I am trying to disable an internet connection to a single user. I have removed explorer and the group right "internet" in user manager, but the user is still able to access the internet via an intranet icon display via a login script. Any suggestions?

The first question is whether or not you can edit the logon script to remove the intranet icon. I don't know how your system/network is configured but you could try deleting the DNS under Control Panel - Network - TCP/IP OR if you are running multiple network protocols for your workstations, you could try removing TCP/IP completely. Thats a litle extreme. But that depends on your network.

Your request is a little vague. Do you want to prevent web surfing only? Do you have a firewall? Does the person have rights to edit their network properties (to undo anything you change)? You can do anything from changing the policy on that computer to only allow specific programs to run (which can be tricky) to disabling the ports on the computer that it uses to access the Internet. Disabling port 80 would prevent them from surfing the web.