Question : Network Segregation

I would like to add a computer from a different department onto our network such that they can access the Internet only.  For security reasons I want to make sure that they can only access the Internet and that no other resources on our network could be accessed from this workstation.  What is the cleanest way to do this?  I had considered setting a router inbetween and utilizing a separate subnet, but thought I'd pose the question to see what others thoughts would be.

Answer : Network Segregation

Agree..  It matters little whether you are running a Domain or Workgroup here...  if the admin does not wish to compromise his network with a computer outside his administrative sphere, he needs to isolate it, meaning a separate subnet that is not allowed access to his current subnet..  which is what we proposed above...

I am sure you know that even a Home XP box can be used to attack any domain... if only because it may come with malware or virii on it...  I could even put ethereal on the Home XP client and watch all the traffic, for heavens sake!  

FE