I'm recollecting from several years ago, doing this on a windows desktop machine by fooling around with the tcp/ip properties but you may have to experiment. As I recall go into the tcp/ip properties and giving the machine a fixed address/subnet but no default gateway. This assumes that your regular user does not have access to admin etc. The experiment ended after a couple of days so there maybe some issues with this I did not become aware of I'm thinking about virus signature updates etc.