Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On a Windows 7 Professional laptop, not on a domain, what's the best way to restrict access to the internet (and preferably network) to Administrator users only?

I don't want to simply set a bogus network address, or proxy. That seems far too dirty somehow.

share|improve this question
    
OK, is the use case "restrict human users" or "restrict accounts that are used to run a service?" –  rackandboneman May 10 '12 at 18:01
    
Human users. I haven't begun to consider Service Accounts. –  Tom O'Connor May 10 '12 at 20:45
add comment

5 Answers

up vote 2 down vote accepted

802.1 and/or NAC/NAP, if your switches and/or servers support it. By default, the laptop would only be in a subnet with no gateway. Then, if certain users can present creds to the auth system, they could be put in a non-quarantined network.

I realize that this isn't "local policy" as such, but it'll work and it's even enterprise-y (centrally managed, fine-grained, etc).

share|improve this answer
    
This is indeed promising. –  Tom O'Connor May 11 '12 at 2:51
add comment

I think that your 2nd paragraph is the only way since only admins can change IPs and enable/disable NICs... Just disable all the NICs.

share|improve this answer
    
I'm just irritated by windows and the insanity of it all.. Ever tried to get WPA2-Enterprise working with a Cisco AP541 something, and the cheapest lenovo laptop ever. –  Tom O'Connor May 10 '12 at 14:26
1  
My reputation's pretty much all linux and so on. –  Tom O'Connor May 10 '12 at 14:27
1  
well my reputation is pretty much windows. The quickest and most effective way to restrict internet access (and preferably also network as you said) is to disable the NICs in Control Panel > Network and Sharing Center > Manage Network Connections. Only admins can enable them. –  August May 10 '12 at 14:46
1  
@August Higher Rep = More Abrasive Comments. ;) –  MDMarra May 10 '12 at 14:47
    
Ok I deleted my "abrasive" comment now that we've straightened everything out. No harm - just trying to keep this a family show for the kids. @Tom - yes Lenovos are crap pretty much ever since IBM sold their laptop division to them. I'd consider them for home use only. –  August May 10 '12 at 14:56
show 2 more comments

Just a suggestion where to look at: If you can restrict who can create a socket and bind it to a certain type of port, which might or might not be possible by policy, you will have a setup that will restrict an one user WHILE the other user can use the network.

share|improve this answer
    
That's not really something that Windows does or can do. –  mfinni May 10 '12 at 15:07
1  
This should've been a Question comment. –  Tom O'Connor May 10 '12 at 15:21
    
Tom - no, I'm replying to rackandboneman. Windows has no ACL structure to allow/disallow users to open certain ports, so it's a bad answer. There's some hacked-up ways in Windows to get a close answer for the question, but rack's answer is not something that can be done. –  mfinni May 11 '12 at 2:37
    
To clarify: I am sometimes too tempted to give hints on what layer of an OS I would look for an answer. And "where ports are bound" would be the one of the likely candidates. –  rackandboneman May 11 '12 at 4:55
    
@rackandboneman - sure, if Windows had such a facility, that would be a great way to do it. It doesn't; I don't think the hooks are even there for 3rd-party software to do it. I honestly don't think there are even any Unices that do that. Can you give any examples of where you've seen this or something like it? I'm very curious. –  mfinni May 11 '12 at 13:30
add comment

If you create a domain, even with only the single computer, then Active Directory could selectively disable certain programs, for certain users on said domain. Otherwise, i suppose you could change the permissions of internet explorer to require administrative access (vvia the properties -> security tab)

share|improve this answer
    
That won't restrict access to the Internet, though. There are plenty of browsers that can install/run without admin rights. –  MDMarra May 10 '12 at 13:10
    
only if they bring it in on a flash drive... –  acolyte May 10 '12 at 14:10
    
If you try and block internet access to a user that wants it, that's the first thing that they're going to do. –  MDMarra May 10 '12 at 14:12
1  
you could always put a company policy into place. –  acolyte May 10 '12 at 14:20
add comment

I'm pretty sure that you can restrict internet through local group policy.

share|improve this answer
    
Why the -2? Its a legit and correct answer. –  cop1152 May 15 '12 at 19:01
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.