Is there a way I can disable internet access for a single account an XP Pro machine? Preferable something built-in like a security policy or something.



It's not clear from your question, but I'm guessing this is a stand-alone PC?

If that's the case you may want to look at Windows Steady State. I've used it to better control access in various stand-alone PCs for very small businesses and homes.

  • ...offers all sorts of 'per user' restrictions, including disabling internet access...and its FREE and created by MS
    – cop1152
    Jul 12 '09 at 2:25
  • Perfect, exactly what I needed. It's beyond me why they don't advertise this better.
    – John
    Jul 21 '09 at 23:11
  • You'd be amazed how many cool tools MS developers have tucked away on their website.
    – AnonJr
    Jul 22 '09 at 0:57

The policy you're looking to change is under:

User Configuration -> Windows Settings -> Internet Explorer Maintenance -> Connection

I believe when you change policies in 'User Configuration' they apply to the currently logged on user, so you would have to log onto the user(s) you wish to restrict.

Note that I'm not entirely sure on this, so take with a pinch of salt.

Personally, my preferred option would be:

a) Setup a bogus proxy server in your browser of choice. Proxy servers are usually stored on a per user basis, (at least in IE) and thus you can block your users with a bogus proxy. This is really easy to circumvent.

b) Install a proxying software such as freeproxy that requires users to Authenticate before they can access the internet. The benefit is you can safely use more global group policies to enforce use of a proxy, or you can use some form of autoconfiguration.

What sort of environment are we discussing here? Is this a work PC? If it's a work PC and it's being used for non work things, you should inform the users that is not acceptable - and more importantly, your workplace should have an acceptable use policy to back it up.

  • It is a home computer not on a domain. We want a young child to be able to play some games but not use the internet just yet. I'll take a look at freeproxy. Thanks for your suggestions.
    – John
    Jul 11 '09 at 0:30

You could also consider an upstream solution depending on what firewall you are using.

  • We are using the built-in Windows firewall. Is there a way I can configure it to block one user from accessing the internet?
    – John
    Jul 11 '09 at 0:04

You mentioned in your comment this was for a young child. The simplest solution is just remove icons to Internet Explorer.

Remove from desktop, pre-SP3: Control Panel -> Display -> Desktop -> Customize Desktop, uncheck Internet Explorer.

Remove from Start Menu: Right click on icon, choose Remove from Menu.

Remove from Start Menu Programs Group: Right-click on Start, Explore, go into Programs, delete the icon.


You could simply write a logon script for the user account in question and release the IP.

Some basic steps if you want to punt:

  • Start->Control Panel->Administrative Tools->Computer Management
  • Local Users and Groups->Users
  • Right click on the user in question and select Properties
  • On the profile tab enter the profile path "c:\" and the logon script name "ReleaseIP.bat"
  • In "c:\" create a ".bat" file called "ReleaseIP.bat" with the following content:
  • "ipconfig /release"
  • In your "network connections" and your Local Area Connection be sure to uncheck "Show icon in notification area when connected" and uncheck "Notify me when this connection has limited or no connectivity" to hide the network icon.

You might have to create a network share and place the script in there depending on your computer configuration.

Unless your kid knows how to renew the IP address they'll effectively be dealing with a disabled network adapter (Assuming you only one network card.)


It depends if you have XP Home or XP Professional. The latter allows you to set a policy that would allow you to redirect any web connection to a bogus address/port i.e. the local address.

  • It is XP Pro. Can you tell me the name of the policy? I can't seem to find it in the list
    – John
    Jul 11 '09 at 0:01
  • Oh man.. I am not using Windows anymore for ages ;)
    – txwikinger
    Jul 11 '09 at 0:08
  • IIRC It was the one setting the proxy for a user. I definitely know that you can do it via group policies on AD. Probably also possible on local policies.
    – txwikinger
    Jul 11 '09 at 0:10

Not particularly a sysadmin answer if we're talking about a young kid (upstream proxies and whatnot are really overkill for your scenario), but Windows Live Family Safety is designed explicitly for this scenario. It is free and will let you lock down access for given users, grant them access to certain sites (they have a list of kid-friendly sites such as the Disney Channel or Nick Jr. sites), and kids can request access to sites that will be routed to your e-mail for review/approval).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.