IF $internet="Y"
WriteValue("HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings","ProxyEnable","0","REG_DWORD")
WriteValue("HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel","Proxy","0","REG_DWORD")
ELSE
WriteValue("HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings","ProxyEnable","1","REG_DWORD")
WriteValue("HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel","Proxy","1","REG_DWORD")
ENDIF

;---------------------------------------Removes internet access PER GROUP ----------------------------

;disable proxy
If InGroup("YR6")
$rmv = DelKey("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings")
Shell "regedit /s c:\WINDOWS\disanet.reg"
EndIf

;disable proxy
If InGroup("YR8")
$rmv = DelKey("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings")
Shell "regedit /s c:\WINDOWS\disanet.reg"
EndIf

;disable proxy
If InGroup("YR9")
$rmv = DelKey("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings")
Shell "regedit /s c:\WINDOWS\enanet.reg"
EndIf

;disable proxy
If InGroup("YR10")
$rmv = DelKey("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings")
Shell "regedit /s c:\WINDOWS\disanet.reg"
EndIf

;disable proxy
If InGroup("YR11")
$rmv = DelKey("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings")
Shell "regedit /s c:\WINDOWS\disanet.reg"
EndIf

;---------------------------------------Removes internet access PER USER ----------------------------

;disable proxy
If @USERID="9368KASHIF"
$rmv = DelKey("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings")
Shell "regedit /s c:\WINDOWS\disanet.reg"
EndIf

;disable proxy
If @USERID="9286NAVEED"
$rmv = DelKey("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings")
Shell "regedit /s c:\WINDOWS\disanet.reg"
EndIf

I don't disagree that running a REAL proxy server is more ironclad, but....

In real life, 99%+ of the students at my school don't have the skills or knowledge to begin to attack the "problem" of bypassing a reg hack, nor do even the more knowledgeable among them know this is WHY they can't get on in the first place. We do remove display of all IE icons on restricted accounts, and have limited Windows Explorer to local folders only. We've actually done a pretty decent job of closing loopholes through which they might attempt unauthorized internet access, even on Windows 9x machines. They don't have access to Internet Options, registry editing tools, a command prompt, etc., can only run authorized programs, and local hard drive contents are hidden. And our students' computer access is monitored, in that staff are present and screens visible when students are using them.

There are further blocks which could be applied, such as manipulating Content Advisor settings, if you want another line of defense. If you don't mind running more than one network protocol, you might even try fiddling with TCP/IP settings. But in several years, it hasn't been a problem yet, though I'm not oblivious to the possibility--and I'm always looking for new ways to crank up security (I even challenged a gifted student who worked with me to come up with creative ways to hack our system, and used the results to improve our security). But in the end, this is less intended as an absolute lockdown than as a practical management tool. Backing everything up with written policies defining consequences for unauthorized tampering with the system is an essential element, too.

Frankly, as long as some accounts have internet access and some don't, the greater danger probably lies in students obtaining access to passwords letting them use someone else's account, which would be an issue even with a proxy server in place. We all hear that "social engineering" represents the greatest threat to most systems.

I'm not going to say this is the best possible solution, but the question was raised in the KiXtart forum, which I take to imply asking can this be done using KiXtart, and the answer is yes, it can. In our case, there are some practical problems with using a proxy server, with some machines on our network being maintained and controlled by our district, and others at our site level, with different rules and access needs being applicable. It's not necessarily that it can't be physically done, but there are some very real administrative obstacles which we're working with here. Meanwhile, we've come up with an approach that is getting the job done.

Joe