Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

i have two networks private and public (internet), each user has two computers, i want to restrict user from switch network cables between these computers, so if he remove the private Network cable and connect the public network cable, he will not able to connect his private computer to internet
both computers windows 7, all computers in private network are connected to windows 2008 R2 domain controller and DHCP. and connected to Symantec Endpoint protraction

i am looking for GP or SEP settings to do this

share|improve this question
    
have you considered a mac address white list so only the computers that you want can join? –  dashboard Apr 4 '13 at 21:19
    
i have more than 1000 computers on each network, distributed on more than 25 sites –  basel Apr 4 '13 at 21:20
1  
use a microtik you can do anything with those router boards... –  dashboard Apr 4 '13 at 21:24

1 Answer 1

On the PRIVATECOMPUTER, find the MAC Address. On the PUBLIC DHCP server, add a reservation for his IP Address to something which you do not route.

Example:

If your PUBLIC DHCP server gives out 192.168.1.x, then add his PRIVATECOMPUTER with a reservation of 172.16.0.x without a router (you will need to add a new scope to this).

This is the best you can do without locking down from the router or mac address pinning on a switch. This will only prevent the silliest of "hackers" from achieving their goal.

share|improve this answer
    
some of remote sites connected to internet through ADSL router and it out of my control. i need an easier way by using Group policy for example, i can do changes on private network only –  basel Apr 4 '13 at 21:32
    
The simplest way is to create a GPO that pushes the 127.0.0.2:88 as proxy server for IE, and disallow user form changing the proxy settings, is this the right way? –  basel Apr 4 '13 at 21:52
    
Like I said, if it's not on the switch or router, any "easy" solution has an "easy" workaround. With your solution, I'd add the proxy server IP as an IP address on my machine and then set up my own ssh proxy out. You have to gauge your users. –  jnovack Apr 5 '13 at 12:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.