0

In a Windows Server 2003 environment, does anyone know a way of restricting internet access with groups and group policy?

2
  • Can you provide more details about what you mean by restrict? Do you mean you want to block everything?
    – Zoredache
    Sep 9, 2009 at 0:10
  • Yes - block all internet access.
    – The Woo
    Sep 9, 2009 at 7:44

3 Answers 3

3

That's not going to work :)

There is (afaik) no registry setting which enables or disables internet access and there definitely is no gpo setting to allow/deny internet use. I could think of a few (crappy, easily removable) obstacles that you could throw at your users but ultimately you should bloxk internet access at your firewall and/or proxy server.

  • you could set the gateway ip address to a bogus ip address (bad idea, because it slows the pc down, causes unwanted LAN-traffic and the user could - depending in his rights - chage it back): use netsh.exe (see MS Technet for an explanation) in the logon script
  • you could mess up the dns server so that the pc won't find internet-domains (bad idea, because you have to be veeery careful not to mess up windows domain stuff, lots of Domain info is stored in the dns so disabling is no option): see this Microsoft documentation for the specific gpo settings
  • you could set the Internet Explorer proxy setting to a bogus ip (bad idea, because it only affects Internet Explorer and the users can simply change it)

So i really woudl suggest: install a (transparent) squid proxy with (transparent) AD/NTLM authentication and block specific users there.

3
  • Any suggestions which transparent proxy to use?
    – The Woo
    Sep 9, 2009 at 0:27
  • "transparent" is just a concept: all internet treffic (you decide whether that applies only to Port80 (HTTP) or other traffic like messengers too) has to pass through the proxy - the users can't circumvent this, no proxy-setting is needed in the browsers. Use squid: see deckle.co.za/squid-users-guide/Transparent_Caching/Proxy and wiki.squid-cache.org/ConfigExamples
    – brengo
    Sep 9, 2009 at 1:00
  • Thanks Brengo! Sometimes "that's not going to work" is the most helpful answer because it saves loads of time chasing dead ends! John
    – John Hoge
    May 10, 2010 at 14:29
0

One quick thing you can do to block Internet access is to simply set a bogus proxy in the browser, and then block access to the browser configuration pages. Both of these things can be done via a Group Policy for Internet Explorer.

It won't block you users from using alternate browsers, or a PortableApps browser they brought in, but it will slow down the average person.

To really address this though you probably need to consider setting your firewall to block everything, and then setup a proxy to permit the traffic you actually want to allow.

0

We use GPO to set the proxy to a dummy address on machines which should not access the Internet. Other policies prevent software installation or access to removable media, as well as access to any application other than the one they need to use. While this may not stop someone who really knows what he/she is doing it is very effective against our production staff.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .