Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I can create "whitelist" functionality for blocking all sites and allowing some via the GP setting: User Configuration > Windows Settings > Internet Explorer Maintenance > Connection/Proxy Settings > Exceptions - Do not use proxy server for addresses beginning with.

Can I create also a blacklist option like this (or similar) in Group Policy?

share|improve this question
up vote 4 down vote accepted

A great way to manage this would be with your internal DNS server. You can setup DNS BlackHoles. Which you can set to go to or whatever IP address you want. This is a lot more manageable and scalable.
You can read up a bit more about it here:

share|improve this answer
I never got to implement this but i'd think this is most likely the answer i'd go with from a management perspective (easier to manage from a single point). – cottsak Sep 17 '10 at 1:42

A hack way to do this would be to keep a HOSTS file on your Netlogon share, and have a Group Policy run a logon script for the users to copy the HOSTS file to their C:\Windows\System32\drivers\etc folder.

The contents of the HOSTS file would contain a list of domains and bogus IP addresses:

Of course, a far better method would be to implement a proxy server on your network (there are countless free ones out there)

share|improve this answer
And your anti-virus software blocks because a script is overwriting the HOSTS file. – Chris S Apr 18 '10 at 3:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.