JSI Tip 9236. How can I prevent a user from accessing the Internet?

You can prevent a user from accessing the Internet by forcing Internet Explorer to use a proxy server that is set to an invalid address.

NOTE: Any program that uses the ProxyEnable and ProxyServer settings at
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings will be prevented.

You should also set Connection Settings and Connwiz Admin Lock, both REG_DWORD data types, at
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel, to 1 to prevent the user from changing these settings.

These setting must be set before the user logs on, but can be set in a logon script.

You can use REG.EXE, built into Windows XP, Windows Server 2003, and later, or installed on Windows 2000 from the Support Tools on the operating system CD-ROM:

reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /V ProxyEnable /T REG_DWORD /F /D 1
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /V ProxyServer /T REG_SZ /F /D "10.1.0.1:2222"
reg add "HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel" /V "Connection Settings" /T REG_DWORD /F /D 1
reg add "HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel" /V "Connwiz Admin Lock" /T REG_DWORD /F /D 1

or you can use regedit /s <Path>\filename.reg, where <Path>\filename.reg contains:

REGEDIT4

\[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\]
"ProxyEnable"=dword:00000001
"ProxyServer"="10.1.0.1:2222"

\[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel\]
"Connection Settings"=dword:00000001
"Connwiz Admin Lock"=dword:00000001