If they are XP Pro you can use group policy editor to disable internet access. Below is a link to group policy settings for various versions of windows and windows server. Note that you do not have to be using active directory to use GP on an XP Pro workstation.
http://www.microsoft.com/downloads/details.aspx?FamilyID=18c90c80-8b0a-4906-a4f5-ff24cc2030fb&displaylang=enIn our organization, I went with Untangle,
www.untangle.comI just took a workstation, added a second nic, then installed untangle in bridge mode. I can now assign specific web policies (or block all access) based on IP. Yes, I had to assign a static IP for some workstations, but overall a very useful tool - especially as it is free.
