Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Like i can create "whitelist" functionality for blocking all sites and allowing some via the GP setting: "User Configuration > Windows Settings > Internet Explorer Maintenance > Connection/Proxy Settings > Exceptions - Do not use proxy server for addresses beginning with"

Can i create also a blacklist option like this (or similar) in Group Policy?

share|improve this question

2 Answers 2

up vote 4 down vote accepted

A great way to manage this would be with your internal DNS server. You can setup DNS BlackHoles. Which you can set to go to 127.0.0.1 or whatever IP address you want. This is a lot more manageable and scalable.
You can read up a bit more about it here: http://www.malwaredomains.com/bhdns.html

share|improve this answer
    
I never got to implement this but i'd think this is most likely the answer i'd go with from a management perspective (easier to manage from a single point). –  cottsak Sep 17 '10 at 1:42

A hack way to do this would be to keep a HOSTS file on your Netlogon share, and have a Group Policy run a logon script for the users to copy the HOSTS file to their C:\Windows\System32\drivers\etc folder.

The contents of the HOSTS file would contain a list of domains and bogus IP addresses:

google.com    127.0.0.1
youtube.com   127.0.0.1

Of course, a far better method would be to implement a proxy server on your network (there are countless free ones out there)

share|improve this answer
    
And your anti-virus software blocks because a script is overwriting the HOSTS file. –  Chris S Apr 18 '10 at 3:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.