'block all' when you log out and the other person logs in.


Edit
Blocking kazaa in content advisor won't get you far since it does not use internet explorer to make a connection.

n0odle, no I don't block kazaa through IE, I block the actual site and download.com so he can't re-d/l it. I know he can search for mirrors, so that's why I want to block internet without me being there.

I know I am asking for a lot but I totally appreciate the level of professionalism you have shown me. I know I don't post much and I appreciate your rapid response.
Thank you guys/gals (if any)

I think it is the best deal to create a user account that belongs to the 'users' group and restrict everything the dude does not need.
Including things like regedit, control panel, run box, cmd prompt etc.
Make a box with one entry in the start menu: programs and have the programs he needs preinstalled.
Also remove all icons from the desktop. I believe this can be done by using gpedit.msc otherwise find some registry tutorial.
Like this one:
http://www.easydesksoftware.com/regtrick.htm

Cheers
noODle

correct me if I'm wrong but... XP home doesn't have a group policy editor does it??

It'd be easier if the internet connection was dial up cos then you could set up your friend as a user and set the dial up account to be accessible only to yourself. I say this cos if you go through the 'connect to' menu and click on the relevant dial up connection there should be a section saying 'save this password for... 'me only' or 'anyone who uses this computer' - obvious which choice you take... this solution would be perfect for you but I don't think it'd work for an always on connection (sadly I don't have one at home just yet :( ) - might be worth a look tho'....

I'm not entirely sure you'd be able to do this without some third party software.... I have something in mind tho' give me a bit of time and I'll see if I can find something for you

Z
[edit] mmm... no sorry the software I had in mind (wasn't a firewall), only supports win9x... I'd go with the other suggestions if mine about 'save password... ' etc isn't available

I don't usually suggest proxies for security but in this case. Most windows based proxies (there is a free one from 602 software that is decent) will not only let you share an internet connect, but also restrict network access by user and time. So setup a user for this guy, and restrict that users access (some firewalls can do this also...but they would have to be software based on your box)

you could try tweakui http://downloads-zdnet.com.com/3000-...ml?tag=lst-0-1 just download it then extract it then right click tweakui.inf and click install then goto control panel and click on tweakui and you can restrict allsorts of stuff or if you need more help on installing it check out
http://www.antionline.com/showthread...hreadid=243017
hope this helps you

X-watch is good, so are others like Surf control and net nanny etc.
I havent used X-Watch so i wouldnt know if it has a custom blocking list or not.
If he still gets through the IE Content advisor, which is easy, as you have to remove one key from the regedit or change the ratings.pol file to ratings.old,
Anyways, if he still gets through, check the websites he vistis and add them to the HOSTS file with the lookup address as the loopback, 127.0.0.1
About Kazaa, blocking Kazaa.com etc has nothing to do with kazaa downloads,
Kazaa works on p2p protocol and opens up randon ports and connects to random ip's(In the case of downloading from someone) to download.
Kazaa has a conetnt restriction, family filter, or whatever they call it.
You can pass protect it.
It's pretty self explainatory, mess with it a little and you'll get it.
Also, if you want restrictios implied on the box he uses, you can manulay edit the registry keys for hiding of stuff you dont want his acces to.. the run button or Internet explorer etc etc.
If you dont know the keys and the way the operate(Dword values, String values, 1=enable, 0=disable etc) then i recommend Winboost.
Google for it.
Also, you can get a firewall, (Highly recommend Outpost) it has a content restriction in it aswell.
You can specify words that a website contains, which is to be blocked.
In your case, obscene words, and phrases.
...

Strange. I have searched exactly the same thing today for applications under XP. I wil have to provide access to my master pc for standard users and I don't want to let them play with config or access to what I have not decided they could access.
I recommend you to protect well your 'normal' accounts before creating the new one, after what you should check you have well disabled "administrators" and "guests" accounts in "computer administration" (in the config panel->admin).
Agter what you will have to install the already advised by everybody firewall and to restrict access to programs. If you know well your system, I would recommend you to go into "folder options"->"view" tab -> uncheck the "use simple file sharing" option. It will enable a "security" tab in properties of each files/folders in your computer where you will be able to give to users access (or not) to thus stuffs.

I will also advise you to keep bootdisks and papers with passwords on them in a secure place (ie not near your computer) ;)

KC

Windows XP Home is built on the NT kernel. This means that instead of having "services" located all over the OS configuration files, they are all in one neat and tidy place in the registry. So, adding onto what No0dle suggested, all you do is load up mmc, add the services snap-in and disable the following:

1. Workstation
2. DHCP Client
3. DNS Client

You have to be admin to enable/disable these services, so make sure your 'friend' is using a normal 'user' account, and he will be effectively cut off from the net. Unfortunately, XP Home does not have group policy, so you can't lock down the workstation through GUI tools and because it is a standalone workstation, the policy would apply to all users anyway, which would elsucko. Admin w/o a desktop :).

Believe it or not, norton internet security is a beutiful setup when used with windows XP and properly configured. It can use windows built in security and if your using NTFS (why wouldn't you?) then it's offers security as good as windows itself. This product allows you to unconditionally restrict internet access to certain users, and has many configuration options if you wan't it somewhere in between on and off. It does cost a bit though and there's no free version, so it may not be the best option.

check out this software

http://www.winability.com/folderguard/

What you can do with Folder Guard:

Actually hide files and folders
Make files and folders read-only for real
Protect files and folders with passwords
Prevent users from installing unauthorized programs
Prevent users from running programs from the floppy disks
Prevent users from reformatting local drives
Restrict access to the Dial-Up Networking settings
Prevent access to the Date/Time settings
Monitor the logon and disable the CANCEL button on the password window
Restrict access to Control Panel and other resources
Restrict software downloads from the Internet
Restrict the Save As Wallpaper command
And much more...