Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way I can disable internet access for a single account an XP Pro machine? Preferable something built-in like a security policy or something.


share|improve this question
up vote 3 down vote accepted

It's not clear from your question, but I'm guessing this is a stand-alone PC?

If that's the case you may want to look at Windows Steady State. I've used it to better control access in various stand-alone PCs for very small businesses and homes.

share|improve this answer
...offers all sorts of 'per user' restrictions, including disabling internet access...and its FREE and created by MS – cop1152 Jul 12 '09 at 2:25
Perfect, exactly what I needed. It's beyond me why they don't advertise this better. – John Jul 21 '09 at 23:11
You'd be amazed how many cool tools MS developers have tucked away on their website. – AnonJr Jul 22 '09 at 0:57

The policy you're looking to change is under:

User Configuration -> Windows Settings -> Internet Explorer Maintenance -> Connection

I believe when you change policies in 'User Configuration' they apply to the currently logged on user, so you would have to log onto the user(s) you wish to restrict.

Note that I'm not entirely sure on this, so take with a pinch of salt.

Personally, my preferred option would be:

a) Setup a bogus proxy server in your browser of choice. Proxy servers are usually stored on a per user basis, (at least in IE) and thus you can block your users with a bogus proxy. This is really easy to circumvent.

b) Install a proxying software such as freeproxy that requires users to Authenticate before they can access the internet. The benefit is you can safely use more global group policies to enforce use of a proxy, or you can use some form of autoconfiguration.

What sort of environment are we discussing here? Is this a work PC? If it's a work PC and it's being used for non work things, you should inform the users that is not acceptable - and more importantly, your workplace should have an acceptable use policy to back it up.

share|improve this answer
It is a home computer not on a domain. We want a young child to be able to play some games but not use the internet just yet. I'll take a look at freeproxy. Thanks for your suggestions. – John Jul 11 '09 at 0:30

You could also consider an upstream solution depending on what firewall you are using.

share|improve this answer
We are using the built-in Windows firewall. Is there a way I can configure it to block one user from accessing the internet? – John Jul 11 '09 at 0:04

You mentioned in your comment this was for a young child. The simplest solution is just remove icons to Internet Explorer.

Remove from desktop, pre-SP3: Control Panel -> Display -> Desktop -> Customize Desktop, uncheck Internet Explorer.

Remove from Start Menu: Right click on icon, choose Remove from Menu.

Remove from Start Menu Programs Group: Right-click on Start, Explore, go into Programs, delete the icon.

share|improve this answer

You could simply write a logon script for the user account in question and release the IP.

Some basic steps if you want to punt:

  • Start->Control Panel->Administrative Tools->Computer Management
  • Local Users and Groups->Users
  • Right click on the user in question and select Properties
  • On the profile tab enter the profile path "c:\" and the logon script name "ReleaseIP.bat"
  • In "c:\" create a ".bat" file called "ReleaseIP.bat" with the following content:
  • "ipconfig /release"
  • In your "network connections" and your Local Area Connection be sure to uncheck "Show icon in notification area when connected" and uncheck "Notify me when this connection has limited or no connectivity" to hide the network icon.

You might have to create a network share and place the script in there depending on your computer configuration.

Unless your kid knows how to renew the IP address they'll effectively be dealing with a disabled network adapter (Assuming you only one network card.)

share|improve this answer

It depends if you have XP Home or XP Professional. The latter allows you to set a policy that would allow you to redirect any web connection to a bogus address/port i.e. the local address.

share|improve this answer
It is XP Pro. Can you tell me the name of the policy? I can't seem to find it in the list – John Jul 11 '09 at 0:01
Oh man.. I am not using Windows anymore for ages ;) – txwikinger Jul 11 '09 at 0:08
IIRC It was the one setting the proxy for a user. I definitely know that you can do it via group policies on AD. Probably also possible on local policies. – txwikinger Jul 11 '09 at 0:10

Not particularly a sysadmin answer if we're talking about a young kid (upstream proxies and whatnot are really overkill for your scenario), but Windows Live Family Safety is designed explicitly for this scenario. It is free and will let you lock down access for given users, grant them access to certain sites (they have a list of kid-friendly sites such as the Disney Channel or Nick Jr. sites), and kids can request access to sites that will be routed to your e-mail for review/approval).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.