Restrict web access to one website

X

xtox

Limp Gawd
Joined
Jul 8, 2004
Messages
242
I have someone running an open day show casing their new website on some laptops to members of the public. They would like the an easy way to show only the website (including it's pages) and not allow anyone to change to a different domain name.

I'm just trying to think of the easiest and cheap (free?) way to do this.

Any suggestions which doesn't mess with other computers in the AD?
 
Use a simple screenshot of the website, that way no browser is involved?
 
vischo said:
Use a simple screenshot of the website, that way no browser is involved?
Click to expand...

Website and its pages he said.

I'd say just put it behind a firewall that blocks everything but that website.

You could, in theory, restrict to a private DNS and all that, but it'd be more trouble than it's worth and not terribly difficult to work around.
 
Last edited:
You can mimic this easily using a GPO as long as internet explorer is the only browser.

Create or edit a GPO for the OU that contains the laptops.

Enable loopback and then goto user config>windows settings>internet explorer>security. Click on security zones and content ratings and hit properties.

From there under content ratings select import the... and then hit modify settings. Under the approved sites tab add the sites you want them to have access then close everything out.

What this does is basically password protect sites that are not in the approved sites list.
 
Easiest way. . . . Windows Steady state.

It allows you to restrict browsing to only specific websites

Or use content advisor on the highest setting
 
Well the cheapest way i can think of is to remove the DNS server settings from the laptops (so that they cant resolve names) and put a static entry in the hosts file in every laptop to their new site.

that way they can only resolve that name. Its a stupid solution but its the cheapest one i can remember
 
KainPT said:
Well the cheapest way i can think of is to remove the DNS server settings from the laptops (so that they cant resolve names) and put a static entry in the hosts file in every laptop to their new site.

that way they can only resolve that name. Its a stupid solution but its the cheapest one i can remember
Click to expand...

I specifically recommended against this solution because it is easily worked around by anyone that knows anything about networking...

Might be fine if the laptops are right in front of presenters who would notice someone changing the network adapter to use a public DNS (4.2.2.1 for example), but if these are computers that are unobserved (which I assume they are, otherwise they wouldn't be wanting to restrict other web use), it'd be rather pointless.

I suppose if it's on an standard user profile with UAC activated then the user would have to enter the admin password to enter network configuration, which could be a viable solution. It wouldn't stop people editing the hosts file though if they really wanted to; granted that's starting to push it; most people don't know the IP addresses for their favorite websites.
 
Last edited:
Thanks guys. I'm now thinking of a forced full screen IE window restricted to the website. Is there any 3rd party software that can do this? Kind of like how display laptops are in the stores.

ben chi(f4) said:
No offense.....

can we have this in english?
Click to expand...

Sorry, it was a quick post I had to make but everyone seemed to figure out what I wrote?
 
xtox said:
Thanks guys. I'm now thinking of a forced full screen IE window restricted to the website. Is there any 3rd party software that can do this? Kind of like how display laptops are in the stores.
Click to expand...

Once again, Windows Steady State
 
I suggest just lock IE in kiosk mode, and then remove everything from the start menu...


Alt+f4 still works... you can do registry edits to lock out the task bar or disable alt+f4/ctrl alt delete.

To lock IE in Kiosk mode just add a -K flag to the shortcut, then open it. It launches full screen and is locked like that.



I was thinking the hosts route would be a fairly easy way to do.
 
Seems like this would be a lot easier in Firefox:

https://mozdevgroup.com/clients/bm/

Use the policy to lock down the Windows installation if necessary. Add a hosts file, edit your router configuration or use a proxy if you really need to make sure its locked down, but from what it sounds like FF with that extension and a disabled start menu is probably sufficient.
 
keenan said:
Seems like this would be a lot easier in Firefox:

https://mozdevgroup.com/clients/bm/

Use the policy to lock down the Windows installation if necessary. Add a hosts file, edit your router configuration or use a proxy if you really need to make sure its locked down, but from what it sounds like FF with that extension and a disabled start menu is probably sufficient.
Click to expand...

That's the same thing as just starting IE in kiosk mode without a plug in. But yea I'm sure either would work :)
 
Host the website on the local machine and do not give the laptops web access?

You mention this is for a show?
 
Easius said:
That's the same thing as just starting IE in kiosk mode without a plug in. But yea I'm sure either would work :)
Click to expand...

Except IE kiosk mode... isn't. All the keyboard shortcuts work, so it's trivial to Ctrl-L and navigate to a different URL (heck, you can even get to file:///c:/). I'm sure it's possible to lock this down somehow with the policy, but it sounds like a pain in the ass to me. At least that was how it was last time I had to do this...
 
sc0tty8 said:
Host the website on the local machine and do not give the laptops web access?

You mention this is for a show?
Click to expand...

That really is a great solution if it weren't for the fact that it would be fairly obvious to the customer that they're not actually accessing any online material. And, of course, if the website is connected to any sort of login server or database, it won't work properly.
 
You must log in or register to reply here.
Back
Top