Prevent Internet Access not functioning RRS feed

  • Question


    Hello all,


    I am having an odd issue with Steady State 2.5 on Vista SP1.  We have all the restrictions turned on including "Prevent Internet Access (except for the sites below)" and we have noticed that it is blocking internet access to all sites including the ones that we have listed.  We tested this by putting in http://www.msn.com in the homepage and allowing *.msn.com in the allowed sites section and it does try to open msn.com, but immediately comes back with a page cannot be displayed.  We removed the Prevent Access setting and kept all of the other Internet Restrictions settings and all web traffic is allowed.


    Any ideas?  We really need to get this rolled out for our customer machines.





    Monday, August 11, 2008 7:24 PM

All replies


    Hi Anthony, have you set up any proxy on the current network? Have you tried other website except MSN.com?

    Friday, August 15, 2008 5:58 AM
  • Hi Sean,


    We do not have a proxy setup on our network.  I did try another website other than www.msn.com I am trying to get the SteadyState machine to only use our company websites.  Still no resolution.






    Thursday, August 28, 2008 4:37 PM
  • is there a fix for this?
    having the same problem (xp sp3) (no proxy, direct internet connection)
    Monday, September 8, 2008 2:35 AM
  • No Fix as of yet.  I cannot deploy SteadyState 2.5 or Vista for our kiosk machines until I get this resolved.




    Thursday, September 18, 2008 12:10 AM
  • Hello,


    Can I recieve any further assistance to this issue?





    Tuesday, September 30, 2008 5:10 PM
  • Hi,

    Try unlocking the profile and disabling all internet restrictions, then logging on as the restricted user and visiting www.msn.com.  Log off, then log on as the administrator, open the restricted user in SteadyState, lock the profile and select the desired internet restrictions again.  Sometimes some of the restrictions in place prevent Internet Explorer from initializing something, which ends up preventing the allowed web sites from showing.  By relaxing the restrictoins and visiting the site once, Internet Explorer is able to initialize everything, so after the restrictions are enabled, the page should still be available.  I suspect it has something to do with an ActiveX object or other plugin, but haven't had a chance to dig any deeper.  This procedure has worked for me, however, and hopefully will for you as well.

    Rob Elmer
    Development Lead
    Windows SteadyState

    Thursday, October 2, 2008 5:18 AM
  • Rob - I have tried your fix and everything else I can think of.  Still no go on the sites I want on the white list.  Any other ideas or helps?


    Lane Taylor

    Summit County IT



    Monday, October 13, 2008 8:18 PM
  • Hi Rob,


    I too followed the instructions that you had recommended with no success.  The odd thing is that everything works great with ALL of the restrictions enabled EXCEPT the prevent access to internet sites except the ones listed below.  Once that is enabled then there is no internet access.  I remove the prevent internet access setting and I can browse the internet fine and it doesnt matter what other settings are enabled.


    Let me know if there is anything else I can try!





    Tuesday, October 21, 2008 12:34 AM
  • Hi Antonius

    In the allowed sites you have to put them this way, for example:

    if you put a space or something else it won't aloud you to access those pages

    I hope this works for you

    Monday, November 3, 2008 4:55 PM
  • Hi Kathya,


    We actually only put in one website with no spaces and it still doesnt allow any internet access.




    Friday, November 14, 2008 8:38 PM
  • Well...


    Based on the lack of any support from Microsoft.  We have chosen to remove and not use Windows SteadyState, and have decided to go with a third party solution.  I am beyond dissapointed with the lack on quick responces and answers to get this product working in our environment.  Requesting support and not getting a responce for weeks on end is rediculous and laughable. Thanks to the other forum people that have responded to our situation.


    I would have to say good luck to those that are having the same problem that I am, and good luck if you are using this software and have any issues with it that needs support.



    Tuesday, November 25, 2008 5:20 PM
  • Hello all,


    I wanted to share a possible fix for any of you still having this issue.  Rob's fix was very close.  If you set all of the security settings, adn then go in and add all of the sites that you want to allow and set your home page as normal when you login to your secured account it will fail.  Log back in to the 'admin' account and change all of the settings to 'No Secuity' EXCEPT prevent internet access except the following sites.  This should allow web access to the sites that you have listed.  From there, log back in to the 'admin' account and set all of the normal security settings and when you log back in to the secured account everything should be working.


    Good Luck!




    Wednesday, December 3, 2008 12:40 AM

    I am having this same issue while trying to use SS to replace a 3rd party app we currently use to "lock in time" (along with gpedit).  The first issue still unresolved is the locked profile situation when you login as an auto login to a restricted account.  If you log off and back on as Admin, it still will not let you edit the restrictions for that user--you must take off auto-login and from the start login as the Admin user.   It obviously can run fine without having that access--but it would be nice.  I have a easy-as-can-be direct-out DSL connection w/ no proxy.  XP SP2 w/ SS 2.5 directly installed--no updates.  Has anyone resolved?


    I also have this this issue, which I am trying to get around by using the -k (kiosk) switch in IE and the webpage you want directly after that (in the startup shortcut).  As long as you only need access to one site (plus same-host links---such as a company main page), you can setup Explorer in kiosk mode where they cannot go anywhere other than the home url.   It can then only be closed by Alt-F4.  Lock the PC down solid using gpedit or SS (show startup folder only) and they won't be able do anything else.


    Good luck to all.  Good program but needs a little fine-tuning...

    Tuesday, January 13, 2009 8:21 PM
  • Has anyone found a fix for this? We are having the same issue.


    Tuesday, January 13, 2009 10:18 PM
  • Hello


    I'm working with SS and fortunately i managed it to work, the bad thing about this is that i don't remember all the steps i followed, i have a profile that allows more than one webpage, you can try it. Just download it and then import a profile and you select the file.


