[Turbanator]

Originally Posted by fine69

I have an office desktop on which I want to restrict the staff's internet access to only the accounting software and nothing else.

Get a firewall, sonic wall is easy to setup. You can allow whatever websites you are ok or allow everything and restrict few like Facebook etc. Usually comes bundled with 3 Year or less, subscription. Keeps check on malware and viruses too.

You can also setup a secured gateway to your server, so people can login only when they connect via office firewall. It comes bundled with VPN if you want to give access from outside say your laptop. This will ensure server is accessible only via secured firewall.

[fine69]

Originally Posted by Turbanator

Get a firewall, sonic wall is easy to setup.

This is going to be somewhat expensive for me. Also, I'm assuming this means another pc of hardware to be kept.

Wouldn't windows firewall give me the same authority that sonic wall would?

Honestly, I'm looking for a cheap fix to this, I only have 2 desktops and won't ever have an extensive computer based setup. Spending big bucks for this doesn't seem right to me.

[Samurai]

Originally Posted by fine69

I have an office desktop on which I want to restrict the staff's internet access to only the accounting software and nothing else.

You could try Linksys LRT224 Dual WAN Business Gigabit VPN Router, it is about 14K + GST.

Check page 42 in the user manual, I think it has what you need.

https://downloads.linksys.com/downlo...User_Guide.pdf

[shipnil]

Originally Posted by fine69

I have an office desktop on which I want to restrict the staff's internet access to only the accounting software and nothing else.

I don't think you have to go through all these expensive options. Microsoft has a family safety application. It is mainly for parents to control their kids computers, with what apps they can access, how long they can access etc. I think you can tweak this to use to control your employees computers. You'll have to setup kind of kids profiles on the two computers, while the computer you have can be setup as master computer.

All the new software installations need admin password which the employees won't have. You can disable all bowsers in there. They won't be able to see or launch them.

Just ensure you disable Microsoft store app as well. For installations of apps on that store, it doesn't ask admin password.

[fine69]

Originally Posted by shipnil

I don't think you have to go through all these expensive options. Microsoft has a family safety application. It is mainly for parents to control their kids computers, with what apps they can access, how long they can access etc.

Windows 10 does seem to have a family safety setting, will check that out, thanks!

[fine69]

Family Safety Setting doesn't seem to do what I intend it to do so I explored few alternatives, firewall experts can guide me here.

There is an obvious option to block inbound and outbound connections through Windows firewall. Using the same if I block all outbound connections then of course internet access is stopped for the user. However, I'm not able to find out if there's a way to only allow one program as an exception to connect to the internet.

I also explored if I could block google chrome from connecting to the internet but I only find google chrome in inbound connections and even if I block it there, internet access doesn't get stopped. I can't seem to find Google Chrome in Outbound Connections.

Windows Firewall is perfectly effective in blocking internet access but I'm unable to find how to add any particular software exception there.

Would appreciate any pointers around this, thanks.

[fine69]

Update to my situation -

I've blocked Chrome, Edge and Internet Explorer in Firewall from making any outbound connections.

I've also blocked Control Panel from Standard User access through Group Policy.

Setup Gmail in Outlook for my office mail ID so all data exchange is now through mail, so no browser needed at all.

This is the next best workaround to what I would've liked but its getting the job done.

[Jaguar]

Originally Posted by fine69

This is the next best workaround to what I would've liked but its getting the job done.

How tech-savvy are your staff? An enterprising person can still install another browser and access the internet. Even if you have removed admin access to install a new browser, there is software that can run off the USB drive and doesn't require any installation.

[fine69]

Originally Posted by Jaguar

How tech-savvy are your staff? An enterprising person can still install another browser and access the internet. Even if you have removed admin access to install a new browser, there is software that can run off the USB drive and doesn't require any installation.

They aren't really tech-savvy. But then google and youtube make simple hacks easily accessible to almost anyone with common sense. So far I've enabled USB access because they need to plug wifi-dongle to access office WiFi. Till yesterday we were also relying on pen drives to share data, it'll only be via mails now.

For now the arrangement is satisfactory, if I see office WiFi getting too slow then maybe I'll investigate further. I've stopped Windows Update also via registry for now.

PS: There used to be a small exe file called ultrasurf back in the day (2005-6) which enabled me to run internet (even torrents) in one of the most secure environment in a top IT company. Not sure how it didn't even leave much trace because our PCs would get audited a lot but then file was always in our mails, it was hardly 100-200KB if I remember correctly. It was always saved as a random extension (not exe). So yes, if one wants to breach my basic restrictions then its going to be easy-peasy.