IE access

[Guest Jeff]

Hello,

 

Is it possible to block internet access per-user on a 2003 TS? I need to

block internet access for one user but not all. I was thinking there might

be registry key to modify to set a Proxy server address, and this would take

care of it since we have no proxy server.

 

Perhaps I can do something with group policy.

 

--

Thanks, Jeff

[Guest news]

Re: IE access

 

Jeff wrote:

> Hello,

>

> Is it possible to block internet access per-user on a 2003 TS? I need to

> block internet access for one user but not all. I was thinking there might

> be registry key to modify to set a Proxy server address, and this would take

> care of it since we have no proxy server.

>

> Perhaps I can do something with group policy.

>

 

how about logging into that user account and putting a fake proxy (to a

network printer- for example).

 

I do that for some, it's a simple fix and it's just for one user. For a

bunch, GPO is best.

 

 

 

Oskar

[Guest Jeff]

Re: IE access

 

I should have clarified. Is there any way to do it while that person is

logged in? I was going to use the fake proxy setup, an old trick, but

effective.

 

--

Thanks, Jeff

 

 

"news" wrote:

> Jeff wrote:

> > Hello,

> >

> > Is it possible to block internet access per-user on a 2003 TS? I need to

> > block internet access for one user but not all. I was thinking there might

> > be registry key to modify to set a Proxy server address, and this would take

> > care of it since we have no proxy server.

> >

> > Perhaps I can do something with group policy.

> >

>

> how about logging into that user account and putting a fake proxy (to a

> network printer- for example).

>

> I do that for some, it's a simple fix and it's just for one user. For a

> bunch, GPO is best.

>

>

>

> Oskar

>

>

[Guest Vera Noest [MVP]]

Re: IE access

 

Yes, in a GPO, linked to the OU which contains the Terminal Server

account, not the user account. Group policy settings will be

automatically refreshed, I believe every 90 minutes by default.

 

You need to define 2 settings in this GPO:

 

Computer Configuration - Administrative Templates - System - Group

Policy

"User Group Policy loopback processing mode" - "Replace"

 

User Configuration - Windows Settings - Internet Explorer

Maintenance - Connection - Proxy

 

Loopback processing sees to it that the User configuration settings

are taken from the GPO linked to the TS OU, instead for the normal

situation, where the User Configuration is taken from the GPO

linked to the Users OU.

 

Then create a security group, let's call it "NoIEUsers". Modify the

security filtering for the GPO, delete the Authenticated users

group, add the NoIEUsers group and add the computer account for the

Terminal Server. Give them both Read + Apply this GPO rights.

 

_________________________________________________________

Vera Noest

MCSE, CCEA, Microsoft MVP - Terminal Server

TS troubleshooting: http://ts.veranoest.net

___ please respond in newsgroup, NOT by private email ___

 

=?Utf-8?B?SmVmZg==?= <Jeff@discussions.microsoft.com> wrote on 10

aug 2007 in microsoft.public.windows.terminal_services:

> I should have clarified. Is there any way to do it while that

> person is logged in? I was going to use the fake proxy setup,

> an old trick, but effective.