I'd like to know how to specifically prevent internet access on a Win 2000 PC. I know no solution is really perfect, but I need to assume that the users are somewhat competent enough to get around simply removing IE from the desktop. I also need networking services to be running, particularly remote desktop/VNC. Thanks.

How are they connecting to the internet? Thru a router? Imagine the power if you knew how to internet search

yes I believe but I'm not sure if my boss wants static IPs for each computer. If that were the case could I just password the router and disable port 80 to that computer?

FYI: Static IP goes from the ISP to the modem, not from the modem to the router & onto the PC. An internal IP address (called private IP) does that. You're taking the wrong approach. i_XpUser

So the correct approach would be to do what I said with the private IPs? If not, what is the right approach?

If the router supports mac filtering its easy to block a specific station. You do a ipconfig /all at a cmd prompt. Note the physical address. Go into the routers setup interface and find the mac filtering or address filtering page. Put this the physical address and set to deny all. You're done. Imagine the power if you knew how to internet search

If you're just looking to block HTTP traffic, if your firewall supports it, block HTTP for the IP's you don't want. OR... Configure each machine to use 127.0.0.1 as a web proxy server, and then lock other users from changing this config. Be aware if they install another web browser, that could get around this. It also potentially stops legitimate traffic such as to obtain patches from Windows Update. OR... Get a firewall such as ISA Server 2006 that can block HTTP from particular machines...or users...how ever you want to do it. "Enough, enough bowing down to disillusion! Hats off & applause to rogues & evolution! The ripple effect is too good not to mention. If you’re not affected, you’re not paying attention!"