This How-To will allow you to disable the internet from being accessed on selected user accounts within Windows XP and Windows Vista and Windows 7.
There are often times useful to parents and network administrators who need or want to lock down their computer(s). For instance, a parent might want to allow a child to access the computer itself, but not access the internet. Or a system administrator might need to lock down a specific computer or an entire cluster of computers from accessing the internet - yet still maintain a network connection to those computers. Of course, there are better ways to do this on a network level, but it has its purpose in certain situations.
It should be noted that all accounts that you apply this to must be set as "Limited Accounts" and not setup as "Administrators". The reason for setting the user account to a "limited account" is to make sure that nobody can install software. You do not want somebody to download and install another browser (Firefox, opera, safari, etc)
as that will defeat all of this. This process only kills the internet for Internet Explorer. So, if you have any of those other browsers installed, you will want to take steps to keep only the Administrator Account from using those programs. (all of the aforementioned browsers allow you to set who can access them)
It should also be noted that you will need to do this for each *user accounts* on the computer - it is not a global setting! (plus, you probably do not want to do this for your primary/administrator account anyway!)
: you will need to set the users account as "Administrator" (we will change this later) so that we can access certain things we'll need access to.
If are you unaware of how to change account types, I would suggest you pass on doing this yourself and call a friend who knows how to do so, because the rest of this will be much more advanced then simply changing a users account type from limited to administrator - Much more advanced!
After you have setup the secondary account as an Administrator log into that users account.
Now Open Internet Explorer. Sorry, but this can only be done via IE... it will not work in Firefox, opera, safari, etc.
Go to: Tools -> Internet Options -> Connections [tab] -> Lan Settings
Under "Proxy Server" check the box to enable it.
Set Address as: 127.0.0.1
Change Port from "80" to "90" (if it is blank, insert 90)
These two screenshots show a before & after:
(6 & 7)
Press "OK" (twice)
Press the Windows "Start Button" -> Run -> gpedit.msc
You will now need to drill down through the following values...
User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Disable the Connections page"
(NOTE: Windows 7 has changed this to "Disable changing connection settings")
Once you find the "Disable the Connections Page" double-click on it. You should see the following screen:
Press "File -> Exit"
Ok, those are the twelve steps necessary to complete the process.
What you will now want to do is go back to your primary Administrator account and change the user account back from an Administrator to a Limited account. (which was the first step in this whole process)
That is all there is to do. I'd advice you log into the users account and open up Internet Explorer just to make sure you did everything correctly!
So What Exactly Does All This Do?
In non-layman's terms... What this does is hard-code the proxy for IE and point it at the local network/computer. By doing so IE will also attempt to load the local network and never allow it to leave the local network. (i.e.: access the internet).
By going into the Group Editor we are then telling Windows to not even show the "Connections" tab within "Tools -> Internet Options" thereby making it almost impossible to change the proxy values back to default settings.
A tricky method to accomplish a simple task that one would think would naturally be within Windows, but isn't.
Hope this works for everybody. And, if you barf up your computer, don't blame me!
John B. Abela
(credit goes to my good friend folken who helped me put all this idea together a few months ago)
(Jan 09, 2011 - updated to indicate changes to Windows 7 changes)