|
One of my clients has finally got fed up with users abusing free internet access, and has asked me to lock each user's accessible content down to only those sites they need for their job. He doesn't want to spend money on a decent firewall or additional software to do this.
The domain is spread over a large area and several floors, and I would lose a day walking around each system to put a content password on each PC, together with the approved sites per user. It is a Server 2003 Active Directory environment, which does not provide such a facility directly.
Is there anyway this can be done from the PDC?
|
|
|
|
|
The hard-to-manage solution would involve only approving a small site list and distributing that through policy. But, this gets out of control when you have multiple groups of people using different site lists and you're constantly adding new "work related" sites all the time. Also, if the users install other browser software besides IE, they can easily bypass this restriction.
The better option is install a proxy server and route everyones browser through it. You get much better management capability, higher security and no little ways for the users to bypass it.
BTW: The money that your boss doesn't spend on a firewall is going to be burned up managing this through policies. Either way, he's spending money on this. There's just no way around it.
|
|
|
|
|
Dave Kreskowiak wrote: The hard-to-manage solution would involve only approving a small site list and distributing that through policy.
Unfortunately, the list is quite extensive, and this would mean dozens of sites for each user, most of which would be irrelevant.
Dave Kreskowiak wrote: and you're constantly adding new "work related" sites all the time.
This will definitely happen.
I am currently thinking that RDP into each user's PC would probably be the only way of getting the job done without a budget.
|
|
|
|
|
Chris C-B wrote: I am currently thinking that RDP into each user's PC would probably be the only way of getting the job done without a budget.
Your salary is on someones budget.
I think that in the long run the firewall/proxy will be cheaper.
"When did ignorance become a point of view" - Dilbert
|
|
|
|
|
Jörgen Andersson wrote: Your salary is on someones budget.
Yes - mine, regrettably, in this case. I have several clients who pay me a monthly retainer for SysAdmin, which provides me with a nice line of revenue between projects, so I have to get the job done. I was hoping to find a way of doing it from the server room, and thus avoid losing an entire day to the task.
|
|
|
|
|
Hi,
Obviously building a small firewall/proxy with a free linux distrib is the cheapest way to achieve this. This computer can even be built on a virtual machine, so it does not require buying some additional hardware (apart from network cards for proxy's interfaces).
The time you're going to spend on it on the long run, if you do it the way your boss would like you to, will be much more expensive, and much less effective, than having a centralised solution where you can set rules and log traffic. Having to log on each and every computer to setup a solution is never a good idea ; and much of the settings are of a per-user basis, that means you have to log on the computer with the credentials of the user itself (thus you have to ask him its password). Last, what you can setup using GPO's can be easyly defeated by using a different browser.
The key idea is iptables and a proxy solution (I'm using squid for the latter).
- iptables will allow you to do a transparent routing from port 80 to the port of the proxy service ; that means you won't have to configure browsers to use a proxy server.
- squid will allow you to setup a bunch of rules and access lists based on computer's IP address and/or username. You can also use predefined categorized site-lists that allow you to block much of unwanted traffic.
Finally, be careful with legal questions ; in my country, it is not legal to log traffic without informing people you do.
Hope this helps.
|
|
|
|
|
Hi All,
anyone to help on this issue,
We have a small office with Windows Server 2008 and eight Domain users, i deleted one Domain user which is no longer working with us but then we discovered that we need some important files from this domain user. I tried to recreate the domain user but when i log in it gives me empty screen. We do Back ups every week.
Any one please who has idea on how to retrieve the files from the deleted domain user
Your support is highly appreciated
thanks,
Yusufu
|
|
|
|
|
Recreating the user won't recreate that persons SID. Login as an administrator, find his files in the system and the admin can Take Ownership of the files, giving you access to them.
When a user is deleted, the files do not get deleted with him. They stay in the file system wherever they're at.
|
|
|
|
|
@ Dave
thanks for the feedback but can you expand more what to do when i log in as administrator because i logged in and found nothing in mydocument, Desktop and other location. I think may be there are further steps to view Domain files
Thanks for your support
Yusufu
|
|
|
|
|
MyDocuments shows you the files for the currently logged in user, so of course you can't see the other persons files.
You have to open either C:\Documents and Settings (Win XP and below) or C:\Users (Vista and above) to see the other persons files.
You then right-click the folder/files you want, click Properties, Security Tab, Advanced button, Owner tab. Then you can click on Take Ownership.
|
|
|
|
|
thank you for the helpful information - happy happy you make me standing you make me look good to the staff
i real appreciate your support
Kindly please is there a way to retrieve the web mails associated to the deleted user
thank you for your continued support;
Yusufu
|
|
|
|
|
Mail? Depends on the system. If it's something like Yahoo, GMail, Hotmail, ... no.
If it's your own internal email system, then you're going to have to consult the documentation on it.
|
|
|
|
|
it is our webserver emails(outlook emails). what documentations am supposed to look?
thanks,
Yusufu
|
|
|
|
|
How about Exchange Server. If you don't have an Exchange Server running, then you're using web emails, in which case, you're S-O-L.
|
|
|
|
|
We do not have exchange server, what do you mean by S-O-L?
thanks
Yusufu
|
|
|
|
|
Sh*t Outta Luck
If all his email was a personal, web-based, account on Yahoo, GMail, Hotmail, and some other service like that, you won't be able to recover it since those services will not grant you access to it.
|
|
|
|
|
@ Dave
No, it was not Yahoo,Gmail nor Hotmail . It was outlook emails .May be we are not on the same page and correct me if i am wrong i think i am not clear with exchange server because we have our server where these emails are always copied there.
thanks you for your patience and support
Yusufu
|
|
|
|
|
Then you're going to have to find it and get the documentation on it. Without knowing what you have, it's impossible for me to help any further.
|
|
|
|
|
Sorry again what kind of documentation are needed?
|
|
|
|
|
ANYTHING you have on your mail server!
|
|
|
|
|
the Statue Of Liberty lost some files too?
|
|
|
|
|
Hi,
Outlook is not a mail server ; Outlook is the mail client that connects to the server and fetch messages.
If you want to know which server Outlook uses, you have to go to the account's properties to see how it is configured.
It can be Exchange Server ; in that case you can reconnect a mailbox, whose original user has been deleted, to another user (this one must not have a mailbox already).
It can be a POP3 or IMAP account stored on a local server, or hosted by a provider.
But the best way to collect useful data about your mail system would be to ask the one that set it up, or, if he/she's not working there anymore, to read the documentation he must have left.
I kindly suggest you to study the mail system of the company you're working for very seriously before attempting to have any action on it 
|
|
|
|
|
Hi,
This should be easy for an expert.
Suppose I'm in the folder C:\Windows\System32 . I want to print out only "System32".
I have found commands that give the entire path, but I want only the last bit 
Thanks,
Mel
|
|
|
|
|
You have posted the same question on 4 different forums; please, don't do it!
The best when asking something is to choose the forum that better matches your subject, and post a unique question explaining as better as possible what is your problem.
Thank you!
|
|
|
|
|
Does anyone know the script to hibernate the computer? I already found the script to log off, restart or shutdown. But not hibernate, if any one know please let me know how to write this script.
Thank,
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
