Setting user access.

smackaholic · Post by **smackaholic** » Sat Sep 30, 2006 2:32 pm

I need to set up an account with limited access. (no fukking internet!!!!!!) I tried stumbling my way through the so called help section in XP pro, but, my computer ignern't ADD riddled ass is still confused.

Help a brotha out.

thanks in advance,

smackaholic, official 'puter admin moron

Mister Bushice · Post by **Mister Bushice** » Sat Sep 30, 2006 5:54 pm

Well, for one thing, XP alone ain't gonna do that. All the user settings in XP Pro do is prevent access to certain file types, areas, and to prevent download and installation of programs.

XP only has three user settings - admin, limited user, and guest. Guest should be turned off or password protected for safety, and the limited accounts don't prevent net access.

To do that you need either a service provider that has a content filter program installed in their browser where you can really manipulate excatly what other users can access on line and see where they go (sbcglobal has a good one) , or you need a program installed in your computer that does the same thing.

However a skilled computer user will eventually find a way around those programs. For example, the sbcglobal program can simply be dodged by first logging in there as a user on the system in order to gain net access, then going and opening IE or firefox browser, which will sniff out the connection and get you on the net unrestricted.

The above also holds true for the power users, users, and special groups. Internet access is not restricted, only certain program manipulation activity and area access may be.

If you want to control browser settings and you use IE, you can turn on the content advisor. read up on it here:

http://www.microsoft.com/windows/ie/ie6 ... onfig.mspx

With Content Advisor, you make a list of websites that you want to be allowed, like http://www.scatlover.com and such. If some user attempts to access any website that is not on your list, they'll be prompted for the Content Advisor password. The problem is you have to use IE to get this, but since you're making concessions anyway, wtf, go for it.

I know there are a bunch of programs out there you can buy, and there may even be hardware that will control access. Google is your fren'

smackaholic · Post by **smackaholic** » Sat Sep 30, 2006 8:49 pm

thanks, bush.

I do use sbcglobal foe my pron errrr internet service provider. guess I'll check wif them.

Mister Bushice · Post by **Mister Bushice** » Sat Sep 30, 2006 10:36 pm

Smack,

You will have to use the SBC browser for net access, which is not always the best way for you, but if you have little ones at home you want to protect, it really is the best way to go.

Some of the features they have:

multiple security levels based on age.

A "report card" that will be mailed to you every week/month to let you know exactly what websites your child has been to.

Ability to turn off chat and IM.

customizable log-ins for each child, so that the 14 year old can cruise more stuff than the 5 year old can, and yet if the 14 year old breaks the rules, you can shut them down and they can't do shit about it.

Time controls. You can set max hours per week/day, and even limit the time of day they can gain internet access. This is a great feature to prevent them from going on line right after school when they should be doing homework.

Only one warning. You will have to remove IE and Firefox, etc. browsers from the computer if you have some computer saavy kids at home or else they can easily figure out how to circumvent the sbc browser.

Post here if you need any help with that shit.

ElTaco · Post by **ElTaco** » Mon Oct 02, 2006 1:02 am

What MB said isn't entirely true. NT, W2k and XP all come with a number of tools that you can use to limit access to programs and in turn the internet. Now I will preface this by saying that this isn't always the simplest or best way of doing things at home but it is very powerful and if you set it up correctly it is rather hard to to break or get around.

First step is to make sure that your administrative and power user accounts are secure, which means deleting accounts (or disabling) the ones that no one is currently using and putting strong passwords on the ones that are being used.

To get started, go to Start -> Control Panel. Then find Administrative Tools and finally open up the Local Security Settings. At this point you can set global settings such as password requirements and loging/auditing. However you are interested in the Local Policies -> User Rights Assignment. Over here you can assign some fairly powerful rights on a user account basis such as network access.

One word of Caution, be very careful about what you Deny vs what you allow, especially when you do it on a group basis. You could accidentally stop yourself from being able to do something important or lock everyone out of the computer without intending to and end up having to re-install.

Also if you set your kids usage too strict, they may just figure out a way to get into your account and reset the password or give themselves admin access so if you do decide to implement security settings, I'd be careful about guarding your admin accounts and making sure they are locked down when you walk away.

Good luck!

Mister Bushice · Post by **Mister Bushice** » Mon Oct 02, 2006 3:19 am

ET,

I did not realize it did all that, but even after looking at it, I still think the options above are easier to deal with. The inaccessibility of the security settings (or should I say the lack of an easy to understand user friendly interface for same) that the average person with little or no computer skills would balk at sorting out would be enough to discourage most people from even attempting it.

