Severely restricting a user account


I have decided to let my son use the computer. Windows 7 Ultimate x64.

I have created him a separate account, but essentially the ONLY thing he should be able to do is access the internet and log off/on.

I also want to restrict him to only 1 website for now.

I don't want him to have access to any programs at all in the Start Menu.

I tried secpol.msc but it just says

"MMC could not create the snap-in"
MMC could not create snap-in. The snap-in might not have been installed correctly.

Name: Local Group Policy Editor
CLSID: {xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx}
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

You can't do all this with just security policies (you can do most). For the web access part, if your home router has that feature (mine does) I can block/allow web access to any website i want to specific hosts; alternatively you can install a proxy server somewhere in your home (or in the workstation itself) and restrict web access with third party tools.

There's a number of ways all those things can be done but require a lot of work and could be hard to maintain.

Easiest thing hands down is to change his account's shell from explorer.exe to iexplore.exe (internet explorer) so that'll be the only program he can run (you need to disable ctrl+alt+del, ctrl+shift+esc as well so he cant start processes from there). That would take care of the local machine access (there's a few ways it can be bypassed but don't think your son could figure it out; including typing C:\ on the web address bar, etc).

For the web acess, you'd still need a proxy of some sort, (or the router )

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
you need to run this as administrator or disable UAC while your making the changes.
Ddiazp has definitely made some good suggestions.

If you really want a great deal of fidelity over your son's capabilities and don't mind spending a bit of money, the consensus opinion is that Faronics WINSelect provides you with the best control functions:

Faronics WINSelect Standard

Faronics WINSelect Standard Manual
David Johnson, CD, MVPOwnerCommented:
you can also enable parental controls I made a video for you here and on youtube to monitor usage i.e. web you need to configure windows live safety
hongeditAuthor Commented:
Thanks guys
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows 7

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.