I have a complicated IP addressing scheme on the network, DHCP hands out addresses that are blocked at the firewall, but we have a range of IP addresses we can manually configure in XP which are not blocked on the corporate firewall. One of my users has figured out a free IP in the internet range, and he is changing his Network Properties every morning into that range, then changing it back to Automatic before he leaves. The user accounts must all be local Administrators because of a legacy application. So whenever I try to prevent access to Control Panel Network or TCP/IP Properties, he always figures out a way to get back in there and change it again. I have set a password on his Kasp Workstation AV, so he cannot change its properties. Is there a way to block internet access in there? He still has to be able to open intranet websites with IE7, but I want to block ALL activity for the Internet Zone. How do I do it? Please give me as much detail as possible, I tend to get lost in the Trusted Zones and Exceptions.

Thank you so much!

Don't know how tight you want to set for the user, if you really want to lock out all internet access.
Select the PC properties,
1. Applications > "Kaspersky network agent" > properties > setting > set "Network Agent Uninstall Password"
to prevent your user to uninstall Network Agent.
2. Set "Anti-Hacker" task properties to highest level and set off in "Stealth mode" under "Zones" for "Internet".

These will take out user's internet access, but you may set some trusted zone manually.
Not really use this functions for my environment, you may try these in a test pc first.