It's been over a week already and I am unable to find satisfactory solutions to my problem on the Internet. I hope the experts here could lend a helping hand. I will just go straight on describing the problem.
Requirements/Restrictions/Conditions
- One (1) Email system domain: @companyname.com
- Three (3) classes of users/accounts: a) normal (can communicate with anyone inside company and outside world) b) internal (can communicate with anyone inside company but not outside world) c) restricted (can only communicate with a pre-defined set of people inside the company)
- Email is hosted externally online (ex. Zoho, Google Mail, etc.)
- Available operating systems: OpenWRT Router, Ubuntu Linux Server, Windows 7 Workstations
- Internal and restricted user types must not be able to arbitrarily set up personal email accounts and access the outside world on their PCs (running Windows 7)
- Internal and restricted user types are non-admin Windows 7 users whose program access is limited through parental controls
Immediate Problem
Requirement #2 has been handled satisfactorily by setting up user restrictions in the online email provider.
The main problem is Requirement #5 as a lockable email client able to run in kiosk-like mode does not seem to exist. For example, I tried Thunderbird, but whatever customizations and extensions (to prevent users from creating non-company issued accounts) I could muster are easily foiled by running its safe mode. Whitelisting IMAP/SMTP to Zoho (and blocking the rest) using a firewall is not enough as the employee could create his own login at Zoho outside the company and then use that login at work.
What can be done to satisfy all the above requirements? Maybe there is a really simple solution that I just missed? Any suggestion on any level of implementation is welcome.