change all your switches to layer 3.. then subnet the ip addresses so that if they change their IP address, they no longer work ( routing won't allow them to connect) then allow that "subnet" to connect to the internet or not at your whim. A little creative subnetting can go a long way.. most new layer 3 switches aren't expensive and can support up to 16 different subnets.. we are looking at doing just this... it also has the very nice side benefit of stopping broadcast storms across a flat switched network. -----Original Message----- From: Jim Harrison [mailto:jim@xxxxxxxxxxxx] Sent: Saturday, August 10, 2002 9:17 AM To: [ISAserver.org Discussion List] Subject: [isalist] Re: Clever Users http://www.ISAserver.org Take them out of the administrators local group. If you're using W9x or WinME, you're just going to have to beat them. Jim Harrison MCP(NT4, W2K), A+, Network+, PCG http://isaserver.org/authors/harrison http://jalojash.org/isatools Read the books! ----- Original Message ----- From: "Omer Iqbal" <networkadmin@xxxxxxxxxxxxxxx> To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx> Sent: Friday, August 09, 2002 9:50 PM Subject: [isalist] Clever Users http://www.ISAserver.org i'm using ISA in workgroup environment. our users are so clever so they can change thier IP address at theit computer to access the Internet. How can i prevent this? ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: jim@xxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub') ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: shawn@xxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub')