How to configure windows group policy to limit browsing

Question

Is there any way to configure group policy on a windows 2003 server to restrict/block external web access to certain groups of users?

Thanks, John

Answer 1

Restricting Specific Web Sites in Internet Explorer Using Group Policy

Answer 2

You could configure a GPO to apply to a OU that the restricted users are in that applies a false proxy to IE. If you can't get your users in different OUs for structural reasons, you could also create the GPO, apply it to the top level OU and only grant that one user group that permission to apply the policy. That doesn't help if they're administrators or if they use a non IE browser.

You could hand out DHCP leases to that subset of computers and place a false default gateway in... I hope you don't have different network segments within the same network that they'd need access to as well.

All told, the best way to do this is with an appliance or system that is specifically designed to grant access to various network locations based on the LDAP user requesting the access.

Answer 3

Yes it's under User Configuration --> Policies>Windows Settings>Internet Explorer Maintenance>Security>Security Zones and Content Ratings. You will need to create a policy for each version of IE that you use. You can either import your current settings or create new ones. You must creat this GPO with the same version of IE installed that you are targeting.

Answer 4

You could run something like ISA server which would more suited to what you want, and restrict access via groups using that.

Answer 5

Block Web Browsing but Allow Intranet Traffic with IPSec

This is geared towards an individual computer, but can be used in a domain group policy as well.