The most effective way I have found is to set proxy settings in IE and then deny registry editing and access to IE settings. To allow access you disable proxy use or set the IP:port address to the valid address; to deny access you enforce proxy use and direct the computer to a fictitious IP address. You can do this via a *.reg file or with policies as proxy use and address are just a matter of a dword and a string in the registry. With a mixed bag of users and OSs you'll have to figure out the best way to do it for your purposes, so I'll just tell you the methods I have used for this and why.
I have used *.reg files called from the logon batch or from a batch file stuck in the startup folder. The advantage is it is easy to do and will allow my teachers to turn the net off and on for the students with a simple del & copy batch file that puts the appropriate *.reg file in place. The problem is that applying the *.reg file can, and frequently is, interrupted by the users accidently at login. This wouldn't be such a big deal if the teachers would learn to use the tools I have given them to remedy this, but as we know, users tend to be lazy. They just want everything to work magically.
The method I use now is group policies. I include code snippets in the *.adm files that I use with Poledit to create the policies. The advantage is it is seems to be more reliable than batch or scripts and you can enforce the policies on a group or individual user basis. The down side is that if you've never used policies before it takes a bit to get the hang of policies. It took me several hours to get it down, but the payoff is easily worth the investment.
The registry locations for proxy use and address are:
[HKEY_C_U\Software\Microsoft\Windows\CurrentVersion \Internet Settings]
Data Name=ProxyEnable(dword)
Values=1(enforce proxy use)or 0(disable proxy use)
Data Name=ProxyServer(string)
Values=proxy address in format IP address : port (ex: "10.1.1.1:80")
To get more specific I would have to know specific details about what you want to do. Let me know if you need more details on how to go about this or if it got you started on the right track to fixing it yourself.
Josh
<a target="_blank" href=http://www.jdharm.net>www.jdharm.net</a>