Blocking all but selected websites

All replies

• 

  

  0

  Sign in to vote

  Hi Sig,
   
  Please understand that protocol prefixes such as http: or https: are not allowed in the Web Addresses Allowed box. This issue has been described in Windows SteadyState Handbook

  
  Windows SteadyState Handbook
  http://www.microsoft.com/downloads/details.aspx?FamilyId=D64AF114-336C-4418-BEB7-E074E813B498&displaylang=en
   
  When you select the “Prevent Internet access (except Web Sites below)” option, the system will set the proxy server in IE to a non-exist one (NoInternetAccess) and add websites allowed to the “Exceptions”. The “Use the same proxy server for all protocols” option is checked. Thus, all website accesses except for those allowed sites are blocked.

  
  If you already have a proxy server configured , the “Prevent Internet access (except Web Sites below)” option will block the Internet access as a whole.

  
  We can manually configure the proxy server to narrow down the cause.
  ----------------
  1. To avoid confusion, please clear the “Prevent Internet access (except Web sites below)” option in SteadyState first.
  2. Click Start and click Run.
  3. Type “inetcpl.cpl” in the open box, and then press Enter.
  4. Select the Connections tab, click LAN Settings.
  5. Uncheck “Automatically detect settings”, select “Use a proxy server for your LAN. Input NoInternetAccess to the Address box, 80 to the port box.

  6. Click Advanced, select “Use the same proxy server for all protocols”
  7. Type in your allowed websites to the Exceptions space. Click OK.
  8. Open Registry Editor, check if ProxyOverride is available under the following branch. If so, please check if its value matches the address we added in the Exceptions list.

  
  [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
   
  9. Check if websites can be accessed.
   
  If the issues still persists, we can conclude that it is not caused by SteadyState. Please check if the issue is caused by an existing proxy server or some security programs which may affect the Internet access.

  
  For your information, the proxy server can also be configured through group policy: [User Configuration\Windows Settings\Internet Explorer Maintenance\Connection]

   
  If there is any update, please feel free to let me know.
   
  Best Regards,

  Thursday, August 30, 2007 7:02 AM
• 

  

  0

  Sign in to vote

  I don't have a proxy server on the network I'm using for this application.  What I'm doing is as follows:

   

  1. Enabling internet access through SteadyState.

  2. Navigating to each site I want the workstation to have access to.

  3. Copying the entire URL.

  4. Pasting the URL to SteadyState allowed site field.

  5. Disabling internet access except for sites listed.

  6. Saving changes and restarting.

  7. Loggin in via locked account.

   

  Through this process, I've been unable to access any websites.

   

  Thursday, August 30, 2007 7:55 PM
• 

  

  0

  Sign in to vote

  Hi Sig,

   

  I have tested your steps in a new user account. Please help check if I did right as yours:

   

  1. Open SteadyState from an administrator account.

  2. Create a new user profile named TestIE. Select “Prevent Internet access (except Web Sites below)” option

  3. Visit the websites I would like to allow. Copy the URL to TestIE’s “Web Addresses Allowed” box.

   

  www.msn.com;www.microsoft.com

   

  Note: Web addresses with Http:// cannot be saved, so I removed the Http:// prefixes. I also remove the parameters in the end the websites. Such as /en/us/default.aspx, they can also affect the access to the websites.

   

  4. Click OK to save changes. Log into TestIE to verify the result. [No problem to access allowed websites]

  5. Log on with administrator and select the “Lock profile to prevent the user from making permanent changes” option.

  6. Enter TestIE account to verify the Internet access again. [No problem to access allowed websites]

   

  If there is different between our steps, please let me know. If the manually configure a proxy server steps have been complete, please also let me know the result and the websites you added. Thus, we can perform further research based on this issue. Thank you for your effort and understanding.

   

  Best Regards,

  Friday, August 31, 2007 10:08 AM
• 

  

  0

  Sign in to vote

  The only step I didn't do was delete the suffixes from the URL's (/en/us/default, etc).  I may also have locked the profile prematurely.  I'll try and again and responde to this thread.

   

   

  Sig

  Friday, August 31, 2007 9:21 PM
• 

  

  0

  Sign in to vote

  Thank you for your feedback on this issue. If there is any update, please feel free to let me know.

   

  Regards,

   

  Monday, September 3, 2007 5:24 AM
• 

  

  0

  Sign in to vote

  Good Day Shawn,

   

  I have been having the same problem that Sig has been having. We do not have a proxy in place neither did I place the system in the Domain. I did all of the steps that was specified in the recommendations. I to get the same error; DNS or website cannot be displayed. I read the SteadyState guide back and forth, in and out and read the success stories and I still can't figured it out. I tried the *google.com;*.msn; didn't work. Tried www.gooogle.com;www.msn.com; didn't work. Finally tried *.google.com;*.microsoft.com; didn't work. I was trying to avoid GPO or creating another OU just for the kiosk users. I even tried the ICAR and the NoInternetAccess in the proxy advance field. Thanks for all of the assistance or advice.

   

  Jay Bee

  Friday, May 16, 2008 2:48 AM
• 

  

  0

  Sign in to vote

  We have a Dell desktop computer that my husband previously used and now we are setting it up for a  new teenager in our home to access a school website to complete summer school classes.  We downloaded the free Windows SteadState v2.5 program and tried to set it so the only website he could get into is the school one.  We setup user settings for him -- in the Feature Restrictions tab "Internet Explorer restrictions" is checked, "Prevent Internet access (except Web sites below) is checked. At the bottom of the screen for Home Page, we put http://www.websitename.com   In the Web Addresses Allowedd box we put the websitename.com.  The example box that comes up has an * at the beginning of that, so we tried it with and without that, with and without www.

