Detecting Internet Surfing

Why don't you check the event log? The system will record any established network connection there.

DanCh99, for your information I work for a UK manufacturer of Fixed Odds Betting Terminals.  These are gambling terminals located in the bookmakers that require the random number to be generated outside the premises by law.  My job is to program the back office software that links to the in-house LAN and receives the random numbers from outside.  So as you can see an internet connection is vital to us for this purpose.  Unfortunately many of the shop managers spend a lot of their time surfing the internet and consequently a very high proportion of our engineer callouts are due to viruses they have downloaded (which of course they always deny).  What I am trying to do is pop up a warning that internet surfing is not permitted and then maybe keep a hidden log that can be used as proof.

jkr, the event log does not appear to distinguish between valid TCPIP use (for getting the random number) and internet surfing.  If I am wrong, how can I programatically retrieve this data?

BTW, I appreciate there are probably other more elaborate ways like removing the DNS server setting but some of our users are very clever and know how to get round this.  Also, a VPN is very expensive!

Hope this information helps.

Internet Options
View
Explorer Bar
History
(or just Ctrl+H keys)

If you right-mouse click a link and click "Properties" it will show the date and time that page was visited.

You could audit when people succesfully run Internet Explorer.

Extracted from:
http://www.microsoft.com/technet/security/topics/threatsandcountermeasures/secmod50.mspx#EJAA

"After enabling the audit object access policy, you must determine the objects to which you want to monitor access, and then modify their SACLs accordingly. For example, if you want to audit any attempts by users to open a particular file, you can set a Success or Failure attribute directly on the file that you want to monitor for that particular event using Windows Explorer or group policy."

User who "succesfully" executed Internet Explorer would be aduited.

Check this site out for a detailed explanation on how to do this:

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/sag_evmonevents_17.mspx

the easiest method would be the firewall route... you can use hardware or software firewalls to keep a log of every site visited.... hardware firewall would be a router. you can get a fairly cheap on from netgear, linksys, etc that will keep a record of websites visited and which internal ip address accessed the site (if you have multiple computers). You could use a software firewall like the free Zonealarm that will do pretty much the same thing. One benefit of using these is that you will have some control over who can go where and even when (especially if you're using a hardware router).

if you seek control you can also use content advisor in the IE properties to require a password for web site access, but that could be a pain in the butt if you ask me :-)

anyways...gl hope this helps.

Thank you everyone for your comments thus far.  I think I should point out a few things for additional information.

Number one, all PC's out in the field have administrator rights.  Not the most ideal setup I know, but there is method behind the madness.  When engineers come to site to fix a problem they will often need administrator rights to do so.  With several hundred PC's out in the field it is not feasible to have a different administrator password for every site and so we use a standard password for convenience.  It was felt that even if we tried to keep this secret we would eventually fail dismally.

mikeleebrla, the windows VPN you mentioned caught my attention; this looks the ideal solution if it can prevent web surfing.  One down side though, it would be a huge overhead.  What we are in a position to do however is to automatically FTP software updates and this leads on to the second point raised by vtsinc - disabling port 80 which I will also have a look at.  Maybe there is some code that could do this???  It could be run either at regular intervals or whenever my program detects explorer has been opened.

Finally, some of you mentioned how to audit which websites people had been visiting but this is not really all that helpful to us.  We just want to prevent people surfing the web full-stop.  The username will always be Administrator (software doesn't fix all the worlds problems!).  If we can't physically stop them, our second best option would be to report when they have and escalate it to the area manager.  Then the shop manager at the alleged time would always be accountable.

this will prevent web sites from being visited without knowing the password that you set

give it a shot and see if that would work for you...

oh, create the password under the general tab once you enable content advisor...
this is a configuration that you can set up on all the pc's then either keep the password secret or just give it to managers... then instruct them how to use content advisor...

don't know if you're using group policy or not... and yet still not sure if the option to set content advisor settings is an option in group policy... i'll have a look and see if that option is available....

Hey! that's just what I am looking for.  Some of the innocent pages (e.g. www.msn.com) still show their content in the background even when the window pops up.  Any reason for that?

"Is there a simple test I can program to check whether anyone has been surfing the internet?"
Sorry mate but I had understood that you wanted to check wether anyone, meaning anybody (not just one user) if they were surfing the internet or not. That is why I suggested to audit or to use Traffic analyzer which would automaticly message you in the event that port number 80 was being used on your network (I still honestly couldn't verify this, that's why I didn't post more info onit ... sorry).

I now understand that all you want to do is stop any but most specificly Administrator (as stated here "We just want to prevent people surfing the web full-stop.  The username will always be Administrator" ) from accessing the internet and I would say, as you said that PaulADavis idea would be the easiest idea ...

The msn site still might popup in the background becuase it either might be trusted automaticly by your explorer as a trusted site or becuase it might be in your computer's internet cache. After all, for microsoft, what content from www.msn.com (microsoftnetwork.com) should you be "advised" from??

not sure... you can always try to specifically block msn and see what effect that has....

Hi UICE, you are right, I will put my hands up here and admit that preventing web surfing was not the original question I asked and as such I will split the points.  PaulADavis, your answer was the most helpful to my scenario and so I will award you some of the points even though it would be wrong for me to flag your answer as the accepted one.

no prob.... glad that i could be of some help :-)

thanks

Well in reality I am the one out of place here. I really do not deserve the points as I did not supply the correct answer to your problem.

I was in reality just trying to state why I might have suggested to audit instead of suggesting a way of controling access based on your initial question ...

Terribly sorry if I somehow said or meant something that in reality wasn't my intention of actualy comunicating.

Glad you could all eventually help you out ...

Cheers ...

This is a problem my company has been struggling with for some time now, and we have been looking at various strategies to deal with it.  There is no single right or wrong answer to this one, it may well be that we implement more than one solution for extra security.  Your comments helped as well and as such you deserve credit for that :-)