    Cick here to download the profile


    Hope it helps


    PD I'm working on WindowsXP

    Wednesday, January 14, 2009 5:51 AM
  • Where you able to solve you problem with stead state not allowing you internet access, despite entering allowed web sites?  I am having the same problem. 

    Monday, February 16, 2009 6:42 AM
  • i am having this same problem on a xp sp2 workstation. If i turn off restrictions it works fine, but if i add computers to the allow access and turn on the restriction it wont work, just gives me a page cannot be displayed and "unable to open search page"
    Wednesday, February 18, 2009 1:25 AM

  • UPDATE : I've edited this post because I've had another click around (not messed with SteadyState for a while) and noticed that as long as you leave "Prevent changes to Internet Explorer registry settings" UN-TICKED, then the "Prevent internet access except for sites below" seems to work. Might be something to do with the fact that it tries to update Internet Explorer on the restricted account at the point they log in for the first time to update its settings. However, it can't because we've told it it's not allowed to? (just a guess).

    However, if that doesn't work, here's the manual process that does.


    (This is the case when you don't already have a proxy).

    NOTE 1: You can easily test this on your active Internet Explorer browser right now. You don't have to log off and go to your restricted account to test its plausability. All we are doing is saying that we want internet access to go through a proxy (that doesn't exist). This means that ALL internet connections fail because the proxy is invalid. Then we tell it to ignore the proxy for the address we want access to.
    SteadyState does exactly the same thing (it calls the proxy something similar to "donotaccessinternet").

    NOTE 2: IF you are going to do this on the restricted account you obviously need to remove any restrictions on internet explorer to begin with in order to make the changes.

    Anyway... here goes..

    1). Go into restricted account and open Internet Explorer.

    2). Go to Tools->Internet Options->Connections (tab)->Lan Settings (bottom right).

    3). Under "Proxy Settings" tick the "Use Proxy Server for your LAN.." and then for the address put "donotuseinternet" and set port to be 80.

    4). Make sure "Do not bypass proxy for local address" is NOT ticked.

    5). Click the "Advanced" button and then tick the box that says "Use the same proxy for all protocols"

    6). Finally, in the very bottom box, put the address you want people to access into it seperated by semi-colon. You can also use a wildcard such as *.msn.com  or *.bbc.co.uk

    7). Once done, accept/apply everything until all your boxes are closed.

    8). You should be able to test this instantly by trying to access the addresses you entered.

    When your happy its working as it should, just go back to your admin account and add all the restrictions back to Internet explorer but do NOT tick the box that says "Prevent internet access except for sites below". By ticking it, it will override the manual settings we've just applied and bugger it all up again.  However (see update at top of this post), it might be fine if you do tick it but UNTICK the one below "Prevent changes to internet explorer settings".

    This was easy for me because I've got one computer. I'm sure for a school with alot of computers it could become tedious to do this. Might be worth doing the manual approach above and using a Proxy Auto Config file insteady that all computers access. That way there's one point of call to make changes. http://en.wikipedia.org/wiki/Proxy_auto-config
    No idea if it works with SteadyState or if you'd even need to use it (with all this Group Policy stuff going around) but if there's a real simple setup going on, its worth investigating if your a frustrated techy teacher *smiles*

    Hope that helps someone, somewhere.. somehow.

    Monday, April 13, 2009 9:51 AM
  • I just want to confirm that Addamm's method is the surest way yet that I have found of getting the Internet Access restrictions to work. It is particularly important to make use of the Proxy dodge whilst the account is unrestricted via SteadyState so that you can really test that your settings in the Exceptions fields (Whitelist) are working as you want them to.

    Thanks also for the wildcard tip in setting the Exceptions string, though I haven't made any use of it as yet. I spent a lot of time trying out alternatives because the SS documentation on this Exceptions string is so woefully inadequate. It is only when you check it out directly on your own browser settings that you see the Do not use proxy server for addresses beginning with" hint.

    One suggestion I should like to add to Addamm's comprehensive update: Get it all working on the account without SS restrictions but subsequently only apply the restrictions that prevent the user getting at the Internet Options menu or more particularly the Connections tab where the Use Proxy settings have been created. No need to risk the (graphically described) effects of the Prevent Internet Access restriction. I am assuming that the SteadyState user would not have access to RegEdit anyway.

    Anyone reading this is probably just setting out with SS and needs also to be aware of the behaviour of Import User. Export and Import User in SS is definitely NOT a way of easily transferring a SS Profile from one user to another when the receiving user already exists. SS Import User will DELETE the whole Windows User account of any user that already exists before creating a new one with the same name and applying what may be a very limited set of restrictions. As far as I can tell there is no way of saving and just applying a profile od SS restrictions to an existing Windows User

    Saturday, May 16, 2009 6:18 PM
  • I can even confirm that Addamm "manual mode" to prevent internet access will work fine, even more it help to understand what Steadystate realy do to prevent internet access. However doing it this way I still had a problem to allow one specific URL. German Search Engine for childrens: "www.blindekuh.de" After a couple of try and errors I figured out that the URL I defined was just a forwarding URL. So I changed it to the REAL Site-URL (www.blinde-kuh.de) and it work immedatly. Once identified this issue, it even work by using standard steadystate setting interface. Thomes
    Saturday, May 8, 2010 8:00 AM
  • Thanks, Adam.  Unticking "Prevent changes to Internet Explorer registry settings" was the magic bullet for me.  Looks like this setting is incompatible with "Prevent Internet Access (except for the sites below)".
    Monday, May 14, 2012 2:07 PM