We've got and I.T. lab at school with about 20pcs with xp home ed, and a separate pc with windows server edition (can't remember which).

As far as I can see, all the pcs are connected independently to a single switch, which in turn is connected to the modem. One port on the switch goes into another room.

The problem is this. When the lab is being used, at times we need to disconnect the web only for the lab, but still allow the pcs to be used (without web access). But at the same time we'd like to prevent the connection from being unaccessible from the server pc and to the other room.

In other words, can I (without physically unplugging the cables!) decide when a pc can and cannot use the web from a pc on the lan, without influencing the other pcs?

I had a look around but found absolutely nothing.

Thanks

Are the PCs in workgroup or Domain? If you have them on a Domain, you can cut Internet Access using IPSec.

chilifrei64 give us a link yesterday on how to do it. (its the 4th on this forum!).

LINK

In case they are on a Workgroup, I dont see a solution unless you buy some 3rd party software.

Thanks for the quick reply.

Actually, all the pcs are all acting as stand-alones at the moment, all connected to the switch independently.

My doubt, now, is: If all the pcs are connected to the switch independently (including the server) will setting up a domain be possible? Will the router need to be reconfigured?

This is, schematically, what we have now:

INTERNET

|

MODEM/ROUTER

|

SWITCH

|

|--------------|--------|

"SERVER" PC1 PC2 etc (sorry for the poor quality of this scheme)

The so-called "server" has no particular privileges at the moment. It's just another standalone.

As you can see, I haven't got a clue! I've set up many simple networks, but have never had to set up a domain network. Any help is much appreciated!

btw although I see that a domain network is the best solution, could you tell me which 3rd party software I could use?

you can set up a domain and apply the policy as Gokui posted

The other thing you could do is test out different proxy server software that is out there and see how detailed in the configuration you can get.. you could have your main server pc be the proxy server.. therefore having internet access and could simply turn off the proxy service effectively disableing internet access. If set up this way.. most any proxy software will work.. setting up a standalone proxy server will require more configuration.

Depending on what your constraints are I would do both strictly for security and deployment purposes but if it isnt cost effective then the solution is worthless. Once pc's are joined to a domain.. your control over the client pc are limitless.