   

  In the General tab we check "Lock profile to prevent the user from making permanent changes.  We've tried logging in with the kid's user info, having that checked and unchecked. 

   

  The school's website will not come at as the home page and we cannot access the school website at all, can't access anything logged in with this kid's user info.

   

  There is an Administrator user and also my husband had set up himself as a user -- His is where we are trying to set the kid's user settings, because the Administrator one won't do much -- guess we don't have that figured out either.  Seems to me we should only have one Administrator user, but we don't know how to "consolidate" them.

   

  This computer is on our home network that has multiple computers.  We don't know what a proxy server is that you are talking about in the other answer you gave, so we don't know if we have one of those or not.  Can you simplify what you are talking about and tell us how to get this computer working so he can only access the school website to do his classes?

   

  I have been on the phone all morning with microsoft -- they are a bunch of idiots -- didn't even know what the SteadyState program was and it is their own product!!!  I've spent the morning being transferred to different "departments" trying to find one that dealt with SteadyState.  Finally got "Professional Customer Service" to be told I'd have to pay between two hundred and some dollars up to five hundred dollars to talk to their tech support -- to figure out how to use their "free" program! What a racket!

   

  Can you help?

  Saturday, June 28, 2008 2:50 PM
• 

  

  0

  Sign in to vote

  I had the same problem even after following Shawn's instructions. 

  I was finally able to access the whitelist sites after I removed the check next to "Prevent changes to the Internet Explorer

  registry settings"

  Sunday, July 13, 2008 2:08 PM
• 

  

  0

  Sign in to vote

  Personally, I have always hated using IE's built-in proxy server. (A proxy server is basically a traffic cop that allows or disallows access to websites based on either a whitelist or a blacklist [the list you set up is either allowed or denied]. A proxy server can be either a hardware based solution [pretty industrial strength and can cost thousands of dollars], or a software solution [third party or your browser's builtin in feature as Sean described above].
  
  I used to use IE's built in feature for our library's research databases (basically we want users to only access the databases, NOT the Internet - a whitelist) so we put all the URL's that we want the public to use in IE's Exceptions space that Sean describes. But it was always a pain to troubleshoot for various reasons, (database vender would change referring URL's quite frequently, without notification, etc..) so I used Public Web Browser's feature that essentially does the same thing but in a much user friendly way, and it's pretty easy to troubleshoot if you can't get access to a particular website. It's not free unfortunately (was designed for libraries in mind to be a fully customizable browser) but for one family I can't say whether or not its worth the $125 a year just for one pc. You can download it and use it but it's hard coded for only 10 minutes, in which time the browser automatically closes.
  
  I find this a better solution to properly manage pc's for databases than Internet Explorer. (Incidentally, PWB is pretty much just a shell with IE underneath the hood, but its functionality is pretty easy for a user to configure). For our public pc's with no Internet restrictions I just use IE with SS and Deep Freeze.
  
  Don't know if this helps but ........
  
  Phil.
  
  http://www.teamsoftwaresolutions.com
  
  P.S.  If everyone is using IE's feature to block websites as per Sean's instructions and it's still not working it may be something with SS or a step you missed??  I'm sure he'll be around to help out further. Sorry I couldn't be more helpful
  
  
  

  Monday, July 14, 2008 1:41 PM
• 

  

  0

  Sign in to vote

  Hi Shawn,

   

  I did what you said and i'm still having the same problem as everyone else.

   

  Here's my setup

   

  Dell Optiplex 745

  Telephone Company's Paradyne Router/Modem (This is the DHCP server) (address 192.168.1.1) (PPPoA Protocol)

  Ethernet Mode: Full Duplex on Port 1

  Firewall is off at Modem level but on at ISP level

  Machine IP Address 192.168.1.5

  Linksys WAP54G Wireless Router (to share the signal over wireless)

  Windows XP Pro (Version 2000)

  Service Pack 3

  Windows Steady State

  Logged in as Admin

  Created Testie on Drive C (Did not use D or E)

  Did not lock profile but left it open

  Did exactly what you did

  Logged out of Admin

  Logged into Testie

  "No internet"

   

  Im wondering if it could have anything to do with the Linksys and the Paradyne. The Linksys is connected to the Paradyne to share the signal wirelessly, but is not the DHCP Server. The Paradyne is.

   

  Tuesday, September 16, 2008 7:14 PM
• 

  

  0

  Sign in to vote

  I was experiencing the same problems with IE.  I wanted to set a default home page and restrict my user to only access that particular site.  I struggled for awhile, then I unchecked Prevent changes to Internet Explorer registry settings. 

   

  This is what I did to make it work:

   

  1.) Logged in as admin

  2.) Created test user

  2.) Set IE restrictions

  4.) Checked Prevent Internet access (except Web sites below)

  5.) Uncheck Prevent changes to Internet Explorer registry settings

  6.) Set following parameters:

  Home Page

  http://www.msn.com

   

  Web Addresses Allowed

  *.msn.com

   

  6.) Logged in as test user

  7.) IE worked fine

  Wednesday, September 24, 2008 5:14 PM