Link to home
Create AccountLog in
Avatar of b1dupree
b1dupree

asked on

Disable Internet Explorer for a User but not the Administrator

I would like to disable Internet Explorer 7 on an XP Professional computer for users and power users but not for the Administrator (so uninstalling would not be a solution).
Thanks,
Bruce
Avatar of b1dupree
b1dupree

ASKER

Just to add, the goal here is to stop users from going onto the Internet.
Are you running this on a domain with AD and GPO installed?
ASKER CERTIFIED SOLUTION
Avatar of OverSeer
OverSeer
Flag of United States of America image

Link to home
membership
Create an account to see this answer
Signing up is free. No credit card required.
Create Account
No, they're not on a domain.
Can I still use the deny permissions for that user?
Should I deny on iexplorer.exe only?
Avatar of tigermatt
Yes, a deny on iexplore.exe would be sufficient for the users in question.
However don't forget if these users are local administrators they will be able (in all circumstances) to circumvent your restrictions quite easily. Also, if they have permissions to install software, obviously they would be able to use Firefox, Opera or one of the other, many web browsers out there. (Of which some may not need Administrative privileges to install)

The only totally secure method of preventing access to the Internet would be to monitor the network activity itself whether in software or hardware. For example, some routers allow you to prevent access at certain times, and programs (with password-protected interfaces which cannot be "End Process"'d in task manager) can be used on the PC to do the same.

-tigermatt
I don't see a permission tab for Iexplore.exe.
BTW, this is on XP Tablet 2005.
SOLUTION
Link to home
membership
Create an account to see this answer
Signing up is free. No credit card required.
Create Account
Just to add to what I posted by disabling simple file sharing you should then see a permissions tab on the properties dialog of the iexplore.exe file, allowing you to remove permissions on the file for everyone other than administrators. (Much better to remove inheritance and delete the permissions except the Administrators group, rather than deny permissions since deny has the risk that you as an administrator will be locked out of it too - deny always takes precedence over allow)
I don't see why I wouldn't work on tablet edition.
Otherwise you can use CACLS(Change Access Control Lists) to modify access control list.
http://www.ss64.com/nt/cacls.html
Using the command line moved into Internet Explorer directory

+ Should be something like:
  C:\Programms\Internet Explorer
+ Then:
   cacls iexplore.exe
+ You should se something like
   C:\Programms\Internet Explorer\iexplore.exe BUILTIN\Administrators:F
                                                                           NT AUTHORITY\SYSTEM:F
                                                                           BUILTIN\Users:F
+ A this point you can modify the access control list by:

1- adding  permission to the to administrator -> cacls iexplore.exe /E /g administrator:F
C:\Programmi\Internet Explorer\iexplore.exe [compueter name]\Administrator:F
                                                                      BUILTIN\Administrators:F
                                                                      NT AUTHORITY\SYSTEM:F
                                                                      BUILTIN\Users:F

2-revoking users access rights to iexplorer.exe -> cacls iexplore.exe /E /R users
C:\Programmi\Internet Explorer\iexplore.exe CWC6\Administrator:F
                                            BUILTIN\Administrators:F
                                            NT AUTHORITY\SYSTEM:F

Hope it helps,cheers
For the Power Users:
-> cacls iexplore.exe /E /R "power users"


Cheers