And besides, its a passive system. The average user would never really know if anything was changed unless they police it diligently.

That is one thing I liked about the sbc browser. Not only user friendly but it is an active interface.

Shlomart Ben Yisrael · Mon Oct 02, 2006 9:18 am

Dual boot.

With no internet connection on the second installation, let them go nuts.

ElTaco · Post by **ElTaco** » Mon Oct 02, 2006 2:30 pm

Mister Bushice wrote:I did not realize it did all that, but even after looking at it, I still think the options above are easier to deal with.

Yep I agree with you there. It doesn't allow for very specific things and fine controlls which is probably more what an at home system requires. What it does allow for is to set general Windows user rights to ensure that your kids can't install software and even limit the software they can run. You can get your hands on the server profile editor and that actually allows you to set rights by software/user as well so you can set what you want the kids to see under the Start menu and what options you want enabled in IE.

The nice thing about something like SBCBrowser is that it has a lot of built in controls that are easy to figure out, the problem is what happens when your kids download a text only browser that does not need to be installed and use that to browse the web and download some other tool that may infect the computer and give them enough rights to use another browser. For that matter, what if they just start up IE?

You may actually be better off using some type of a mixed solution. First you will probably want to secure the machine. Create a regular power user account for yourself and the wife. Make the kids have their own logins and make them standard users. Require a decent password from everyone and disable all other accounts on the machine, except for the built in Administrator of course, which should have a strong password that only you know. What this does for you is ensure that the kids all have their own account so they can't mess with each other's stuff or yours. Because you set the Kids accounts as general users, they can't by default install any software that writes to Program Files or into the Registry. Be careful though because they can still download software and run it if it is small enough to be just run from the desktop. It also stops them from installing drivers that have not been approved by MS. This should limit your virus problems.

Next you'll want to run one up to date virus checker and probably two spyware checkers. My 3 favorites are Spybot S&D, Ad-Aware and recently I've started to like the MS Windows Defender. Spybot and Defender both actively monitor the Registry for changes. What may be of interest to you is if you are worried about your kids browsing bad websites and downloading infected files, instead of disabling their internet you could control it by getting a router that checks to make sure that the Virus checker is installed and running. Most SOHO DSL/Cable routers support this feature. For example:
NETGEAR WGR614 Cable/DSL 54 Mbps Wireless Router, 802.11g SOHO router allows you to block websites by URL or offensive material. It also looks for Antivirus and can also Log everything. Of course the problem here is that this would also effect your web browsing. In fact some companies like Netgear, D-link and Eli offer security packs with a per year subscription for a whole package that will protect you, your computer and your kids from everything.

I guess ultimately you have to decide what and why you need/want this and of course how much its worth to you. Of course you could always switch to Linux which is free and offers very powerful tools to lock down the computer including scriptable firewall rules.

PSUFAN · Post by **PSUFAN** » Mon Oct 02, 2006 4:06 pm

Just a general question...aren't real-world steps what should be used here?

After all, a kid is going to get that internet access, if not at your house, then elsewhere. You might just drive them to hide it from you better.

Mister Bushice · Post by **Mister Bushice** » Mon Oct 02, 2006 7:05 pm

The nice thing about something like SBCBrowser is that it has a lot of built in controls that are easy to figure out, the problem is what happens when your kids download a text only browser that does not need to be installed and use that to browse the web and download some other tool that may infect the computer and give them enough rights to use another browser. For that matter, what if they just start up IE?

I mentioned that above. First off, if you set the SBC browser correctly, kids will not be able to download and install anything. That is one of the features of the user controls. You can also do that in XP I believe. non-administrative users cannot DL and install things, correct?

Secondly, yes, you would have to remove or hide the IE browser. I just uninstalled it for my brother in law, as he has the original CDs ( not that he'd use it with three little ones in the house).

PSU,

You make a good point. I know for a fact that my 10-12 year old nephews go over to one of their friends house and play certain inappropriate video games, but at least controlling the amount of time they are allowed to spend on the computer at home still does help ensure they don't destroy the computer by downloading all kinds of crap, and it makes sure they get homework done, since they have to do it at home before they go out anywhere, and there is no contant internet access available to distract them.

What the hell. Kids will get away with shit because they know how to. I was snitching porno mags from my older brothers closet at age 12. I turned out mostly alright. :)

ElTaco · Post by **ElTaco** » Mon Oct 02, 2006 8:25 pm

What would I know about having kids? I'm an IT manager and not a dad. All jokes asside, yes you guys are probably right. Than again, Smackaholic has yet to describe what he wants to do exactly.