1

I wish to limit my office PCs to within the local LAN I set up. So, I've set the router to restrict internet access from these PCs.

Basically, the idea is to prevent users from uploading confidential company information to the internet.

Since it's possible for a user to plug in his own 3G router into the office PC's ethernet port, the security could be compromised.

So, is it possible to bind an ethernet port (or network adapter) to connect only to specific routers? Or even just a specific MAC address (which should be enough)?

Assume that the office PC is running Windows 7.

2
  • What sort of access rights do the users have? Are they part of a domain?
    – Journeyman Geek
    Mar 28, 2014 at 11:08
  • Windows 7 office PCs are standalone (i.e. just part of a workgroup, not a domain). I'll be administering the (very few) office PCs manually, one by one. Mar 29, 2014 at 2:47

3 Answers 3

1

For your specific threat, I suggest you to prevent users to add new network connection. Perhaps the registry entry NC_AddRemoveComponents will help you

HKLM\Software\Policies\Microsoft\Windows\Network Connections 

More information on Microsoft Technet

2
  • Thanks, but this registry subkey doesn't exist on Windows 7. Mar 29, 2014 at 2:45
  • Found the corresponding entry in gpedit.msc: Prohibit adding and removing components for a LAN or remote access connection. However, the policy only affects administrators. Mar 29, 2014 at 5:28
0

It depends on what infrastructure you have in your office. I'm guessing there will be a switch between the router and the ethernet ports that users connect to. Most commercial grade switches will let you restrict by MAC address but if you have a home grade switch then you probably can't.

If you want to prevent users from sending documents home, there are a few things you can do:

  • Disable USB storage devices on the PCs
  • Password protect the BIOS on the PCs so they can't reboot and modify settings
  • Have users sign a policy that they won't upload confidential information for legal protection
  • Clearly label what is confidential and what is not

There are things you can't control such as if they use wireless devices to connect to the Internet. The only way that I can think of to prevent users from using tethering on their smart phones for wireless access would be to disable wireless on laptops altogether.

Hope this helps

1
  • Thanks, all done. Actually I discovered my current problem after having implemented your suggestions. Mar 29, 2014 at 2:50
0

Maybe you could try by adding default route, so even if user adds his connection, computer would still try to go through your router IP.

If your router IP is 192.168.1.1 you could try something like:

route add 0.0.0.0 mask 0.0.0.0 192.168.1.1

More information at http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/route.mspx?mfr=true

1
  • 1
    silvermightstar said it's possible for a user to plug in his own 3G router into the office PC's ethernet port so, this measure seems to be useless if the 3G router has 192.168.1.1 as ip adress...
    – CmPi
    Mar 28, 2014 at 12:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .