I wish to limit my office PCs to within the local LAN I set up. So, I've set the router to restrict internet access from these PCs.

Basically, the idea is to prevent users from uploading confidential company information to the internet.

Since it's possible for a user to plug in his own 3G router into the office PC's ethernet port, the security could be compromised.

So, is it possible to bind an ethernet port (or network adapter) to connect only to specific routers? Or even just a specific MAC address (which should be enough)?

Assume that the office PC is running Windows 7.

  • What sort of access rights do the users have? Are they part of a domain? – Journeyman Geek Mar 28 '14 at 11:08
  • Windows 7 office PCs are standalone (i.e. just part of a workgroup, not a domain). I'll be administering the (very few) office PCs manually, one by one. – silvernightstar Mar 29 '14 at 2:47

For your specific threat, I suggest you to prevent users to add new network connection. Perhaps the registry entry NC_AddRemoveComponents will help you

HKLM\Software\Policies\Microsoft\Windows\Network Connections 

More information on Microsoft Technet

  • Thanks, but this registry subkey doesn't exist on Windows 7. – silvernightstar Mar 29 '14 at 2:45
  • Found the corresponding entry in gpedit.msc: Prohibit adding and removing components for a LAN or remote access connection. However, the policy only affects administrators. – silvernightstar Mar 29 '14 at 5:28

It depends on what infrastructure you have in your office. I'm guessing there will be a switch between the router and the ethernet ports that users connect to. Most commercial grade switches will let you restrict by MAC address but if you have a home grade switch then you probably can't.

If you want to prevent users from sending documents home, there are a few things you can do:

  • Disable USB storage devices on the PCs
  • Password protect the BIOS on the PCs so they can't reboot and modify settings
  • Have users sign a policy that they won't upload confidential information for legal protection
  • Clearly label what is confidential and what is not

There are things you can't control such as if they use wireless devices to connect to the Internet. The only way that I can think of to prevent users from using tethering on their smart phones for wireless access would be to disable wireless on laptops altogether.

Hope this helps

  • Thanks, all done. Actually I discovered my current problem after having implemented your suggestions. – silvernightstar Mar 29 '14 at 2:50

Maybe you could try by adding default route, so even if user adds his connection, computer would still try to go through your router IP.

If your router IP is you could try something like:

route add mask

More information at http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/route.mspx?mfr=true

  • 1
    silvermightstar said it's possible for a user to plug in his own 3G router into the office PC's ethernet port so, this measure seems to be useless if the 3G router has as ip adress... – CmPi Mar 28 '14 at 12:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.